Loading
HIPAA Compliant Conversion Data for CallRail
Keep CallRail. Hippo takes the calls CallRail tracks and sends Google Ads and Meta a conversion for the ones you choose to count, with the caller's number and name removed. You keep the record of which campaigns bring patients who call, whoever runs your ads.
No annual contracts.
Transparent pricing.
We set it up for you.
CallRail Is Not HIPAA Compliant by Default
CallRail signs a BAA on its Healthcare plans, which run as a separate CallRail account, and its terms allow protected health information only on a Healthcare plan with a BAA signed directly with CallRail (as of 10/09/26).
BAA scope
CallRail's BAA stops at CallRail
CallRail's terms make the security and confidentiality of the integrations you turn on your responsibility, including the ones that post your calls to Google Ads and Meta.
Meta integration
Meta looks for the caller
With its Meta (Facebook) integration on, CallRail sends Meta an event for the calls, texts and form submissions it tracks, and Meta tries to match each one to a person's profile by phone number or email. Meta's terms(opens in a new tab) bar data that includes or is based on health information.
Health information
A call can say why someone called
Even without a recording, the fact that a call to your practice happened at all may create health information, and a tracking number tied to one campaign, such as implants, adds to it. A phone number is one of the identifiers HIPAA's de-identification standard lists(opens in a new tab) for removal.
How Hippo sends Google Ads and Meta your CallRail calls
Your website
Book your appointment
Book now
Call us
Number tap
Form
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads and Meta
Number tap
Form
We set it up.
We take the Google tag and the Meta Pixel off your pages and install Hippo on a subdomain of your domain. We add a webhook in your CallRail Healthcare account. CallRail's code and tracking numbers stay.
CallRail sends Hippo the call.
A patient who clicked your ad calls the tracking number on your page. CallRail tracks the call, and its webhook sends it to Hippo.
Hippo removes the caller's number and name.
It passes on only the calls you choose to count, each under a name that implies no condition, treatment or service.
Google Ads and Meta get the conversion.
Hippo sends the conversion from its server and keeps a record of the call by the campaign that produced it. Whoever runs your ads sees the call conversions arrive in Google Ads and in Meta's Events Manager.
CallRail stops sending call and form conversions.
During setup we switch off the call and form conversions CallRail reports to Google Ads and Meta, so CallRail and Hippo do not both report the same call.
What Google Ads and Meta receive
Sent
Sent: the calls you choose to count
Google Ads and Meta receive a conversion under a neutral name for the calls you count, and a tap on your site's phone number arrives as its own conversion. On your pages, Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses. For a call, that means the caller's number and name. The recording, the transcript, the tracking number and the keyword are left out too.
Held
Held until you allow it
An event Hippo doesn't recognize stays in Hippo, so a new form can't start sending to Google Ads or Meta on its own.
Kept
Kept in Hippo, under your BAA
Hippo stores what it records, call details included, in its own storage under the BAA it signs with every customer, with a log of what went to Google Ads and Meta and what was removed first.
What health advertisers say about calls and conversions
They can't tell what's working
Calls come in, and no one can say which campaign booked the patient.
Tracking phone calls as well. I only have buttons on the landing page where it says click to call. No lead form. I am getting calls but they are all unqualified leads because they don’t have the right insurance
PPC agency, dental client a lot of “marketing worked” reports fall apart once you ask what actually made it onto the schedule.
Dental marketer Patients researching treatments don't fill out forms.
Med spa CMO An upload can say too much
Uploads and hashed matches that send more than a conversion.
But with HIPAA, I’d be very careful uploading anything that confirms patient status, treatment interest, appointment booking, condition, or revenue tied to care
PPC consultant Depending on the conversion action you could still be forwarding sensitive information to a 3rd party since the hash is used to link conversion data to the users existing Google account.
PPC agency Running ads for dermatology, and we don’t use enhanced conversions out of concerns for patient privacy.
PPC agency
Call tracking lawsuits and settlements on health sites
BJC HealthCare(opens in a new tab)
$5.5 million
Patients who used its MyChart patient portal alleged that the health system's websites sent their information to Meta, Google, SiteScout, Invoca and The Trade Desk. Settled, with payments issued(opens in a new tab).
TMC Health(opens in a new tab)
Proposed
Patients allege that tracking code on the health system's website, where they search for doctors, research conditions and sign up for classes, sent their information to outside companies. The original complaint(opens in a new tab) named the Meta Pixel, the LinkedIn Insight Tag, the Snap Pixel and CallRail's web-tracking code. The parties have filed notice of a class settlement, and its terms are not public yet.
Soderstrom Dermatology Center(opens in a new tab)
Pending
Patients allege that tracking code on the dermatology practice's website sent their condition searches and booking information to Google, Meta and Liine, a platform that the complaint(opens in a new tab) says performs call tracking.
All three name a call-tracking company among the companies that received data from the organization's own website.
See what your site sends to Google Ads and Meta(opens in a new tab)What you get
CallRail calls, by campaign
Hippo ties the calls CallRail sends it to the campaigns that produced them, in a record you own, whatever Google Ads and Meta do with the conversion.
Forms and bookings, beside your calls
In the same record, Hippo ties the forms on your site and the bookings in your scheduler to the campaigns that produced them.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
A record of what was sent
A log of every event that went to Google Ads and Meta and what was removed from it first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is CallRail HIPAA compliant?
Not by default. CallRail signs a BAA on its Healthcare plans(opens in a new tab), which run as a separate CallRail account. CallRail's terms of use(opens in a new tab) allow protected health information only on a Healthcare plan with a BAA signed directly with CallRail, and they leave it to you(opens in a new tab) to decide whether its services suit your HIPAA obligations. Even without a recording, the fact that a call to your practice happened at all may create health information(opens in a new tab).
CallRail signed a BAA with us. Isn't that enough?
No. CallRail's BAA covers CallRail. Under HIPAA, you may share PHI with a business associate only with that business associate's own written assurance(opens in a new tab), and CallRail's terms make the integrations you turn on your responsibility(opens in a new tab). Meta Ads offers no BAA, and Google offers one for Local Services Ads and none for the Google Ads campaigns advertisers run on search, display and YouTube. The BAA you sign with Hippo covers Hippo, and Hippo removes names, emails, phone numbers, dates of birth and IP addresses before it sends a conversion to Google Ads or Meta.
Does Hippo replace CallRail?
No. Keep CallRail. Your tracking numbers and recordings stay in CallRail, and its code stays on your pages. CallRail sends its calls to Hippo by webhook, and Hippo takes over only the call and form conversions CallRail reports to Google Ads and Meta.
CallRail already sends our calls to Google Ads and Meta. Will a call count twice?
Not from CallRail and Hippo together. During setup we switch off the call and form conversions CallRail reports to Google Ads and Meta, so CallRail and Hippo do not both report the same call. CallRail's Google Ads reporting(opens in a new tab) and its Meta reporting(opens in a new tab) are switched off one CallRail company at a time. Google's own call conversions from call ads are separate from CallRail's(opens in a new tab), and a tap on your site's phone number is its own conversion. On a walkthrough we go through which call conversions your Google Ads account counts.
What do Google Ads and Meta get from a call?
A conversion under a neutral name, for the calls you choose to count. Hippo removes the caller's number and name first and gives the conversion a name that implies no condition, treatment or service, as Meta's terms require(opens in a new tab) of event names. The recording, the transcript, the tracking number and the keyword are not part of it. Hippo keeps a record of what it sent and what it removed. When CallRail posts a call to Meta itself, Meta looks for a phone number or email(opens in a new tab) to match it to a person's profile.
Can we use CallRail's enhanced conversions?
Not for health calls. Turned on in CallRail, Enhanced Conversions for Leads adds the caller's redacted(opens in a new tab) name, phone number and email, when CallRail has them, to each conversion CallRail sends Google. Conversions related to health can't be used for measurement in enhanced conversions(opens in a new tab). Hippo's call conversions carry no caller name, phone number or email.
Our agency runs CallRail and the ads. Who sets this up, and what changes in our CallRail account?
We do. Whoever controls your domain adds a DNS record for your Hippo subdomain. We install Hippo, add the webhook on CallRail's Integrations page(opens in a new tab) with whoever administers your CallRail account, and switch off CallRail's call and form conversions to Google Ads and Meta. Your agency keeps running the campaigns and sees the call conversions arrive in Google Ads and in Meta's Events Manager.
We get existing patients and wrong numbers. Which calls count?
You choose which calls count as conversions, and Hippo sends Google Ads and Meta only those calls. We set that up with you, and the calls you leave out stay in Hippo's record of your calls by campaign.
Meta restricted our events. Do calls get around that?
No. Meta's terms(opens in a new tab) cover call conversions like any other event, and sending an event from a server changes the route and leaves what it carries as it was. Meta can restrict certain mid and lower funnel standard events(opens in a new tab) for sites in its health and wellness category. Under a restriction, custom events, which is how CallRail's Meta events arrive, stay blocked(opens in a new tab) until you review and confirm them. Hippo cannot lift a category Meta assigns or restore an event Meta blocks, and it never renames an event to get past a restriction. You can ask Meta to review(opens in a new tab) the category. Hippo still records your calls by campaign, whatever Meta blocks.
Should we talk to a lawyer about our CallRail tracking?
Yes, if you want to know how these laws apply to your business. This page describes CallRail's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by CallRail.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.