GoHighLevel is not HIPAA compliant by default. It becomes usable for protected health information only after an agency buys HighLevel's HIPAA add-on (US$297 per month at the time of writing), signs the Business Associate Agreement inside the platform, and then turns HIPAA on for each sub-account that handles patient data. Those three steps are what "GoHighLevel HIPAA compliance" means in practice. Everything below comes from HighLevel's own help article on HIPAA compliance (last modified June 11, 2026) and from the healthcare accounts we have configured.
The short version
- Default accounts: not HIPAA compliant. Do not put patient data in one.
- Add-on: US$297 per month, bought by the agency, applies to every sub-account under it, cannot be cancelled, refunded or removed once enabled.
- BAA: signed between HighLevel and the agency inside Settings > Compliance. The agency must then sign its own BAA with each practice.
- Covered data once enabled: contacts, notes, custom fields, SMS/MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars, invoices.
- Still your job: consent for texting, staff access rules, what PHI you choose to store, and the compliance program around the software.
The BAA chain at a glance
- Practice (covered entity)
- Agency that owns the account (business associate of the practice)
- HighLevel (business associate of the agency)
Each arrow is a signed Business Associate Agreement: HighLevel signs with the agency inside the platform, and the agency signs its own with each practice. If either document is missing, the chain is broken, whatever the software does. The sections below go through each link.
- 1Agency buys the HIPAA add-on ($297 a month)
- 2BAA signed with HighLevel inside the platform
- 3HIPAA turned on for each sub-account that holds patient data
- 4Agency signs its own BAA with each practice
Source: HighLevel HIPAA help article (modified June 11, 2026), as summarised in our HIPAA guide
Is GoHighLevel HIPAA compliant?
GoHighLevel is not HIPAA compliant out of the box. HighLevel states plainly that accounts are not HIPAA compliant by default. The platform offers a paid HIPAA package that adds encryption of electronic PHI, Business Associate Agreements, audit logging and enforced multi-factor authentication. With that package active and the agreements signed, GoHighLevel can be used as a business associate's system for patient communication and CRM work. Without it, a clinic that stores patient names next to appointment details and treatment notes in GoHighLevel is handling PHI in a tool that has not agreed to protect it.
A second point gets missed constantly: a HIPAA-eligible tool does not make a practice compliant. Compliance is the practice's program (risk analysis, policies, training, access control, breach procedures). The software is one control inside that program.
GoHighLevel HIPAA compliance checklist for a healthcare account
People search for "GoHighLevel HIPAA compliance" wanting a list they can tick, so here is the one we run before a healthcare account goes live. Turning the add-on on is item one of ten; the rest is configuration and policy, which the add-on cannot do for you.
| # | Check | Where | Why it matters |
|---|---|---|---|
| 1 | HIPAA add-on purchased and enabled for every sub-account that will hold patient data | Agency settings, then each sub-account | The BAA only covers sub-accounts where HIPAA mode is on |
| 2 | Business Associate Agreement signed and a copy stored with your other BAAs | HighLevel's agreement flow | Your compliance officer will be asked for it |
| 3 | Users limited to the people who need access, with roles set and shared logins removed | Settings, Team | Access control is a HIPAA requirement regardless of the vendor |
| 4 | No protected health information in SMS or email subject lines; reminders say "your appointment", not the treatment | Workflow message copy | Texts travel over carrier networks the BAA does not cover |
| 5 | Intake and consent forms capture texting consent and write it to a field the workflows check | Sites, Forms; workflow If/Else | Consent and TCPA sit next to HIPAA in every audit |
| 6 | Every integration reviewed: does the third party sign a BAA, and does PHI leave the account through it | Settings, Integrations; webhooks; Zapier or Make | A connected tool without a BAA breaks the chain |
| 7 | Call recording and voicemail transcription set per state consent law, or off | Settings, Phone Numbers | Recordings contain PHI and are governed by state law too |
| 8 | Data retention and deletion decided and written down, including what happens when a patient asks for deletion | Policy document, Contacts | HIPAA gives patients rights the software does not exercise for you |
| 9 | Staff trained on what may and may not be typed into Conversations and notes | Recorded training | Most breaches are people, not platforms |
| 10 | The audit log reviewed monthly for unexpected exports or logins | Audit logs in the account | Detection is part of the rule, not an extra |
If any row is a no, the account is HIPAA eligible, not HIPAA compliant, whatever the add-on invoice says. The sections below explain each part of the chain.
What the HighLevel HIPAA add-on costs
At the time of writing, HighLevel lists the HIPAA package at US$297 per month, available on every agency plan ($97, $297 and $497 monthly, or the annual equivalents). Third-party guides quote an annual option of $2,970; confirm that on the purchase screen, because HighLevel's own article shows only the monthly figure.
Three terms matter more than the price:
- It is account-wide. One purchase covers all sub-accounts under the agency. You cannot buy it for one clinic only.
- It is permanent. HighLevel's article says the package cannot be cancelled, refunded, removed or downgraded once enabled, because encrypted PHI cannot be "un-encrypted". Budget for it as a standing cost.
- Each sub-account is switched on separately. After the agency-level activation, the agency owner enables HIPAA per location under Sub-Accounts > Advanced Settings, and that switch does not turn off either.
For a single practice that holds its own GoHighLevel agency account, the add-on roughly quadruples a $97 subscription. For an agency serving several clinics, the cost is shared across all of them, which is one reason healthcare practices often work through an implementation partner's agency account under a written transfer agreement.
How the Business Associate Agreement works
HighLevel's model has three parties. The practice is the covered entity. The agency that owns the GoHighLevel account is a business associate of the practice. HighLevel is a business associate of the agency. HighLevel signs its BAA with the agency inside the platform (Settings > Compliance, through Documents & Contracts; the signer's details can be edited there and the signed copy downloaded). The agency must then provide its own BAA to each client practice, which means the agency itself needs to run a HIPAA compliance program and not merely resell the toggle.
If you are a practice evaluating a GoHighLevel partner, ask for two documents: the partner's signed BAA with HighLevel, and the BAA they will sign with you. If either is missing, the chain is broken regardless of what the software does.
What the add-on actually protects
According to HighLevel's article, once enabled: all data is encrypted automatically before it is written to disk, using 256-bit AES, with encryption keys themselves encrypted under a rotated set of master keys managed through Google's server-side encryption with access auditing. Data is decrypted transparently for authorized users. The FAQ lists the covered data types as contacts, notes, custom fields, SMS/MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars and invoices. The mobile app's Conversations, Calendars and Contacts inherit the same encryption and MFA controls, and Reviews AI responses in HIPAA-enabled sub-accounts follow HIPAA handling automatically.
Two things the article does not address, so treat them as open until HighLevel confirms in writing: coverage of AI features beyond Reviews AI (Voice AI transcripts, Conversation AI), and the retention and access details of the audit log. We configure healthcare accounts so AI features touch no PHI until that is settled with the client's compliance officer.
How to enable HIPAA in GoHighLevel, step by step
- Log in at the agency level and open Settings > Compliance.
- Read the "Before You Buy" details. This is where the permanent, non-refundable terms are stated.
- Buy the HIPAA package at $297 per month, check the acknowledgement and subscribe.
- Sign the BAA when it is presented. HIPAA activates at the agency level once it is signed. Expect provisioning to take a little time; third-party guides report 48 to 72 hours, HighLevel's article gives no figure.
- Open Sub-Accounts, choose the location, go to Advanced Settings, and enable HIPAA for that sub-account. Repeat for each clinic. Users need the right permissions to see these settings.
- Download the signed BAA from the Compliance section and file it with the practice's compliance records.
- Sign your own BAA with the practice if you are the agency.
How to confirm it worked: the Compliance section shows the package active and the BAA signed, and each HIPAA-enabled sub-account shows the setting on under Advanced Settings. If a sub-account is later transferred, note that HighLevel only allows a HIPAA-enabled sub-account to move to another agency that is also HIPAA compliant.
What HIPAA mode does not do for you
| Area | What the add-on covers | What stays with the practice or agency |
|---|---|---|
| Encryption at rest | Automatic, AES-256, key rotation | Nothing extra |
| Access control | MFA enforced | Who gets which role, offboarding staff, shared logins (never) |
| Texting patients | Message content encrypted in the account | Consent to text, what you put in a text, carrier-side exposure of SMS, A2P registration |
| Email bodies and attachments encrypted in the account | Email in transit and the recipient's inbox are outside HighLevel's control; minimum-necessary content rules | |
| Calls and recordings | Voice recordings encrypted | Recording consent laws by state, who can listen |
| AI features | Reviews AI handled under HIPAA in enabled sub-accounts | Voice AI and Conversation AI not addressed in the article; keep PHI out until confirmed |
| Agreements | BAA between HighLevel and the agency | BAA between agency and practice; the practice's own risk analysis and policies |
| Audit | Audit logging mentioned | Reviewing logs, incident response, breach notification |
How we configure GoHighLevel for healthcare clinics once HIPAA is on
The add-on is the floor. These are the build decisions that keep a healthcare account defensible, drawn from the clinic systems described on our healthcare setup page. The workflow-by-workflow version, with the FCC text limits and the features HighLevel does not document, is our guide to HIPAA compliant workflow automation:
- Minimum necessary in messages. Appointment reminders carry date, time and location, not the reason for the visit. Treatment and recall sequences use service categories the patient already knows, not diagnoses.
- Consent captured on the record. A dated SMS consent field and the source of consent, collected on intake forms and respected by every workflow through an entry filter.
- Role design. Front desk, providers and marketing see different things. No shared logins, MFA on for everyone.
- PHI boundaries with other tools. The EHR or practice-management system remains the clinical record. Integrations move scheduling signals, not charts.
- Documented workflows. A written map of every automation that touches patient data, so the compliance officer can review it and the next administrator can understand it.
Related: the HIPAA add-on cost by plan and GoHighLevel for medical practices.
HIPAA compliant vs HIPAA eligible: what the difference means
No software product is "HIPAA certified": HIPAA applies to the organizations that handle protected health information and to their business associates, and it is met through policies, safeguards and agreements, not through a badge on a tool. "HIPAA eligible" is the honest description of a platform that offers a BAA and the safeguards to use it within a compliant program. That is what the $297 a month add-on gives you for GoHighLevel, and why the sections above separate what it covers from what stays with the practice.
Does GoHighLevel stay HIPAA compliant if you connect Zapier, Twilio or other tools?
The add-on covers HighLevel's own handling of the data types listed above. When data leaves the account through a webhook, Zapier, Make, your own Twilio account or any other integration, the receiving service is a separate vendor. If it handles protected health information it needs its own agreement and review. This is our reading of how business associates work, not a statement from HighLevel, so confirm each connection with your compliance adviser. Our practice is to keep health details out of automations that pass through tools without a BAA. See GoHighLevel integrations for the routes, and the Zapier, Make and Google Drive BAA table in our workflow guide.
What are the HIPAA penalties?
Civil penalties are tiered by how culpable the violation was and are adjusted for inflation each year, so read the current amounts on HHS.gov rather than a figure printed here. Cost is one reason to decide before building, not after.
Which healthcare providers use GoHighLevel with the HIPAA add-on?
Practices that want a front-office system around their clinical software: medical practices, TRT clinics, weight loss clinics, dental practices, chiropractors, optometrists and med spas. The total monthly cost by plan is in the HIPAA add-on cost guide.
Sources and further reading
Checked at the time of writing; prices, features and policies change.
- HighLevel: HIPAA Compliance With HighLevel (help article, modified June 11, 2026)
- HHS: HIPAA compliance and enforcement
- HighLevel pricing page (HIPAA add-on)
- HighLevel terms of service
Frequently asked questions
Does GoHighLevel sign a BAA?
Yes, with the agency that owns the account, once the HIPAA package is purchased. The BAA is signed inside Settings > Compliance and can be downloaded there. HighLevel does not sign a BAA directly with each sub-account or practice; the agency provides its own BAA to its healthcare clients.
Can I use GoHighLevel for a medical practice without the HIPAA add-on?
Only if no protected health information ever enters the account, which is hard to guarantee once patients reply to texts or fill in forms. In practice, a clinic, dental office, med spa offering medical treatments or chiropractor should treat the add-on as required before go-live.
Is the HIPAA add-on refundable if we change our mind?
No, HighLevel states that the package cannot be cancelled, refunded, removed or downgraded once enabled, because encrypted PHI cannot be reverted. Decide before you buy, and read the "Before You Buy" section in Settings > Compliance.
Does HIPAA mode cover SMS reminders to patients?
It encrypts the messages stored in your account. It does not change the fact that SMS travels through carriers in the clear, so reminders should contain the minimum necessary information, and patients should have consented to text contact. Many practices keep clinical detail out of texts entirely.
Are Voice AI and Conversation AI covered?
HighLevel's HIPAA article names Reviews AI as following HIPAA handling in enabled sub-accounts and does not address the other AI features. Until HighLevel confirms in writing, configure AI agents so they do not collect or store PHI, or keep them off HIPAA sub-accounts.
Can a HIPAA-enabled sub-account be moved to another agency?
Only if the receiving agency is also HIPAA compliant on HighLevel. Practices that want the freedom to change partners should confirm, in writing, how a transfer would work before the build starts.
Sources: HighLevel help center, "HIPAA Compliance With HighLevel" (article 48000983084, last modified June 11, 2026), read on October 16, 2026; HighLevel pricing page for plan tiers, same date. This page explains platform behaviour and implementation practice; it is not legal or compliance advice. Confirm obligations with your compliance officer or counsel.
Does GoHighLevel stay HIPAA compliant when connected to Zapier?
The add-on covers HighLevel's own handling of the data. Once data passes to Zapier or another tool, that tool is a separate vendor and needs its own agreement and review before it handles protected health information. Keep health details out of such connections unless your compliance adviser approves them.
Does GoHighLevel work with Twilio under HIPAA?
HighLevel's built-in phone system is its own service, covered by the add-on's SMS and voice-recording protections as listed above. If you connect your own Twilio account, that account is a separate vendor relationship with its own terms and agreements.
What are the penalties for HIPAA violations?
Civil penalties are tiered by culpability and adjusted for inflation each year. Read the current amounts on HHS.gov rather than relying on a figure from a third-party page.
What types of healthcare providers can use GoHighLevel?
Practices that want a front-office system around their clinical software: medical practices, TRT and weight loss clinics, dental, chiropractic, optometry, med spas, hair transplant clinics and rehab and addiction treatment centers, with the add-on and a BAA if protected health information is stored.