Is GoHighLevel HIPAA Compliant? What the Add-On Covers

Not by default. HighLevel's own HIPAA help article says GoHighLevel accounts are not HIPAA compliant out of the box. HIPAA support is a paid add-on at $297 a month that includes a business associate agreement (BAA), encryption of ePHI (electronic protected health information), audit logging and enforced multi-factor login, and an agency on any plan can buy it. The add-on makes compliance possible. It doesn't make your practice compliant: that depends on how you and your agency set up and use the account. This is not legal advice, so confirm every decision in this guide with your compliance advisor.

In short, Go High Level HIPAA compliance is something you set up, not something you buy. I build GoHighLevel sub-accounts for dental practices, physical therapy clinics and med spas, and I don't label any setup compliant, mine included.

While testing an AI receptionist for a med spa in Pennsylvania, my test caller asked whether a treatment was safe while breastfeeding. The agent didn't hand that question to the team. The caller was another AI and the contact was fake, so nothing reached a patient. The fix made the hand-off a tool call that runs first: the team gets notified, and the agent goes back to booking without giving medical advice. After the fixes, the phone test suite passed 14 of 15 questions.

That's the pattern for the whole account. The add-on protects what HighLevel stores. Your setup decides what gets stored and where it gets sent.

What is the GoHighLevel HIPAA add-on, and what does it cost?

HighLevel calls it the HIPAA Compliance package, and it's bought at the agency level. According to the help article (last modified June 11, 2026), it costs $297 per month and bundles four things: encryption of ePHI, BAAs, audit logging and MFA enforcement. HighLevel's HIPAA webinar page also lists a yearly price of $2,970.

Four details matter before anyone clicks buy:

• It's permanent. The help article says the package can't be canceled, refunded, removed or downgraded once it's enabled.
• It covers the whole agency. The article says it applies to all location accounts within the agency.
• The BAA depends on payment. HighLevel's Terms of Service (updated June 2026) say the BAA is contingent on an active, fully paid HIPAA subscription. If that payment fails, the BAA terminates immediately and automatically, and HighLevel is no longer your business associate for that account.
• Transfers need two compliant agencies. If you move your sub-account to another agency later, the article says that only works when both agencies are HIPAA compliant.

Put the payment clause on the practice manager's calendar. An expired card can end the contract the whole setup rests on.

On encryption, the help article says data is encrypted with 256-bit AES before it's written to disk, with keys managed by Google. HighLevel's Security and Compliance Overview adds TLS 1.2 or 1.3 in transit.

Does HighLevel sign a BAA, and on which plans?

Yes, as part of the add-on. The help article says agencies on any plan can subscribe. HighLevel's pricing page shows those plans as Starter at $97 a month, Unlimited, and Agency Pro at $497, and it lists HIPAA compliance as included in the Enterprise plan, which has no public price.

Who signs matters more than which plan. The article calls the practice the covered entity and calls both HighLevel and the agency business associates. Agency users view, sign and download the BAA under Settings > Compliance. HighLevel's changelog says signer details can now be edited inside the document, and that HIPAA turns on automatically once the BAA is signed.

The article adds a condition many practices miss. Before your agency can give you a BAA, the agency itself must be in "full compliance with HIPAA Title II." So there are two agreements in the chain: HighLevel signs with the agency, and the agency signs with you. Ask your agency for both, in writing. If your practice holds its own HighLevel account with no agency in between, confirm with HighLevel how the agreement applies to you.

Check one thing yourself. The same article also tells agency owners to switch on the HIPAA toggle for each sub-account under Sub-Accounts > the sub-account > Advanced Settings, and says it can't be turned off afterward. That sits next to the "automatic once signed" line, so I open every healthcare sub-account and look at the toggle. The webinar page says activation typically completes 48 to 72 hours after purchase, so don't load patient records on day one.

What does the HIPAA add-on cover, and what isn't documented?

The help article lists the objects that can store PHI, plus the mobile app and Reviews AI. For email, HighLevel's LC Email article says there is a signed BAA with Mailgun, and that you're covered while the HIPAA package is active. Here's what I found and didn't find on HighLevel's own pages, as of October 2026:

"Not mentioned" doesn't mean excluded. It means you ask HighLevel in writing and keep the answer next to your BAA.

The Security and Compliance Overview also points to HighLevel's Terms: customers are responsible for capturing only appropriate information. That's the part no add-on can do for you.

What does the practice still have to do itself?

The add-on is a vendor's promise about its own platform. Everything around it belongs to you or your agency.

• Decide what may be stored. The federal minimum necessary standard asks covered entities and business associates to make reasonable efforts to limit PHI to what the purpose needs. A CRM for booking and reminders needs far less than your chart.
• Get the agreements. Under the same section, a covered entity may let a business associate handle PHI on its behalf once it has satisfactory assurance that the information will be safeguarded. Every vendor that touches patient data is part of that question.
• Control who logs in. Give a user seat only to people who need one, remove staff who leave, and keep MFA on.
• Keep the subscription paid. See the Terms clause above.
• Set rules for the front desk. A note field holds whatever someone types. Write down what never goes into the CRM.

It also helps to know what counts. The federal definition of individually identifiable health information covers information about a person's past, present or future physical or mental health, the care they received, or payment for that care, when it identifies them or reasonably could. That's why I treat a tag like "knee surgery" on a named contact as patient information.

How do I set up a healthcare sub-account so PHI doesn't leak?

My rule is simple. GoHighLevel runs the conversation around the visit: inquiries, booking, reminders, recall and reviews. The clinical record stays in your practice management or EHR software. I explained that split for dentists in my dental CRM guide. Then I go place by place.

Tags

Tags describe where someone is in the relationship, never their body. "new-patient", "recall-due", "no-show" and "review-asked" are fine. "diabetic", "post-op" or "pregnant" are not. Tag names show up in contact lists, filters, workflow triggers and exports, so I write the naming rule into the handover document and audit inherited tags before go-live.

Custom fields

I replace free text with a short dropdown for the reason of the visit: cleaning, consult, follow-up, evaluation. A dropdown can only hold what you allowed. I don't create fields for diagnoses, medications or treatment notes, and I delete leftover template fields nobody uses.

SMS and email bodies

A reminder needs the day, the time, the place and a way to reply. It doesn't need the procedure. "Your visit is Tuesday at 3 PM, reply YES to confirm" does the job and gives nothing away if someone else glances at the phone's lock screen. I apply the same rule to emails and to internal notifications, which often land on staff members' personal phones.

For email, LC Email is where HighLevel documents a BAA. Any other sending provider needs its own answer.

AI agents

My chat bots for two med spas in New Jersey run behind what I call a medical-question wall. When a lead asks something clinical, the agent doesn't answer. It hands the topic to a human, notifies the team and goes back to booking. On the voice side, the reply to a medical question comes from the tool, word for word, and the team is notified before the caller hears it. A call can't be unsaid, so I don't leave that sentence to the model.

The agent's knowledge base gets services, hours, prices and policies, never patient records. The HIPAA article doesn't mention Conversation AI or Voice AI, so ask HighLevel in writing whether they fall under your BAA. If the agent runs on an outside voice platform, that platform is another vendor to ask. I cover the rest in AI voice agents in healthcare and in my GoHighLevel Conversation AI setup guide.

n8n and webhooks

This is where data leaves HighLevel. The workflow Webhook action sends the whole contact record with your custom data added on top, not only the field you had in mind. HighLevel's HIPAA article says nothing about data a workflow sends out, so I treat the server host, the n8n instance and any AI model it calls as separate vendors, each with its own BAA question.

In a healthcare account I send an ID and the minimum fields, not the record. I check what the n8n execution history saves and for how long. And I treat webhook URLs as secrets. On a mortgage build, a documentation site I made exposed live webhook URLs for about 10 hours, and they had to be rotated. My n8n GoHighLevel integration guide compares the three ways to connect the two.

Third-party integrations

Every marketplace app, Zapier connection and ad integration is another door. I learned that from my own voice AI app for GoHighLevel agencies. Installed in several sub-accounts, a dental practice's among them, it picked the first location row it found instead of the signed-in one. One sub-account could see another's call data. It took five fixes, and now a request without the right sign-in returns nothing.

Ad tracking deserves the same question. For a dental practice I set up click ID fields and Google Tag Manager so the ads could be measured. In a healthcare account, ask your advisor before any booking or conversion is sent back to Google or Meta.

What goes on the setup checklist?

Run this before a single real patient enters the sub-account.

1. Your compliance advisor confirms whether HIPAA applies and what the CRM may store.
2. The agency buys the HIPAA package knowing it can't be canceled, or is on Enterprise.
3. HighLevel and the agency sign the BAA under Settings > Compliance, and you keep a copy.
4. Your agency signs a BAA with your practice.
5. The HIPAA toggle is on in the sub-account's Advanced Settings.
6. Every user has MFA and the fewest permissions that work. Former staff are removed.
7. The card behind the HIPAA package is current, and a named person gets billing alerts.
8. Tag names follow a written rule, and visit reasons are dropdowns, not free text.
9. Every SMS, email and internal notification template is read for procedure or condition names.
10. Email goes out through LC Email or a provider that signs a BAA.
11. AI agents hand off every medical question to a human, proven with test questions.
12. You have HighLevel's written answer on Conversation AI, Voice AI and social channels.
13. Every webhook, n8n flow, marketplace app and integration is listed with what it sends.
14. Testing uses fake patients only.

On the last point: my dental demo account has 30 fake contacts, all with do-not-disturb switched on. Across my eight demo accounts, physical therapy included, 268 test journeys passed in the second round of testing. The method is in how I test GoHighLevel workflows.

If you'd rather start from a built system, the dental automation pack and the physical therapy pack are GoHighLevel snapshots with the workflows for $22 each. They don't buy the add-on or sign anything for you, so run the checklist first. For a done-for-you build, see my GoHighLevel setup service or the healthcare page. The calendar below is open if you want to walk through your account.

FAQ

Is GoHighLevel HIPAA compliant out of the box?

No. You need the HIPAA add-on, a signed BAA and a setup that keeps PHI where it belongs.

How much does the GoHighLevel HIPAA add-on cost?

$297 a month per the help article and the pricing page, or $2,970 a year per the webinar page. Enterprise includes it.

Can I cancel the HIPAA add-on later?

No. The help article says it can't be canceled, refunded, removed or downgraded once enabled.

Does HighLevel sign a BAA with my practice?

HighLevel signs with the account holder, usually your agency, and the agency must be HIPAA compliant before it can give you one. Ask for both agreements.

Is GHL Voice AI or Conversation AI covered by the BAA?

The HIPAA help article doesn't mention either, as of October 2026. Ask HighLevel in writing before an AI agent talks to patients, and keep its medical answers behind a hand-off.

What happens if the HIPAA payment fails?

Per HighLevel's Terms of Service, the BAA terminates immediately and automatically. Treat that card like rent.