Looking for a HIPAA compliant CRM? Start with HIPAA mode

What HIPAA mode does

HIPAA mode is a switch in Settings. When you turn it on, a confirm dialog lists exactly what will be disabled. From then on, the rules are enforced by the server, not left to habit.

• Refuses providers that won't sign a BAA, with no silent fallbacks
• Turns off any active integration that is not BAA-eligible
• Logs idle sessions out on the server (15 minutes by default)
• Requires two-factor sign-in for the workspace
• Mirrors every event to an audit log, with ids only
• Keeps health details out of messages and calendar invites
• Makes AI-written texts and emails wait for human approval

What a HIPAA compliant CRM setup really needs

HIPAA compliance is shared. You need a Business Associate Agreement (BAA) with every provider that touches protected health information: your host, your phone provider, your email service and your AI provider.

You also need your own policies: who has access, how you train staff, how you handle a breach. Imago enforces the technical side. It cannot sign your BAAs or write your policies for you.

Self-hosted keeps data on your server

Self-hosted, your database stays on the server you choose. Pick a host that will sign a BAA, connect BAA-eligible providers, and HIPAA mode blocks the rest.

Imago Cloud does not offer a BAA yet. A HIPAA add-on with a BAA from Imago is planned for Cloud later.

Voice and AI with guardrails

Voice agents in HIPAA workspaces refuse speech providers without a BAA. Call events carry ids only, and take-message notifications never include what the caller said.

You can turn transcript storage off. The knowledge base supports HIPAA mode and keeps each workspace's data separate in the database.

Everything else a practice needs

HIPAA mode sits on top of the full CRM. Book appointments with confirmations and reminders, run intake forms with conditional logic, take payments on your own Stripe account and answer patients from one inbox.

Some features are limited while HIPAA mode is on, by design. For example, providers without a BAA stay switched off, and voicemail transcripts are left out of automation events. The settings page shows you what applies.

A simple checklist before you go live

Imago's HIPAA settings page shows a provider-eligibility table for every provider you have configured, so you can see what is allowed before you switch HIPAA mode on. Then work through your own list with your advisor.

• Choose a host that will sign a BAA, and sign it
• Sign BAAs with your phone, email and AI providers
• Switch on HIPAA mode and review what it disabled
• Set your idle logoff time and require two-factor sign-in
• Write your access, training and breach policies