Guide · Call Tracking
The cheapest call tracking with a signed BAA is Convirza at $29 — the '$50 compliance floor' was a mirage
Convirza publishes a signed-BAA commitment on its $29 entry plan, and WhatConverts states HIPAA support at $30. The CallRail $50 plan this category is built around does not include a BAA at all — that's a separate, sales-gated Healthcare account. The compliant floor is lower, and messier, than the sticker suggests.
Re-verified 2026-06-23 — and this guide had it backwards. The earlier version said the compliance filter wiped out everything under $50 and left CallRail’s $50 plan as the floor. That was wrong on both ends. Convirza ($29) publishes a signed-BAA commitment — “Convirza will provide and sign a Business Associate Agreement (BAA),” no tier restriction — so it, not CallRail, is the cheapest plan backed by a published BAA. WhatConverts ($30) publishes HIPAA support (“complies with all HIPAA standards for HIPAA enabled customer accounts”), though not a BAA. And CallRail’s BAA isn’t on its $50 self-serve tier at all — it’s a separate, sales-gated Healthcare account. The “$50 floor” was an artifact of mis-flagged compliance data, not the market.
Ask for the cheapest call tracking plan and the answer is Convirza Starter at $29/mo or WhatConverts Call Tracking at $30/mo. Add the filter that matters to a covered entity — will this vendor sign a Business Associate Agreement? — and the surprising answer is that you do not have to leave the cheap end to get one. Convirza states plainly that it “will provide and sign a Business Associate Agreement,” with no tier restriction, which makes its $29 Starter the lowest-cost plan in this category backed by a published BAA commitment. The plan everyone reaches for first — CallRail’s $50 Lead Tracking — is actually not the compliant one: CallRail’s BAA lives in a separate, sales-gated Healthcare account, not the self-serve tier you’d buy off the pricing page.
What each vendor actually publishes about compliance
| Vendor | Entry plan | Base/mo | HIPAA published? | Signed BAA? |
|---|---|---|---|---|
| Convirza | Starter | $29 | yes (via its BAA) | yes — published, no tier-gate |
| WhatConverts | Call Tracking | $30 | yes | not published |
| Nimbata | Pro | $39 | not published | — |
| WildJar | Starter | $39 | not published | — |
| CallRail | Lead Tracking | $55 ($50 annual) | yes — but on a separate Healthcare account, not this tier | yes — sales-gated Healthcare account, not the $50 plan |
| CallTrackingMetrics | Marketing Lite | $79 | only from Marketing Pro ($179) | not published |
| Invoca | — | quote-only | yes | yes (platform-wide) |
Two corrections to how this category is usually read. First, “not published” is not the same as “absent,” but it is still a disqualifier for a covered entity — Nimbata and WildJar say nothing about HIPAA, so you can’t contract on it. Second, and the bigger one: the two cheapest plans on the board, Convirza and WhatConverts, do publish compliance — Convirza a full signed-BAA commitment, WhatConverts a HIPAA-compliance statement. The old “compliance starts at $50” story was simply wrong.
Convirza is the floor — and it publishes the BAA
Convirza’s Starter at $29/mo is the cheapest call-tracking plan whose vendor publicly commits to signing a BAA. Its Caller-Privacy page states it directly: “To help you comply with privacy regulations, Convirza will provide and sign a Business Associate Agreement (BAA).” There is no language tying that commitment to an Enterprise tier, so a covered entity can pair it with the $29 base (call recording metered at $0.08/min, conversation-analytics add-ons from $0.02/min). Like every BAA in this category, you arrange it through sales rather than clicking a checkbox — but it is a published commitment attached to the cheapest plan, which is exactly what the old version of this guide said did not exist.
CallRail’s BAA is real — just not on the $50 plan
CallRail is the brand most healthcare buyers are steered toward, and it will sign a BAA. The catch, confirmed in CallRail’s own support documentation, is that HIPAA at CallRail requires a separate Healthcare account — not the standard, self-serve Lead Tracking ($55/mo, or $50 billed annually) tier you’d buy off the pricing page. CallRail doesn’t post the Healthcare account’s price, and its live pricing grid is JavaScript-rendered and no longer machine-readable, so the metered per-minute rate beyond the 250-minute bundle isn’t published openly either (third-party trackers put it near $0.05–$0.06/min). So CallRail’s compliant price is unpublished and sits above its $50 sticker — the opposite of a $50 floor.
WhatConverts: HIPAA stated, BAA not
WhatConverts ($30) lands in between. Its security page states it “complies with all HIPAA standards for HIPAA enabled customer accounts” — a real, published HIPAA posture, which is more than Nimbata or WildJar offer. But it stops short of a signed-BAA commitment; nothing on its security, pricing, or privacy pages mentions a BAA. So for a covered entity that needs a contractual BAA, WhatConverts’ published posture gets you HIPAA awareness but not the document — a sales conversation at best.
CallTrackingMetrics buries compliance in the mid-tier
CallTrackingMetrics is the clearest “headline price ≠ compliant price” case. Its entry plan, Marketing Lite at $79/mo, carries no HIPAA. The HIPAA/GDPR feature appears only from Marketing Pro at $179/mo and up — and even there, CTM publishes the compliance feature, not a signed-BAA commitment. So CTM’s effective compliance entry isn’t its $79 sticker; it’s $179 (with 3,000 transcribed minutes included, $0.02/min overage), and the BAA itself is still a sales conversation.
The quote-only confirmation
Invoca confirms HIPAA with SOC 2 Type 2, PCI DSS, and BAA support, published platform-wide rather than gated to a tier — but it publishes no plans at all; pricing is sales-gated and scaled by annual phone-number volume into the thousands. It belongs in the compliance conversation but not the cheapest-plan one, because there’s no published figure to compare.
How to read this
If you need a signed BAA, the cheapest call-tracking plan that publishes one is Convirza Starter at $29/mo — not CallRail’s $50, whose BAA lives in a separate, unpriced Healthcare account. If HIPAA support without a contractual BAA is enough, WhatConverts at $30 states it too. CallTrackingMetrics’ compliant entry is $179 (Marketing Pro), not the $79 its page leads with, and Invoca confirms a BAA but won’t quote a number. The real lesson is the one this guide previously got wrong: the compliance filter does not wipe out the cheap end of the market — two of the three cheapest plans publish compliance, and the “$50 floor” was a data artifact, not a price. As always, confirm the BAA in writing with any vendor before you route PHI through a tracking number. (For the same trap in a single-practice setting, see call tracking for a HIPAA dental office.)