Kipu
Kipu Health
EMR plus an admissions CRM. Kipu says its CRM turns website form inquiries into tasks; API access is by key, for Kipu clients and developers working with one.
Integrations
The systems your treatment center website has to work with.
Your EHR, your CRM, call tracking, forms, reviews, analytics and scheduling. For each one: how it actually reaches a website, whether the vendor offers a BAA and on which plan, and where patient details tend to leak. Every vendor claim comes from the vendor's own pages, with the sources listed.
- 16 tools, read against vendor docs
- BAA status, per the vendor
- Sources checked October 15, 2026
How to read these pages
What it is
One line, in plain words, so you know which system we mean before anything else.
How it reaches your site
Embed, link-out, form posting, webhook or API. Only what the vendor documents; where it documents nothing, we say so.
BAA, per the vendor
What the vendor's own pages say about a Business Associate Agreement, and on which plan. Silence is reported as silence.
What to watch out for
The part that matters: where patient details can leak, which settings to change, and what the vendor's own docs warn about.
Who wires it
We do the website side: the form, the widget, the call tracking snippet and the analytics setup. No account managers and no handoffs: the person you brief is the person who builds, and seniors do the work. The vendor side, such as users and pipelines inside your EHR, stays with your admin or the vendor's own team.
Not legal advice. These pages report what each vendor publishes, checked October 15, 2026. Nothing here implies a partnership with any vendor listed. For the terms behind the acronyms, see the glossary.
EHR and practice management
Where admissions inquiries end up. Most of these platforms bundle a CRM for referrals and inquiries, and few publish how a website form gets in.
Sunwave Health
EMR, CRM and billing. Sunwave documents a CallTrackingMetrics integration for calls; a website form method is not published.
BestNotes
EHR with a secure online intake application you can link from your website. BestNotes mentions API documentation for custom integrations.
Alleva
EMR with CRM tools and a client and family portal. Alleva describes an open API; the web form route is not published.
Lightning Step
Lightning Step, now part of Sunwave
EHR, CRM and billing. The CRM lists a web inquiry form and online booking; the published BAA binds it to 42 CFR Part 2.
CRM
Lead and relationship systems outside the EHR. Both offer a BAA, but only for named services or on specific plans.
Salesforce Health Cloud
Salesforce
Healthcare CRM on the Salesforce platform. Web-to-Lead turns a website form into leads; the BAA covers named services only.
HubSpot
CRM, forms and a tracking code. HIPAA use needs an Enterprise subscription with Sensitive Data turned on and the BAA accepted.
Call tracking
For many treatment centers, the first inquiry is a phone call. These tools swap the number on your site so every call carries its source.
CallRail
Number swapping and form tracking by JavaScript snippet. The BAA comes with a Healthcare plan, which is a separate account.
CallTrackingMetrics
CallTrackingMetrics (CTM)
Tracking code, FormReactor forms and webhooks. HIPAA workflows need a BAA, an eligible plan and specific settings.
Forms
Hosted form builders with healthcare plans, for when the website form needs to collect more than a name and a phone number.
Reviews and messaging
Review widgets and website chat. Chat is the quiet risk: people often type things into a chat box they would not put in a form.
Analytics
Measurement and the container that loads every other tag. Google offers no BAA for Analytics and documents none for Tag Manager, which shapes everything else.
Google Analytics 4
Google
Web analytics by tag. Google offers no BAA for Analytics, and says where its tags should not go on HIPAA-covered sites.
Google Tag Manager
Google
One container that loads every other tag. Tag Manager itself collects no visitor data, but every tag inside it can.
Scheduling
Booking links and embedded calendars, and where they stop being safe to use.
Calendly
Booking by link or embed. Calendly says it does not comply with HIPAA, and its terms rule out PHI.
Frequently asked questions
No. They describe what each vendor publishes about connecting to a website, with links to the vendor's own pages so you can check every line. Nothing here implies a partnership, reseller deal or certification.
Not by itself. A BAA covers the vendor that signs it. The website form, the plugins in between, the analytics tags and the email notifications each need their own answer, which is why every page here has a section on what to watch out for.
Tell us what it is. We read the vendor's documentation first. If it publishes a way in, we use it, and if it does not, we say so before any work starts.
Every page lists its sources and the date we checked them, October 15, 2026. Vendors change plans and terms, so confirm the BAA and plan in writing with the vendor before you rely on it.
No. It is what each vendor publishes, read by a team that builds treatment center websites. Your compliance lead or counsel decides what counts as PHI in your workflows.
