Is GoHighLevel HIPAA Compliant? Cost, BAA and Setup

GoHighLevel is not HIPAA compliant by default. To use it with patient health information, you buy the GoHighLevel HIPAA add-on for US$297 a month, sign a business associate agreement (BAA) inside the app, and switch HIPAA on for each sub-account. Here is what it costs, how setup works, what you can never undo, and what the add-on does not do for you.

Everything below comes from GoHighLevel's help article HIPAA Compliance in HighLevel (last modified 11 June 2026), its pricing page and its HIPAA page, all checked on 12 October 2026. We explain the product. We do not give legal advice. Whether HIPAA applies to you, and what it asks of you, is a question for your compliance adviser.

The short answer

• By default: no. GoHighLevel says accounts are not HIPAA compliant out of the box.
• Cost: US$297 a month on top of your plan. Enterprise includes it.
• BAA: yes, signed in the app under Settings, then Compliance.
• Setup: buy it in the agency account, sign the BAA, then turn HIPAA on per sub-account.
• No way back: it cannot be cancelled, refunded or turned off.

Is GoHighLevel HIPAA compliant out of the box?

No. The help article says it in bold: "HighLevel accounts are NOT HIPAA compliant by default." GoHighLevel's HIPAA page says the same thing in its own words. A normal account, on any plan below Enterprise, does not come with the BAA or the extra controls. You have to buy them.

Here is what the add-on gives you, in GoHighLevel's words: "encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement." The help article says the database encrypts all data with 256-bit AES before it is written to disk. The HIPAA page adds role-based access control and "detailed user activity logs".

So think of the add-on as two things. A contract (the BAA). And a set of locks on the software (encryption, logs, forced two-step login). Both matter. Neither one decides who on your team gets a login, what they type into a text, or which other apps you plug in. That part stays with you.

The add-on gets you a BAA and some locks. Your team and your other apps are still on you.

How much does GoHighLevel HIPAA cost?

The add-on costs US$297 a month, on top of your GoHighLevel plan. The help article says agencies on any plan can buy it, and the buy button reads "Pay $297 & Subscribe". The Enterprise plan, which is priced by quote, lists "HIPAA compliance included in purchase".

Prices in US dollars from GoHighLevel's pricing page and the help article above, checked 12 October 2026. The plans also come yearly ($970, $2,970 and $4,970).

A few things the table does not show:

• Monthly or yearly. GoHighLevel's HIPAA page lists the add-on at "$297 per month (or $2,970 per year)". The help article and the buy button only show the monthly price. Ask support which one you will be billed before you pay.
• One price for the agency. The pricing page lists HIPAA at $297 a month with no "per sub-account" note. Other add-ons on the same list, like the AI Employee plans, do say "per sub-account".
• Usage is extra. Texts, calls, email and AI are billed through your wallet on top, like on any plan. Our GoHighLevel pricing guide breaks those fees down.
• No refunds. The help article calls the add-on "non-cancellable and non-refundable". It does not say what happens to it if you close the whole account. Ask before you buy.

Price it as a fixed cost. Once it is on, it stays on, and so does the bill.

Does GoHighLevel sign a BAA?

Yes. The BAA comes with the add-on, and you sign it inside the app, from the agency account. You do not need a separate tool for it. The help article says HIPAA documents now live in GoHighLevel's own Documents and Contracts system, so the old PandaDoc step is gone.

A BAA is the written contract HIPAA expects between a covered entity, like a clinic, and a company that handles patient information for it. The US Department of Health and Human Services explains what one has to cover on its Business Associate Contracts page.

To sign it, from the help article:

1. Go to Settings, then Compliance.
2. In the BAA section, click View Details.
3. Click View Document to open the BAA.
4. Click Edit Document if the signer or business details need changing. No support ticket needed.
5. Sign it on the page.
6. Download the signed copy from the Compliance section and keep it with your records.

If you are an agency building for clinics, your clients may ask you to sign a BAA with them too. How that chain should look is a question for their adviser and yours.

How do you turn on HIPAA in GoHighLevel?

You buy it in the agency account, sign the BAA, then switch it on for each sub-account by hand. The help article lays it out like this:

1. In the agency account, click Settings, then Compliance.
2. Read the "Before You Buy" details.
3. Click the button to buy the HIPAA package at $297 a month.
4. Read the note, the features and the acknowledgement. Tick the box and click "Pay $297 & Subscribe".
5. Sign the BAA (the steps above).
6. Go to Sub-Accounts, open the sub-account, go to Advanced Settings and turn the HIPAA toggle on.

That last step does not happen by itself. The help article calls it "the final hardening step for that location", and you repeat it for each sub-account. GoHighLevel's HIPAA page says activation is usually done 48 to 72 hours after purchase, so do not plan a launch for the same afternoon.

New to GoHighLevel? Build your funnels, forms and automations on the trial first, with made-up contacts. Our special link (we may earn a commission from this link) gets you a 30-day free trial plus a free live bootcamp. Sign up on GoHighLevel's own site and you get the standard 14 days, with no bootcamp. GoHighLevel says accounts are not HIPAA compliant by default, so keep real patient details out until the BAA is signed and the toggle is on.

Can you turn off HIPAA in GoHighLevel?

No. Not the add-on, and not the switch on a sub-account. Here is how the help article puts it:

• On the add-on: "Once enabled, HIPAA is permanent for your agency and cannot be canceled, refunded, removed, or downgraded."
• On the sub-account switch: "Once enabled, this setting cannot be turned off."
• Why: "Because PHI cannot be 'un-encrypted', the add-on is permanent for that agency."

So plan before you click. Know which sub-accounts will hold patient details and which will not. A demo account or your own marketing account may not need it, and once the switch is on, it stays on.

One more rule from the help article's FAQ: you can move a HIPAA sub-account to another agency, but only if both agencies are HIPAA compliant. If you might hand a client's account to another agency later, check that first.

Two switches, and neither one turns off. Decide before you click.

What does the GoHighLevel HIPAA add-on cover?

The help article says it covers "All objects that can store PHI: Contacts, Notes, Custom Fields, SMS/MMS, voice recordings, email bodies & attachments, form/survey submissions, calendars, invoices."

It also says:

• Mobile app. Conversations, Calendars and Contacts in the GoHighLevel mobile app "inherit the same encryption & MFA controls".
• Review replies. AI-written review responses "follow HIPAA-compliant handling automatically".
• Documents. HIPAA documents are made and kept in GoHighLevel's Documents and Contracts system.

Now the gaps. The help article does not list which features, if any, change or switch off when HIPAA is on. It does not mention Zapier, webhooks, outside integrations or connected apps at all. If patient details will leave GoHighLevel for another app, do not assume the BAA follows them there. Ask GoHighLevel support in writing, and ask your adviser whether that other app needs its own BAA.

Does the add-on make your practice HIPAA compliant?

No, not by itself. HHS says HIPAA's rules apply to covered entities, like health care providers, and to the business associates that handle health information for them. Its Covered Entities and Business Associates page is the place to start. The add-on covers GoHighLevel's part of that. Your part is the rest.

Things the add-on cannot decide for you:

• Who on your team gets a login, and what they can see.
• What your team writes in texts, emails and notes.
• Which other apps you connect, and whether they sign a BAA.
• Forms, chat or tracking on any website you run outside GoHighLevel.
• What happens when someone leaves your team.

The easy mistake is to buy the add-on, feel done, and then plug three other tools into it. Take this list and the signed BAA to your compliance adviser before real patient data goes in. They know the rules that apply to you. We don't.

Who needs the GoHighLevel HIPAA add-on?

GoHighLevel's own answer: "Agencies that handle PHI and require contractual and product-level controls (including a BAA)." That is a product answer, not a legal one.

The people who ask us about it are dental offices, medical clinics and med spas that want GoHighLevel for booking, reminders, intake forms and two-way texts with patients. Agencies with healthcare clients ask too. The add-on is bought in the agency account and switched on per sub-account, and the pricing page shows one $297 price, not a price per sub-account. If support confirms that for your account, an agency with several clinic clients spreads the cost across them. A single clinic carries it alone.

Whether HIPAA applies to your business at all is your adviser's call. Not ours, and not a sales page's. If they say it does, the add-on is how GoHighLevel offers the BAA. If they say it does not, you may not need to pay for it.

Ask your adviser whether HIPAA applies first. Buy the add-on second.

If you run a practice, our dental answering service guide and medical answering service guide list the privacy questions to ask any vendor that touches patient calls. They work for GoHighLevel too.

When is GoHighLevel the wrong choice for HIPAA work?

It is the wrong choice when you only need one or two jobs done. If your practice software already sends reminders and you just want that, GoHighLevel plus $297 a month buys you a second system to keep safe. That is more cost and more logins for little gain.

Healthcare-first tools are worth a look too. Weave, for example, sells itself to healthcare practices and publishes a Business Associate Addendum in its legal terms on getweave.com (last updated 10 April 2026, checked 12 October 2026). It does not show prices on its homepage. If you want a tool that starts from patients rather than marketing, compare it before you choose. Our GoHighLevel alternatives post covers six other tools, but it did not compare them on HIPAA, so check each one's BAA yourself.

GoHighLevel makes more sense when you want marketing and patient follow-up in one place. Booking, forms, texts, email and contacts in one account, under one BAA with GoHighLevel. Or when you are an agency with several healthcare clients. If that is you, start with our special link for the 30-day free trial and build with test data first.

One tool for everything sounds tidy. It only helps if you will use most of it.

What should you ask GoHighLevel before you buy HIPAA?

Ask these in writing, before you click "Pay $297 & Subscribe". The help article and the HIPAA page do not answer them:

1. Will I be billed $297 a month or $2,970 a year?
2. Is the price for my whole agency, or for each sub-account I switch on?
3. Can I read the full BAA before I pay?
4. Which features, if any, change or switch off when the toggle is on?
5. Does the BAA cover the AI features, the phone system and connected apps?
6. What happens to the add-on, and its billing, if I close my account?

Then take the answers and the BAA to your compliance adviser. That is the order: product questions to GoHighLevel, legal questions to your adviser.

FAQ

Is GoHighLevel HIPAA compliant?

Not by default. GoHighLevel's help article says accounts are not HIPAA compliant out of the box. You buy the HIPAA add-on for US$297 a month, sign the BAA in the app, then switch HIPAA on per sub-account. Whether that is enough for your practice is a question for your compliance adviser, not the software.

How much is the GoHighLevel HIPAA add-on?

US$297 a month on top of your plan, so $394 a month at the lowest on the Starter plan, before usage fees. GoHighLevel's HIPAA page also lists $2,970 a year, but the help article and buy button show only the monthly price. Enterprise includes HIPAA. All checked on GoHighLevel's own pages on 12 October 2026.

Does GoHighLevel sign a BAA?

Yes. The BAA comes with the HIPAA add-on. You sign it inside the agency account under Settings, then Compliance, and you can edit the signer details yourself without a support ticket. Once signed, download a copy from the same section. HHS explains what a business associate contract should cover on its own site.

Can I cancel the GoHighLevel HIPAA add-on?

No. The help article says that once enabled, HIPAA is permanent for your agency and cannot be cancelled, refunded, removed or downgraded. The switch on each sub-account cannot be turned off either. GoHighLevel's reason is that encrypted patient data cannot be un-encrypted. Plan which sub-accounts need it before you buy.

Is HIPAA included in any GoHighLevel plan?

Only Enterprise. GoHighLevel's pricing page lists "HIPAA compliance included in purchase" on the Enterprise plan, which is priced by quote. Starter at $97, Unlimited at $297 and Agency Pro at $497 a month do not include it. On those plans it is the $297 a month add-on.

Does the HIPAA add-on cover the GoHighLevel mobile app?

Partly, as far as the help article says. Conversations, Calendars and Contacts in the mobile app inherit the same encryption and two-step login controls. The article does not mention other parts of the app. If your team works from phones, ask GoHighLevel support in writing which screens the BAA covers.

Do I have to turn HIPAA on for every sub-account?

No. After you buy the add-on and sign the BAA, you turn HIPAA on by hand for each sub-account in Advanced Settings. Once on, that switch cannot be turned off. Which sub-accounts should have it depends on what data they hold, and that is a question for your adviser.

So, is GoHighLevel HIPAA compliant? Not until you pay for the add-on, sign the BAA and flip the switch on each sub-account that holds patient details. Even then, the software is only one part of it. Your team, your other apps and your adviser cover the rest.

GoHighLevel is the tool. Someone still has to do the work. If you run a clinic and would rather hand the marketing over, see how we work with dental practices, or see how Havstock Unlimited works. Either way, get your adviser's sign-off before the GoHighLevel HIPAA switch goes on.