Is GoHighLevel HIPAA compliant?

General information, not legal advice. Everything below comes from HighLevel's own HIPAA help article (last updated June 11, 2026), HighLevel's HIPAA page and HHS guidance, all read on November 9, 2026. Your compliance officer or healthcare attorney decides what applies to your practice.

Is GoHighLevel HIPAA compliant?

Not by default. GoHighLevel becomes usable for protected health information (PHI) only after the agency buys HighLevel's HIPAA add-on (US$297 a month at the time of writing), signs HighLevel's Business Associate Agreement (BAA) and switches HIPAA on in each sub-account that will hold patient data. Even then, the BAA covers HighLevel's side, not your own HIPAA duties.

HighLevel's help article opens with "HighLevel accounts are NOT HIPAA compliant by default", and its HIPAA page says the same: "HighLevel is not HIPAA compliant by default."

Once the add-on is active, the BAA is signed and the sub-account toggle is on, the platform can hold PHI. Until all of that is done, in that order, your account is not covered, so finish it before the first real patient record goes in. Your practice or agency also needs its own HIPAA program, with a risk analysis, written policies, staff training and access control, and buying software does not give you one.

If you are a clinic owner, the practical question is usually narrower: can the front desk run intake, booking and reminders in GoHighLevel without breaking HIPAA? Usually yes, with the add-on and minimal-detail messages. Our GoHighLevel for healthcare clinics page covers what clinics automate and what stays in the EHR.

How much does the GoHighLevel HIPAA add-on cost?

US$297 a month, according to HighLevel's help article, or US$2,970 a year on HighLevel's HIPAA page, at the time of writing. It sits on top of your normal plan, works on any plan from Starter up, and cannot be canceled, refunded or downgraded once you buy it.

The sums are ours. Paying yearly saves $594 a year on the add-on alone (12 x $297 = $3,564, against $2,970). Because the add-on can never be removed, the yearly option only makes sense once you are sure the account will stay on GoHighLevel. Usage costs such as texts, calls and email are billed on top, as they are without HIPAA.

The help article lists eligible plans as "$97, $970, $297, $2970, $497, $4970", so Starter accounts can buy it too. It is bought once for the agency rather than per sub-account; HighLevel says it "applies to all location accounts within your account."

How do you turn on HIPAA in GoHighLevel?

Buy the add-on in the agency account under Settings, Compliance, sign the BAA in the same Compliance section, then open each sub-account that will hold PHI and turn the HIPAA toggle on under its Advanced Settings. Do all three before any patient data is imported or collected.

The steps, as HighLevel's help article describes them on November 9, 2026:

1. In the agency account, open Settings, Compliance and read the "Before You Buy" notes.
2. Click "Buy HIPAA Package at $297 per Month" and read the note, the features list and the acknowledgement.
3. Tick the acknowledgement and click "Pay $297 & Subscribe". You can add or choose a payment method in the same window.
4. Sign the BAA. It lives under Settings, Compliance, BAA, View Details, View Document. You can edit the signer details yourself ("Edit Document", then "Update Changes") and download the signed copy from the same place. It runs through HighLevel's Documents & Contracts tool, not PandaDoc.
5. For each sub-account that will hold PHI, go to Sub-Accounts, open the sub-account, then Advanced Settings, and turn the HIPAA toggle on. HighLevel says this toggle "cannot be turned off" once enabled.
6. Check the result. HighLevel's HIPAA page says activation is typically completed within 48 to 72 hours after purchase. Do not import patient records until the toggle shows as on in every sub-account that needs it.

HighLevel's article contradicts itself on that last step. Its benefits list says, in its benefits list, that HIPAA compliance "is enabled automatically once the BAA is signed" with "no manual activation required". Its steps and its FAQ say the agency owner must enable HIPAA manually in each sub-account. We treat the manual step as the rule: open every sub-account and confirm the toggle yourself. If the toggle is already on, nothing is lost. If it is off and you assumed it was automatic, PHI is sitting in a sub-account the BAA does not yet protect.

New to how GoHighLevel splits the agency level from sub-accounts? See agency account vs sub-account.

What does the GoHighLevel BAA cover, and what does it not say?

HighLevel names the data it covers: contacts, notes, custom fields, SMS and MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars and invoices, plus the mobile app's conversations, calendars and contacts. Its article does not mention Conversation AI, Voice AI, social inbox channels or third-party integrations, so do not assume those are covered.

We split everything a clinic usually runs into three groups. The first column is HighLevel's own wording. The other two are our reading of what the article leaves out, so treat them as questions to put to HighLevel support in writing, not as HighLevel's position.

On security, HighLevel says the package "enables encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement", that data is encrypted with 256-bit AES before it is written to disk, and its HIPAA page adds "role-based permissions and detailed user activity logs."

A BAA binds the two parties who sign it. HighLevel's BAA covers HighLevel. When a message leaves GoHighLevel for Meta, Google or a Zapier step, it lands with a company that has not signed your BAA. HHS's cloud computing guidance treats a cloud service that creates, receives, maintains or transmits ePHI for a covered entity as a business associate, and using one without a BAA breaks the HIPAA rules. Which automation tools sign a BAA is covered in our guide to HIPAA and automation tools.

Does signing the BAA make your clinic or agency HIPAA compliant?

No. The BAA makes HighLevel responsible for safeguarding the PHI it holds for you. Your practice still owns its risk analysis, policies, staff training, user access and what your team types into messages. HighLevel's own page says "Your organization is ultimately responsible for meeting all HIPAA requirements."

Who does what depends on who holds the GoHighLevel account:

• A clinic with its own account signs HighLevel's BAA directly. The clinic is the covered entity and HighLevel is its business associate.
• An agency running sub-accounts for clinics sits in the middle. The clinic signs a BAA with the agency, and the agency signs HighLevel's. HighLevel's article says agencies must be HIPAA Title II compliant to give their practice clients a BAA, and it offers the contact details of The Compliancy Group, the consultancy HighLevel says it worked with on its own compliance.
• A build partner like us works inside your account to your compliance lead's requirements. We set up the add-on, toggles, user roles and minimal-detail messages, but we do not certify anyone.

Watch for "HIPAA certified" claims, from any vendor. HHS says the Office for Civil Rights does not endorse, certify or recommend specific technology products, and its FAQ on certification says an outside "certification" does not stop HHS from later finding a violation. There is no official HIPAA certificate for GoHighLevel, for an agency or for us.

What goes on a GoHighLevel HIPAA checklist before patient data goes in?

Activate the add-on, sign the BAA, switch HIPAA on in each sub-account, turn on MFA and tight user roles, keep PHI out of channels and tools without a BAA, and cut every automated message down to the minimum detail. Then write down who checks it and when.

The checklist we run on a clinic account before go-live:

1. List every form field, custom field and message that could hold a condition, treatment, medication, insurance detail or visit reason. Those are your PHI fields.
2. Buy the add-on, sign the BAA and switch the toggle on, then confirm the toggle in every sub-account on that list.
3. Give each person their own login with MFA on, and make staff sub-account users who see only their own location. Remove former staff the day they leave.
4. Decide which inbox channels may carry patient detail. Our default: SMS, email and calls inside GoHighLevel only; social DMs get a short reply that moves the patient to a phone call or a secure form.
5. For every Zapier, Make or webhook step, check whether that tool signs a BAA. If not, send it IDs and status only, never the clinical field.
6. Before Conversation AI or Voice AI reads or writes patient detail, get HighLevel's answer in writing on whether your BAA covers it. Until then, limit bots to booking and general questions.
7. Keep reminder wording to date, time, location and a call-back number, and leave out the reason for the visit. Our appointment confirmation text templates include a minimum-detail medical version.
8. Treat CSV exports and screenshots as PHI too. Decide who may export and where files are kept.

Specialties add their own rules. Med spas, weight-loss and TRT clinics, dentists and home care agencies each handle different detail at intake; see GoHighLevel for med spas, weight loss and TRT clinics, dentists and home care agencies. For a real dental front office on GoHighLevel and n8n, see our Smile Bright case study.

Do you need the HIPAA add-on at all?

You need it if your business is a HIPAA covered entity or business associate and any patient health information will be stored in, or sent through, GoHighLevel. If GoHighLevel only runs marketing to people who are not yet patients, and no health detail is collected, some practices decide they do not. Your compliance lead makes that call.

Questions that usually settle it:

• Does a form ask what treatment, condition or symptom someone has? At a covered practice, treat that as PHI.
• Will appointment reminders, intake or recall run from GoHighLevel? Then patient records are in it, and the add-on is the normal route.
• Will staff reply to patients in the GoHighLevel inbox? Patients will type health detail whether you ask for it or not.

If the answer to all three is no, and you are only running ads, landing pages and first-contact booking, ask your compliance lead whether the add-on is needed yet. Because it can never be removed, it is cheaper to decide early than to switch it on by reflex.

More GoHighLevel HIPAA compliance questions

Can I cancel the GoHighLevel HIPAA add-on later?

No. HighLevel's help article says that once enabled, HIPAA "is permanent for your agency and cannot be canceled, refunded, removed, or downgraded." The subscription is "non-cancellable and non-refundable." Budget for $297 a month for as long as the agency account exists, or $2,970 a year on annual billing.

Is the HIPAA add-on charged per sub-account?

No. It is bought once at the agency level and applies to all sub-accounts in that account, according to HighLevel's help article. You still switch HIPAA on inside each sub-account that will hold PHI. Texts, calls and email used by each sub-account are billed as usual.

Can I turn on HIPAA for just one sub-account?

You pay once for the whole agency, and HighLevel says the package applies to all its sub-accounts. Its steps still have you switch the HIPAA toggle on per sub-account, under Advanced Settings, and that toggle cannot be turned off once on. An agency with clinic and non-clinic clients should ask HighLevel support how the toggle affects the non-clinic accounts before enabling it.

Does GoHighLevel sign a BAA on the $97 Starter plan?

Yes. HighLevel's help article lists every plan, $97, $297 and $497 monthly and their annual versions, as eligible for the HIPAA package. The BAA comes with the add-on, so the Starter plan plus the add-on is $394 a month at the time of writing.

Is the GoHighLevel mobile app HIPAA compliant?

HighLevel says conversations, calendars and contacts in its mobile app "inherit the same encryption & MFA controls" once HIPAA is active. The phone itself is your responsibility: a screen lock, no shared logins, and a way to sign staff out of lost devices.

Can I move a HIPAA sub-account to another agency?

Only if both agencies have the HIPAA package. HighLevel says HIPAA-ready sub-accounts can be transferred only when both agencies are HIPAA compliant. How a normal transfer works is covered in how to transfer a GoHighLevel sub-account.

Is GoHighLevel HIPAA certified?

No, and nothing is. HHS does not certify software or vendors for HIPAA. HighLevel offers a HIPAA package with a BAA and security controls; it says it worked with The Compliancy Group on its own compliance. Treat any "HIPAA certified" badge on a GoHighLevel snapshot or agency site as marketing.

Can I text patients from GoHighLevel under HIPAA?

HighLevel lists SMS and MMS among the data its HIPAA package covers. Keep reminders to date, time, place and a call-back number, respect a patient's stated contact preference, and follow the separate TCPA consent rules for automated texts. HIPAA governs the health detail; the TCPA governs the automated sending.

Are GoHighLevel's AI agents covered by the BAA?

HighLevel's HIPAA article names only Reviews AI. It does not say whether Conversation AI or Voice AI are covered. Until HighLevel confirms in writing for your account, we set AI agents to handle booking and general questions only, and hand anything clinical to a person.

Can Autoesta set up GoHighLevel for HIPAA?

Yes, as a build partner. We configure the add-on, sub-account toggles, user roles, minimal-detail messages and integrations that keep PHI where a BAA covers it, all to your compliance lead's requirements. We are not lawyers and do not certify compliance. The first step is a free call and account audit.