Last verified: October 2026, against HighLevel's HIPAA page and help center. General information, not legal advice — confirm with your compliance officer or attorney.
Is Go High Level HIPAA compliant? HighLevel's own answer starts with a no: "HighLevel is not HIPAA compliant by default." It becomes usable for patient data only after an agency buys HighLevel's HIPAA package, signs HighLevel's business associate agreement (BAA), switches HIPAA on for your practice's sub-account, and signs its own BAA with you. If your marketing agency built your funnels and texting in GoHighLevel, each of those links is worth checking.
Short answer from HighLevel's documentation
Short answer (verified October 2026): HighLevel says accounts are "NOT HIPAA compliant by default." To handle PHI, "your agency must purchase and activate the HIPAA module and complete a Business Associate Agreement (BAA)" (HighLevel (opens in a new tab)). The add-on costs "$297 per month (or $2,970 per year)," is open to "Agencies on Any Plan," and "cannot be canceled, refunded, removed, or downgraded once enabled." Agency owners must then "manually enable HIPAA for each sub-account" (help article (opens in a new tab)).
HighLevel adds that "Your organization is ultimately responsible for meeting all HIPAA requirements."
Agency accounts and sub-accounts: who signs the BAA
GoHighLevel is sold mostly to agencies. The agency holds the account; each client practice lives in a sub-account (HighLevel also calls them locations). HighLevel's help article describes the roles directly: the practice is "the HIPAA-covered entity," while "HighLevel and the Agency are considered 'HIPAA Business Associates.'"
That creates a chain, and every link needs a contract:
- Your practice and the agency. The agency handles your patients' data, so it's your business associate and needs a BAA with you.
- The agency and HighLevel. HighLevel is the agency's subcontractor. HIPAA's definition of business associate includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate" (45 CFR 160.103 (opens in a new tab)). A business associate may pass PHI to a subcontractor only with satisfactory written assurances (45 CFR 164.502(e) (opens in a new tab)). HighLevel's BAA is that assurance.
HighLevel's article doesn't describe practices signing anything with HighLevel directly. If the agency's BAA with you is missing, the chain is broken however HighLevel is configured. More on how these chains work in subcontractor BAAs.
Where PHI enters: funnels, forms, pipelines and conversations
| Entry point | Illustrative example | Why it's PHI |
|---|---|---|
| Funnel landing pages | "Do you have thinning hair? Take the 60-second quiz" | Quiz answers tie a named lead to a condition |
| Forms and surveys | "Reason for visit" or "Which treatment are you interested in?" | Health detail plus contact details |
| Appointment widgets | A booking for "Laser hair removal consult" | Name, time and service at a named practice |
| Pipelines | Stages named "Lip filler booked" or "Implant consult no-show" | The stage itself reveals treatment |
| Conversations inbox | Texts, emails and call recordings with leads and patients | Messages often contain symptoms and history |
HighLevel says the HIPAA add-on covers "All objects that can store PHI," and lists contacts, notes, custom fields, SMS/MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars and invoices. Conversations, calendars and contacts in the mobile app "inherit the same encryption & MFA controls." Coverage applies only in sub-accounts where HIPAA is switched on.
Settings and add-ons the answer depends on
- The HIPAA package. Bought under Settings > Compliance, then the BAA is signed in the app. HighLevel says activation "typically" takes 48–72 hours after purchase.
- The sub-account toggle. Sub-Accounts > the practice's location > Advanced Settings > HIPAA. HighLevel says, "Once enabled, this setting cannot be turned off." One part of the article calls activation "automatic," but its steps and FAQ say it's manual, so check the toggle yourself.
- Security controls. HighLevel lists AES-256 encryption, role-based permissions, user activity logs and MFA enforcement.
- Gaps in the documentation. The article doesn't address funnels, third-party integrations or AI features beyond Reviews AI, and doesn't say where data is stored. Get written answers for anything your sub-account uses.
Questions to ask your agency
Copy these into an email and keep the replies:
- Who owns the HighLevel agency account, and who owns our sub-account data?
- On what date did you sign HighLevel's BAA? Please send a copy.
- Is HIPAA switched on for our sub-account? Please send a screenshot of the toggle.
- Where is our data stored, and which integrations receive it?
- Are any ad pixels or analytics scripts on funnel pages that collect health answers?
- Will you sign a BAA with our practice, and does our contract cover breach notice?
- If we leave, how is our data exported, in what format, and when is it deleted?
HighLevel lets a HIPAA-ready sub-account transfer only "when both agencies have the HIPAA module enabled." Put the exit terms in writing before you need them; marketing agency contracts covers the clauses. If the agency is also pushing a different CRM, HubSpot and HIPAA runs the same checks.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
If you'd rather keep patient data out of GoHighLevel
Some practices keep the agency's tools for ads reporting and move patient requests somewhere they control. Options include an EHR or practice-management system you already pay for, or a dedicated patient CRM. Med spas comparing options can start with CRM for med spas.
Medfy is one alternative for the website side. Its HIPAA-compliant website forms send requests into a patient CRM and inbox, Medfy signs a BAA with your practice, and patient information is stored in separate, encrypted HIPAA databases in the US or Canada. See Medfy's HIPAA safeguards. A free marketing audit also flags pixels sitting on your current forms. Other tools are covered in HIPAA-compliant software.
Frequently asked questions
Does GoHighLevel sign a BAA?
Yes, with agencies that buy its HIPAA package, which HighLevel prices at $297 a month or $2,970 a year and says can't be canceled once enabled. The agency signs HighLevel's BAA inside the app. HighLevel doesn't describe signing directly with a practice that sits in an agency's sub-account, so your BAA is normally with the agency. Confirm your chain with your compliance officer or attorney.
Is my agency's GoHighLevel account covered by HIPAA?
Only if three things are true: the agency bought HighLevel's HIPAA package and signed its BAA, the agency switched on the HIPAA toggle for your sub-account, and the agency signed a BAA with your practice. HighLevel says accounts are not HIPAA compliant by default. Ask for the BAA dates and a screenshot of the toggle, and have your compliance officer or attorney review them.
Can we use GoHighLevel funnels for patient intake?
Form and survey submissions are on HighLevel's list of data the HIPAA add-on covers, so intake is possible in a sub-account with HIPAA switched on and a full BAA chain. HighLevel's article doesn't address funnels or integrations by name, so get written confirmation for your exact setup, including any tracking pixels on funnel pages, and review it with your compliance officer or attorney.
What happens to our data if we leave the agency?
HighLevel lets a HIPAA-enabled sub-account move only to another agency that also has the HIPAA module. Its HIPAA article doesn't describe exporting contact or conversation data, so agree the exit in your contract: what gets exported, in what format, how fast, and written confirmation that copies are deleted afterward. Have your attorney review the clause before you sign.