Choosing an Insurance Agency CRM: The Evaluation Checklist
A buyer's checklist for evaluating a CRM or AMS for an insurance agency: HIPAA audit trail, CMS call-recording retention, licensing, commissions, consent, and data portability.
An insurance agency CRM has to do more than track contacts and send email: it has to hold up under a HIPAA audit, document CMS-required call recordings, keep state license and carrier appointment status current, and calculate downline commissions correctly. Before you sign a contract, run every CRM you're considering through the checklist below, built around the items that actually cause agencies pain after they've already switched. Why a generic CRM checklist falls short here Most CRM buying guides are written for sales teams that close a deal and move on. An insurance agency's CRM has to keep working on a book of business for years: policies renew, licenses expire, commissions pay out on a delay, and regulators can ask to see records from calls made months or years earlier. A platform that looks fine in a 30-minute demo can still leave you without an audit trail, a call recording, or a clean handoff when an agent leaves. The categories below are the ones that are hard to retrofit after you've already migrated your book. The evaluation checklist 1. HIPAA audit trail If your agency handles Medicare, ACA, or other health-related client data, the CRM is touching electronic protected health information (ePHI). The HIPAA Security Rule's audit controls standard, 45 CFR 164.312(b) , requires a covered entity or its business associate to implement hardware, software, or procedural mechanisms that record and examine activity in any information system that contains or uses ePHI. Ask whether every view, export, print, and login against a client's PHI is logged automatically, not just database-level access you'd have to reconstruct later. Ask who can read the audit log, and whether a denied access attempt is captured as well as a successful one. Ask for a signed Business Associate Agreement (BAA) before you put any client health data in the system. For the full list of what a HIPAA audit trail needs to cover, see our guide to HIPAA audit trail requirements . 2. Call recording, transcription, and compliance retention If you or your downline sell Medicare Advantage or Part D, CMS requires that marketing and sales calls between a Third-Party Marketing Organization (TPMO) and a beneficiary be recorded in their entirety, under 42 CFR 422.2274(g)(2) and 423.2274(g)(2) . The retention period for those recordings changed for the 2027 contract year: CMS's final rule now requires the marketing and sales portion of a call to be retained for a minimum of 6 years rather than the previous 10, with the first 3 years kept in audio format and years 4 through 6 allowed as either audio or a complete, accurate transcript ( Federal Register, April 6, 2026 ). The separate requirement that enrollment records — including the enrollment portion of a recorded call — be retained for 10 years was not changed. Ask whether call recording is built into the CRM's own dialer or requires a separate add-on that has to be wired together and kept in sync. Ask whether the platform can tell the difference between the marketing/sales portion of a call and the enrollment portion, since they now carry different retention periods. Ask whether recordings are transcribed and scored against a coaching rubric, or whether you'd need a second tool just to review call quality. Our call quality assurance checklist goes deeper into what to score once recording is in place. 3. State license and carrier appointment tracking Every state insurance department ties your right to sell to an active producer license and, in most states, to an active carrier appointment, both tracked through the National Insurance Producer Registry (NIPR) . A license that lapses — or an appointment that was never filed — can mean an unpaid commission or a compliance problem you don't find out about until a client complains. Ask whether the CRM syncs license and appointment data automatically, or whether someone on your team has to check manually and re-key it. Ask what happens before a license or appointment lapses: is there a warning with enough lead time to renew, or only a record of the lapse after it's already happened? If you run a downline, ask whether you can see every agent's license and appointment status in one place, by state and by carrier. See our multi-state license tracking guide for what to track once an agent writes business in more than one state. 4. Commission and downline override tracking Commission statements rarely match the CRM's own activity records on the first try, and the gap gets worse the more carriers and downline levels you have. Ask whether the CRM calculates commission and downline override amounts from its own policy and hierarchy data, or whether that math happens in a spreadsheet outside the system. Ask how chargebacks are tracked against the original commission, and whether that history survives if the writing agent later leaves the agency. Ask whether an agent can see their own commission and chargeback detail without a manual pull from the agency admin. 5. Texting and calling consent Every outbound text or call to a lead or client carries TCPA exposure. A CRM that can't show, for a specific contact, when and how they consented to be contacted — and immediately honor an opt-out — puts that exposure on you, not the vendor. Ask whether opt-outs are enforced automatically across every campaign and every agent, not just the one that received the "STOP" reply. Ask whether consent and opt-out events are timestamped and retrievable per contact. 6. Integrations with quoting and enrollment tools Re-keying a client's information between a quoting platform and the CRM is where duplicate records and missed follow-ups start. Ask whether the CRM can launch a quote for ACA or Medicare directly from the client's record, and whether enrollment data flows back into that same record automatically. Ask what happens to a partial quote or an abandoned enrollment: does it disappear, or does it stay visible as a follow-up task? 7. Role-based access for agencies and downlines An FMO, IMO, or multi-location agency needs an admin to see everything while a line agent sees only their own book — and a denied attempt at seeing more than that should itself be logged, not just blocked silently. Ask how many distinct roles the platform supports out of the box (agency admin, sub-agency admin, independent agent, loan-out/shared-seat agent, client-facing portal, and so on), and whether access by role is enforced at the data level or only hidden in the interface. Ask whether a role change or access denial is captured in the same audit log as PHI access, so a HIPAA audit and an access-control audit pull from one system of record. 8. Data portability and switching cost Ask this question before you sign, not after you've outgrown the platform: can you export your full contact, policy, and commission history in a usable format, or does the vendor's contract or technical design make your own data hard to leave with? Example: a six-person ACA and Medicare agency evaluating three CRMs during a renewal cycle found that two of them could export contacts but not linked policy or commission history — meaning a future switch would mean manually rebuilding years of commission records. For a deeper look at migrating without losing data, see our guide to switching agency management systems . Questions to ask in a demo "Show me a client's audit log, not a mock-up of one." A vendor who can't pull up a real log in the demo probably doesn't have one running in production. "Pull up a real call recording and its transcript, start to finish." This tells you whether recording and transcription actually work together or are two separate, loosely connected features. "Walk me through what happens automatically when a license expires." The answer should describe a system behavior, not a person's manual process. "If I left tomorrow, what would my downline see in the commission report?" This surfaces whether chargeback and override history actually survives…
Where AgencyView fits
Keep reading
Share: Facebook · LinkedIn · X · Email
All articles · AgencyView