HIPAA Call Tracking: A Practical Checklist for Clinics and Treatment Centers

HIPAA call tracking isn't a product feature you switch on; it's a set of decisions about vendors, recordings, access and what data leaves your systems. Healthcare marketers want what every marketer wants: to know which campaigns bring in new patients. But calls to a clinic, hospital or treatment center often include health information, and that changes how call tracking needs to be set up.

This checklist covers the questions to work through. It isn't legal advice. HIPAA obligations depend on your organization and how you use each tool, so involve your privacy officer or counsel. We link to the U.S. Department of Health and Human Services (HHS) where it helps.

HIPAA call tracking: a quick framing

HIPAA applies to covered entities (such as most healthcare providers that bill electronically) and their business associates. Protected health information (PHI) is individually identifiable health information held or transmitted by those organizations. A phone call where someone gives their name and describes their symptoms or the treatment they're seeking will usually contain PHI. A recording or transcript of that call does too.

HHS has published guidance on online tracking technologies used by regulated entities, including when vendors become business associates. Part of that guidance was vacated by a federal court in June 2024, and HHS notes this at the top of the page, so read it with that context: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

1. Vendor and agreement

• Will the call tracking vendor create, receive, maintain or transmit PHI on your behalf? If it records calls, stores caller details or produces transcripts, the answer is usually yes.
• Will the vendor sign a business associate agreement (BAA)? HHS describes what a BAA must include on its Business Associate Contracts page. Don't route PHI through a vendor before the agreement is in place.
• Which features are covered? Ask whether recordings, transcription, AI analysis, texting and chat are all within the scope of the agreement and the vendor's safeguards.

2. Recording and transcription

• Do you need to record every line? Recording only the numbers used for marketing intake, and not clinical or nurse lines, reduces exposure.
• Are callers told about recording? State laws on call recording consent vary, and some require all parties to agree. A short notice at the start of calls is common practice.
• Is recording storage encrypted, and for how long is it kept? Set a retention period that meets your record-keeping needs without keeping recordings forever.
• Is redaction available? Automatic redaction of card numbers, Social Security numbers and similar fields in transcripts limits what's stored in readable text.

3. Access inside the platform

• Who can play recordings and read transcripts? Use role-based permissions. Marketing staff and agencies often need sources and outcomes, not conversation content.
• Is two-factor authentication required? Turn it on for everyone, and use single sign-on if your organization supports it.
• Are logins individual? Shared accounts make it impossible to know who accessed what.
• What happens when staff leave? Include the call tracking platform in your offboarding checklist.

4. Notifications and integrations

• What do email and text alerts include? A "new call" alert that includes the caller's name and a transcript snippet puts PHI in inboxes and on phones. Limit alerts to what staff need, such as a link that requires login.
• Which systems receive call data? Map every integration: CRM, EHR, Slack, spreadsheets, analytics. Each one that receives PHI needs to be appropriate for it.
• Are webhooks and API exports reviewed? Custom integrations are easy to set up and easy to forget.

5. Conversions sent to ad platforms

This is where healthcare call tracking gets most of its scrutiny. Sending call outcomes back to Google Ads, Microsoft Ads or Meta is useful for bidding, but you need to be careful about what's sent.

• Send outcomes, not health details. A conversion that says "qualified inquiry" tied to an ad click ID is very different from one that includes the caller's name, phone number or the condition they called about.
• Avoid condition-specific conversion names. Name conversion actions generically ("New patient inquiry") rather than by diagnosis or treatment.
• Don't send caller contact details for audience matching unless your counsel has reviewed it and the appropriate permissions are in place.
• Document the decision. Write down what's sent, why, and who approved it.

6. Your website

Number-swapping scripts run on your website, so they sit alongside analytics and advertising tags.

• Which pages carry the call tracking script? Public marketing pages are typical. Patient portals, logged-in areas and appointment forms deserve extra care.
• What does the script collect? Referrer, landing page and UTM tags are standard. Make sure form contents aren't captured on pages where people enter health information unless that's covered.
• How does it interact with your consent banner? Decide how the script should be categorized and test the behavior.

7. AI features

• Where is AI processing done, and is it covered by your agreement? Ask how transcripts are processed for summaries and AI questions.
• What questions do you ask? "Was this a new patient inquiry?" and "Was an appointment scheduled?" are useful for marketing. Questions that extract diagnoses for marketing use are a different matter.
• Who sees AI outputs? Apply the same permissions to summaries as to recordings.

8. Behavioral health and substance use treatment

Programs covered by federal rules on substance use disorder records have additional confidentiality requirements beyond HIPAA. Advertising in this sector is also closely reviewed by ad platforms. If this applies to you, review your call tracking setup with counsel who knows these rules, and keep marketing access to conversation content to a minimum.

9. Write it down and review it

• Add call tracking to your HIPAA risk analysis.
• Keep a short document describing numbers, recordings, access roles, integrations and conversions.
• Review it at least once a year and whenever you add a feature or integration.

10. Train the people who use it

Most privacy problems with call tracking come from everyday habits rather than the software itself: forwarding a recording to a personal email, pasting a transcript into a chat tool, or sharing a login with an agency. A short training session when the system goes live, plus a one-page summary of what's allowed, prevents most of them. Include agency partners and contractors who have access.

Where RingIris fits

RingIris supports the controls on this list: per-number recording settings, recording notices, redaction options, role-based permissions, two-factor login, single sign-on, limited notifications and conversion rules that pass outcomes rather than health details. Ask about a business associate agreement during your demo, and see our healthcare and behavioral health pages for how teams typically set things up.

Related reading

• RingIris for healthcare
• RingIris for behavioral health
• Security at RingIris

Frequently asked questions