That distinction is worth real money now. URMC paid $2.85 million and Froedtert Health $2 million in cases rooted in marketing-adjacent data handling; Cerebral turned ad-stack data flows into a federal enforcement story; and Klaviyo's telehealth deplatformings proved vendors will drop healthcare customers who create risk. A call-tracking account is squarely in that category: it holds identified patient phone calls, wired to your ad platforms.

What CallRail actually offers

CallRail sells a Healthcare plan: a designated tier where CallRail signs a Business Associate Agreement and applies HIPAA-oriented controls. Credit where due — most call-tracking vendors either won't sign a BAA or bury the option. The structure:

• BAA on the Healthcare plan only. Regular plans carry no BAA. If your agency set up CallRail for you and nobody ever said "Healthcare plan," assume you don't have one — log in and check, today.
• Healthcare pricing. It's a premium tier on top of standard per-number and per-minute fees. Budget roughly a meaningful multiple of the base plan.
• HIPAA-mode restrictions. The controls that make it defensible also remove features people buy call tracking for.

The fine print, item by item

1. Recordings and transcripts are the trade-off. Call recordings are where patients state names, DOBs, symptoms, and insurance. On the Healthcare plan, recording and transcription features are restricted — disabled, limited, or locked behind tighter access — and the conversation-intelligence layer (keyword spotting, automated call scoring on audio) is correspondingly constrained. If the sales pitch that sold you CallRail was "AI analyzes every call," verify which of those features survive HIPAA mode before you sign.

2. Integrations get narrowed. Syncs that would push call data (caller IDs, recordings, call details) to systems outside the BAA — some CRMs, some ad destinations, some reporting tools — are limited on the Healthcare plan. Every integration you keep needs its own answer to "is this endpoint covered, and what fields flow?" The BAA covers CallRail; it does not follow your data into HubSpot, a Google Sheet, or a Zap.

3. The BAA doesn't cover your behavior. Exporting call logs with caller IDs to email, giving your whole front office one shared login, or piping numbers into a lookalike audience are all on you. A BAA is a permission slip for the vendor relationship, not absolution for the workflow.

4. The DNI script still runs on your site. CallRail's swap script observes visits — source, campaign, pages — to attribute calls. On a medical site, page paths are sensitive by themselves. Review where the script fires and what it collects; keep it off patient-portal and post-login pages entirely.

5. Ad-platform feedback is the perennial leak. The point of call tracking is telling Google Ads which clicks produced calls. Compliant shape: offline conversion uploads keyed to click IDs — never caller phone numbers or call content. Audit what your account actually sends; default setups have historically been chattier than that.

Quick verdict table

The five questions to ask before (or after) buying

1. Are we on the Healthcare plan, and is the BAA countersigned? (Get the PDF.)
2. Which recording/transcription/AI features are disabled in our configuration — and did we buy based on any of them?
3. Which integrations are active, and what fields does each one send where?
4. What exactly goes to Google/Meta — conversion events keyed to click IDs, or caller data?
5. Who on our team (and our agency's team) can access call audio, and is that access logged?

If any answer is a shrug, you have a project.

The alternative we built

CallRail-on-the-Healthcare-plan is a reasonable point solution. We took a different route: call tracking native to the practice platform, so the compliance isn't a plan upgrade —

• Pool-based dynamic number insertion gated by paid-click recency — tracking numbers only for visitors with a recent paid click worth attributing; everyone else sees your real number (your local SEO NAP consistency thanks you).
• Automated headless swap verification — a browser bot continuously confirms the number swap renders correctly on your live pages, so broken DNI is caught by machine, not by a month of misattributed "direct" calls.
• Call records encrypted at the field level in the database, with every access written to an append-only HIPAA audit log — the same treatment as leads and messages, because a call record is a patient record.
• One BAA across calls, forms, texting, and the website — no seams between vendors for data to fall through.

Full category comparison, including CallTrackingMetrics: HIPAA-Compliant Call Tracking Compared.

Do the marketing. Call attribution is how you find the campaigns that ring phones — you should absolutely be running it, on infrastructure that treats the calls as PHI by default. If you'd rather not manage plan tiers and integration audits, that's what we're for: the platform plus the team that runs your ads and reads the call reports weekly.

Check your site first: the free PHI leak scanner flags call-tracking and analytics scripts sending visitor data off-domain — ungated, about a minute.

Then book a demo to see compliant call attribution running on a real practice account.

Related: HIPAA-Compliant Call Tracking Compared · Cross-Location Attribution Under HIPAA · The 2026 Guide to HIPAA-Compliant Marketing

Security details: trust.pilotpractice.com