Best HIPAA Compliant Call Tracking Software: BAAs by Plan

The best HIPAA compliant call tracking software is a tool that signs a BAA on the plan you buy: CallRail on its Healthcare plans, CallTrackingMetrics on Marketing Pro and above, WhatConverts on Pro and Elite, and Invoca, which offers an industry-standard BAA template. Your phone system and any answering service need their own BAA, so this guide also quotes RingCentral, Nextiva, Dialpad, Zoom, 8x8, Weave, Google Voice, Microsoft Teams and two answering services. For the website side of the same funnel, Curve Compliance signs a BAA on every plan and sends form and booking conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Everything here was checked on October 10, 2026.

Book a call. Curve Compliance sends your website and booking conversions server-side, receives each call from a call tracker such as CallRail by webhook and credits it to the original ad click, and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.

HIPAA compliant call tracking software: the short list

Curve Compliance publishes this guide. The vendors are in alphabetical order, and each row quotes the vendor's own page.

Tool	Plan with the BAA	In the vendor's words	Checked
CallRail	Healthcare plans	"we also sign a business associate agreement (BAA) with each of our Healthcare clients" (CallRail, HIPAA FAQ)	October 10, 2026
CallTrackingMetrics	Marketing Pro and above	"Our HIPAA compliant features are included in the Marketing Pro plan and above" (CTM FAQ), and "CTM will put in place Business Associate Agreements (BAAs) with customers" (CTM security)	October 10, 2026
Invoca	Standard BAA, or your own on review	"For customers who are subject to HIPAA, Invoca offers an industry-standard BAA template" (Invoca)	October 10, 2026
WhatConverts	Pro and Elite	"Available on: Pro and Elite Plans" and "Once your Business Associate Agreement (BAA) is executed, the WhatConverts team will activate HIPAA compliance for your profile" (WhatConverts help)	October 10, 2026

Marchex, another call analytics vendor, is not in the table: its call recording terms, effective February 21, 2018, say Marchex is not to be deemed a business associate under HIPAA for those services. The BAA Directory quotes the terms for more tools.

What a call tracker's BAA covers

HIPAA defines a business associate as a person or company that "creates, receives, maintains, or transmits protected health information" for a covered entity (45 CFR 160.103). A call tracker that stores recordings, transcripts and caller numbers for a clinic holds that kind of data, and its BAA covers what it holds for you. Read more in what a business associate agreement is.

The BAA does not follow the data out. Invoca says it "does not transmit PHI to third-party systems unless the customer explicitly creates such a data feed" (Invoca). WhatConverts says webhooks "must be sent to secure (HTTPS) URLs, and the receiving platform must also be HIPAA-compliant" (WhatConverts FAQ). Every integration you switch on is a separate question.

Settings matter as much as the contract. On CallRail Healthcare plans with Call Tracking Intelligence, "Recording and transcripts are OFF by default, but can be turned on later" (they start ON when Premium Conversation Intelligence and Convert Assist are added), and PII redaction "is enabled by default on Healthcare accounts to help ensure compliance with HIPAA regulations" (CallRail Help Center). Its medical category redacts "Conditions, diagnoses, medications, treatments, procedures, and tests." With HIPAA turned on, WhatConverts email notifications "do not include customer or patient names, email addresses, phone numbers, addresses, form contents, chat contents, or call transcriptions" (WhatConverts FAQ). For vendor deep dives, see Is CallRail HIPAA compliant? and Is Invoca HIPAA compliant?

What reaches Google Ads and Meta from a call

Google Ads lists five ways to count calls, from calls on ads to call conversions imported from another system (Google Ads Help). With call reporting on, Google forwarding numbers track "call duration, call start time, caller phone number" (Google). To import call conversions from another system, Google says "you'll need to track call details like the caller's phone number and the call start time" (Google).

Google can also record calls. "AI-qualified call leads use Google AI to evaluate call recordings," and recording is on by default with one exception that matters here: "Call recording will remain turned off if you previously turned it off, or if your business was identified as operating in healthcare or financial services" (Google, AI-qualified call leads). Google adds that "you can manually enable call recording at any time to benefit from AI-qualified call leads." See Google Ads call reporting for clinics and HIPAA call tracking for Google Ads.

Meta says the information it does not permit through its business tools "includes health information," and that "the names you choose and criteria you establish for your events, conversions, and Custom Audiences must not reflect, imply, or be based on any prohibited information" (Meta, about prohibited information). A call conversion sent to Meta should carry a neutral event name and nothing from the call itself.

HHS guidance points the same way. Its bulletin on online tracking technologies says "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures." HHS notes on that page that on June 20, 2024, in American Hospital Association v. Becerra, a federal court vacated the part about tracking that connects an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers.

Recording and transcription rules for clinics

Two sets of rules apply. State law decides whether you may record at all. California Penal Code 632 covers recording a confidential communication "without the consent of all parties" (Cal. Penal Code 632). CallRail's help center puts it plainly: "Recording laws vary by state. Some require all-party consent; others require only one." CallRail lets you set an automated greeting that tells callers they are being recorded (CallRail).

HIPAA decides where a recording may live. A recording or transcript of a patient call can contain PHI, and the vendor that stores it needs a BAA. HHS describes the "conduit" exception, which covers services that only pass data along, as "limited to transmission-only services for PHI (whether in electronic or paper form), including any temporary storage of PHI incident to such transmission." HHS adds that a service that keeps ePHI for storage "will qualify as a business associate, and not a conduit" (HHS, cloud computing guidance).

Keep recordings off unless you use them. Which states' rules apply to your calls is a legal question, so talk to your counsel. Read dental call tracking: what you can record.

HIPAA compliant phone systems and answering services

The call tracker forwards calls to your phone system, and the phone system stores its own voicemail, call logs, recordings and often texts and faxes. That makes it a second vendor to check for a BAA. These phone systems state their BAA terms on their own pages:

Phone system	BAA terms, in the vendor's words	Source
8x8	"As an Express account admin, you will need to upgrade to an X Series account to obtain a Business Associate Agreement from 8x8."	8x8 Support
Dialpad	"Online BAA signing is available on all paid Dialpad accounts."	Dialpad Help; Dialpad + HIPAA
Google Voice	Google lists "Google Voice (managed users only)" among the Workspace services "included in the Google Cloud BAA."	Google Cloud
Microsoft Teams	Microsoft "offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services," and lists Microsoft Teams in scope.	Microsoft Learn
Nextiva	HIPAA offerings are marked "HC" on your quote, and "You must also enter into a Business Associate Agreement or BAA with Nextiva."	Nextiva HIPAA Use Guidelines
RingCentral	"RingCentral makes available a business associate agreement (BAA) for our paying Covered Entity customers." Covered services include RingEX and RingCX.	RingCentral and HIPAA (PDF)
Weave	Weave's Business Associate Addendum "supplements the underlying agreement, including the Terms of Service" with each client.	Weave
Zoom Phone	Zoom enters into BAAs on paid plans. In a May 27, 2021 post: "With an executed BAA, you can use Zoom Phone's products and features, including SMS, to communicate with patients."	Zoom Support; Zoom blog

Check the services, not just the brand. For a closer look at one system, read Is RingCentral HIPAA compliant?

A medical answering service takes patient messages and holds them for you, which is the kind of work the business associate definition describes. Ruby says "For customers who require HIPAA-compliant service, Ruby provides a Business Associate Agreement," and that with HIPAA service "messages and caller information will not be emailed and/or texted to you, but rather will be available via a secure method" (Ruby). Specialty Answering Service wrote in a February 13, 2018 post: "We can also sign a BAA to insure that we are staying compliant under HIPAA" (Specialty Answering Service).

Where Curve Compliance fits: the website side

Many patients never call. They fill in a form or book online, and Curve Compliance covers that path under a BAA it signs on every plan:

• Server-side conversions. One script replaces browser ad pixels, and conversions go from Curve's servers to Meta Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn.
• A fixed list of fields. Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
• PHI checks. Curve detects PHI-like patterns, such as condition names, form answers or emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
• Booking attribution. Curve keeps the ad click when a visitor leaves to book in IntakeQ, Calendly, Acuity, Jane App, ZocDoc, Boulevard, Mindbody, Vagaro and other schedulers. Bookings made days later still match.
• Calls from your call tracker. Curve Compliance receives each call from a call tracker such as CallRail by webhook and credits it to the original ad click, next to your web and booking conversions.
• Curve Forms. HIPAA-hosted intake and lead forms with ad attribution attached.
• Proof. Event Logs show what Curve sent to each platform and what each platform accepted, and Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions.

Curve Compliance's BAA covers the data that passes through Curve. Your call tracker, phone system and answering service each sign their own. The free website scan lists the pixels and trackers on a page. Read more on Curve Compliance conversion tracking, Curve Forms and HIPAA compliant attribution software.

How to choose HIPAA compliant call tracking software

Ask these on every demo.

1. The BAA on your plan. CallRail, CTM and WhatConverts tie HIPAA to named plans. Sign the BAA before the first patient call.
2. Recording defaults. Ask whether recording and transcripts start on or off, what gets redacted, and who can listen.
3. What leaves the platform. List every integration and alert, and the fields each one carries.
4. The consent greeting. Confirm it plays before the conversation starts.
5. The rest of the funnel. Your phone system, answering service and website tools each need their own BAA.

Vendors change their terms. Confirm the BAA for the plan you will buy before any patient data flows.

Sources, checked October 10, 2026: CallRail FAQ; CallRail help; CTM FAQ; CTM security; Invoca; WhatConverts help; WhatConverts FAQ; Marchex terms; RingCentral; Nextiva; Dialpad BAA; Dialpad HIPAA; Zoom support; Zoom blog; 8x8; Weave; Google Cloud; Microsoft; Ruby; Specialty Answering Service; Google Ads Help on call conversions, call reporting, call imports and AI-qualified leads; Meta; HHS on tracking and cloud computing; AHA v. Becerra; 45 CFR 160.103; Cal. Penal Code 632.

Frequently Asked Questions

Which call tracking software is HIPAA compliant?

Look for a vendor that signs a BAA on your plan, then use its HIPAA settings. CallRail signs one with its Healthcare clients, CallTrackingMetrics on Marketing Pro and above, WhatConverts on Pro and Elite, and Invoca offers a standard BAA template.

Is CallRail HIPAA compliant?

CallRail says it signs a BAA "with each of our Healthcare clients." See Is CallRail HIPAA compliant? and CallRail in the BAA Directory.

Does CallTrackingMetrics sign a BAA?

Yes. CTM says it "will put in place Business Associate Agreements (BAAs) with customers," and that its HIPAA compliant features are included in the Marketing Pro plan and above.

What is a HIPAA compliant phone system?

One whose vendor signs a BAA that covers the services you use, set up with the vendor's HIPAA settings. RingCentral, Nextiva, Dialpad, Zoom, 8x8, Weave, Google Voice and Microsoft Teams publish BAA terms for named plans and services.

Does a medical answering service need a BAA?

An answering service that takes patient messages handles the kind of data the business associate definition in 45 CFR 160.103 describes. Ruby says it "provides a Business Associate Agreement" for customers who require HIPAA-compliant service.

Does Google Ads record calls for healthcare advertisers?

Google says call recording for AI-qualified call leads stays off "if your business was identified as operating in healthcare or financial services," and that you can turn it on manually at any time.

What reaches Google Ads and Meta when a call converts?

Google's call import relies on call details like the caller's phone number and the call start time. Meta does not permit health information, including in event names. Send the conversion with a neutral name and nothing from the call.

Where does Curve Compliance fit next to call tracking?

Curve Compliance covers the website side. It sends form and booking conversions server-side to the ad platforms, keeps the ad click through schedulers such as IntakeQ, Calendly and Jane App, and signs a BAA on every plan. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok today, then set up server-side conversions for your forms and online bookings. Most customers are live in about a week. Book a call with Curve.