Is GoHighLevel HIPAA Compliant? What the BAA Covers in 2026

The law (often searched as HIPPA compliance) protects health information that can identify a person, such as a name tied to an appointment, a treatment note or a form answer about symptoms. The legal term is protected health information, or PHI. Two groups carry the duties.

Covered entities and business associates

A covered entity is a health plan, a clearinghouse, or a healthcare provider that sends health information electronically in standard transactions such as insurance claims. A business associate is any outside company that creates, receives, stores or sends that information on the practice's behalf. Your CRM vendor is one, and so is the marketing firm that runs it. Practices need written business associate agreements in place before patient details change hands, as the HHS guidance explains.

Where agencies fit

If you manage accounts for clinics, you sit in the middle. HighLevel's article treats the practice as the regulated party, with the vendor and the marketing firm both acting as business associates. That means you need your own BAA with each client, and the article says you must already meet the rules yourself before you can offer one. The vendor can also introduce you to The Compliancy Group to help.

Many cash-pay med spa and aesthetics businesses are not covered entities at all, because they never bill insurance electronically. Most still choose to follow the same rules, since patients expect it and state privacy laws can apply either way. Ask a healthcare attorney if you are unsure which side you are on.

Passing the cost on to practices

One package protects every sub-account you switch on, so the cost per practice drops as you add more of them. Spread across five practices, $297 works out to about $59 each a month; across ten, about $30. You can bill it as its own line or fold it into your monthly retainer. Either way, tell each practice it exists, so nobody is surprised when you explain why their texts and forms work the way they do.

According to HighLevel's help center article, the package turns on four protections across your whole account:

• Data protection: Data is encrypted before it is written to disk with 256-bit AES, under master keys that are rotated regularly. Data in transit uses TLS 1.2 or 1.3.
• A signed agreement: The BAA is generated in the app, signed there and stored in Documents & Contracts. There is no separate PandaDoc step any more.
• Audit trail: Actions and events in the account are logged, so activity on protected records is on file.
• Enforced sign-in: Admins can require MFA for every user. Conversations, Calendars and Contacts in the mobile app inherit the same controls.

Which data the package covers

The FAQ lists contacts, notes, custom fields, SMS and MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars and invoices. In the article's words, that is "everything the account has."

Where the data lives

HighLevel's security overview says product infrastructure runs on Google Cloud and AWS data centers in the United States, with daily backups kept for seven days. The company holds a SOC 2 Type II report and an ISO/IEC 27001:2022 certificate. Those are useful evidence for your risk assessment, but HHS does not certify products or recognize private certificates for the Security Rule, so be wary of any vendor that claims an official seal.

The package costs $297 a month or $2,970 a year, and you can add it to any plan. It sits on top of your normal subscription, so the monthly total looks like this:

See our GoHighLevel pricing breakdown for what each plan includes. Usage charges for texts, emails and calls are billed on top, as on any account.

Read this before you pay

• The package is non-cancellable and non-refundable, and it cannot be downgraded or removed. There is no way to un-encrypt protected data, so the choice is permanent.
• Once you switch protection on for a sub-account, that toggle cannot be turned off either.
• A protected sub-account can only be transferred to another account that also has the package.

1. In your main account view, open Settings, then Compliance.
2. Read the Before You Buy notes, tick the acknowledgement box and pay for the package.
3. In the BAA section, click View Details, then View Document. Fix the signer or business details with Edit Document if needed, then sign. You can download the signed BAA from the same screen.
4. Wait for activation. The package switches on once the agreement is signed, and HighLevel's product page says this typically takes 48 to 72 hours.
5. For each client account that will hold patient details, go to Sub-Accounts, open the account, choose Advanced Settings and turn its toggle on.

If a team member cannot see these screens, check their user permissions first. If you would rather hand off the setup, configuration and implementation, our GoHighLevel specialists can do it for you.

This is where most practices get caught out. The package makes the software HIPAA-eligible. It does not make your practice compliant.

Your own policies and training

You still need a risk assessment, written rules for who can see patient details, staff training, and a plan for handling incidents. Under the notification rules, patients affected by a breach must be told without unreasonable delay and no later than 60 days after discovery, and a business associate must report to the practice within the same window.

Connected apps outside the BAA

The BAA covers HighLevel's platform, not the apps you connect to it. Zapier says it is not compliant and will not sign one (its own statement), so no patient details should pass through a Zap. The same goes for any integration, email tool or ad account a third party runs: each one needs its own BAA before health information flows into it. Map every tool in your stack before launch.

AI features

The help article names one AI tool: in protected sub-accounts, AI-written review replies follow HIPAA-compliant handling automatically. It says nothing either way about Conversation AI, Voice AI or other assistants. Until the vendor confirms coverage in writing, don't let an AI bot read, summarize or answer messages that contain health details. Our AI features guide explains what each one does.

Clinical records

GoHighLevel is a marketing and booking system, not an electronic health record (EHR). Keep diagnoses, treatment notes and the patient chart in your clinical system, and keep only what you need for booking and follow-up in the CRM. A large healthcare group that needs a two-way link to its records system should plan that connection with its IT team.

Most problems come from habits carried over from a non-medical account, not from the package itself.

• Importing too early: Old patient lists go into the account only after the BAA is signed and the sub-account toggle is on. Anything uploaded before then sat in an unprotected account.
• Staff alerts sent to personal inboxes: Internal notification steps often email new form answers to a manager's Gmail. Send a short alert that says a new enquiry arrived, and keep the details inside the app.
• Reports that copy everything: Exporting contact lists to spreadsheets for weekly reports moves health details outside the BAA. Use the dashboards in the account instead, or cut the export down to counts.
• Shared logins: One login for the front desk makes the activity log far less useful, because you can no longer tell who opened a record. Give every person their own user.
• Forgetting the practice's own agreement: Your BAA with the vendor covers you. The practice still needs a signed agreement with you, and that paperwork is yours to prepare.

Once the package is live, a few habits keep exposure small.

• Collect less: Use the form builder to create forms for intake that ask only what booking needs. Save sensitive answers to dedicated custom fields so you control who sees them.
• Keep messages generic: Write each SMS template so it says when and where, never why. "Your visit is at 3pm Tuesday" is fine; naming a treatment is not. The same goes for a missed-call text-back reply, which should only invite the caller to book.
• Limit access: Give staff role-based permissions, enforce MFA and remove users the day they leave.
• Automate carefully: Workflow automation is safe when every step stays inside protected sub-accounts. Avoid steps that push details to Slack, Google Sheets or a webhook that has no BAA.
• Book inside the account: The built-in calendar keeps the schedule and the reminder history in one protected place, and appointment texting stays in the same inbox.
• Leave card data to your processor: Card numbers are not stored in the account. Each payment runs through a processor such as Stripe.

Start from a ready-made build

A snapshot copies pipelines, workflows and forms into a new account, but it does not bring protection with it. Load it into a sub-account that already has its toggle on, then review every message before launch. Ready-made builds exist for an aesthetics clinic, and the dental package includes 20 workflows and three patient pipelines. The chiropractor package lists 2 pipelines and 18 workflows.

Here is how a typical new-patient journey runs once everything is switched on, and what each step should and should not contain.

1. A visitor fills in a short enquiry form on your site: name, phone, email and the service they are interested in. Detailed medical history waits for the first visit.
2. An automated step tags the contact, creates an opportunity in the new-patient pipeline and sends a text with a booking link.
3. The patient picks a slot. The appointment confirmation and reminders mention only the date, time, location and what to bring.
4. After the visit, an automation sends a thank-you message and a review request. Neither names the treatment, because a review request is still a message about someone's care.
5. If the patient goes quiet, a follow-up sequence offers to rebook. Staff see the full history in the conversation thread, all inside the protected sub-account.

Every step stays in one place, nothing leaves through a tool without a BAA, and a message glimpsed on a patient's lock screen reveals nothing about why they visited.

Put these to HighLevel support, or to the marketer who will run your account, and keep the answers in writing.

• Which AI tools does the BAA cover, and which should stay off in a protected sub-account?
• Which of the connected apps we rely on will sign their own agreement?
• Who on the team will have access, and what can each role see?
• How do we export our records if we ever leave the platform?
• Who responds to an incident, and how fast will we hear about it?

It suits you if

• You run a cash-pay or small private practice, such as an aesthetics, physical therapy or chiropractic office, and want booking, reminders, reviews and follow-up in one place.
• You manage marketing for several practices and want one $297 package to cover every sub-account you protect.
• Your staff already work in the GoHighLevel CRM and you would rather protect it than replace it.

Look elsewhere if

• You need a patient portal for records, lab results or secure document exchange.
• Your main need is clinical charting or insurance billing.
• You can't keep patient details out of tools that won't sign their own agreement.

Weighing other systems first? Our Keap comparison sets pricing and features side by side.