GoHighLevel HIPAA compliance: the $297 add-on explained

What the add-on turns on

With HIPAA active, HighLevel encrypts data and metadata under 256-bit AES, keeps audit logs and enforces multi-factor authentication. HighLevel's article lists the areas covered, including contacts, notes, custom fields, SMS and MMS, voice recordings, email, forms, calendars, invoices and mobile app features. The package also includes a BAA, the agreement in which a vendor that handles protected health information for a healthcare business commits to safeguarding it. HighLevel generates and stores its BAA in its own Documents and Contracts tool, and signer details can be edited there without opening a support ticket.

The terms to read before you buy

The permanence is the part agencies most often miss. Because the add-on applies to every location account under the agency and cannot be removed, enabling it for one healthcare client commits the agency to $3,564 a year for as long as the agency account exists. Work that cost into your healthcare clients' fees before you switch it on, and read HighLevel's current terms at the point of purchase.

• $297 a month, charged once for the whole agency account, not per sub-account
• HighLevel states the package cannot be canceled, refunded, removed or downgraded once enabled
• The BAA is tied to an active HIPAA subscription; HighLevel says that if the subscription lapses, the BAA may automatically expire (policy effective September 22, 2025)
• HighLevel cancels a HIPAA subscription if the BAA is not signed within 30 days
• HIPAA is switched on per sub-account, and once on, that setting cannot be turned off

Activation and sub-account settings

Activation follows the BAA. HighLevel sells the subscription inside the app, sends the BAA through Documents and Contracts, and turns HIPAA on automatically once the BAA is signed, with no manual activation request. The agency owner then turns on the HIPAA toggle in the advanced settings of each sub-account that needs protection, which HighLevel describes as the final hardening step for that location. Once a sub-account's toggle is on, it stays on. Decide in advance which sub-accounts will hold protected health information, and keep any healthcare client out of workflows or integrations you have not reviewed.

What the add-on does not do

HighLevel's safeguards cover the platform; they do not decide how a practice uses it. Whether a reminder text may mention the reason for a visit, which staff may open a patient record, how long data is kept and how a breach is reported are decisions for the practice and its compliance adviser. HighLevel's own article says your agency must also be in full compliance. The U.S. Department of Health and Human Services explains the Privacy, Security and Breach Notification Rules at hhs.gov, and a healthcare attorney or compliance professional should review any setup that will handle patient information.

When agencies consider it

Agencies serving dental offices, therapists, chiropractors and other healthcare providers are often asked by clients whether the platform will sign a BAA, and HighLevel's answer is yes, through this add-on. Whether a particular client needs HIPAA safeguards is a question for that client and its adviser, not for the agency to guess. HighLevel also describes itself as HIPAA ready on its privacy and security page and reports a SOC 2 Type II attestation, documents healthcare buyers often request alongside the BAA during vendor review.

Costs add up differently for every account. Put your numbers into the HighLevel cost calculator, or browse every HighLevel feature.

Cost your account Try HighLevel

Questions