CRM best practices for a small clinic
CRM best practices are written for companies with a sales team, and a clinic with two treatment rooms and one person on the desk does not have one. What survives the translation is smaller than the literature suggests: a single record for each enquiry, a named owner for the next move, a date by which the record has either become an appointment or gone, and a short list of things that must never be typed into it.
This page is about that smaller version. Where a rule comes from the law it is linked at the point it is used; where it is our own reasoning about how a practice this size works, the text says so rather than borrowing the authority of a regulation.
What are CRM best practices, for a clinic this size?
One record for each enquiry, one named person responsible for the next move, and one date after which the record is deleted. Almost everything else is an optimisation of a problem a two-room practice does not have yet.
The best practices for CRM in a large organisation are mostly about coordination: stopping two people from calling the same prospect, forecasting a quarter, reporting upwards. A practice where the person who answers the phone is the person with their hands on a patient has none of those problems, and inherits none of the solutions. What it has instead is a narrower and more awkward problem — the enquiry arrives while both hands are busy — so good CRM practices here are the ones that still work when they are used by somebody who is already late.
It is worth separating all of this from the question of what the three letters stand for, which is a different article: if the acronym itself is new, our page on crm meaning medical practices does that job, and this page does not repeat it.
One distinction before the detail, because it saves money. What is usually meant by crm industry best practices is the generic version of the advice — pipeline stages, lead scoring, automation rules, dashboards — and it assumes somebody whose job is to maintain them. Read as a shopping list it will sell a practice a system nobody has the hours to feed; read as a description of what a large company needs, it is a useful account of what not to buy yet.
What should the record of an enquiry hold?
Five things: who the person is, how they arrived, what they asked, what happens next and who is doing it, and what they agreed to. Nothing about why they might be coming.
That last line is not squeamishness; it is the shape the law gives the record. Article 5(1)(c) GDPR requires that personal data be «adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed» — the principle it names «data minimisation» — and the purpose of this record, before a first appointment exists, is to get somebody booked in. A symptom typed into a free-text box is not necessary for that, and it changes what the record is: the section further down on what never goes in explains why that matters more than it looks.
The table below is the whole record. One enquiry, one row, and no field in it that exists because a form asked for it.
| Field | Why it is there | What to leave out |
|---|---|---|
| Name and contact | The record exists so that somebody can get back to the person, which makes this the one field that cannot be optional. A first name and the number or address they wrote from is enough to do it. | Full address, date of birth, anything else a form collects out of habit. None of it is needed to arrange a first visit, and data minimisation is the test the record has to pass. |
| The channel it arrived from | The only field on the list that is there for the practice rather than for the person. Knowing whether requests come in by phone, by form or as a message is what decides where the next hour of attention goes. | Tracking identifiers copied out of a link. They belong to the reporting rather than to the person, and nobody at the desk will ever read them. |
| What they asked | In their own words, in one line, so that whoever rings back is not asking the same question again: «wants an evening slot», «asked whether you see children», «wanted to know where to park». | Any guess at a diagnosis, and any note about a condition — including one the person volunteered unprompted. The reason is the section below, and it is the only entry on this list with a prohibition behind it. |
| Next action and owner | A record with no named next move is a note, not a record. The field holds what happens and the person doing it as a single entry, because the two are useless apart. | «Follow up» with nobody's name against it. The field exists precisely to stop a record that belongs to everybody and therefore to no one. |
| What they agreed to | Whether the person agreed to be contacted, by which channel, and the date they said so. It is the part of the record that is impossible to reconstruct afterwards from memory. | A stored tick with no date and no record of the wording shown. It preserves that somebody clicked, which is not the same as what they were told. |
The last row is worth one more sentence, because it is the field most practices treat as a formality. Consent, under Article 4(11) GDPR, is «any freely given, specific, informed and unambiguous indication of the data subject's wishes» given «by a statement or by a clear affirmative action» — so a column holding a tick and nothing else has recorded the click and lost everything that made it consent.
Who owns the follow-up, and by when?
One named person per record, and a date written into the record rather than remembered. Both halves are this page's reasoning about small practices, not a rule from anywhere.
The reason to insist on a name is that the alternative is not «the team», it is nobody. In a practice of two or three people the owner field looks like paperwork, because everybody knows who does what; it earns its keep on the day one of them is ill, or on the Monday after a week when requests came in faster than anybody had hours to answer them. The date earns its keep differently: a practice treating patients all day has no spare attention for a list it has to re-read in order to find out what is overdue.
Emanuele De Falco is the case we point to here, and the gap he describes is the one this section exists for. A physiotherapist working near Naples who had changed premises and effectively started again from nothing, in a market he describes as crowded with colleagues and rehabilitation centres, he says that before, an enquiry he did not answer straight away was an enquiry that had already gone to somebody else — and that the requests themselves were arriving at two and three in the morning. Of what changed, he says: «The system you provide, beyond the advertising, manages everything automatically».
That is the honest shape of the problem, and it is why the owner field has a limit. A named person closes the gap during the hours that person is free; nothing written in a record closes the gap at three in the morning, and no rule about follow-up can be kept by somebody who is in a room with a patient. What the record can do is make sure that whatever answered first is visible to whoever opens it next, which is the whole of what the next section is about.
How long should a cold enquiry stay in the CRM?
Until the purpose it was collected for has ended, and then no longer. That is not a policy preference but a principle with a name.
The rule is short enough to quote in full. Article 5(1)(e) GDPR requires that personal data be «kept in a form which permits identification of data subjects for no longer than is necessary» «for the purposes for which the personal data are processed», and calls it «storage limitation». Read against an enquiry that never became an appointment, that sentence is unusually easy to apply: the purpose was to arrange a first visit, and it ended when the person stopped answering.
A record kept «in case they come back» is a record whose purpose has been quietly rewritten to justify keeping it, and the rewriting is visible from outside the practice. Article 5(2) is the reason that matters: «The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1». The burden is not on anyone to catch the practice out; it is on the practice to be able to show why what it still holds is still necessary.
The practical form of all that is one extra column: a date on every record, set when the record is created, after which the record goes unless something has happened to it. Deciding that length honestly is the hard part, and it belongs to the practice rather than to this page — what a first visit is for, and how long somebody who asked about one can plausibly still be deciding, is not the same question in every discipline. Doing the deletions in a single pass rather than one record at a time is our own reasoning, and it is the only part of this section that is.
What should never be written in it?
Anything that says, or lets somebody work out, what is wrong with the person. The free-text box is where it happens, and it happens by accident.
This is a hard line rather than a preference because it changes the category of the whole record. Article 4(15) GDPR defines data concerning health as «personal data related to the physical or mental health of a natural person» which «reveal information about his or her health status», and Article 9(1) provides that the processing of «data concerning health» «shall be prohibited». A line reading «lower back, worse in the mornings» sitting beside a name and a mobile number is that data, whoever typed it and however helpfully it was meant.
Prohibited is not the end of the sentence: Article 9(2) lifts it where one of its conditions applies, and the two a practice would reach for are «the data subject has given explicit consent to the processing of those personal data for one or more specified purposes» and the medical route, where «processing is necessary for the purposes of preventive or occupational medicine» «on the basis of Union or Member State law or pursuant to contract with a health professional». The point about an enquiry record is that it is the one place in a practice where neither has been established: there is no contract with a health professional yet, and nobody has given explicit consent to anything beyond being called back. Once the person is a patient, that changes — and the clinical note that then exists is a different record, kept somewhere else, for a different reason.
The rest of the list is short and follows from the same thought. No diagnosis, no symptom, no name of a treatment that implies either. No opinion about the person. Nothing about what they are likely to be able to afford. And no detail that was volunteered in passing on the phone and would be awkward to find in writing — the «what they asked» field holds the logistics of the request, not its reason, and a practice that keeps it to that has nothing to tidy up later.
What are the CRM implementation best practices that matter in week one?
One place for everything, one owner per record, and a deletion date from the first day rather than the first audit. A practice that has those three can add anything else later.
The failure a small practice actually meets in week one is not a badly configured system. It is two systems running beside each other: the paper diary that holds the appointments and the phone that holds the requests, with a third of the picture in somebody's head. Nothing in that arrangement is broken on any single day, which is exactly why it survives — and the day it costs something is the day the person holding the third part is away.
Alberto Dalmasso is the second case, and his is about when the record has to start. A massage therapist in Borgomanero, with a practice he has run for more than ten years and a long history of agencies tried before this one, he describes acquiring «target clients who book by themselves, without having to chase them» — people who were in the diary before anybody at the practice had spoken to them. A record that only comes into existence once somebody has been phoned cannot hold that enquiry at all, and the practice finds out it was missing when the person walks in.
So the week-one version of this is smaller than an implementation plan. Decide where a request lives the moment it arrives, before anybody has looked at it. Give every record a name against it and a date on it. Then leave the stages, the scoring and the dashboards alone until somebody has the hours to maintain them, which in a practice this size is usually never, and is not a failure.
What none of this answers is who does the answering while the practice is in a treatment room — the part a system decides rather than a policy. That is the subject of our page on crm for medical clinics, which is about the half of the work that does not get installed.
If the part you would rather hand over is the answering — the enquiry that arrives at eleven at night, the one that has to be called back while you are with a patient, the record that has to exist before anybody has read it — you can Apply as a customer.
