The short answer
Yes, but only with the HIPAA add-on. HighLevel accounts are not HIPAA compliant by default. The HIPAA package costs $297 a month on any plan, applies to the whole agency, includes a Business Associate Agreement signed inside HighLevel, and cannot be canceled, refunded or removed once enabled. The BAA stays effective only while the HIPAA subscription is active. Have a HIPAA professional review your setup.
How the BAA gets signed
An agency owner buys the package in the agency account under Settings, Compliance, after confirming the $297 monthly charge and ticking the acknowledgement box. The BAA is generated in HighLevel's Documents and Contracts system, where signer details can be edited, then signed and downloaded from the same Compliance section. Signing activates the package at agency level, but each sub-account that will hold patient data still needs its HIPAA toggle switched on under Advanced Settings, and that toggle cannot be turned off later. If the HIPAA subscription lapses, HighLevel says the BAA may expire automatically.
Who counts as the business associate
HighLevel's help article describes a chain. Your client, such as a medical or dental practice, is the covered entity, and both HighLevel and your agency are business associates. HighLevel signs its BAA with the agency and says it worked with the consultancy The Compliancy Group to meet the HIPAA Privacy Rule and Security Rule. For patient data to be protected end to end, HighLevel says the agency must itself comply with HIPAA Title II so it can sign its own BAA with the practice. HighLevel's agreement with you does not replace that second agreement.
What the add-on covers
Once HIPAA is on, HighLevel treats every object that can hold protected health information as covered, and its encryption runs at 256-bit AES with regularly rotated keys. Conversations, Calendars and Contacts in the HighLevel mobile app inherit the same encryption and MFA controls. The fee is charged once for the whole agency rather than per client, and HighLevel's Enterprise plan includes HIPAA compliance in its price. A HIPAA-enabled sub-account can be transferred only to another agency that is also HIPAA compliant.
- Contacts, notes and custom fields
- SMS and MMS messages, voice recordings, email bodies and attachments
- Form and survey submissions, calendars and invoices
- Reviews AI replies in HIPAA-enabled sub-accounts
More answers in HighLevel questions. For costs, see GoHighLevel pricing or run the cost calculator.