Store insurance type as a short category, such as Medicare, Medicaid, Commercial, or Self pay, and the referral source as a value from a fixed list, in custom fields in GoHighLevel, and keep member numbers, claims, and clinical detail in the practice management system or EHR. The bottom line: the CRM needs only what it takes to route, remind, and report, and the referral source field is tracking, never a way to reward a referral.
What goes where
| Data | Where | Why |
|---|---|---|
| Insurance category | Custom field on the contact, from a list | Routes visit types and wording |
| Member ID and plan details | Practice management system only | Not needed for routing, and sensitive |
| Referral source: self, patient referral, physician referral, insurer directory, web search, other | Custom field, from a list | Reports and workflows |
| Referring provider name | Custom field or a custom object | Closes the loop with the referring office |
| Diagnosis and clinical notes | EHR only | Minimum necessary |
GoHighLevel's help pages describe custom fields on contacts and opportunities, and custom objects with associations for repeating records such as referrals. Confirm the field names and permissions in your account, and use role based access so only staff who need these fields can see them.
GoHighLevel's help portal says accounts are not HIPAA compliant by default, and that HIPAA Compliance is a paid upgrade, $297 a month as an account wide add on, that must be enabled for the agency and then configured for the sub accounts that need it. Third party guides add that the add on provides a business associate agreement, encryption, audit logging, and multi factor authentication, that the practice also needs its own agreement with the agency, and that GoHighLevel itself recommends avoiding protected health information in SMS and email even with the add on. Whether the AI features are covered by the agreement is a question to put to HighLevel in writing before any patient data reaches them.
The kickback rules
Tracking where patients come from is normal. What matters is what the practice does with the data. Law firm summaries explain that the federal Anti Kickback Statute prohibits intentionally paying or offering remuneration to induce or reward referrals for federal health care program business, that it is violated if one purpose of the remuneration is to induce referrals, and that meals, tickets, and gift cards count as remuneration. The Stark Law adds a strict liability prohibition on physician referrals for designated health services where a financial relationship exists. One summary reports that the OIG's nominal gift limit was raised to $15 per instance and $75 a year, and advises tracking and documenting any allowable gifts. So a referral source report should inform marketing and operations, and it should never become a list of who to reward by volume. Ask counsel before building any reward or appreciation program.
Build it in GoHighLevel
- Create the fields in the table, with fixed lists for Insurance category and Referral source.
- Fill them at registration from the practice system, not by hand, if an import or integration is available.
- Use Insurance category to choose the wording of visit reminders, such as wellness visit versus physical.
- Use Referral source in a monthly report of new patients by source, and share it with the practice leader, not with referral partners.
- Set permissions so only registration and the practice manager can edit the fields.
- Write a one page data policy: what the CRM stores, what stays in the EHR, and who may see each.
Worked example
For example, a practice with 150 new patients a month and 40 percent from physician referrals has 60 referral patients (150 times 0.4). Recording the referring provider for each lets the office send a visit summary to the right office, which our referral tracking guide covers.
Mistakes to avoid
- Storing member IDs in the CRM. Keep them in the practice system.
- Free text for referral source. Use a list so reports work.
- Building rewards by referral volume. That risks the kickback laws.
- Giving every user access. Limit by role.
How this was handled before
The practice system held insurance, and a registration form held the referral source in free text that few people read. Fixed lists make the referral source usable in reports, and the kickback laws shape what the practice may do with those reports.
What to measure after launch
Track patients with an insurance category, patients with a referral source, and users who can edit the fields. Audit field accuracy against the practice system quarterly.
Check before you switch it on
US text messages sent from a standard 10 digit number need A2P 10DLC registration. The HighLevel support portal says registration is required for texts to US recipients from 10 digit long code numbers and that toll free numbers do not require it. HighLevel's opt in guidelines also say a person cannot be forced to agree to text messages in order to submit a form, so keep the consent box optional. One compliance guide separates informational texts, which need documented consent, from marketing texts, which need prior express written consent. Ask your attorney which category your reminders fall into. Have counsel review any referral related program, and your privacy officer review the field list. This is general information, not legal advice.
Questions people ask
Should insurance IDs be stored in the CRM?
Keep them in the practice management system. Store a category in the CRM.
Is tracking referral sources allowed?
Yes. The legal risk lies in rewarding or inducing referrals, which the Anti Kickback Statute prohibits for federal program business.
Where are repeating records stored?
GoHighLevel's custom objects and associations are designed for records that repeat, such as referrals.
Ready to try it yourself? Start a GoHighLevel account here.
You can also see this in action in our GoHighLevel capabilities demo.