CallRail helps healthcare businesses and marketers continue to close the attribution gap by tracking inbound phone calls and form submissions from the marketing sources that drove them. CallRail also records, transcribes, and analyzes those conversations through Call Tracking and Premium Conversation IntelligenceTM. But with that tracking and analysis comes a great responsibility, especially in the healthcare industry.
From scheduling appointments to billing, referrals, and prescription refills, patients share a lot of private information with their healthcare provider. Record and transcribe a call, and that information also exists as a written transcript and as AI-generated output such as call summaries, sentiment scores, and keyword matches. Each of these is treated as protected health information (PHI).
The Health Insurance Portability and Accountability Act (HIPAA) and its expansion, the Health Information Technology for Economic and Clinical Health Act (HITECH) can protect this information. If you are a healthcare provider or a marketing agency that services one, you need to ensure the data from these calls stays secure.
What's included, and what's on by default
On a Healthcare Plan, you remain in control of whether calls are recorded and transcribed at all, and the defaults depend on your plan:
- Healthcare Plan with Call Tracking: call recording and transcripts are OFF by default and can be turned on by you at any time.
- Healthcare Plan with Premium Conversation Intelligence and Voice Assist: call recording and transcripts are ON by default and can be turned off at any time.
- When transcription is enabled on a Healthcare account, PHI and PII redaction is ON by default.
- Call recording must be enabled before transcription can run. Turning AI features off stops transcription.
HIPAA-supported functionality requires a CallRail Healthcare Plan and a signed Business Associate Agreement (BAA).
Online tracking technology and compliance in 2026
Online tracking compliance in 2026 comes down to two things: knowing where PHI lives, and controlling who can access it.
Call recordings, transcripts, call summaries, sentiment scores, and keyword matches all count as PHI, as does anything collected behind a patient login. Federal courts have narrowed what counts as PHI on public webpages, but your obligations for everything else are unchanged: don't share PHI with a third party unless you have a signed Business Associate Agreement (BAA) or the patient has authorized it.
The pressure now comes from outside the OCR. Class actions over tracking technology have produced multimillion-dollar settlements against health systems, and state laws like Washington's My Health My Data Act govern consumer health data that falls outside HIPAA entirely, with a private right of action attached. A BAA covers your HIPAA exposure, but doesn't cover those.
CallRail takes HIPAA compliance seriously. That's why we've created an end-to-end solution for healthcare providers and signed a Business Associate Agreement (BAA) with each of our covered entities. This collaborative effort ensures that covered entities, and the agencies supporting them, maintain compliance with HIPAA and HITECH regulations.
Under the HIPAA Security Rule, the 5 following ‘technical safeguards’ are called out (no pun intended).
- Access Controls - Technical policies and procedures for only authorized personnel to access Protected Health Information (PHI)
- Audit Controls - Enable the ability to track and report all access to data
- Integrity Controls - Ensure data cannot be altered or destroyed
- Authentication Controls - Implement procedures to verify that a person seeking access to ePHI is who they say they are
- Transmission Security - Guard against unauthorized access being transmitted
How CallRail keeps Protected Health Information secure
Annual attestation to confirm compliance
Third-party audit of CallRail's practices
To ensure the security and privacy of its healthcare customer data, CallRail engages a third-party audit firm to test its controls in accordance with the HIPAA Privacy and Security rules. CallRail's HIPAA attestation serves as proof that it is fulfilling its obligations and commitments.
Access controls
All data encrypted “at rest”
All call records, web visitor sessions, call recordings, transcripts, call summaries, sentiment scores, keyword spotting results, and call routing data are fully encrypted when stored on disk. This data is seamlessly decrypted as needed for reporting purposes when accessed by the customer. These precautions protect the data even if hard drives fail, or are decommissioned or stolen.
Secure access
Every user gets their own login credentials, which can be controlled by an administrator. Login sessions automatically expire after a brief period of inactivity to prevent unauthorized access.
Firewalls and private network gaps
The databases, application servers, and other machines responsible for routing calls through CallRail are isolated and inaccessible via the public internet (except the web application itself, of course). This private network is protected by a pair of redundant hardware firewalls to ensure only expected traffic is allowed.
Audit controls
Full audit history
For Healthcare plans, we log every action in the application by user, timestamp, and IP address. Playback of any call recording, viewing or export of any transcript or call summary, transcript search activity, as well as all changes to calls, tags, or configuration are similarly logged.
Integrity controls
Separate accounts for healthcare data
Healthcare accounts always remain separate from standard CallRail accounts, so PHI never mixes with data from accounts that aren't scoped for HIPAA. Moving to a Healthcare plan also requires re-authorizing your integrations, so data only flows where you've approved it.
Authentication controls
Protection for external systems
CallRail prevents transmission of call details considered Protected Health Information, like call recordings and caller ID, as well as transcripts, call summaries, and other AI-generated conversation data, to external systems that aren't considered in compliance with HIPAA requirements, and instead provides a link that requires the user to log in to review the information.
Transmission security
All data encrypted “in transit”
All access to CallRail is encrypted via SSL to protect data from interception on network points between the user and CallRail.
Premium Conversation Intelligence and PHI
Automatic PHI and PII redaction
On Healthcare accounts, redaction is enabled by default. CallRail detects sensitive information in call recordings and transcripts. Redaction covers:
- Secure information: Social Security number, credit card number, expiration date, and CVV
- Personal information: date of birth, age, religion, and political affiliation
- Medical information: conditions, diagnoses, medications, treatments, procedures, and tests
- All numeric values: any number sequence of two or more digits
Redaction is an additional safeguard layered on top of the access, audit, integrity, and transmission controls above. It is not a substitute for them, and it does not replace your own internal policies for handling PHI.
Managing HIPAA compliance
Managing HIPAA compliance can be daunting. These capabilities, paired with strong internal data practices, help you protect patient information. Your practice still gets the full value of call tracking, including insight into what callers actually say.
