Google’s customer data policy lists health and medical information, including purchases of medical services, as a sensitive category, and says conversions in sensitive categories can’t be used for measurement in enhanced conversions. For a treatment center, that one line changes which features on attribution vendors’ pricing pages can be used.
Attribution still works for treatment centers. It just has to be built from tools that sign a Business Associate Agreement, and wired so that only neutral, PHI-free signal reaches Google and Meta.
This guide ranks ten attribution tools across call tracking, data routing, CRM, and reporting, based on each vendor’s published BAA terms, attribution features, ad platform fit, and pricing transparency as of September 2026.
It’s the evaluation behind the stack recommendations we make inside our admission ops and attribution work. For the attribution model itself, see our complete guide to attribution for treatment centers. This piece is about choosing the tools.
Key Takeaways
- A treatment center attribution stack has four layers: call and form tracking, a BAA-covered data routing layer, a CRM that records the admit, and reporting. Each vendor that receives PHI needs a signed BAA.
- Call tracking is where most treatment center leads start. CTM includes HIPAA features on Marketing Pro and above, CallRail runs HIPAA through a separate Healthcare plan, and WhatConverts offers a BAA from its Pro plan.
- Google says health-related conversions can’t be used in enhanced conversions, and Meta says it doesn’t permit health information through its Business Tools. Call tracking features that push hashed identifiers to ad platforms should stay off.
- Some tools marketed for attribution don’t fit. Hyros says it can’t be used with protected health information, and Marchex’s terms say it isn’t a business associate.
- HubSpot and Salesforce both offer BAAs, but only on specific tiers or services. Confirm the covered product in writing before any lead data goes in.
- Webserv has a referral partnership with Dazos, which appears in this ranking. The relationship is disclosed in the methodology and in its entry.
What an attribution stack has to do for a treatment center
A treatment center’s buying journey rarely ends on the website. A family member searches, clicks an ad, reads two pages, and calls. The admissions team runs a benefits check, and the admit happens days later.
Attribution has to connect that click to the admit without exposing who the caller was or why they called. That takes four layers working together:
- Capture: call tracking and form tracking record the source, campaign, and keyword behind each inquiry.
- Routing: a BAA-covered layer strips PHI and sends neutral conversion events to ad platforms.
- Record: the CRM ties each inquiry to its outcome, from qualified lead to admit.
- Reporting: a dashboard joins spend to admits by source.
DEFINITION
Closed-loop attribution. A setup in which the outcome recorded in the CRM, such as an admit, is matched to the ad click or call that started the inquiry and reported against spend. For treatment centers, the loop has to close without sending PHI or condition-specific event names to any vendor that hasn’t signed a BAA.
Every layer carries a compliance floor. HHS’s online tracking technologies bulletin says a tracking vendor that receives PHI is a business associate and needs a signed BAA, the same rule HHS sets out in its business associate guidance.
The bulletin also describes routing data through a BAA-covered vendor that de-identifies it before it reaches a vendor that won’t sign.
A federal court vacated part of that bulletin in June 2024, and HHS notes the ruling on the page. The BAA requirement for vendors that receive PHI stands. Substance use disorder programs also have 42 CFR Part 2 to consider, which our Part 2 guide for treatment center marketing covers.
The ad platform rules every tool has to work within
Before comparing vendors, it helps to know what Google and Meta will accept, because those rules decide which vendor features a treatment center can switch on.
Google. Google’s customer data policies cover enhanced conversions for web, enhanced conversions for leads, and store sales uploads. The policy lists health or medical information as a sensitive category and says conversion information related to sensitive categories may not be uploaded.
Google’s personalized advertising policy names addiction counseling as an example of the health category, which rules out Customer Match, your data segments, and lookalike targeting for it. Google also says it doesn’t offer a BAA for Google Analytics.
Meta. Meta’s page about prohibited information says it doesn’t permit health information through its Business Tools, with examples that include mental health and places of treatment and counseling. Event and conversion names can’t imply that information either.
Meta may also categorize a data source as health and wellness, which limits what it accepts. Its core setup blocks custom parameters and everything in the URL after the domain, and Meta says it isn’t a substitute for the advertiser’s own compliance work.
The practical rule: send ad platforms a neutral conversion event tied to the click, such as tier_1_conversion, and leave identifier matching, condition names, and patient lists out. Our HIPAA-safe conversion tracking stack covers the event design.
How we ranked the tools
Rankings reflect fit for a typical treatment center marketing and admissions team, judged on five criteria from each vendor’s public documentation:
- BAA availability: whether the vendor signs a BAA, and on which plan or service.
- Attribution depth: how much of the click-to-admit path the tool covers.
- Ad platform fit: whether it can send neutral conversion signal to Google and Meta without PHI.
- Treatment center fit: integrations with the call tracking, CRM, and reporting tools treatment centers already run.
- Pricing transparency: whether plans and the HIPAA tier are published.
Webserv has a partnership with Dazos and earns referral fees when clients we work with select it. We didn’t receive payment from any other vendor listed. BAA terms and prices change, so confirm both with the vendor in writing before you sign.
The 10 tools, ranked
The table summarizes each tool’s layer, BAA terms, and published pricing.
| Rank | Tool | Layer | BAA | Plan with BAA | Public pricing |
|---|---|---|---|---|---|
| 1 | CTM | Call tracking | Yes | Marketing Pro and above | $179/mo monthly ($149 yearly) |
| 2 | CallRail | Call tracking | Yes | Healthcare plan | Not published |
| 3 | Invoca | Call tracking | Yes | Not plan-limited | Quote |
| 4 | WhatConverts | Call, form, chat | Yes | Pro and above | Pro $100/mo |
| 5 | Freshpaint | Routing | Yes | All integrations | Quote |
| 6 | Ours Privacy | Routing | Yes | Every tier | Not published |
| 7 | Dazos | CRM | Not stated | n/a | Not published |
| 8 | Salesforce | CRM | Yes | Listed services | Not covered here |
| 9 | HubSpot | CRM | Yes | Enterprise | Not covered here |
| 10 | Data Studio / Looker | Reporting | Yes | Google Cloud agreement | n/a |
Full notes on each tool follow, in ranked order.
1. CTM (CallTrackingMetrics)
Layer: call and form tracking. BAA: yes; HIPAA features on Marketing Pro and above.
CTM covers call, text, and form attribution, with multi-touch reporting and triggers that can send a conversion to Google Ads. Its plans FAQ says HIPAA features are included on Marketing Pro and above, with no separate HIPAA plan. Its HIPAA help article says to contact CTM to put a BAA in place.
Pricing is published on its plans page. Marketing Pro is $179 per month billed monthly, or $149 per month billed yearly, plus usage. HubSpot integration starts on Marketing Pro and Salesforce on Sales Engage.
Best for: single- and multi-facility operators who want call tracking with HIPAA coverage on a published plan. Our CTM implementation playbook covers setup.
Watch for: AI features. CTM’s pages don’t say whether AskAI or VoiceAI fall under HIPAA coverage, so ask before enabling them on recorded calls.
2. CallRail (Healthcare plan)
Layer: call and form tracking. BAA: yes, on the Healthcare plan.
CallRail runs HIPAA through a separate Healthcare account with its own billing, and says it will enter into a BAA for those accounts. Its pricing page lists standard plans from $50 per month, but Healthcare pricing isn’t published.
CallRail’s Google Ads integration posts calls and forms as offline conversions using the click ID. It also supports enhanced conversions for leads, which a treatment center shouldn’t switch on given Google’s sensitive-category rule.
Best for: teams already using CallRail who want HIPAA coverage without switching vendors. Our CallRail vs CTM comparison covers the trade-offs.
Watch for: migrating an existing standard account. The Healthcare plan is a separate account, so plan the number port and integration rebuild.
3. Invoca
Layer: call tracking and conversation intelligence. BAA: yes.
Invoca offers call tracking with dynamic numbers, plus offline conversion and revenue import for closed-loop attribution. Its HIPAA page says it offers an industry-standard BAA template and will review a customer’s own.
Pricing is by quote across Pro, Enterprise, Elite, and Performance plans. Google Ads, GA4, Microsoft Ads, Meta, and HubSpot integrations are listed on Pro, and Salesforce is a premium add-on.
Best for: multi-facility groups with high call volume and a team to run a larger platform.
Watch for: redaction scope. Invoca’s redaction add-on lists card numbers, Social Security numbers, and dates of birth, so ask how it handles other PHI in recordings and transcripts.
4. WhatConverts
Layer: call, form, and chat tracking. BAA: yes, Pro plan and above.
WhatConverts tracks calls, forms, and chat with multi-click attribution. Its HIPAA page says it offers BAAs on Pro and higher, signed electronically, with HIPAA turned on per profile.
Its pricing page lists Pro at $100 per month for a single account. That makes it the lowest published price for a BAA-covered tracking plan in this list.
Best for: single-facility operators who want calls, forms, and chat in one lead log at a published price.
Watch for: the per-profile HIPAA setting. Confirm it’s on for every profile before tracking goes live.
5. Freshpaint
Layer: BAA-covered data routing. BAA: yes.
Freshpaint sits between the website and ad platforms, removing PHI before events go out. Its FAQ says it offers a BAA, and its healthcare integrations page says every integration is protected under that BAA.
Its documentation covers the Facebook Conversions API and Google Ads destinations, and it integrates with CallRail and CTM. Pricing is by quote across three tiers.
Best for: operators who want Google and Meta optimization to keep working after moving PHI handling to a vendor that signs.
Watch for: destination settings. Freshpaint lists Google Ads enhanced conversions as a destination; keep it off for health conversions.
6. Ours Privacy
Layer: BAA-covered data routing. BAA: yes, every tier.
Ours Privacy’s pricing page says every tier includes a BAA, with custom BAAs from the Core tier. Google Ads, GA4, and Meta destinations are available on all tiers, and CRM and call tracking connections, including CallRail, CTM, and Invoca, start at Core.
Pricing isn’t published and is based on monthly tracked users.
Best for: teams that want routing plus CRM and call tracking connections under one BAA.
Watch for: tier fit. If the call tracking and CRM connections are the reason you’re buying, confirm you’re on Core or above.
7. Dazos
Layer: CRM with marketing attribution. BAA: not stated on public pages. Disclosure: Webserv is a Dazos partner.
Dazos is a behavioral health CRM whose Marketing Reports join marketing, admissions, and billing data, with revenue by source, multi-touch attribution, and referral partner performance. Its integrations page lists CallRail, CTM, Google Ads, Meta, and HubSpot.
Its site says it has built-in HIPAA compliance. BAA terms aren’t published, so request them in writing like any other vendor.
Best for: operators who want admissions and attribution reporting in a behavioral-health-specific CRM. Our CRM buyer’s guide compares it with the alternatives.
Watch for: our relationship. We earn referral fees when clients select Dazos, so weigh this entry against the others on its merits.
8. Salesforce
Layer: CRM and marketing automation. BAA: yes, for listed services.
Salesforce’s business associate addendum page says only services named in a signed BAA are covered. The list includes Sales Cloud, Service Cloud, Health Cloud, and several Marketing Cloud products, and excludes some Einstein features.
Best for: multi-facility groups with an admin or partner to build custom attribution reporting. Our Salesforce admissions setup guide covers the pipeline.
Watch for: add-ons outside the BAA. Check each product and AI feature against the covered services list before turning it on.
9. HubSpot (Enterprise with Sensitive Data)
Layer: CRM and marketing automation. BAA: yes, on Enterprise subscriptions.
HubSpot’s sensitive data guide says HIPAA use requires an Enterprise subscription with Sensitive Data turned on and the HIPAA options selected. The BAA is part of HubSpot’s sensitive data terms and accepted in the app.
Some tools, such as personalization tokens and chatbots, don’t work with sensitive data properties.
Best for: operators already on HubSpot Enterprise who want source reporting in the CRM. Our HubSpot for admissions guide covers the fit.
Watch for: Professional tiers. Lead data on a non-Enterprise portal isn’t covered.
10. Data Studio and Looker (reporting)
Layer: reporting. BAA: yes, under a Google Cloud agreement.
Google’s HIPAA compliance page lists Data Studio as covered only when the customer has opted to govern it under their Google Cloud agreement, and lists Looker as covered.
Best for: teams that want a spend-to-admit dashboard without buying another reporting tool.
Watch for: the opt-in. A free Data Studio report connected to CRM data isn’t covered by default.
How an inpatient rehab scaled paid media to 95 admits while cutting cost per admission by 24%
Campaign consolidation and PMAX optimization drove 30% admission growth with improved efficiency, all while maintaining OON payer mix.
Read the case study →Q3 2025
Tools that don’t fit treatment center attribution
Some tools that show up in attribution roundups aren’t a fit once PHI is involved.
- Hyros. Its trust center includes a HIPAA and PHI notice saying it can’t be used with protected health information.
- Marchex. Its call recording terms say it shall not be deemed a business associate.
- Ruler Analytics. Its public pages don’t state a BAA. Treat it as unsuitable until the vendor confirms one in writing.
- Google Analytics 4 on its own. Google doesn’t sign a BAA for it. It can stay in the stack behind a routing layer, and our GA4 configuration guide covers the setup.
COMMON MISTAKE
Switching on enhanced conversions for leads. Some call tracking platforms, CallRail among them, offer a one-click setting that sends hashed caller details to Google Ads to improve match rates. It’s built for industries where conversion data isn’t sensitive.
Google’s policy says health-related conversions can’t be used for measurement in enhanced conversions. For a treatment center, keep that setting off, send click-based conversions with neutral names, and document the decision.
How to choose your stack
Most treatment centers don’t need all ten tools. The right combination depends on size, call volume, and who will run it.
Single facility, small team. One BAA-covered call tracking tool (CTM, CallRail Healthcare, or WhatConverts), a CRM on a covered tier, and a Data Studio dashboard under a Google Cloud agreement. Add a routing layer if Google and Meta conversion signal matters to your campaigns.
Multi-facility group. Call tracking with conversation intelligence (CTM or Invoca), a routing layer (Freshpaint or Ours Privacy), and a CRM that can carry multi-location reporting (Salesforce or Dazos). Our call tracking guide covers how the numbers map to facilities and campaigns.
Referral-heavy census. If a large share of admits come from referral partners rather than ads, CRM reporting on referral sources matters more than ad platform signal. See our referral partner attribution guide.
OPERATOR INSIGHT
Fix the CRM outcome field before you buy another dashboard. A common attribution gap isn’t a missing tool at all; it’s admits that were never recorded against the inquiry that produced them.
If the admissions team doesn’t mark each inquiry with its outcome, no vendor on this list can close the loop. Fix the intake workflow first, then choose the tools that report on it.
The implementation checklist
Use this sequence whichever tools you choose:
Inventory every tag and destination
List every script on the site and every place lead data goes today.
Get BAAs signed first
Collect a signed BAA from each vendor that will receive PHI, on the plan or service that carries it.
Design neutral events
Name conversions by value tier, not condition or level of care.
Wire click-based conversions
Send conversions tied to the click ID through a BAA-covered path, with enhanced conversions off for health conversions.
Record outcomes in the CRM
Require an outcome on every inquiry, from qualified lead to admit.
Reconcile monthly
Compare CRM admits to reported conversions by source, and fix gaps before optimizing spend.
Keep a written record of each step and sign-off. It’s your documentation if a regulator, platform reviewer, or LegitScript asks how the setup works.
Where this fits in your marketing system
Attribution tools are only as useful as the decisions they inform. Once the loop is closed, the next step is using cost per admit by source to shift budget, which our guide on lowering cost per admit without cutting ad budget covers.
For how attribution fits the rest of the marketing plan, see our complete guide to behavioral health marketing. If you want a second opinion on your current stack, book an intro meeting and we’ll review it with you.
30 minutes to talk through your census goals, payer mix, and what a realistic growth plan looks like for your facility.
No pitch. No pressure. Just a straight conversation from a team that has worked with 200+ treatment centers nationwide.
Frequently Asked Questions
What is the best attribution tool for a treatment center?
There isn’t one tool that covers the whole path. Most treatment centers need BAA-covered call tracking, a CRM on a covered tier, and a reporting layer, plus a routing layer if Google and Meta conversion signal matters.
For call tracking, CTM publishes HIPAA coverage on Marketing Pro and above, CallRail offers a Healthcare plan, and WhatConverts offers a BAA from its Pro plan.
Choose based on your call volume, who will run the setup, and which CRM you already use.
Can treatment centers use Google Ads enhanced conversions?
Google’s customer data policy says conversions related to sensitive categories, including health or medical information, can’t be used for measurement in enhanced conversions.
For treatment centers, that means sending click-based conversions with neutral names instead of hashed caller or lead details.
Confirm your setup with counsel and your Google representative, and document the decision.
Does call tracking software need a BAA?
If it records calls, transcribes them, or logs caller details for a treatment center, it’s receiving PHI, and HHS guidance says a vendor that receives PHI needs a signed BAA.
Several call tracking vendors offer BAAs, but on specific plans. CTM includes HIPAA features on Marketing Pro and above, and CallRail uses a separate Healthcare account.
Ask separately about AI features such as call summaries and scoring, since coverage isn’t always stated.
Is Hyros HIPAA compliant?
Hyros’s trust center includes a notice saying it can’t be used with protected health information, and HIPAA isn’t among the frameworks it lists.
That rules it out for treatment center lead data, including call and form details.
Choose a vendor that signs a BAA for any tool that will receive inquiry or caller information.
How do treatment centers track admits back to ads?
Record the source of each inquiry at capture, through call tracking or form tracking, and carry it into the CRM with the lead.
When the admissions team marks the inquiry as admitted, the CRM can report admits by source and send a neutral conversion back to the ad platform through a BAA-covered path.
Reconcile CRM admits against reported conversions each month so budget decisions rest on real outcomes.
Trevor Gage is the Director of Marketing at Webserv, a digital marketing agency for treatment centers.
