Guide · Call Tracking
Only two call-tracking vendors in our catalog confirm both HIPAA support and a signed BAA
Most call-tracking platforms say nothing about HIPAA at all. Four say something — and two of those four publish the compliance flag without the paperwork that makes it legal, and both of those only as a tier-gated upgrade. Neither vendor that does confirm a BAA posts a price for the account it rides on.
If you run a healthcare practice, the compliance filter eliminates most of this market before price is even worth discussing. Of the 16 call-tracking vendors in our catalog, 12 publish nothing at all about HIPAA — not a flag, not a BAA mention, nothing. Only four say anything, and the distinctions between those four are the entire story. Two — CallRail and Invoca — confirm both HIPAA support and an available signed Business Associate Agreement. The other two, WhatConverts and CallTrackingMetrics, state HIPAA compliance but publish no BAA specifics at all; WhatConverts ticks HIPAA from its Pro tier at $100/mo, CallTrackingMetrics from Marketing Pro at $179/mo month-to-month.
That is the answer in one paragraph. The rest is why those four are not interchangeable — and why even the two that confirm a BAA will not tell you what it costs.
The two that confirm both HIPAA and a BAA
A HIPAA “flag” without a Business Associate Agreement is close to useless to a covered entity. Under the rule, the vendor handling call recordings and transcripts of patient calls is a business associate; without the signed BAA, you’re the one exposed. So the column that matters isn’t “HIPAA: yes” — it’s “BAA: available.”
| Vendor | HIPAA | BAA | Entry into compliance | Source posture |
|---|---|---|---|---|
| CallRail | Yes | Yes | Healthcare account — price not posted; the self-serve Lead Tracking tier is $55/mo month-to-month ($50 billed annually) and does not carry it | Published pricing, unpriced compliance account |
| Invoca | Yes | Yes | Quote-only | Sales-gated |
| WhatConverts | Yes | Not published | Pro, $100/mo (no annual rate published) | Published pricing |
| CallTrackingMetrics | Yes | Not published | Marketing Pro, $179/mo month-to-month ($149 billed annually) | Published pricing |
CallRail is the only vendor in the catalog that pairs a confirmed HIPAA-plus-BAA posture with a published price list at all — but the plan whose price you can see is not the compliant one. Its Lead Tracking plan is $55/mo month-to-month — $50/mo billed annually, which is the figure the pricing page shows first, because CallRail opens it with the billing toggle already set to Yearly — and it bundles 5 local tracking numbers and 250 local minutes. Metered usage sits on top at $0.06/min local and $0.08/min toll-free at that entry allotment, with form submissions at $0.02 each and analysis minutes at $0.05/min alongside them. Extra numbers are printed as “$3 ea.” local and “$5 ea.” toll-free, with no billing period attached, so they are a charge per number rather than a monthly line. The per-minute rates are set by the allotment rather than platform-wide: CallRail’s own plan table steps the local rate down to $0.045/min once the bundle reaches 4,000 minutes. For non-PHI call tracking that is still the cleanest path on price — a known base, no tier ladder to climb — but the BAA comes through a separate, sales-gated Healthcare account, and CallRail posts no price for it. So $55/mo is the platform price, not a compliance price.
Invoca also confirms both — its pricing page states HIPAA compliance alongside SOC 2 Type 2, PCI DSS, and BAA support. The catch is economic, not legal: Invoca publishes no monthly figure. Its tiers (Pro / Enterprise / Elite) are scaled by annual phone-number volume in the 6,000–18,000 range and route to a sales form. This is enterprise infrastructure — appropriate for a hospital network or a multi-location group, materially oversized for a single practice.
The practical consequence of those two rows is worth stating plainly: this category has no published price for a signed BAA. Both vendors that commit to one route you to sales before quoting anything.
The two that publish HIPAA without the paperwork
WhatConverts is the cheapest published HIPAA posture in the catalog, and it is easy to over-read. HIPAA is on the Pro card and the comparison table ticks a HIPAA Compliance row from Pro upward — that is $100/mo, the third rung of a $30 / $60 / $100 / $160 ladder, each rung including a $30 usage credit. There is no annual rate to quote: the page’s segmented control picks a business type, not a billing period, and every figure on it is labelled “/mo”. What the page does not contain, anywhere, is a BAA. So a covered entity gets a published HIPAA flag at $100/mo and still has to negotiate the document that makes the arrangement lawful.
CallTrackingMetrics is where healthcare buyers more often get caught, because its compliance sits behind a tier jump. It does state HIPAA compliance — but only from Marketing Pro at $179/mo month-to-month ($149 billed annually), not on the Marketing Lite tier at $79/mo ($65 billed annually) that a cost-conscious buyer would naturally start with. And our dataset records its BAA status as not published: the HIPAA claim is there, the paperwork commitment isn’t spelled out the way CallRail’s and Invoca’s are.
Marketing Pro is a capable plan on its own terms — it adds AskAI, white-label and HubSpot integration, and 25 sub-accounts, with 3,000 transcribed minutes per sub-account and $0.02/min beyond them. Read that bundle carefully: CTM’s page states those minutes do not renew each month, so they are a one-time transcription allowance rather than a recurring pot of call minutes. But for compliance purposes, the relevant fact is that CTM’s HIPAA posture is tier-gated and BAA-ambiguous. If you go this route, the signed BAA is a question to settle in writing with their sales team before you send a single patient call through it — not an assumption you can make from the pricing page.
What the silence means
The twelve vendors that publish nothing — Ringba, Nimbata, Infinity, Convirza, WildJar, Dialics, Mediahawk, and the quote-only set of Marchex, Phonexa, CallSource, Retreaver and TrackDrive — are not necessarily non-compliant. In our data, null means not published, not confirmed absent.
Convirza deserves a paragraph of its own, because it is the one vendor in that group whose public site says something and then unsays it. Its Caller Privacy page carries, in full: “To help you comply with privacy regulations, Convirza will provide and sign a Business Associate Agreement (BAA), extending our commitment to data protection.” That sentence is real. It is also the eighth tile of a “Key Features & Benefits” product grid that names no plan, tier or account type, and Caller Privacy appears in neither of Convirza’s two published plan matrices; its pricing page mentions HIPAA only as a nav link and BAA not at all. Pulling the other way, clause 15 of the terms and conditions that govern the account states “Convirza makes no claims or warranties regarding compliance with HIPAA,” and clause 27 voids “any conflicting or additional terms … not set forth herein.” A vendor that publishes a BAA sentence on a marketing page and disclaims HIPAA in its contract has established neither, which is why both fields stay null in our index. Treat it as a reason to start the compliance conversation with Convirza, not evidence it will contract one.
A healthcare buyer cannot run a practice on a maybe. If a vendor won’t put HIPAA and BAA support in writing in the agreement you actually sign, the burden is entirely on you to extract that commitment — and for most of these vendors, billed at attractive rates like Convirza’s $29/mo Starter or Nimbata’s $39/mo Pro ($35/mo billed annually), the saving evaporates the moment legal has to negotiate a one-off agreement. Convirza’s $29 is not even a checkout: every one of its tiers sells through “Get A Demo”, so you are in a sales conversation from the first click regardless. WildJar used to sit in that sentence at $39 and no longer belongs in it: the live page prices its US Starter at $150/mo — a bundle of 4 tracking numbers, 500 minutes and AI transcription rather than a meter — and its Growth/Agency plan at $89/mo plus usage, with no annual rate published for either. The $39 came from a pricing page WildJar no longer links to. None of that moves its compliance posture, which is still silence on both fields.
How to read this
For a single healthcare practice that wants a documented BAA, CallRail is still the default answer — it is the only vendor combining confirmed HIPAA, confirmed BAA and published pricing — but budget for a sales conversation and an unposted number, because the BAA rides on its separate Healthcare account rather than the $55/mo month-to-month ($50/mo billed annually) tier you can buy with a card. Invoca is the same compliance posture at enterprise scale and enterprise (quote-only) economics. If a published HIPAA flag without a BAA is enough for your risk posture, WhatConverts Pro at $100/mo is the cheapest of those, with CallTrackingMetrics Marketing Pro at $179/mo month-to-month the next rung — in both cases the agreement itself is still something you have to pin down in writing. Everything else in the category is a compliance unknown — which, for protected health information, is the same as a no until proven otherwise.