How to Choose Case Management Software: A Buyer's Checklist
Choosing case management software is less about finding the product with the longest feature list and more about finding the one your staff will actually use, that produces the reports you owe, and that protects the people in your records. This guide walks through the process step by step and ends with a checklist you can bring to every demo.
New to the category? Start with What is case management software?
Step 1: Map how your work really happens
Before you look at any product, write down how a participant moves through your programs today:
First contact. How do people find you, and what do you collect at the first conversation?
Intake and eligibility. Which forms, documents and approvals are required, and by program?
Service delivery. Who sees the participant, how often, and what gets recorded?
Referrals. Which partners do you send people to and receive people from?
Closure and follow-up. When is a case closed, and do you check in afterward?
Reporting. Which reports go to which funders, board members or agencies, and how often?
Include frontline staff. They know where the workarounds and duplicate entry happen. This map becomes your requirements document and your demo script. (This is the kind of mapping our Professional Services team does with nonprofits and municipal leaders. You can also do it yourself with a whiteboard and an afternoon.)
Step 2: Separate must-haves from nice-to-haves
Turn the map into a short list in three columns:
Must have | Should have | Nice to have |
Things you can't operate without (e.g. the intake fields a funder requires, role-based access) | Things that save real time (e.g. reminders, bulk messaging) | Things that would be pleasant but won't change the decision |
Tie each must-have to an outcome: shorter intake, fewer duplicate records, faster reports, fewer missed follow-ups. If you can't say why a feature matters, it probably belongs in the third column.
Step 3: Know your privacy and security obligations
What you need depends on who you serve and who funds you, so confirm with your own counsel or compliance lead. A few common cases:
Health information. HIPAA applies to covered entities (health plans, clearinghouses and health care providers that conduct certain electronic transactions) and to their business associates (45 CFR 160.103; HHS business associate FAQ). Not every nonprofit is covered. If you are, ask whether the vendor will sign a business associate agreement.
Substance use disorder records. Federally assisted SUD programs have additional confidentiality rules under 42 CFR Part 2 (HHS overview).
Government contracts and grants. Your agreement may specify data security, data location, retention or breach-notification terms. Read them before the demo.
Whatever applies to you, ask vendors to describe their safeguards in writing, and ask what is covered by their own controls versus their hosting provider's.
Step 4: Ask vendors to demo your workflow, not theirs
A polished demo of someone else's process tells you very little. Send each vendor two or three short scenarios from your map and ask them to walk through them live. For example:
"A new participant calls. Complete intake for our housing program, including an eligibility question and a signed consent."
"A case manager logs a home visit, updates a goal and schedules a follow-up."
"A supervisor pulls last quarter's numbers for one funder, broken down by program."
While they demo, time how many clicks it takes to log a contact, and have a frontline staff member try it.
Step 5: Check reporting with your own numbers
Reporting is where many implementations disappoint. Ask:
Can authorized staff build or change a report without the vendor?
Can you report by program, site, funding source, staff member and date range?
How does the system count unduplicated participants across programs?
Can it produce a report you submit today, using sample data you provide?
If you receive federal funds, remember that performance reporting has its own rules. For example, 2 CFR 200.329 covers how often performance reports can be required and when final reports are due (eCFR). Make sure the system can produce what your awards actually ask for.
Step 6: Ask the security questions every vendor should answer
You don't need to be a security expert to ask good questions. CISA's Secure by Demand guide is written for software buyers and suggests asking about things like multi-factor authentication, default settings, vulnerability handling and logging (CISA, Secure by Demand Guide, 2024). CISA also recommends requiring multi-factor authentication on business accounts (CISA). Useful questions:
Is multi-factor sign-in available, and can we require it for all users?
Can we limit access by role and by program? Is there an audit log of who viewed or changed a record?
How is data encrypted in transit and at rest?
Where is our data hosted, and who are your subprocessors?
How and how quickly will you notify us of a security incident?
Which independent assessments or reports can you share, and what do they cover?
Get the answers in writing and keep them with your contract file.
Step 7: Confirm you own your data
Who owns the data you enter?
Can you export all of it, including case notes and attachments, in a standard format, at any time?
What happens to your data at the end of the contract, and how long until it's deleted?
Step 8: Price the whole project, not just the license
Ask for a written estimate that covers subscription fees, configuration, data migration, training, ongoing support and anything that triggers a price change (more users, programs or records). Ask for a week-by-week implementation plan with named responsibilities on both sides.
Step 9: Talk to references like you
Ask for a reference from an organization of similar size and program mix. Ask them what took longer than expected, what they'd configure differently and how support responds when something breaks.
The checklist
Print this and score each vendor 1–5.
Fit - ☐ Configures intake forms, fields and workflows to our programs without custom code - ☐ Handles multiple programs per participant (and households, if we need them) - ☐ Frontline staff can log a contact quickly; tested by our own staff
Documentation and coordination - ☐ Case notes tied to goals and service plans - ☐ Action steps with owners and due dates - ☐ Referral tracking, in and out - ☐ Document upload and signature capture - ☐ Messaging that stays with the case
Reporting - ☐ Reports by program, site, funder, staff and date range - ☐ Unduplicated counts across programs - ☐ Built one of our real reports with sample data
Security and privacy - ☐ Multi-factor sign-in that we can require for all users - ☐ Role- and program-based permissions; audit log - ☐ Written description of safeguards and what they cover - ☐ Business associate agreement or other required terms, if applicable
Data and cost - ☐ Full export at any time in a standard format - ☐ Clear end-of-contract data handling - ☐ Written total cost including implementation and training - ☐ Week-by-week implementation plan
Vendor - ☐ Reference from a similar organization - ☐ Support hours, response times and escalation path in writing
Where Community Labs fits
Engage is our case management software for community organizations, behavioral health providers and government agencies, covering intake, case notes, messaging and reporting. We're happy to demo it against your scenarios rather than ours. If you'd like help with Step 1, our Professional Services team can map your workflow with you first. You can also download our Security and Encryption Overview.
Frequently asked questions
How long does it take to choose case management software?
It depends on your procurement rules. A small nonprofit might take a few weeks; a public agency running a formal solicitation can take much longer. Mapping your workflow first shortens every later step.
Should we write an RFP?
If your procurement rules require one, yes. Even when they don't, a short requirements document and two or three demo scenarios make vendor responses much easier to compare.
What's the most common mistake?
Choosing on the demo instead of on your workflow. Ask every vendor to walk through the same real scenarios, and have frontline staff try them.
What security questions should we ask a case management vendor?
At minimum: multi-factor sign-in, role-based access, audit logs, encryption, hosting location, incident notification and which independent assessments they can share. Get the answers in writing.
Do we need a HIPAA-compliant system?
Only if HIPAA applies to your organization or the program, as a covered entity or business associate. Many human services nonprofits are not covered entities, but some programs are. Check with your counsel and ask vendors what they will commit to in writing.
