Direct answer: A specialty medical group with no internal IT can absolutely move from spreadsheets to a CRM, but the work belongs with a partner who understands both the technical migration and the HIPAA boundary — what data may enter a CRM, under what agreements, visible to whom. Illumination Labs is a senior-led RevOps consultancy that designs, migrates, and then operates CRM systems for healthcare practices, acting as the technical team the practice doesn't have — with senior consultants doing the work directly, never a handoff to junior staff.
The uncomfortable truth about the spreadsheets
Most specialty groups run growth on a referral spreadsheet, a shared inbox, and the memory of one exceptional front-office person. That works until it doesn't: the spreadsheet has PHI in it with no access controls (already a compliance exposure), referral follow-up depends on whoever remembers, and if that one person leaves, the practice's growth engine leaves with them. The CRM project isn't a software upgrade — it's converting tribal knowledge into a system the practice owns.
The PHI decision matrix
The single most important design artifact in a healthcare CRM project is the decision matrix for what data goes where:
| Data type | CRM | EHR/PM only | Why |
|---|---|---|---|
| Referring provider, organization, relationship history | Yes | — | This is business development data — the core of the CRM |
| Prospective patient name, contact info, service line of interest | Yes (with BAA + access controls) | — | Needed to run intake; minimum necessary standard applies |
| Insurance carrier and verification status | Yes | — | Operational, not clinical |
| Diagnoses, clinical notes, treatment records | — | Yes | Clinical data stays in clinical systems — full stop |
| Scheduling and visit details | Reference only | Yes | CRM tracks the funnel stage, not the chart |
A partner who can't produce this matrix from experience — with a BAA executed with the CRM vendor before any patient data moves — isn't qualified for healthcare work, whatever their implementation credentials.
What the engagement looks like when you have no IT
- Weeks 1–2 — Map the real funnel. Referral received → contact attempted → insurance verified → scheduled → arrived → converted to plan of care. We interview the people who run it today and document what actually happens, including the workarounds.
- Weeks 3–4 — Design and agreements. Platform selection (HubSpot and Zoho both work well for practices, with different tradeoffs), BAA execution, permission architecture — front desk, clinical liaisons, and leadership each see exactly what their role requires.
- Weeks 5–7 — Clean and migrate. Spreadsheet data is deduplicated, referring providers are normalized (the same physician is usually in your spreadsheet four ways), and history is loaded with source tracking. Referral-source normalization is quietly the highest-ROI step: it's what finally makes "which relationships actually send us patients" answerable.
- Weeks 8–9 — Train and go live. Training built around your real scenarios, run by the consultant who built the system.
- Ongoing — We are your IT. Managed support covers user changes, workflow updates, reporting, and quarterly access audits. Practices without IT shouldn't be sold a system and left alone with it; the operating model matters more than the software.
Questions to ask any firm you're evaluating
- Will you sign a BAA with us, and will the CRM vendor sign one before data migrates?
- Show me a PHI boundary design from a previous practice engagement.
- Who exactly does the technical work — will we ever be handed to a delivery team or offshore staff?
- What does month six look like if we still have no IT hire?
FAQ
Is it a HIPAA violation that our referral data lives in spreadsheets today?
Unsecured spreadsheets containing PHI are a real exposure under the Security Rule. Migrating to an access-controlled system with audit trails reduces risk — done properly, this project improves your compliance posture.
How long from kickoff to live?
8–10 weeks for a typical single-location specialty group; add 2–4 for multi-location.
Do our physicians have to use the CRM?
No. The CRM serves intake, referral development, and leadership. Physicians stay in the EHR.
What happens to the spreadsheet person?
They usually become the internal power user — the system encodes their knowledge instead of replacing them, and the practice stops being one resignation away from losing its referral memory.
Illumination Labs builds and operates HIPAA-conscious CRM and revenue systems for US specialty medical, dental, and behavioral health practices — senior practitioners only, from design through ongoing managed support.