Quick Answer: A non-PHI marketing CRM at a men's health practice runs alongside your EHR, not instead of it. The CRM captures pre-clinical, marketing-side data: name, phone, email, city, campaign source, marketing consent, non-clinical interaction history. The EHR captures everything clinical after intake. Kept clean, this two-system architecture lets your marketing team move fast on acquisition and non-PHI operations without ever touching HIPAA scope, while your clinical team owns the record of care inside the EHR.
The single biggest data architecture mistake we see men's health practices make is trying to run everything out of the EHR. The EHR is a clinical system. It was built for documentation, prescription workflows, and clinical notes. It was not built to run a Meta ad campaign, track UTM sources across a 90-day journey, or send review requests without violating HIPAA scope.
The opposite mistake is running marketing tools with PHI in them because the marketing team pulled a list from the EHR without thinking about scope. That is a compliance incident waiting to happen.
The right architecture is two systems. The EHR owns clinical. A non-PHI marketing CRM owns pre-clinical and non-clinical marketing operations. This post walks through how to set that up.
Why Two Systems
Three reasons. First, the tools built for each job are fundamentally different. An EHR needs to handle SOAP notes, coding, prescription workflows, and lab integration. A marketing CRM needs to handle email automation, lead scoring, campaign attribution, and social scheduling. Trying to force one tool to do both means both are done badly.
Second, HIPAA scope is easier to manage with a clear boundary. If PHI never leaves the EHR, you never have to defend a scope decision in your marketing tools. See HIPAA Journal for background on how covered entities should think about system boundaries.
Third, the vendors are different. Most modern marketing platforms including MiOpsAI do not sign BAAs on standard plans. If your marketing CRM is PHI-scoped, you either overpay for enterprise BAA-covered tiers, or you violate scope. The non-PHI approach sidesteps this entirely.
The Scope Line, Explicit
MiOpsAI runs marketing, acquisition, and non-PHI patient operations for men's health practices. Clinical records, ePHI, and any HIPAA-scoped data stay inside your EHR. We do not sign BAAs today. Every field in the CRM setup below is chosen so it sits cleanly outside HIPAA scope.
The Non-PHI Field Schema
Here is the field structure that keeps your marketing CRM clean:
| Field | Type | Notes |
|---|---|---|
| First name | Text | Prospect-provided at form fill |
| Last name or initial | Text | Optional at form fill |
| Phone | Phone | Required for SMS workflows |
| Required for email workflows | ||
| City and state | Text | For geographic targeting |
| Campaign source | Enum | Google Ads, Meta, organic, referral, event |
| Campaign name | Text | Which specific campaign |
| Landing page | URL | Which page they submitted from |
| General interest area | Enum | TRT, ED, general wellness, weight management |
| Marketing consent | Boolean | Opt-in status |
| SMS consent | Boolean | Separate from email consent |
| Lead status | Enum | New, contacted, consult booked, consult completed, lapsed |
| First contact timestamp | Timestamp | For speed-to-lead metrics |
| Consult booked timestamp | Timestamp | Marketing conversion event |
| Last marketing interaction | Timestamp | For reactivation segmentation |
Notice what is not in this schema: no diagnoses, no medications, no lab values, no clinical status, no treatment history, no symptoms. All of that is EHR territory.
What Should Never Enter the Marketing CRM
- Specific medications the patient is taking
- Lab values (testosterone level, PSA, HbA1c)
- Diagnoses (hypogonadism, erectile dysfunction, prostate issues)
- Treatment history (injection cadence, prescription refill dates)
- Symptoms in structured fields
- Insurance information
- Any clinical note content
The rule of thumb: if you would need a BAA to send this data to a vendor, it does not belong in the non-PHI CRM. Period.
The Handoff Point
The clean handoff happens at consult booking. A prospect fills out a form, gets contacted by Lizzi, the operations chair, and books a consult. At the moment of booking, the marketing CRM records "consult booked" and stops collecting clinical detail. The prospect then enters your EHR intake process, which captures everything clinical that comes next.
After the consult, the EHR can send a non-PHI "visit completed" signal back to the marketing CRM so review requests and reactivation campaigns can trigger. The signal is a boolean, not clinical detail.
How MiOpsAI Structures This
Inside the MiOpsAI Command Center, the non-PHI CRM is one of the surfaces that Lizzi operates on. Contact records use the schema above. Sally uses the campaign source and interaction data to segment for email and SMS campaigns. Marcus reads the campaign source and consult booked timestamps to compute cost per booked consult per channel. Milo coordinates any staff tasks that come out of contact activity.
Common Setup Mistakes
- Copying the EHR schema. The EHR has fields the marketing CRM should not have. Do not mirror it.
- Free-text notes fields. Free-text is where PHI leaks in. Structured enums are safer.
- Bidirectional sync of clinical fields. Fine to sync consult booked flags. Not fine to sync diagnoses or prescriptions into the marketing tool.
- No consent tracking. Marketing consent and SMS consent are legally distinct attributes. Track them separately.
- No campaign source discipline. If half your contacts have campaign source = "unknown", your channel attribution is broken.
Migration From an Existing Setup
Most men's health practices have PHI leaking into their current marketing tools. The cleanup process takes 30 to 60 days:
- Audit. Identify all fields in the current marketing tool that contain clinical data.
- Purge or migrate. Clinical data goes back to the EHR or gets deleted. Non-PHI stays.
- Rebuild schema. Adopt the non-PHI schema above in the new tool.
- Rewire forms. All landing page and intake forms updated to only capture non-PHI.
- Retrain staff. The people entering data need to know the scope line.
- Set up handoff. The clean CRM-to-EHR handoff at consult booking.
FAQ
Can the non-PHI CRM integrate with my EHR?
Yes, at the non-PHI signal level. The CRM can send "contact booked a consult" to the EHR, and the EHR can send "visit completed" back to the CRM. Clinical detail does not cross the boundary.
What if a prospect volunteers clinical information on a form?
You have a few options. The cleanest is to not have any free-text field on the form that invites clinical detail. If they include it anyway, the intake team can transfer relevant information into the EHR during the consult call, and the marketing CRM record should be scrubbed of the clinical text.
Do I need two CRMs, or one non-PHI CRM plus an EHR?
The latter, in almost every case. A dedicated CRM alongside the EHR is the standard architecture. The EHR often has a basic patient portal or scheduling module, which is not a real marketing CRM.
What is the risk if I get this wrong?
HIPAA violations for putting PHI in a non-BAA-covered tool can carry material fines and reputational damage. The two-system architecture is not a nice-to-have. It is compliance hygiene.
How long does the initial setup take?
For a typical single-location TRT practice, the non-PHI CRM setup inside MiOpsAI takes two to four weeks including schema configuration, form rewiring, staff training, and the CRM-to-EHR handoff.
Ready to Set Up a Clean Marketing CRM?
Visit our men's healthcare industry page or request access to walk through the schema for your specific practice. For context on the automation side that sits on top of this schema, see our comparison of HubSpot alternatives for men's health.