A HIPAA-bound dental office can't self-serve a call-tracking BAA — every one runs through sales

Corrected 2026-09-08 — twice, and the second correction is about vendors rather than a number. Still true, and still the point of this guide: CallRail’s entry Lead Tracking plan does not include a BAA. HIPAA at CallRail requires a separate “Healthcare” account set up through sales (per CallRail’s own help center), and its price is not posted on the public pricing grid. Fixed earlier today: that entry plan is $55/mo month-to-month, not the $50 this guide kept quoting — $50 is CallRail’s annual-billed rate, and its pricing page opens with the billing toggle on Yearly, which is how the two got swapped. Read in a browser, the same grid gives the overage rates plainly: $0.06/local-min and $0.08/toll-free-min at the plan’s 250-minute allotment (the guide previously said $0.05 local). We have also dropped a third-party pricing roundup that has since gone offline, and with it the CallRail Healthcare price estimate it was the only source for. Fixed now: WhatConverts publishes HIPAA, from its Pro tier at $100/mo, so it no longer belongs in this guide’s list of vendors that say nothing — and at $100 it displaces CallTrackingMetrics as the cheapest tier that lists HIPAA at all. Neither of them publishes a BAA. Convirza’s Caller Privacy page does carry a BAA sentence, which this guide’s blanket “leaves both fields unpublished” glossed over — but clause 15 of Convirza’s own contract disclaims HIPAA outright, so it is still not a compliant path, and the section below sets out exactly why. CTM’s 3,000 transcribed minutes are corrected too: they are per sub-account and do not renew each month. Invoca is unchanged. Fixed today: CallRail’s published entry schedule carries two lines this guide had dropped — form submissions at $0.02 each and analysis minutes at $0.05/min — and its extra-number charges are printed as “$3 ea.” and “$5 ea.” with no billing period attached, so this guide no longer implies a monthly one. We also re-checked the two vendors whose records were rebuilt today, WildJar and Mediahawk: both still publish nothing on HIPAA or a BAA, so the shortlist below is unaffected.

A dental practice that needs call tracking is not a hard shopping problem — two constraints do almost all the filtering. The office handles personal health information on the phone, so it needs a vendor that will sign a Business Associate Agreement; and it runs modest call volume, so it does not need an enterprise platform. The catch, easy to miss, is that the BAA is not something you can buy off a self-serve pricing page. CallRail’s cheapest plan, Lead Tracking at $55/mo month-to-month ($50 billed annually), does not include a BAA — HIPAA at CallRail is a separate “Healthcare” account you request from sales, and CallRail’s public pricing grid doesn’t post its price. So the real shape of this decision is the opposite of cheap-and-easy: every path to a signed BAA runs through a sales conversation, and the floor sits well above the $55 sticker that catches your eye first.

That correction is the recommendation. The rest is what each path actually costs, and which of them stop short of a signature.

The BAA filter does the work — and it filters toward sales, not a $55 plan

Of the sixteen vendors in this dataset, a published commitment to sign a BAA exists in exactly two places, and not where you’d hope. Invoca publishes it plainly — “HIPAA Compliant” and “BAA Supported Platform” sit in its site-wide footer, available across every tier — but Invoca is quote-only enterprise pricing scaled by 6,000–18,000 phone numbers a year, aimed at contact centers, not a four-operatory dental office. CallRail will sign a BAA too, but only through a separate Healthcare account that its standard self-serve plans don’t include; you request it from sales, and CallRail posts no price for it anywhere, so there is no public figure to compare.

Two more vendors publish HIPAA without the paperwork. WhatConverts ticks a HIPAA Compliance row from its Pro tier at $100/mo upward — the cheapest published HIPAA flag in the category — but the word BAA appears nowhere on its pricing page. CallTrackingMetrics lists a HIPAA/GDPR compliance feature starting on Marketing Pro ($179/mo month-to-month, ~$149 billed annually) and likewise publishes no signed-BAA commitment. For a covered entity both are half an answer: a compliance flag you can read, and a contract you still have to negotiate.

Everyone else — Ringba, Nimbata, Infinity, WildJar, Dialics, Mediahawk, and the five remaining quote-only names (Marchex, Phonexa, CallSource, Retreaver, TrackDrive) — leaves both fields unpublished. With Convirza, covered below, that is twelve of the sixteen. In a compliance context, unpublished is not a maybe; it is a different vendor.

Convirza is the one that looks like an exception and is not. Its Caller Privacy page carries, in full: “To help you comply with privacy regulations, Convirza will provide and sign a Business Associate Agreement (BAA), extending our commitment to data protection.” Read on its own that sounds like the cheapest BAA in the market, attached to a $29 base. Three things stop it being one. The sentence is the eighth tile of a “Key Features & Benefits” product grid that names no plan, tier or account type, and Caller Privacy appears in neither of Convirza’s two published plan matrices. Clause 15 of the terms and conditions that govern the account states the opposite outright: “Convirza makes no claims or warranties regarding compliance with HIPAA,” with a merger clause at 27 voiding “any conflicting or additional terms … not set forth herein.” And there is no $29 to buy unaided in any case — every Convirza tier’s button is “Get A Demo”. Our index holds Convirza’s HIPAA and BAA fields as unstated. For a dental office, that makes it a reason to start a compliance conversation, not evidence anyone will sign.

So the BAA filter doesn’t hand a modest dental office a cheap self-serve winner. It hands it a short list of sales conversations.

The shortlist: two vendors that can sign, two that only publish a flag

Here is what a HIPAA-bound dental office is actually choosing between, cheapest knowable price first:

Vendor	What it publishes	Price	What it really means
WhatConverts	HIPAA from the Pro tier; no BAA anywhere on the page	$100/mo (no annual rate published)	cheapest published HIPAA flag — the agreement itself is still a sales conversation
CallTrackingMetrics	HIPAA/GDPR feature from Marketing Pro; no BAA	$179/mo month-to-month (~$149 billed annually)	the same halfway position, $79 dearer
CallRail	A signed BAA, through a separate Healthcare account	not posted	the $55/mo Lead Tracking self-serve tier carries no BAA
Invoca	Platform-wide BAA, all tiers	quote-only (enterprise)	scaled by 6,000–18,000 numbers/yr — overkill for a dental office

The one number a dental office will find first — and should not trust as compliant — is CallRail’s $55 Lead Tracking sticker. It’s a fine product for non-PHI call tracking: $55/mo month-to-month for 5 local numbers and 250 local minutes, and at a realistic 150 calls of four minutes (600 talk-minutes) you run 350 minutes over the bundle at $0.06/min, so about $76/mo. Billed annually the base drops to $50 — roughly 9% off — which puts the same month near $71. Toll-free minutes run $0.08/min, SMS $0.03/msg, form submissions $0.02 each and analysis minutes $0.05/min. Extra numbers are printed as “$3 ea.” local and “$5 ea.” toll-free — the page attaches no billing period to either, so they are a charge per number, and the $76 above assumes the five bundled numbers are enough and buys none. But none of that comes with a BAA, so for a dental practice it is the wrong product at any price: the compliant CallRail account is a different, sales-gated SKU that costs more.

What each option actually buys

WhatConverts Pro at $100/mo is now the cheapest plan in the set that lists HIPAA at all, which is the correction that reorders this shortlist — it undercuts CallTrackingMetrics by $79. It sits third on a $30 / $60 / $100 / $160 ladder whose every rung includes a $30 usage credit, with usage on top at $0.045/local-min, $0.065/toll-free-min and $0.03/SMS, and there is no annual rate to shop for: the page’s segmented control picks a business type, not a billing period. What it does not publish is a BAA, so a covered entity buys a readable compliance flag and still has to get the document in writing.

CallTrackingMetrics Marketing Pro at $179/mo month-to-month ($149 billed annually) is the same halfway position at a higher price, with more platform around it: 25 sub-accounts, AskAI, white-label and HubSpot integration. Its bundled 3,000 transcribed minutes are worth reading carefully — CTM’s page states they are per sub-account and do not renew each month, with transcription past them at $0.02/min, so they are a one-time transcription allowance rather than a recurring pot of call minutes. The cheaper Marketing Lite at $79/mo ($65 billed annually) does not carry the HIPAA tier, and carries no sub-accounts either, so it’s off the table for this buyer.

CallRail’s Healthcare account is the path most dental offices will be steered to, since CallRail is the category’s default brand — but it is set up by contacting CallRail directly, and its price is not posted, so you cannot comparison-shop it from the pricing page. What the page does tell you is the floor it sits above: $55/mo month-to-month for the self-serve tier. Budget for a sales call and a number well north of that.

Invoca will sign the BAA on any tier — its compliance badges are platform-wide, not gated to an upper plan — but its pricing is a quote scaled by 6,000–18,000 annual phone numbers, which is enterprise economics aimed at contact centers, not a single dental office. It’s the answer only if you’ve outgrown the question. (For a side-by-side on the non-compliance economics, see our CallRail vs WhatConverts pricing comparison.)

How to read this

For a HIPAA-bound dental practice, the honest answer is that there is no cheap self-serve shortcut. The BAA requirement, not call volume or price, still settles the shortlist — and it settles it toward a sales conversation with no posted number. If you need a vendor that publishes a commitment to sign, there are two: CallRail’s Healthcare account (request it from sales; it sits above the public $55/mo month-to-month tier and is not priced) and Invoca (platform-wide BAA, enterprise quote — only if you’ve outgrown the question). If a published HIPAA flag is as far as your risk posture requires, WhatConverts Pro at $100/mo is now the cheapest of those and CallTrackingMetrics Marketing Pro at $179/mo the next rung — but neither publishes the agreement itself. The $55 Lead Tracking plan that looks like the obvious pick is the one trap to avoid: it’s a capable call-tracking product, but it is not the HIPAA-compliant one. And treat a BAA sentence on a marketing page as an invitation to ask, not an answer — Convirza publishes one and disclaims HIPAA in the contract underneath it. Whichever you choose, get the BAA in writing before you sign; that is the document that makes the rest of it legal.