CRM procurement and integration questions

A marketing CRM is usually sold on its dashboard. Ask these questions instead, in writing, and keep the answers with the contract. A supplier that will not answer them in writing has answered them anyway.

Data ownership and export

• Does the contract say the practice owns the data it puts into the system and the data the system collects for it?
• Can I export everything (contacts, enquiries, notes, call and message history, consent records) at any time, without asking support?
• In what format, and can another system import it?
• When the contract ends, how long do I have to export, and when and how will you delete the data?

What data it would hold

UK GDPR requires personal data to be limited to what is necessary for the purpose ^[2]. A marketing CRM's purpose is managing enquiries and follow-up. It needs contact details, the enquiry source and what happened next. It should not hold clinical records, medical history or clinical notes; those belong in your practice management system.

Even without clinical notes, a CRM can hold confidential information. The General Dental Council's standards treat what treatment a patient is having and how much it costs as confidential ^[1]. Ask:

• Which fields does the system hold, and can I switch off or remove the ones I do not need?
• Will any data be copied in from my practice management system? Which fields, exactly?
• Can free-text notes be kept free of clinical detail, and how will my team be prompted to do that?
• How long is each type of record kept, and can I set that myself?

Integration claims to test live

"Integrates with your PMS" can mean anything from a live two-way connection to a nightly file of names. Do not accept it on a slide or a partner logo. Ask for a live demonstration connected to your own system, or a test copy of it, and watch it happen:

• Create a test enquiry from your website form and a test call. Do both arrive in the CRM with the right source?
• Book the test enquirer in. Does the appointment appear in your real diary, and how long does it take?
• Mark the consultation attended in your practice management system. Does the CRM learn that, and what else does it receive?
• Change a phone number in one system. Which system wins, and does the other update?
• What happens when the connection fails? Who is told, and what is retried?

Ask for the answers to be written into the order form: which data moves, in which direction, how often, and what the supplier will do if the integration stops working after you sign.

The data processing agreement

A CRM supplier holding enquiry data for you is a processor. UK GDPR requires a written contract that sets out the subject matter, duration, nature and purpose of the processing, and the types of personal data ^[3]. Among other things, the contract must require the supplier to:

• process the data only on your documented instructions;
• make sure its staff are bound by confidentiality;
• use another processor only with your written authorisation, and tell you of changes;
• help you respond when patients exercise their rights;
• delete or return all the data at the end, at your choice;
• give you the information needed to show compliance, and allow audits ^[3].

Ask for the agreement before the demonstration, not after the contract. Ask for the list of sub-processors, including hosting and messaging providers, and where the data is stored.

Access controls

• Can I give each user their own login, with permission levels that limit what they can see and export?
• Is two-factor sign-in available, and can I make it compulsory?
• If an outside agency needs access, can it have a separate, limited login that I can remove on the day it leaves?
• Is there a log of who viewed, changed or exported records?

Cost and contract

• What is the setup fee, the monthly fee, and what does it scale with (users, sites, contacts, messages)?
• Are SMS, call recording or integrations charged separately?
• Are prices before or after VAT?
• What is the minimum term and the notice period, and can prices rise during the term?
• Is the integration with my practice management system included, or quoted separately?

Put each supplier's answers into the software requirements checklist, and check where the CRM sits in your wider setup with the software stack guide.