Is a Spreadsheet Enough to Track Therapy Referrals? And Is It HIPAA-Compliant?

I am going to start this article with what may be a strange admission for someone who is apparently now building referral-management software:

Your practice may be completely fine just using a spreadsheet.

If you are a solo therapist or a small practice receiving a manageable number of inquiries, there is no reason to introduce another piece of software just because software exists. A thoughtfully designed spreadsheet may be inexpensive, familiar, flexible, and more than enough for what you need.

The question is not whether spreadsheets are good or bad. It is whether the spreadsheet is still doing what your practice needs it to do.

What should a therapy referral tracker actually track?

At its simplest, a referral tracker needs to help the practice understand where each prospective client is in the process.

That may include when the inquiry arrived, where it came from, who currently owns it, whether anyone has made contact, what needs to happen next, and the eventual outcome. Depending on the practice, you may also need basic matching information, such as age, location, insurance or payment type, session format, or the kind of support the person is looking for.

The important distinction is that a referral tracker should remain an operational tool, not slowly become a second clinical chart.

You need enough information to move the referral appropriately. You do not need to recreate everything that belongs in the EHR.

Before anything else: does your spreadsheet contain PHI?

This is the part that can get overlooked because a referral tracker may feel more administrative than clinical. But it can start containing protected health information pretty quickly.

A person's name or email address by itself is not necessarily PHI. However, once identifying information is connected to information about someone's physical or mental health, health care, or payment for health care, it can fall within HIPAA's definition of protected health information when a covered entity or business associate holds it. A referral spreadsheet that includes someone's name alongside the fact that they are seeking therapy, the concern they are calling about, insurance information, or other health-related details may therefore contain PHI.

That does not mean an online spreadsheet is automatically inappropriate for a therapy practice. It does mean the practice needs to be thoughtful about where that spreadsheet lives and how it's used.

For example, Google supports HIPAA workloads in certain Google Workspace services, including Sheets, when the organization has the appropriate Workspace setup and accepts Google's Business Associate Agreement. Google specifically tells customers who have not signed its BAA not to use PHI in Google Workspace or Cloud Identity services.

The same broader principle applies regardless of platform: if a cloud provider is storing or processing ePHI on behalf of a HIPAA-covered practice, HHS generally considers that provider a business associate and requires an appropriate Business Associate Agreement. The practice is also still responsible for conducting its own risk analysis and putting reasonable safeguards around the information.

So before using a cloud spreadsheet as a referral tracker, I would want a practice to know more than “the file is password protected.” Who can access it? Are staff using organization-managed accounts or personal ones? Can anyone create a public sharing link? What happens when someone leaves the practice? Are access and changes reviewable? Does information get copied into email, downloaded to personal devices, or passed into scripts and automations that are not covered by the same agreements?

HIPAA's Security Rule expects regulated organizations to assess risks to ePHI, control access appropriately, and regularly review records of access and security activity. That means the question is not simply whether Google Sheets, Excel, or another tool can support HIPAA compliance. The question is whether this setup and workflow appropriately protects the information the practice puts into it.

This is another reason I like keeping a referral tracker intentionally narrow. The more clinical detail a practice starts putting into what was supposed to be an operational tool, the more it begins functioning like a shadow health record. If the referral system only needs enough information to route the person appropriately and track what happens next, that is probably all it should contain.

The spreadsheet usually starts breaking around ownership

Okay, now that we’ve covered HIPAA compliance, things get interesting on the tech side when a spreadsheet starts introducing ownership. A spreadsheet can easily have a column called “Assigned Therapist.” If the cell says Sarah, everyone can see that Sarah has the referral. However, that doesn't necessarily mean Sarah saw it, accepted it, contacted the prospective client, or even knows she is now responsible for moving it forward. It also doesn’t mean another therapist hasn’t reached out or doesn't now know PHI about Sarah’s referral.

This is when practices naturally start adding processes around the spreadsheet. Maybe admin emails when someone gets assigned. Maybe therapists are expected to change the status manually. Maybe someone reviews the sheet once a day and checks for referrals that have been sitting too long. Maybe they create separate spreadsheets for each person to protect potential client information.

This is usually when the spreadsheet is still storing the information, but the actual referral system consists of the spreadsheet plus email plus reminders plus someone remembering to monitor it all.

You can absolutely build formulas, conditional formatting, scripts, or automations that make a spreadsheet much smarter. Depending on your practice, that may be exactly the right solution. But eventually, it is worth asking how much human attention it takes to keep the system running.

If someone has to scan the sheet several times a day to find overdue referrals, the person is doing the monitoring. And if admin has to message clinicians individually when follow-up has not happened, admin is doing the workflow.

If nobody knows something was missed until the spreadsheet is reviewed later, the system documents what happened rather than helping prevent it.

None of that makes the spreadsheet bad, but it does mean the practice may be asking it to do something beyond its original job.

How do you know when you have outgrown it?

I would pay attention to patterns rather than practice size.

A ten-person practice with a very simple intake system may be perfectly happy in a spreadsheet, while a four-person practice with complicated referrals may already be struggling.

The bigger signs include unclear ownership, repeated manual reminders, referrals moving back and forth between people, clinicians forgetting to update statuses, people contacting the same prospective client twice, or a practice owner regularly checking the tracker because they don't quite trust everything is being handled.

The moment the system depends on someone constantly watching it, you probably have a workflow problem, not a spreadsheet problem.

What should come next?

I have good news here! This does not mean you need a giant practice-management platform.

This is exactly why I started partnering with the practice I’m interning at: to use my tech skills and start building Referral Flow. It solves a niche problem well, but it doesn’t justify replacing everything a practice already uses.

The practice may already like its EHR. The website form may be working perfectly well. Scheduling may be fine. But what is missing is connection between those systems. And introducing something like Referral Flow introduces clear ownership, visible deadlines, clean handoffs, and one shared understanding of what happened with each referral.

In Referral Flow, every referral has one current owner. Follow-up has a visible expectation. Reassignment is a real handoff, not an email somebody hopes gets noticed. The practice can see where a referral is without reconstructing the process from several different places.

So, the moral of the story is that there is nothing wrong with starting with a spreadsheet. But sometimes your practice has outgrown it.