CRM for Physical Therapy Clinics: Do You Need One?

When a clinic owner searches “CRM,” they’re usually asking about three separate jobs: referral-source management (the physicians, employers, and attorneys who send patients), inquiry and lead follow-up (people who aren’t patients yet), and reactivation and recall (getting discharged or lapsed patients back on the schedule). Each pulls from different data and carries different legal weight; treating “CRM” as one purchase decision is how clinics end up paying for software that duplicates what the EHR already does.

Of the three, only one is a job the EHR genuinely doesn’t do: chasing people who aren’t registered patients. Referral tracking and recall are mostly reporting and messaging on data the EHR already holds, so the real question is whether the EHR can produce the list and send the message, not whether a CRM exists. And once that data touches a patient’s condition or care, a system holding it on the clinic’s behalf becomes a business associate under HIPAA, which shapes the vendor conversation first.

One scoping note: “rehabilitation center” as a search term also pulls in addiction-treatment and behavioral health admissions teams, whose records can fall under 42 CFR Part 2, a separate, stricter confidentiality regime. This post covers outpatient PT, OT, and chiropractic clinics only, not Part 2 programs. Current as of September 2026.

What does a CRM do for a physical therapy or chiropractic clinic?

Vendors sell “CRM” as one product, but clinics mean three different jobs.

The inquiry job is the one an EHR genuinely can’t do, because an inquiry isn’t a patient record. The other two are largely reporting and messaging on data already in the chart: can the EHR produce the list and send the message with functions it already has?

What does the EHR already have?

A rehab EHR built for physical therapy practices and chiropractic clinics captures most of what referral tracking and recall need, because Medicare’s documentation rules already put the relevant dates in the chart.

For recall, Medicare’s certification rules supply the anchor dates. The physician’s or NPP’s certification covers “the duration of the plan of care, or 90 calendar days from the date of the initial treatment, whichever is less,” progress reports are due “at least once every 10 treatment days,” and a discharge note “is required for each episode of outpatient treatment” (Medicare Benefit Policy Manual, Ch. 15, §220.1.3 and §220.3, Rev. 13889, issued 07-30-26). Certification end date, last progress report, and discharge status: the three anchors a recall list needs, already required fields. See our plan-of-care certification guide for the certification detail.

How do you track referral sources without a CRM?

Referral tracking works as a reporting problem if intake captures the right fields on every case: referral source, referring provider (with NPI if applicable), referral date, date received, diagnosis or body region, payer, whether the eval was scheduled and completed (with dates), whether a plan of care was established, visits completed, and discharge status, plus a source field for self-referred and direct-access patients (web, Google, word of mouth, former patient).

With those fields populated, a referral conversion report follows: rows are referral source, columns are referrals received, evals scheduled and completed, plans of care started, average days to eval, visits per case, and discharge with goals met. Two derived rates matter most: referral-to-eval (scheduling performance) and eval-to-plan-of-care (clinical fit). A referral aging list flags referrals with no scheduled eval after a set number of business days, a threshold the clinic sets (three to five days is a common target, not a regulatory one).

Sending this data to the referring physician sits inside HIPAA’s ordinary permitted uses. Treatment, by definition, includes “the referral of a patient for health care from one health care provider to another” (45 CFR 164.501), and a covered entity may disclose PHI “for treatment activities of a health care provider” (45 CFR 164.506(c)) without authorization, exempt from minimum necessary (45 CFR 164.502(b)). The internal conversion report is a health care operations use, “business planning and development” (45 CFR 164.501), also permitted without authorization.

How do you build a reactivation and recall list from discharge data?

Three lists come directly out of EHR data: unfinished plans of care (active cases with no visit in a set number of days and remaining certified visits or an unexpired certification), discharged patients due for a re-check (discharge date plus an interval the clinic sets, a clinic decision, not a regulatory one), and patients who never completed the evaluation (referral received, eval scheduled, then no-showed or cancelled and never rebooked, overlapping with referral tracking above).

These messages sit on the treatment and operations side of HIPAA, not marketing, as long as no third party pays the clinic to send them. A reminder to finish a plan of care, or an offer of a re-check for a condition already treated, describes the covered entity’s own services, excluded from HIPAA’s marketing definition “except where the covered entity receives financial remuneration in exchange for making the communication” (45 CFR 164.501). Because these messages use PHI, whoever sends them, a CRM included, needs a business associate agreement (BAA). A message that instead promotes a paid third party’s product is marketing and needs a signed authorization (below); TCPA governs the channel either way (also below).

Can a CRM hold patient data under HIPAA?

A CRM storing a patient’s name alongside diagnosis, visit status, or payer information meets HIPAA’s business associate definition: a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter” (45 CFR 160.103). A CRM subcontractor handling PHI, such as its SMS or email vendor, is a business associate one level down. The referring physician is specifically excluded, so that relationship needs no BAA.

Before letting a business associate touch PHI, a covered entity must obtain “satisfactory assurance that the business associate will appropriately safeguard the information” in a written contract (45 CFR 164.502(e)) with required content:

The same terms apply to a subcontract between the CRM and its own vendors (45 CFR 164.504(e)(5)). Even under a BAA, minimum necessary limits what should sync in: “reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose” (45 CFR 164.502(b)). Reactivation needs only the fields the message requires (name, contact channel, consent, trigger date), not a full chart sync.

This applies upstream too, at the web inquiry form. Once a provider receives information identifying a person and describing their condition, it meets HIPAA’s definition of individually identifiable health information: “created or received by a health care provider” and “relates to the past, present, or future physical or mental health or condition of an individual” (45 CFR 160.103). Treat inquiry data describing symptoms as PHI, routed through a system under a BAA, not a consumer form tool with none.

When does patient outreach count as HIPAA marketing?

HIPAA defines marketing narrowly: “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service” (45 CFR 164.501). It excludes treatment communications, including care coordination and recommending “alternative treatments, therapies, health care providers, or settings of care,” and communications describing “a health-related product or service… provided by… the covered entity making the communication,” both only if the entity receives no financial remuneration for making it (remuneration meaning “direct or indirect payment from or on behalf of a third party,” excluding payment for treating the individual). Appointment reminders and messages about a clinic’s own services fall under these exclusions, not a specific “reminder exception”; what matters is whether a third party paid.

Once a communication is marketing paid for by a third party, HIPAA requires a signed authorization first: a description of the information disclosed, who may make and receive it, the purpose, an expiration date or event, the individual’s signature and date, and a stated right to revoke (45 CFR 164.508(a)(3), (c)). If remuneration is involved, the authorization must say so, and a clinic cannot condition treatment on signing it (45 CFR 164.508(b)(4)); a checkbox buried in the consent to treat doesn’t satisfy the rule.

A stricter, related rule covers selling a patient list outright: a covered entity “may not sell protected health information” except under an authorization stating remuneration is involved (45 CFR 164.502(a)(5)(ii), 164.508(a)(4)), with an exception for treatment and payment. Sharing a discharged-patient list with a partner for payment needs this authorization, not a marketing one.

What does the TCPA require for texts and calls?

HIPAA governs what a message says; the TCPA governs the channel. It’s unlawful to call a cell phone with an automatic dialer or artificial or prerecorded voice “other than a call made for emergency purposes or made with the prior express consent of the called party” (47 U.S.C. 227(b)(1)(A)), with damages of “$500… for each such violation,” tripled if willful (227(b)(3)). The FCC’s rule raises the bar for telemarketing to a cell number, requiring “the prior express written consent of the called party”: a signed agreement clearly authorizing the calls or texts to a specific number (47 CFR 64.1200(a)(1), (a)(2), (f)(9)).

Health care communications get a specific exemption from prior express consent entirely, if all eight conditions are met:

A reactivation text that reads as a wellness checkup or post-discharge follow-up plausibly fits this exemption; one offering a discount does not, and needs prior express written consent as ordinary telemarketing. Write reactivation messages as care communications, keep promotion out of them, and get written consent for anything promotional.

Consent can be revoked anytime “using any reasonable method to clearly express a desire not to receive further calls or text messages,” including replying STOP, QUIT, CANCEL, or UNSUBSCRIBE (47 CFR 64.1200(a)(10)); a single confirmation text within five minutes with no marketing content doesn’t itself violate the rule (64.1200(a)(12)). A do-not-call request must be honored within “ten (10) business days from the receipt of such request” (64.1200(d)(3)). This revocation language was adopted in the FCC’s February 2024 order and appears in the rule as of the October 1, 2025 CFR edition.

State law can add another layer: consumer health data laws generally exempt PHI and the entities holding it. Washington’s My Health My Data Act, for example, “does not apply to” information meeting HIPAA’s PHI definition, or information “intermingled to be indistinguishable” from PHI held by a covered entity or business associate (RCW 19.373.100). That exemption is drafted around PHI specifically, so consumer data collected outside the HIPAA relationship (analytics, ad pixels, a newsletter list of non-patients) may still fall inside state law. Check your own state before assuming everything a CRM touches is exempt.

When is the EHR enough and when is a CRM justified?

If the table points to a CRM, screen vendors first: Will it sign a BAA on your plan tier? Does the BAA cover its email and SMS subprocessors? What happens to your data at termination? Can you export data for a patient’s access request? Does it track consent per channel?

Where do intake and inquiry forms fit?

Referral tracking and recall both start with fields captured at intake, and the inquiry job starts even earlier, at the website’s “request an appointment” form. Because that form can collect a name alongside a description of a condition, it should sit under a BAA from the start. Our guide to HIPAA-compliant form builders covers the BAA and Security Rule requirements.

The EHR side of the decision table above, referral fields on the case, plan-of-care and discharge dates, and the tools to act on them, is where PrismEHR fits: automated appointment reminders, a patient portal with two-way secure messaging and online scheduling, and reporting, all under a signed BAA. It doesn’t manage referral-source relationships or build recall campaigns; that’s the CRM decision above. For the intake and inquiry front end, CuratoForm signs a BAA with every customer and offers static reusable links for a general intake form alongside patient-scoped links for one individual. The same questions apply to chiropractic practices.