Home / Notes

Dental · Tracking

Call Tracking for Dental Practices Without Breaking HIPAA

LEV BROVTSEV · AUGUST 2, 2026

Most dental enquiries arrive by phone, which means most practices are optimizing their advertising on a minority of the data. The usual reason given is privacy. The usual reason is wrong.

Why this matters more in dentistry than almost anywhere else

In most industries the majority of enquiries arrive as form submissions. In dentistry the majority arrive as phone calls — someone in pain, or someone who has been thinking about implants for two years and finally picks up the phone. Depending on the practice, calls represent somewhere between half and three-quarters of all new patient contact.

If those calls are not attributed to a source, two things follow. Your reporting understates advertising performance by roughly that same proportion, which makes profitable campaigns look unprofitable. And, more damagingly, the bidding algorithm is learning from the smaller, unrepresentative slice of people who happened to prefer a form. It will find you more of those people. That is not what you wanted.

Where the line actually sits

The relevant concept is protected health information — broadly, individually identifiable information relating to someone's health, care, or payment for care. The critical word is identifiable: HHS guidance on de-identification turns on whether a recipient could reasonably work out who the person is. Aggregate and de-identified marketing signals sit outside that category; anything that lets a recipient work out who the person is sits inside it.

Look at the left column and notice what is missing: any way to identify a human being. A click identifier is a random string that means something inside your ad account and nothing anywhere else. It says "a click happened, and later something good happened." It does not say who.

That is the entire trick, and it is why the objection collapses. You are not sending Google a patient. You are sending Google feedback about one of its own clicks.

Recording is a different question — and the answer is usually no

Call tracking and call recording get conflated constantly, and they carry very different exposure.

Tracking which advertisement produced a call, how long it lasted, and whether it resulted in a booking is a marketing measurement. A recording of a conversation in which someone describes their tooth pain and gives their name is, for practical purposes, a medical record. It has to be stored accordingly, access-controlled accordingly, retained and destroyed accordingly, and it sits under any vendor arrangement accordingly.

Many practices record because their agency told them it helps with lead quality scoring. It does help. It also multiplies your obligations, and in most cases the same insight is available from duration thresholds and outcome data without keeping a single recording. Unless there is a specific operational reason — coaching front desk staff, for instance, with proper consent and controls — I would not recommend it.

How to set it up

1. Dynamic number insertion on the site

A call tracking platform swaps the phone number shown on your website depending on how the visitor arrived. Someone from a Google Ad sees one number, someone from organic search another. The call routes to your normal line — the patient notices nothing — but the source is now known.

2. Capture the click identifier alongside it

When the visitor arrives from an ad, Google appends an identifier to the URL. The call tracking platform should store that against the call record. This is the join between "a call happened" and "an ad caused it," and without it the rest does not work.

3. Set a duration threshold, not a call count

Not every call is a lead. Wrong numbers, existing patients rescheduling, and suppliers all ring the same line. A minimum duration — commonly sixty to ninety seconds — filters most of that out. Set it too low and you teach the algorithm that hang-ups are success.

4. Record the outcome in your practice management system

The call is not the goal; the attended appointment is. Whoever handles the phone needs a way to mark what happened, and that status needs to sit against the same record that carries the click identifier.

5. Send only the four permitted fields back

The upload to Google contains the click identifier, the conversion name, the time, and the value. Nothing else. If your setup is sending more than that, someone has configured it wrong — and that is a genuine exposure, unlike call tracking in principle.

The vendor question

If a call tracking provider handles information that identifies patients on your behalf — and one that records calls certainly does — you generally need a business associate agreement with them. Most established healthcare-oriented providers will sign one and will say so plainly on their site. A provider that has never been asked, or does not know what you mean, is telling you something.

HHS has also published guidance on online tracking technologies aimed squarely at pixels and analytics on healthcare sites — worth reading before anyone tells you the website side is fine.

Ask three things before signing anything: whether they sign a BAA, what data they transmit to third parties by default, and whether their standard configuration sends anything to advertising or analytics platforms beyond the permitted fields. That last one catches the most problems, because some tools ship with helpful integrations enabled that pass more than they should.

What to check in your practice this week

• What proportion of new patient enquiries arrive by phone. If you do not know, ask the front desk to tally a week.
• Whether any call source tracking exists at all. If the same number appears everywhere on the site, it does not.
• Whether calls are being recorded, and if so, whether anyone decided that deliberately or it came switched on.
• Whether your call tracking vendor has signed a business associate agreement.
• What your current setup sends to Google and Meta. Ask your agency for the exact field list, not a reassurance.
• Whether the practice management system records an outcome that can be traced back to the original call.

What changes once calls are counted

The first effect is arithmetic: reported advertising performance improves substantially, because you are finally counting the majority of what it produced. Campaigns that looked marginal often turn out to have been the profitable ones.

The second effect is slower and larger. Once attended appointments — arriving by phone — flow back into the platform, bidding begins optimizing toward the people who call and turn up, rather than toward the people who fill in forms and vanish. In a category where the phone is how serious patients make contact, that shift is the single largest lever available in the account.