Call tracking tells you which marketing made the phone ring. For a medical practice that matters, because a large share of new patients call rather than fill in a form. Most call tracking content is written by call tracking vendors. This page covers what a practice needs to know: how the numbers work, why recordings and transcripts contain protected health information, what to require from a vendor, and lighter ways to count calls without one.
In short: Call tracking assigns different phone numbers to different marketing sources, such as an ad, your website or a mailer, and logs which number each caller dialed. For a practice, the counts are useful, but recordings, transcripts and caller details can be protected health information, so a vendor that handles them needs a Business Associate Agreement.
What call tracking is
At its simplest, call tracking is a set of phone numbers that forward to your real line. Each number is used in one place only. When a call comes in, the system logs which number was dialed, so it knows the source.
Vendors add layers on top: per-visitor numbers on your website, recordings, transcripts, automatic call scoring, and integrations that send "a call happened" back to Google Ads.
Demand for the topic is steady, and clicks are expensive because vendors compete for them:
| Search (US, monthly) | Searches | Avg. CPC |
|---|---|---|
| call tracking | 1,600 | — |
| call tracking software | 720 | $78.73 |
| hipaa compliant call tracking | 20 | $89.69 |
| is callrail hipaa compliant | 20 | — |
Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026.
Calls are the hardest part of measuring marketing ROI, which is why practices look at call tracking in the first place.
How tracking numbers and dynamic number insertion work
There are two ways numbers get assigned.
Static numbers are printed or placed once: one number on a billboard, another on a mailer, another in a directory listing. Every call to that number is credited to that source.
Dynamic number insertion (DNI) uses a script on your website to swap the displayed phone number depending on how the visitor arrived:
- A visitor lands on your site from, say, a Google ad.
- The script reads the source (the ad click ID, the referrer, or the UTM tagging on the link).
- It shows a number assigned to that source, or to that individual visitor.
- When they call, the vendor matches the call to the visit.
Google Ads has its own version. Its help page says website call conversions use a Google forwarding number that dynamically replaces your website number (opens in a new tab) for people who clicked your ad, and that these numbers are only available in certain countries.
DNI is powerful for attribution for calls, but it means a third-party script runs on your website and a third party sees your call data. Both have privacy consequences.
Call recordings, transcripts and PHI
Under HIPAA, protected health information (PHI) is individually identifiable health information held or sent by a covered entity or its business associate "in any form or media, whether electronic, paper, or oral," according to HHS's summary of the Privacy Rule (opens in a new tab). It includes information about a person's past, present or future health, their care, or payment for it.
A new-patient call is full of it. Take an illustrative example: "Hi, I'm calling about my son's ear infection; do you take our insurance?" That is identifiable health information the moment it's recorded alongside the caller's phone number.
So:
- Recordings and transcripts of patient calls are PHI.
- Caller phone numbers linked to a medical practice and an appointment request can be PHI.
- A vendor that stores, transcribes or analyzes them creates, receives or maintains PHI on your behalf. HHS calls such a vendor a business associate (opens in a new tab), and you must have a written contract, a Business Associate Agreement (BAA), before it handles PHI.
HHS's narrow "conduit" exception covers entities that only transmit PHI, like the postal service. A call tracking service that stores recordings is not a conduit.
The website script matters too. HHS's guidance on online tracking technologies (opens in a new tab) says a tracking vendor that receives PHI from your site is a business associate, and that a cookie banner isn't a HIPAA authorization. (A June 2024 court ruling vacated the part covering IP addresses on public health-information pages; the rest stands.)
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Choosing a HIPAA-ready call tracking vendor
Vendors describe HIPAA support in different ways, and it often depends on the plan. Check each on the vendor's own pages and in writing.
For example, CallRail's HIPAA page (opens in a new tab) says "Every Healthcare Plan includes a Business Associate Agreement (BAA)" (checked October 2026). That tells you to confirm which plan you're on, not just which vendor.
Ask every vendor:
- Will you sign a BAA, and on which plan? Get the BAA before any patient call is recorded.
- Can recording and transcription be turned off, per number or entirely?
- Where are recordings stored, for how long, and who can access them? Look for role-based access and an audit log.
- What do you send to ad platforms? The answer should be "a conversion happened, with a value," never a transcript, keywords from the call, or the caller's number.
- Does AI call scoring analyze content? If so, that analysis is processing PHI and must be covered by the BAA.
- How do we export and delete data if we leave?
Our guide to vendors that need a BAA covers the wider list.
Your Google listing and tracking numbers
Google's guidelines for representing your business (opens in a new tab), checked in October 2026, don't mention tracking numbers specifically. They do require a phone number that "connects to your individual business location," that is "under the direct control of the business," and they ban numbers that redirect people to landing pages. Business Profile also lets you add up to two more phone numbers (opens in a new tab) besides your primary one.
If you put a tracking number on your listing, make sure it rings your location and you control it, and keep your main number listed as an additional number. Your website and directory listings should keep showing the main number so your contact details stay consistent across the web.
Tracking calls without a vendor: click-to-call and listing calls
Many small practices don't need a vendor. Three free signals cover most new-patient calls:
- Click-to-call taps on your website. Make your number a tap-to-call link and count taps by the source of the visit. This catches most mobile calls from the site without recording anything.
- Calls from your Google listing. Business Profile's performance report counts calls from your Google listing, defined in Google's help as taps on the call button (opens in a new tab).
- The intake question. "How did you hear about us?" recorded at booking and reported monthly as counts by answer. It catches referrals, signs and calls from memory.
Medfy's first-party website analytics counts calls (taps on your number), forms, bookings and directions by source, and its Google reporting includes Business Profile calls. Medfy does this without recording calls; marketing reports use aggregate numbers, and ad platforms never receive patient data. Read how Medfy handles patient data.
Connecting calls to Google Ads and your reports
If you run Google Ads, the platform can count calls itself. Its help page on call conversion tracking (opens in a new tab) lists calls from ads with call or location assets, calls from website visits (a number shown on your site, or clicks on it), and calls imported from another system.
Two cautions for practices:
- Count by duration, not content. Google says calls from ads can be scored by AI analysis of recordings or by a minimum call duration you set. Duration keeps the content of patient calls out of the ad platform.
- Send counts, not callers. If you import calls from a call tracking vendor, send that a qualified call happened and when, nothing about who called or why.
For setup detail, see call tracking in Google Ads. In your monthly report, show calls by source alongside forms and bookings, and judge channels on completed new patients.
To find out what's on your site today, including any third-party scripts on patient forms, start with a free marketing audit.
Frequently asked questions
Is call tracking HIPAA compliant?
Call tracking is not compliant or non-compliant by itself; it depends on what the vendor handles and the contract you sign. If the service records, transcribes or stores call details that relate to a patient's care, it handles protected health information, and the vendor needs a Business Associate Agreement. Choose a plan that includes one, limit recording, and keep call content out of ad platforms.
Will a tracking number hurt my Google listing?
It can if it creates mismatched information. Google's current guidelines require a phone number that connects to your location and is under your direct control, and Business Profile lets you add up to two more numbers besides the primary one. If you use a tracking number there, keep your main number listed as an additional number and on your website and directories.
Do I need a BAA with my call tracking company?
Yes, if it creates, receives, maintains or transmits protected health information for you, such as call recordings, transcripts or caller details tied to appointments. HHS treats such vendors as business associates. A service that only counts calls by source, without recording content or storing caller identities, may not need one, but confirm with the vendor and your privacy advisor.
Can I track calls without call tracking software?
Yes. Count taps on the phone number on your website by the source of the visit, read the calls figure in your Google Business Profile performance report, and ask every new caller how they heard about you, recording the answer as a monthly count. Together these cover most new-patient calls for a small practice without recording a single conversation.