Call tracking for medical practices: numbers, recordings and patient privacy

For most practices the phone is still where new patients turn into appointments. A patient sees an ad or a search result, reads a page or two, then calls. If you cannot tell which ad, page or listing led to that call, you cannot tell which marketing is worth paying for. Call tracking is how practices answer that question.

It also puts a vendor between your patients and your front desk, and many tools can record and transcribe calls. A call to a practice often includes a name, a date of birth, insurance details and the reason for the visit. This guide explains how call tracking works, where the rules come in, and what to set up before you switch it on. To hear what callers actually hear, see our guide to mystery shopping your practice. For website analytics, see our guide to Google Analytics on medical practice websites. Networks that sell calls by the call use the same routing technology; our guide to pay-per-call in healthcare covers the kickback and telemarketing rules.

How call tracking works

A call tracking system gives each marketing source its own phone number, forwards those numbers to your real line, and logs each call: which number was dialed, when, for how long, and usually the caller’s number. There are three common setups:

• Ad platform numbers. Google Ads says that when call reporting is turned on, a Google forwarding number is assigned to your ad, so it can track details such as call duration, start time, the caller’s number and whether the call connected. You can count calls of a set length as conversions.
• Website numbers. A script on your site swaps the number a visitor sees based on how they arrived, often called dynamic number insertion. Google Ads also describes tracking calls to a number on your website after an ad click.
• Static numbers. A fixed number on a mailer, a radio spot, a referral card or a billboard, so calls from that piece can be counted.

Google Ads notes that if you use a third-party call tracking system, you can turn off call reporting so your own number or your tracking number shows on ads instead of a Google forwarding number. Pick one system as the source of truth, or the same call gets counted twice.

Keep your Google Business Profile number right

Google’s guidelines for representing your business say to provide a phone number that connects to your individual business location, to use a local number rather than a central call center helpline whenever possible, and not to provide numbers that redirect or refer users to numbers other than those of the actual business. The number must be under the direct control of the business. The guidelines also say additional phone numbers can be used on Google Business Profile websites and other local surfaces.

In practice that means the main number on each location’s profile should be a number your practice controls and answers, not a number owned by a marketing vendor that could disappear when the contract ends. Keep the same main number on your website’s contact page and in your listings, so patients and search engines see one consistent number per location. Our guide to Google Business Profile for doctors covers the rest of the profile. When a patient asks a voice assistant to call the practice, it dials the listing number, as our guide to voice search for medical practices explains.

Recording calls: federal law and state law

The federal wiretap law, 18 U.S.C. 2511, makes it unlawful to intentionally intercept a wire, oral or electronic communication unless an exception applies. Section 2511(2)(d) says it is not unlawful for a person not acting under color of law to intercept a communication where that person is a party to it, or where one of the parties has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act.

That is the federal rule, and it is the floor, not the whole answer. State laws on recording calls also apply, and they are not all the same: some ask for the consent of everyone on the call. Patients may call you from another state. The simplest way to avoid the question is a short message at the start of every recorded call saying the call may be recorded, and a way for the caller to reach a person without recording if they object. Ask your attorney whether that is enough for the states your patients call from.

Then decide whether you need recordings at all. Call logs with source, time and duration answer most marketing questions. Recordings and transcripts are useful for training and quality review, but they are also a store of patient information that someone has to protect, limit access to and eventually dispose of.

What HIPAA asks about call tracking vendors

Under 45 CFR 160.103, protected health information is individually identifiable health information, which includes information that relates to a person’s health, care or payment for care and identifies them or could reasonably be used to identify them. A phone call in which a caller gives their name and asks about a knee replacement or a crown fits that description.

The same section defines a business associate as a person who, on behalf of a covered entity and other than as a workforce member, creates, receives, maintains or transmits protected health information for a regulated function or activity. Under 45 CFR 164.502(e), a covered entity may let a business associate handle protected health information on its behalf only if it obtains satisfactory assurance that the business associate will appropriately safeguard it, which is what a business associate agreement documents.

A call tracking vendor that only counts calls is a different case from one that records, transcribes or analyzes them. Ask each vendor, in writing:

• What it stores for each call: numbers, timing, recordings, transcripts, keyword or AI summaries.
• Whether it will sign a business associate agreement, and which features are covered by it.
• Who at the vendor can access recordings and transcripts, and where they are stored.
• How long data is kept by default, whether you can shorten it, and how it is deleted.
• Whether any call data, including transcripts or conversion details, is sent to ad platforms or used to train models.

The decision about whether a particular setup is acceptable belongs to your practice and its counsel. We do not describe any call tracking tool as HIPAA compliant, because compliance depends on how the practice configures and uses it. Under 45 CFR 164.502(b), covered entities must make reasonable efforts to limit protected health information to the minimum necessary for the purpose, which is a good reason to turn off recording and transcription features you do not need. Our guide to HIPAA marketing rules explains the wider framework.

Call tracking on your website and the OCR tracking bulletin

Dynamic number insertion runs a script on your web pages, so it raises the same questions as any tracking technology on a practice site. The HHS Office for Civil Rights bulletin on online tracking technologies explains how HIPAA applies when information collected through tracking includes protected health information. HHS notes at the top of the bulletin that on June 20, 2024 the U.S. District Court for the Northern District of Texas, in American Hospital Association v. Becerra, vacated the guidance to the extent it says HIPAA obligations are triggered when an online technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. The rest of the bulletin remains.

For call tracking that means: keep number-swapping scripts off patient portal, intake and booking pages, check what the script sends back to the vendor, and do not pass call details that reveal a condition to ad platforms as conversion data. Count that a call happened and how long it lasted, not what it was about. Our guide to tracking pixels on practice websites covers the bulletin and the court ruling in detail, and our guide to practice website privacy policies covers how to describe call tracking to patients.

Calling or texting patients back

Call tracking logs the caller’s number, which makes it tempting to call or text back everyone who hung up. Outbound calls and texts have their own rules. The Telephone Consumer Protection Act, 47 U.S.C. 227(b)(1)(A), restricts calls made using an automatic telephone dialing system or an artificial or prerecorded voice to cell phones and certain other lines without the called party’s prior express consent, other than for emergency purposes. A staff member calling back a missed call by hand is different from an automated text campaign to every number in the log. Our guide to text message appointment reminders covers consent for texts.

A setup checklist for practices

1. Decide what you need to measure. Usually: calls by source, by location and by time of day, and how many were answered. That rarely requires recording.
2. Pick one system. Either the ad platform’s call reporting or a third-party tool for each channel, so calls are not counted twice.
3. Protect your main number. The number on each Google Business Profile and on your contact page is one the practice owns and answers.
4. Settle recording before launch. Decide whether to record, add a recording notice, set retention and limit who can listen, with your attorney’s advice on state law.
5. Review the vendor. Ask the written questions above, and get a business associate agreement in place before any feature that stores call content is turned on, if counsel says one is needed.
6. Keep scripts off sensitive pages. No number swapping on portal, intake or booking pages, and no condition details sent as conversions.
7. Use the data to answer the phone better. Missed calls by hour show when you need more coverage. Staff, an answering service or an AI front desk can cover those hours; see our guides to a new patient phone script and answering services versus AI receptionists.

When we run Google Ads for practices, call measurement is set up with these points in mind: call counts and duration as conversions, and no call content sent to the ad platform.

For the greeting wording, what to do when a caller declines, and how long to keep recordings, see our call recording consent guide.

Sources

• 18 U.S.C. 2511: Interception and disclosure of wire, oral, or electronic communications prohibited
• 45 CFR 160.103: Definitions (business associate, protected health information)
• 45 CFR 164.502: Uses and disclosures of protected health information (minimum necessary, business associates)
• HHS: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024)
• 47 U.S.C. 227: Restrictions on use of telephone equipment (TCPA)
• Google: Guidelines for representing your business on Google
• Google Ads Help: About call reporting
• Google Ads Help: About phone call conversion tracking

More in Phones, front desk and patient messages