CallRail
Call tracking
Number swapping and form tracking by JavaScript snippet. The BAA comes with a Healthcare plan, which is a separate account.
Call tracking
CallTrackingMetrics and your treatment center website
Tracking code, FormReactor forms and webhooks. HIPAA workflows need a BAA, an eligible plan and specific settings.
- Read against the vendor's own pages
- BAA on specific plans
- Checked October 15, 2026
What it is
Call tracking and contact center software with number swapping, website form capture (FormReactor), webhooks and an API.
How it connects to a website
- Embed
CTM's tracking code goes on the site directly or through Google Tag Manager as a Custom HTML tag, and swaps numbers on the pages you choose.
- Form posting
FormReactor captures website form submissions. CTM says it integrates with three third-party form tools: Contact Form 7, Gravity Forms and Unbounce.
- Webhook
CTM webhooks post activity data to a URL you set, on eligible plans. Sunwave Health documents a CTM integration built this way.
What KhanWork does with it
- Install the CTM tracking code, usually through Google Tag Manager, so numbers swap on the pages that should show them.
- Connect the website form through FormReactor where your form tool is one CTM supports.
- Route calls into your EHR's CRM where that EHR documents a CTM integration.
- Set notifications so they carry no PHI.
Setup, as the vendor documents it
- Before any workflow that may involve PHI, work through the HIPAA Readiness panel (Trust Center, Privacy Compliance, HIPAA Readiness): eligible plan, BAA status and required security settings.
- Install the tracking code: in Google Tag Manager, add a Custom HTML tag with your account's tracking code and fire it on all pages, or only the pages where numbers should swap.
- Use only tracking numbers eligible for HIPAA. CTM marks ineligible numbers with an asterisk on the Buy Numbers and Tracking Numbers pages.
- Set up FormReactor under Flows, Forms for website form capture.
Source: CallTrackingMetrics help center. Menus and labels change; follow what you see in your account.
What to watch out for
Where patient details can slip out with CallTrackingMetrics, and what the vendor's own documents say to switch on, switch off or ask for.
Required security settings
CTM's HIPAA article requires auto logout after no more than 15 minutes, two-factor authentication, a login before call recordings play, and encrypted recording and storage where calls are recorded.
Data that leaves CTM is yours to protect
CTM says not to put PHI in text messages and to strip recordings, transcripts, names, numbers and notes from post-call notifications and call log exports.
Third-party integrations are on you
Connections to Salesforce, HubSpot, Facebook and the like are your organization's responsibility to configure in a HIPAA-compliant way, per CTM.
Online Fax is out
CTM says Online Fax cannot currently be used for workflows that require HIPAA compliance.
Redact on a schedule
CTM's Activity Data Redaction removes personal information from call, chat, text and form records daily or every 30, 60 or 90 days. Decide the schedule with your compliance lead.
Frequently asked questions
Yes, for accounts on HIPAA-eligible plans. CTM's HIPAA article is written for customers with a BAA in place, and the HIPAA Readiness panel lets you start a standard agreement.
CTM's HIPAA article lists Marketing Pro, Sales Engage, Enterprise, Advanced, Growth and Connect.
Where the EHR documents it. Sunwave Health, for example, documents a CTM integration that opens each call as a new Opportunity. For others, check the EHR's documentation first.
Sources
- CTM help center, Architecting for HIPAA Compliance (opens in a new tab) (checked )
- CTM, Plans FAQ (opens in a new tab) (checked )
- CTM help center, Installing the Tracking Code with Google Tag Manager (opens in a new tab) (checked )
- CTM help center, Click-to-Call Form (FormReactors) (opens in a new tab) (checked )
- CTM help center, Webhooks API Integration (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with CallTrackingMetrics (CTM). Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
