Skip to main content
BAA Directory

Does CallTrackingMetrics sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on the Marketing Pro plan and above. CTM puts BAAs in place with customers as part of its HIPAA Compliance Program.

Call tracking and phones. Checked on the vendor's own pages on .

Using CallTrackingMetrics on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What CTM says

“As part of our HIPAA Compliance Program, CTM will put in place Business Associate Agreements (BAAs) with customers to document the requirements of the relationship as it relates to HIPAA”

Source: CTM Security, HIPAA/HITECH Compliance, checked .

“Our HIPAA compliant features are included in the Marketing Pro plan and above and we have additional resources available to ensure HIPAA compliance.”

Source: CTM Plans and Pricing FAQs, Is CTM HIPAA compliant?, checked .

What this means for ad tracking

A phone call from an ad is often a clinic's most valuable conversion. Call tracking records calls, transcribes them and can send call conversions to Google Ads and other platforms.

A BAA with CallTrackingMetrics covers the recordings, transcripts and lead details it holds. It does not cover the ad platform that receives a call or lead conversion, so caller details and call content should stay out of what goes to Google Ads or Meta.

Curve Compliance closes that gap: it receives call outcomes through an incoming webhook, credits each to the original ad click, and sends the conversion server-side under a BAA it signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Keep CallTrackingMetrics for what it does well. Curve Compliance carries the conversion signal to your ad platforms separately, under its own BAA.
  • Call outcomes arrive through incoming webhooks and are credited to the original ad click.
  • Server-side conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, sent from Curve's servers with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does CallTrackingMetrics sign a BAA?

Yes, on the Marketing Pro plan and above. CTM puts BAAs in place with customers as part of its HIPAA Compliance Program. In CTM's words: “As part of our HIPAA Compliance Program, CTM will put in place Business Associate Agreements (BAAs) with customers to document the requirements of the relationship as it relates to HIPAA” We checked CTM's own pages on October 1, 2026.

Which CallTrackingMetrics plans include a BAA?

CTM says its HIPAA compliant features are included in the Marketing Pro plan and above, and it puts BAAs in place with customers as part of its HIPAA Compliance Program.

Does a BAA with CallTrackingMetrics cover my ad pixels?

No. A BAA covers the data CTM handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with CTM.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with CTM before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call