What is HIPAA-compliant call tracking?

Call tracking assigns different phone numbers to different sources, such as a Google ad, a Google Business Profile or a website visitor session, through dynamic number insertion. When someone calls, the system records the source, time, duration and caller ID, and often records and transcribes the call. Many tools also score calls, for example as new-patient booking or not.

For a practice, that data quickly becomes PHI: a caller's phone number linked to a request for a specific treatment, or a recording where someone describes symptoms. HIPAA therefore applies. A compliant setup includes a signed BAA with the call tracking vendor, role-based access, secure storage, audit logs, retention limits, and rules for what is shared with other tools.

Separately, call recording laws apply. Federal law and many states allow recording with one party's consent, but several states, including California, Florida and Pennsylvania, require consent from all parties. A recorded greeting announcing recording is the common approach.

A BAA is necessary but not enough. Practices still need to configure the tool so that only needed data is stored and only the right people can access it. A common mistake is enabling AI transcription and keyword alerts that forward health details to email or chat apps without safeguards. Another is assuming the vendor's "HIPAA compliant" label covers every feature; some features may sit outside the BAA.

State laws on recording and on consumer health data can be stricter than HIPAA. Review recording notices, retention periods and integrations with your compliance or legal team. Revisit the setup whenever you add a location in a new state, switch phone systems or connect a new reporting tool, since each change can open a new path for patient data.