GoHighLevel HIPAA Setup: Steps, BAA and What Is Still on You

HIPAA in GoHighLevel is a setup you complete, not a setting that is on. HighLevel’s help article says accounts are not HIPAA compliant by default and that the package is an optional add-on for the whole agency account. This page is the order of work: what to click, what the article calls automatic, what it calls manual, and what neither covers. For the yes-or-no question and the BAA chain, see Is GoHighLevel HIPAA compliant?. This guide belongs to the wider GoHighLevel compliance hub.

Checked on 2026-10-13 against HighLevel’s HIPAA article (the extracted text I opened shows no date; our FAQ records it as updated June 11, 2026), HHS pages on business associates and email, and the HIPAA Privacy Rule. This is not legal advice. Your compliance officer or counsel decides what your practice needs.

What does the HIPAA add-on turn on in GoHighLevel?

It adds the controls HighLevel lists in its article: encryption of electronic protected health information, a Business Associate Agreement, audit logging, enforced multi-factor authentication, and HIPAA handling for the mobile app and for Reviews AI responses in HIPAA-enabled sub-accounts. The article says encryption applies automatically to stored data and that Google manages the keys.

Item	What HighLevel says
Encryption	Applied automatically to stored ePHI; keys managed by Google
BAA	Managed in Documents and Contracts; signer details editable without a support ticket
Audit logging and MFA	Part of the package; MFA is enforced
Mobile app	Conversations, Calendars and Contacts inherit the same controls
Reviews AI	Responses follow the package in HIPAA-enabled sub-accounts
Data types	Contacts, notes, custom fields, SMS/MMS, voice recordings, email, form submissions, calendars, invoices

Source: HighLevel Support, HIPAA Compliance With HighLevel, checked 2026-10-13. Our summary of HighLevel’s description of its own platform; it is not an audit.

What is automatic and what is manual?

The article describes both words. Agency-level activation is automatic: it says HIPAA is enabled once the BAA is signed, with no manual activation required for that. Sub-account activation is manual: it says “Agency Owners must then manually enable HIPAA for each sub-account.”

Those statements do not conflict. They describe two levels.

Level	Who does it	When
Agency account	HighLevel, automatically	After you buy the package and sign the BAA
Each sub-account	You, by hand	In Sub-Accounts, the location, Advanced Settings, HIPAA toggle

An agency that buys the package, signs the BAA and stops has paid for protection its clinic sub-accounts are not using.

How do I set up HIPAA in GoHighLevel, step by step?

Follow these in order. Menu labels come from HighLevel’s article; if yours differ, look for the same words.

1. Decide which sub-accounts need it. The toggle cannot be turned off, and the package cannot be removed. Healthcare and non-healthcare clients in one agency account share a permanent monthly cost, so decide this first.
2. Subscribe (agency view). Go to Settings > Compliance. Read the Before You Buy details. Use the purchase button for the HIPAA package, read the Note, Features and Acknowledgement section, tick the box and pay.
3. Sign the BAA. In Settings > Compliance, open View Details in the BAA section, then View Document. If the signer or business details are wrong, click Edit Document, change them and click Update Changes. Sign inside the same screen.
4. Download the signed BAA from the Compliance section and keep it with your compliance records.
5. Turn HIPAA on per sub-account. Go to Sub-Accounts > [the location] > Advanced Settings and switch HIPAA on. Once on, it cannot be turned off.
6. Check permissions. HighLevel says access depends on user permissions. If a user cannot see the settings, check their role.
7. Confirm it worked. Open each clinic’s Advanced Settings and check the toggle shows on. Open Compliance and check the BAA shows as signed.

If you are moving an existing HIPAA sub-account between agencies, the article says both agencies must be HIPAA compliant.

What do I still have to do after the toggle is on?

Run an audit of everything that touches patient data. The package protects data held inside HighLevel. HHS’s business-associate guidance says a covered entity may disclose protected health information to a business associate with satisfactory written assurances, and that a business associate must have a BAA with its subcontractor before disclosing PHI to it. HighLevel’s article makes the same point from its side: your agency needs to be HIPAA compliant itself so that you can give your client practice a BAA.

Where PHI may leak	Question to ask	Likely action
Workflows that call webhooks, Zapier-type tools or sheets	Does the tool receive patient details, and does it sign a BAA?	Remove the details, or send only a “new lead” alert
Intake forms and surveys	Do public pages ask for symptoms, medications or diagnoses?	Ask minimum necessary at booking; collect health detail inside the protected account
SMS and email templates	How much does each message reveal?	Keep to time, place and callback; no diagnoses or results
Shared logins	Can you tell who did what?	One user per person, least-privilege permissions
The agency-to-practice paper	Does your agency have its own BAA with each clinic?	Sign it before patient data goes in
Other tools in the stack	Ad platforms, call trackers, review sites	Do not send PHI unless a BAA is in place

Texting and email

HighLevel lists SMS and MMS as covered data, and A2P registration still applies; see the A2P registration steps. Messages travel over carrier networks outside HighLevel, so write each template on the assumption that a stranger might see the lock screen. On email, HHS’s FAQ says the Privacy Rule does not prohibit unencrypted email for treatment-related communications, but expects reasonable safeguards, including limiting the amount or type of information disclosed and verifying the address. Applying the same caution to text is our practice recommendation, not an HHS rule for SMS. Consent and opt-out for patient texts are in the TCPA consent guide.

What does HIPAA setup cost across several clinics?

The package is a flat US$297 a month per agency account regardless of how many sub-accounts you switch on, so the per-clinic share falls as you add HIPAA clinics. The worked table is in our HIPAA FAQ, and the hidden costs guide lists the other add-ons and usage fees. aibrevo’s own build prices are scoped per project; see pricing.

When should I get help with a HIPAA setup?

If patient data is already in the account, or you are importing records, have the account reviewed before more goes in. The usual jobs are switching on every sub-account, taking PHI out of outbound workflows, rebuilding intake forms and writing the BAA chain down. aibrevo’s medical clinics page shows what that build covers, and the GoHighLevel service page explains how scoping works. Legal sign-off stays with your counsel or compliance consultant.

Sources

• HighLevel Support, HIPAA Compliance With HighLevel: price, permanence, automatic vs manual wording, BAA steps, data types, permissions, agency obligations, transfers. Checked 2026-10-13; no date shown in the extracted text.
• HHS, Business Associates guidance: satisfactory assurances, BAA with subcontractors. Checked 2026-10-13 via text mirror (the direct page returned HTTP 403 to our fetch tool).
• HHS, FAQ 570 on email with patients: unencrypted email, reasonable safeguards. Checked 2026-10-13 via text mirror.
• Not verified: the exact toggle label wording in your current UI, and any activation delay after BAA signing (third-party guides mention up to 72 hours; HighLevel’s article does not).