Speed to Contact: Measuring Follow-Up Without PHI

You measure speed to contact by timestamping two moments, the instant a lead becomes reachable and the instant someone genuinely attempts to reach them, then reporting the distribution of the gap between them, and Curve is the HIPAA-compliant tracking layer that joins that gap to the campaign that produced the lead. A duration is not health information. What makes speed to contact a compliance question is the join: to connect follow-up time to ad performance you have to touch a record that identifies a person who contacted a healthcare provider. Keep that join inside systems covered by a BAA and forward only neutral, hashed signals. Curve includes a signed Business Associate Agreement on every plan.

Speed to contact is the highest-leverage operational metric in patient acquisition, and it is almost always the cheapest thing to fix. It requires no new budget, no creative, and no landing page test. It requires knowing your current number, which most practices do not.

A note before the method: this article does not quote a benchmark. There are widely circulated numbers about response times in lead generation, most of which come from outside healthcare, from sources of varying quality, and from a different era of consumer behavior. Your baseline is the only number that matters, and you can have it this week.

The measurement is mostly definitions

Speed to contact looks trivially simple and is not, because both endpoints are ambiguous, and two teams measuring the same clinic with different definitions will produce numbers that differ by an order of magnitude. Settle the definitions first and write them down.

The start timestamp

There are at least three candidates, and they can be far apart:

• Lead submitted. When the patient pressed the button. This is the only endpoint that reflects the patient's experience, which makes it the right one to report.
• Lead received. When the record landed in your CRM. Any delay between submitted and received is your integration, not your team, and it is worth measuring separately because middleware queues and batching add real minutes.
• Lead surfaced. When it appeared in a queue somebody was actually watching. Leads that route to an unmonitored inbox are surfaced never.

Report against submitted, and track received separately as an integration health metric. If your automation layer is adding delay, no amount of coaching the intake team will fix it. This is one reason to understand where tools like Zapier sit in a healthcare automation chain, both for latency and for BAA coverage.

The end timestamp

Harder, because "contacted" means different things to different systems. Decide explicitly which of these stops the clock:

• An outbound dial, whether or not anyone answered.
• A connected call where the patient actually spoke to someone.
• A voicemail left.
• An SMS sent by a person.
• An email sent by a person.
• An automated confirmation email or text.

The last one is the trap. Automated acknowledgements fire in seconds and will make your speed-to-contact number look excellent while nothing has happened. Exclude automation from the metric entirely. It is worth having, and it is not contact.

The most useful definition for most clinics is first human contact attempt, counting dials, personal texts, and personal emails, whether or not they connect. Then track connection rate as a second metric, because a fast attempt that never reaches anyone is only half the job.

Read the distribution, not the average

Averages are actively misleading here because the data is heavily skewed. A handful of leads that sat for three days will drag an otherwise healthy average into meaninglessness, and one very fast day will hide a systematic afternoon gap.

Report at least these:

• Median. Your typical experience. This is the headline number.
• 90th percentile. Your bad experience. This is where the problems live, and it is the number that moves when you fix routing or coverage.
• Share contacted within a threshold you set yourself. Pick a target that means something operationally, such as within five minutes or within one hour, and track the percentage that clears it. A share is easier for a team to act on than a duration.
• Share never contacted. The most important number in the set, and the one no average will ever show you. Leads that received zero attempts are a routing or ownership failure, not a speed problem.

Two clocks, not one

A lead arriving at 11pm on a Saturday cannot be answered in five minutes unless you staff overnight. Measured on a raw wall clock, weekend and evening volume will dominate your distribution and your team will reasonably dismiss the metric as unfair.

Run two clocks. The raw clock measures the patient's actual wait, which is what determines whether they call a competitor, and it is the number that should inform whether you extend coverage. The business-hours clock stops during closed hours and measures your team's responsiveness while working, which is the number to manage them against. Both are true, and they answer different questions.

Segmenting without leaking

Speed to contact becomes strategic once you can slice it. Useful slices include hour of day and day of week, channel (form, phone, chat, Lead Ads), campaign, location, and individual coordinator or team.

All of this analysis is safe when it happens inside your own environment. The compliance line is about what leaves. A duration is not health information on its own, but a per-service-line response time report joined to identifiable records is a report about people receiving specific kinds of care. Two rules keep it clean:

• Do the analysis in systems covered by a BAA. Your CRM, your data warehouse, your call platform, your compliant analytics layer. Not a spreadsheet emailed around, and not a general-purpose analytics tool without a BAA.
• Never let a service line, condition, procedure, or specialty-identifying location travel to an ad platform. That includes as a conversion parameter, an event name, or a column in an upload. Analyze by service line all you like on your side, and forward nothing about it.

Aggregate reporting is a different matter. A dashboard showing median response time by hour, with no individual records and no clinical dimension, is an operational report and can be shared normally.

Where the data lives, and how to join it

The two timestamps almost never live in the same system. Submission time is in the form handler or the tracking layer. Contact time is in the phone system, the CRM activity log, or the texting platform. Joining them is the actual engineering work.

The join key should be the strongest identifier you have, in this order: a bridge token or click ID that ties the session to the record, then a normalized and hashed email, then a normalized phone number in E.164 format. Phone is often the practical winner for the contact side, since the call platform knows the number it dialed and little else.

Two failure modes to expect. First, clock drift and time zones. Systems that log in different zones or with different precision will produce negative durations and impossible outliers, so normalize to UTC at ingest. Second, missing attempts. Coordinators who call from a personal mobile or an untracked line generate contact that no system records, and their leads look neglected. Fix the instrumentation before you draw conclusions about the people.

How Curve fits into this

Curve is HIPAA-compliant ad tracking, attribution, and analytics for healthcare. It is not a dialer, a CRM, or a workflow tool, so it does not make the call. What it does is hold the timeline and the attribution, which is the half of this problem that is usually missing.

Server-side event collection with timestamps. The tracking script installs in place of the Meta Pixel or a raw Google tag, and events go to Curve's US-hosted infrastructure. The submission event is timestamped there, on infrastructure you control, rather than being inferred later from a CRM record that may have been created minutes after the fact.

Incoming webhooks with attribution matching. Your CRM, call tracking platform, or booking tool posts follow-up activity back to Curve, and Curve matches it to the original session by email, click ID, or bridge token. That match is what closes the gap between "someone submitted a form" and "someone was called," and it is what lets response time be reported against the campaign that produced the lead. CallRail connects this way as an inbound webhook. Incoming data cannot override protected core attribution and contact fields, so an upstream system cannot corrupt the record it matched into.

Bridge tokens. When a patient clicks out to a separate booking or intake tool, the bridge token keeps the thread intact, so a booking that happens off your domain still lands on the right timeline.

Per-destination field mapping and neutral aliases. Only mapped fields forward to a given destination, with nothing going by default, and the ad platform sees a neutral event name rather than your service line. So your internal analysis can be as clinical as it needs to be while the outbound signal stays neutral.

PHI-pattern detection. Payloads are inspected for PHI-shaped values such as MRN-style identifiers, SSNs, dates, and long numeric sequences, and flagged. It is a monitoring layer rather than redaction, and it is how you notice that a call platform started posting a note field. A signed BAA is included on every plan. For the surrounding architecture, see our guide to lead routing from ad click to CRM without PHI.

Turning the number into behavior

A metric nobody acts on is a decoration. Once you have a baseline, the changes that tend to matter are structural rather than motivational:

1. Cut the integration delay first. Minutes lost between submitted and received are free to recover and require nothing from your team.
2. Give every lead an owner at creation. Unowned leads are where the never-contacted count comes from.
3. Set one threshold and make it visible. A single shared target beats a dashboard of percentiles that nobody opens.
4. Alert on breach, not on arrival. Notify when a lead has gone unattempted past the threshold, since a notification on every lead is noise within a week.
5. Look at the hour-of-day chart before hiring. Most coverage gaps are a specific recurring window, and the fix is scheduling rather than headcount.
6. Instrument every contact channel so that work performed is work recorded.
7. Re-measure monthly. Response time decays quietly as volume grows.

Frequently asked questions

Is response time itself considered PHI?

A duration on its own is not. It becomes protected health information when it is attached to an identifiable person in the context of contacting a healthcare provider, which is exactly the form it takes in your CRM. Keep the record-level analysis inside BAA-covered systems and share only aggregates.

Should an automated confirmation email count as contact?

No. It fires in seconds and will make the metric look excellent while nobody has actually reached out. Count human attempts only, and track automated acknowledgements separately if you want to know they are firing.

What target should we set?

Set it from your own data rather than a published figure. Measure your current median and 90th percentile, then set a threshold that is a real improvement but reachable with current staffing. Move it once the team is consistently clearing it.

How do we handle leads that arrive outside business hours?

Measure both clocks. The raw clock tells you what the patient experienced and whether after-hours coverage is worth paying for. The business-hours clock tells you how your team performs while on shift. Manage the team on the second, make coverage decisions with the first.

Can we send response time to an ad platform as a conversion parameter?

There is rarely a reason to, and it creates risk for little gain. Platforms optimize on conversions and values, not on your operational metrics. Keep response time in your own reporting and send the platform a neutral conversion for the outcome it should be bidding toward.

Our coordinators call from mobile phones. Can we still measure this?

Not accurately, and that is the first thing to fix. Untracked calls make real work invisible and make good coordinators look negligent. Route outbound contact through a tracked line or log attempts in the CRM before you interpret any of these numbers.

How do we connect response time to ad spend?

Through the click ID captured when the visitor first arrived. If the submission carries the click ID and the follow-up activity is matched back to the same record, you can report response time by campaign. Our free compliance scanner is a separate check for what is currently loading on your site.

Where to start

Write the two definitions down, pull one month of data, and produce four numbers: median, 90th percentile, share within your threshold, and share never contacted. That is a morning of work and it usually surprises people. The never-contacted figure alone tends to justify the exercise.

Curve supplies the half that CRMs do not: a server-side timestamp on the original submission, webhook matching by email, click ID, or bridge token to tie follow-up activity back to it, and per-destination field mapping so none of the clinical context travels outward. A signed BAA comes with every plan. See how the full path is wired in our guide to connecting lead forms to your CRM without PHI, or visit curvecompliance.com to get your baseline measured properly.

Reviewed August 2026. Ad platform conversion APIs and healthcare advertising policies change frequently. Verify field-level requirements against current platform documentation before implementation.