By Alpit Patel and the aibrevo team · October 6, 2026 · Updated October 13, 2026 · 7 min read
Is GoHighLevel HIPAA Compliant? The Add-On, the BAA and the Step Most Setups Miss
Quick answer
GoHighLevel is not HIPAA compliant by default. It becomes eligible for PHI only after the agency buys HighLevel's $297/month HIPAA add-on, signs the Business Associate Agreement, and turns HIPAA on in each sub-account. The add-on is permanent and non-refundable, and the agency still owes the practice its own BAA.
Part of the guide: GoHighLevel compliance
Key takeaways
- No, not by default. HighLevel's own help article says accounts are "NOT HIPAA compliant by default". HIPAA is a paid add-on at $297 per month for the whole agency account.
- Buying the add-on and signing the BAA activates HIPAA at the agency level. Each sub-account then has to be switched on by hand in Advanced Settings. A clinic sub-account left off is not protected.
- The add-on is permanent: it cannot be cancelled, refunded, removed or downgraded, because encrypted PHI cannot be un-encrypted.
- HighLevel signs a BAA with the agency. If an agency runs the account for a practice, the agency is a business associate too and needs its own BAA with the practice (45 CFR 164.502(e)).
- At $3,564 a year flat, the add-on costs $3,564 per clinic for an agency with one healthcare client and $178 per clinic with twenty.
No. GoHighLevel is not HIPAA compliant out of the box. HighLevel’s own help article (updated June 11, 2026) says accounts are “NOT HIPAA compliant by default”. It becomes eligible to hold protected health information (PHI) after three things happen: the agency buys the $297 per month HIPAA package, signs HighLevel’s Business Associate Agreement (BAA), and turns HIPAA on inside each sub-account that stores patient data. Most guides stop at the first two. The third is where clinic setups go wrong.
Checked on October 6, 2026 against HighLevel’s help article and the HIPAA Privacy Rule text at 45 CFR 164.502(e). This page explains the platform side. It is not legal advice; your compliance program and counsel decide what is appropriate for your practice.
How do you make GoHighLevel HIPAA compliant?
Follow HighLevel’s steps in this order. The last one is easy to miss.
- Buy the package. In the agency account, go to Settings > Compliance, read the “Before You Buy” details, click Buy HIPAA Package at $297 per Month, tick the acknowledgement box and click Pay $297 & Subscribe.
- Sign the BAA. In the same Compliance section, click View Details, then View Document. Use Edit Document if signer or business details are wrong, then sign. HighLevel says the package activates at the agency level automatically once the BAA is signed.
- Turn on HIPAA in each sub-account. Go to Sub-Accounts > [the clinic’s location] > Advanced Settings and switch the HIPAA toggle on. HighLevel calls this “the final hardening step for that location”. Once on, it cannot be turned off.
- Confirm it worked. Download the signed BAA from Settings > Compliance and keep it with your compliance records. Open each clinic sub-account’s Advanced Settings and check the toggle shows on. If a user can’t see the setting, check their user permissions; HighLevel notes access depends on them.
The step most setups miss
HighLevel’s article contains two statements that read like a contradiction: HIPAA “is enabled automatically once the BAA is signed”, and agency owners “must then manually enable HIPAA for each sub-account”. Both are true. The automatic part is the agency-level package. The manual part is every clinic’s sub-account. An agency that buys the add-on, signs the BAA and stops there has paid for protection that its clinic sub-accounts are not using.
What does the HIPAA add-on change in GoHighLevel?
According to HighLevel, the package adds:
| Control | What HighLevel says |
|---|---|
| Encryption | Data is encrypted before it is written to disk, using 256-bit AES with regularly rotated master keys |
| Business Associate Agreement | Included, signed and stored in Documents & Contracts |
| Audit logging | Enabled as part of the package |
| Multi-factor authentication | Enforced |
| Mobile app | Conversations, Calendars and Contacts inherit the same encryption and MFA controls |
| Reviews AI | AI-generated review responses follow HIPAA handling in HIPAA-enabled sub-accounts |
| Data types covered | Contacts, notes, custom fields, SMS/MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars, invoices |
That list is HighLevel’s description of its own platform. It covers data inside HighLevel. It does not cover data once it leaves.
Who needs a BAA with whom?
HIPAA treats this as a chain. The clinic is the covered entity. Anyone handling its patient data on its behalf is a business associate, and each link needs written assurances, usually a BAA. The rule is in 45 CFR 164.502(e), which also covers subcontractors of a business associate. For EU and UK patients and contacts, the separate question is whether GoHighLevel is GDPR compliant.
HighLevel’s article puts it plainly: HighLevel and the agency are both business associates, and “your Agency must also be in full compliance with HIPAA Title II so that you can provide your client Practice with a HIPAA Business Associate Agreement as well.” Buying the add-on covers the HighLevel link. It does not make the agency compliant, and it does not cover a workflow that pushes patient details to an outside tool.
Where do GoHighLevel clinic setups break HIPAA?
These failure patterns follow directly from how the rules above work. Each fix is configuration or process, not a second add-on.
| What you see | Why it’s a problem | Fix |
|---|---|---|
| Add-on paid, BAA signed, clinic sub-account toggle off | Agency-level activation does not harden the location | Turn on HIPAA in each clinic sub-account’s Advanced Settings |
| Workflow sends form answers to a spreadsheet, Slack or email digest | PHI leaves HighLevel to a tool with no BAA | Send only a “new lead” alert without health details, or use a tool that signs a BAA |
| Intake form asks for symptoms, medications or diagnosis on a public page | Collects more PHI than marketing needs | Ask health questions after booking, inside the protected sub-account |
| Text templates mention treatment or results | More detail than an appointment reminder needs | Keep texts to time, place and a callback number; record consent to text |
| Staff share one login | No individual audit trail; MFA undermined | One user per person, least-privilege permissions |
| Agency has no BAA with the clinic | The agency is a business associate without written assurances | Sign a BAA with each clinic before importing patient data |
| Healthcare and non-healthcare clients in one agency account | The add-on is account-wide and permanent | Decide deliberately; one option is a separate agency account for healthcare clients |
What does the add-on cost per clinic?
The fee is flat per agency account, so the cost per clinic falls as the number of HIPAA clinics grows. This matters if you are an agency deciding whether healthcare clients are worth taking on, or a clinic comparing an agency-run account with its own.
| HIPAA clinics on the account | Yearly add-on cost | Cost per clinic per year |
|---|---|---|
| 1 | $3,564 | $3,564 |
| 3 | $3,564 | $1,188 |
| 5 | $3,564 | $713 |
| 10 | $3,564 | $356 |
| 20 | $3,564 | $178 |
$297 x 12 months, divided by clinics. Add-on fee only, excluding the plan fee, messaging usage and setup. Source: HighLevel’s HIPAA article, checked October 6, 2026.
A single clinic running its own GoHighLevel account pays the full $3,564 a year on top of the plan. The GoHighLevel hidden costs guide lists the other add-ons and usage fees, and the pricing calculator totals a monthly bill.
When should a clinic get help with a HIPAA setup?
If the account already holds patient data, or you are moving records in from another system, an outside review is worth it before more data goes in. The common jobs are turning on HIPAA in every sub-account, removing PHI from workflows that send data out, rebuilding intake forms, and documenting the BAA chain.
aibrevo sets up and reviews GoHighLevel for clinics; see GoHighLevel for medical clinics for what that build covers. aibrevo works with its partner company autoesta, whose team delivers GoHighLevel builds; aibrevo’s CRM team scopes the project with you. Book a short call and bring a list of the tools your workflows send data to.
For examples of builds that handle health-adjacent data, see Ultra Cryo & Recovery, where the account was configured with HIPAA in mind, and Care Star Healthcare, whose paperwork workflows touch protected health information and need the right agreements in place.
Sources
- HighLevel Support, HIPAA Compliance With HighLevel, updated June 11, 2026: price, permanence, BAA steps, per-sub-account toggle, covered data types, mobile app, Reviews AI, encryption.
- HighLevel changelog, Editable BAAs and automatic HIPAA compliance.
- eCFR, 45 CFR 164.502(e), disclosures to business associates and subcontractors, checked October 6, 2026.