How do I set up HIPAA-compliant referral tracking in a chiropractic CRM?

To set up HIPAA-compliant referral tracking, sign a Business Associate Agreement (BAA) with your CRM vendor before any patient-linked data goes in, then build a small set of fields and tags that record where a patient came from and whether you may market to them. Do not attach payments, gifts, or discounts to a referral, because the federal Anti-Kickback Statute prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or reward referrals involving items or services payable by federal health-care programs.

The setup below uses 8 custom fields, 6 tags, and 2 workflows. No source mandates a referral schema, so treat this as a practical design to review with your privacy officer or attorney. If you are still choosing software, start with our page on CRM for chiropractors.

Do you need a BAA just to track referral names?

You need a BAA if the CRM creates, receives, maintains, or transmits electronic PHI on behalf of or for the benefit of your practice. HHS says a BAA is not required when the app does not perform those activities for the covered entity.

A referral name can be PHI depending on context and its link to a person's health care. The sources do not set a rule that names alone are or are not PHI. A name sitting next to a visit date, a condition, or a care plan is far more likely to qualify than a name in a standalone mailing list.

The safe habit is to treat every patient-linked referral record as PHI and sign the BAA first.

What must the BAA say?

A written BAA must define the business associate's permitted and required uses and disclosures of PHI. It must also prohibit other uses or disclosures except as the agreement or law permits, per HHS guidance on business associate contracts.

The agreement must include the elements in 45 CFR 164.504(e), including permitted uses and disclosures, restrictions on further disclosure, and compliance obligations when the business associate performs covered-entity duties, as HHS explains.

Before you enter any PHI, check these items:

1. The BAA is signed by both parties and dated before the first data import.
2. It lists what the vendor may do with PHI, and nothing broader.
3. It restricts further disclosure.
4. Any marketing or messaging feature limits the vendor to using PHI only for your communication activities. HHS requires that when a business associate handles marketing-related communications.

HHS requires written contracts or other arrangements that protect PHI, but does not require you to monitor the business associate's safeguards or contract compliance. Reviewing the vendor yourself once a year is a choice, not a federal requirement.

Ask for the BAA in writing from any vendor, including a general-purpose CRM. Do not assume a product is covered because it is popular or marketed to clinics. Our how we pick page explains what we check when comparing CRMs.

Which custom fields do you need to track referral sources?

You need 8 fields on each patient or lead record. Keep them factual and keep clinical detail out of them.

Field name	Type	Purpose
Referral Type	Dropdown: Doctor, Patient, Self-reported, Unknown	Separates the two workflows
Referral Source	Link to a contact record	Names who referred, once
Referring Practice	Text or company link	Groups doctor referrals by office
Referral Date	Date	Measures time to first visit
Payer Category	Dropdown: Federal program, Other insurance, Cash	Flags higher-risk records for review
Marketing Authorization	Yes / No, plus date	Controls any PHI-based marketing
Thank-You Type	Dropdown: None, Verbal, Handwritten note	Records that no value was given
Compliance Review	Date and initials	Shows who checked the record

Do not add fields such as "referral bonus," "credit issued," or "gift value." A field that tracks rewards creates a record that looks like payment for referrals.

What tags should you use?

Use 6 tags, applied by staff at intake:

• ref-doctor: referred by another clinician.
• ref-patient: referred by an existing patient.
• ref-unknown: source not yet confirmed.
• mkt-auth-yes: signed marketing authorization on file.
• mkt-auth-no: no authorization, so no marketing messages.
• review-hold: needs a manager or attorney look before any outreach.

Build every marketing list from mkt-auth-yes only. HHS notes that marketing communications using or disclosing PHI generally require the individual's authorization, with exceptions for face-to-face communications and promotional gifts of nominal value.

How do you track doctor-to-doctor chiropractic referrals?

Track the relationship and the volume, never a reward. Use a pipeline with these 6 stages:

1. Identified: a nearby physician, therapist, or specialist worth meeting.
2. Introduced: you have met in person or exchanged a practice introduction.
3. First Referral Received: tag the patient ref-doctor and fill in Referring Practice.
4. Patient Scheduled: log the Referral Date.
5. Care Started: set Payer Category and Compliance Review.
6. Active Relationship: count referrals per quarter.

Before you send any patient information back to a referring doctor, confirm the rules with your privacy officer or counsel. Keep what the CRM stores minimal.

On the Stark side, CMS says the Stark Law also prohibits the entity from submitting claims for improperly referred designated health services. CMS also states that Stark protections prohibit referrals based solely on financial incentives to the provider. Whether a particular chiropractic arrangement falls within Stark depends on statutory definitions and exceptions, so an attorney should decide that.

Do not record lunches, gift cards, or office perks as "relationship spend" tied to a referring doctor. Anything of value can be remuneration.

How do you track patient-to-patient referrals?

Use this 5-step workflow:

1. At intake, ask "How did you hear about us?" and let the patient answer freely.
2. Set Referral Type to Patient and link the referrer in Referral Source only if the new patient volunteered the name.
3. Tag ref-patient and set Marketing Authorization to Yes or No.
4. Send the referring patient a verbal or handwritten thank-you, and record it as Thank-You Type.
5. Do not email the referrer about the new patient's visit or care.

The OIG's Roadmap for New Physicians says the Anti-Kickback Statute can cover referrals made by patients, not only those made by professionals. That is why "refer a friend, get a free visit" programs need legal review before launch.

Can you give gifts or discounts for patient referrals?

Do not assume you can. OIG Advisory Opinion 20-03 confirms that remuneration includes anything of value, including noncash gifts.

The same opinion treated a $5 payment to referring chiropractors as remuneration. It did not implicate the Anti-Kickback Statute under those specific facts because the recipient did not furnish or arrange federally reimbursable services.

An advisory opinion is fact-specific and does not approve a materially different arrangement. A reward paid to a patient who receives federally reimbursed care is a different situation. State anti-kickback, fee-splitting, gift, discount, and consumer-protection laws may also be stricter, and we have not verified them here.

How do you keep tracking tools from leaking PHI?

Check every tool that touches referral data, including website forms and ad pixels. HHS guidance says online tracking technology vendors are business associates when they create, receive, maintain, or transmit PHI for a regulated entity's covered function, or provide services involving PHI disclosure.

Also never export or hand over a patient list to a partner. Covered entities generally may not sell or give away patient lists without authorization from each person on the list.

How do you calculate the lifetime value of a referred patient?

No regulator publishes a formula, so use simple arithmetic from your own collections. Multiply average visits per patient by average collected revenue per visit, then compare referral sources side by side.

Example numbers only: 22 visits at $58 collected per visit is $1,276 per patient. If doctor-referred patients average 26 visits and patient-referred ones average 19, the tagged records show which channel is worth more time.

Do not subtract a referral reward, because there should not be one.

Monthly compliance checklist

• Count records with ref-unknown and resolve them within 30 days.
• Confirm every marketing list uses mkt-auth-yes only.
• Scan Thank-You Type for anything beyond verbal or handwritten notes.
• Review all review-hold records.
• Confirm the BAA is still on file and that no new integration or tracking tool was added without one.

For more on matching a CRM to your clinic type, see all 18 CRMs compared and what the 4 types of CRM are. Confirm all rules as of November 2026, since laws and vendor terms change.