GoHighLevel HIPAA Setup Checklist: What to Do, in Order, Before PHI Touches the Account

GoHighLevel’s HIPAA setup is one checkbox you can never take back.

That’s not drama, it’s HighLevel’s own wording. The add-on, once active, can’t be cancelled, refunded, removed or downgraded, and the per-sub-account switch “cannot be turned off” (HighLevel help: HIPAA Compliance With HighLevel, checked Oct 2026). So the useful work happens before the click, and most of it has nothing to do with software.

Disclosure: I earn a commission if you sign up for GoHighLevel through links on this page. How that works is in the editorial policy.

This is general information, not legal advice. Confirm your obligations with a qualified healthcare compliance professional.

HIPAA obligations depend on your role, your contracts and your workflows. Nothing on this list, and no software setting, makes a practice compliant on its own — the add-on gives you safeguards that support compliance, and the rest is policy, training and judgement.

If you’re still deciding which CRM, start with the HIPAA CRM shortlist — that post compares platforms. This one assumes you’ve picked GoHighLevel and walks the setup in order. For context on who’s writing: I’ve spent 10+ years building websites and have done GoHighLevel funnel, CRM and automation work since 2022, including a multi-location rebuild for a two-location aesthetic med spa. This post sits in the CRM & Lead Management pillar.

What $297 a month actually buys

Here’s the whole package, from HighLevel’s own pages and nothing else.

The HIPAA help article describes an optional, account-wide add-on that “enables encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement” for US$297 a month, open to agencies on any plan. HighLevel’s HIPAA page adds an annual option at $2,970, AES-256 encryption, role-based permissions with user activity logs, in-app compliance documents, and an activation window of typically 48–72 hours after purchase (all checked Oct 2026).

Two things about that price trip people up.

First, it’s account-wide. Buy it once and it applies to every location in the agency — you don’t pay $297 per clinic. Second, the same article says accounts “are NOT HIPAA compliant by default.” There’s no partial version where your existing setup quietly qualifies.

What it doesn’t buy is a compliance program. HighLevel’s HIPAA page is blunt about it: “Your organization is ultimately responsible for meeting all HIPAA requirements.” The software gives you safeguards. It doesn’t write your policies, train your front desk, or stop someone texting a diagnosis.

Who’s who: the Practice, the agency and HighLevel

You need this straight before you sign anything, because the roles decide whose name goes on which contract.

HighLevel’s article frames it like this: the Practice — the clinic, med spa or counseling group — is the HIPAA-covered entity. HighLevel and the agency are both business associates. The article also points agencies to The Compliancy Group for help with their own side of compliance.

Translation: if you’re an agency, the HighLevel BAA covers your relationship with HighLevel. It does not cover your relationship with your client. That’s a second agreement, and you’re the one offering it.

If you’re a practice running your own GHL account, you’re the covered entity and the account holder. Fewer contracts, same obligations.

The pre-flight checklist (before you click buy)

Picture a two-location counseling practice on a Tuesday morning. The owner has already decided on GHL, the agency has a sub-account half-built, and someone wants to “just turn on HIPAA” before lunch. Stop there. Run these first.

1. Confirm the agency account is the right one. The add-on attaches to the whole agency and can’t be removed. If you run unrelated clients in the same agency, they’ll all sit under it. Some agencies choose a separate agency account for healthcare clients — weigh the cost of a second plan with the plan picker.
2. Map where PHI will live. Contacts, intake forms, appointment notes, call recordings, invoices. Write it down per sub-account.
3. List every outside tool that touches contact data. Zapier, Make, Google Sheets, a calendar sync, an analytics script. Each one becomes a question for step 7.
4. Book the compliance conversation. The roles above, your BAA with the practice, your risk analysis, and what counts as PHI in your workflows are legal and policy questions, not settings.
5. Check who can reach the HIPAA settings. HighLevel notes that access “may depend on the user’s assigned permissions.” Make sure the person buying is an agency admin.

The setup checklist, in the order HighLevel documents it

Every path below comes from the HIPAA help article. Menus move; if yours looks different, follow the article, not this post.

Step 1: Buy the package at the agency level

In the agency account, go to Settings > Compliance, read the Before You Buy details, and click Buy HIPAA Package at $297 per Month. You’ll see a note on features and an acknowledgement box. Read it — it’s the non-cancellable part — tick it, and click Pay $297 & Subscribe.

Step 2: Sign the BAA inside the app

No email chain with support. HighLevel’s HIPAA documents now live in its Documents & Contracts system: Settings > Compliance, the BAA section, View Details, then View Document. If the signer or business details are wrong, Edit Document fixes them before you sign. Once signed, download it and file it wherever your compliance records live. The article says the package activates at the agency level once the BAA is signed.

Step 3: Switch HIPAA on for each sub-account that needs it

This is the step people miss. The article says agency owners “must manually enable HIPAA for each sub-account” under Sub-Accounts > [Location] > Advanced Settings, using the HIPAA toggle. (The same article’s benefits list mentions automatic activation; the step-by-step section and its FAQ say manual. Check every healthcare sub-account’s toggle rather than trusting either.) Once it’s on, it stays on.

Step 4: Give every person their own login and the narrowest access

HighLevel’s user roles and permissions article splits access two ways. User Type decides where someone works — Agency, or Account limited to the sub-accounts you assign. Role and permissions decide what they can do there, down to turning modules off. There’s also an Only Assigned Data option that limits a user to records assigned to them, for supported record types — the article doesn’t list which, so confirm contacts are covered in your account before you rely on it.

Practical rule: no shared front-desk login, ever. One person, one user. The HIPAA Security Rule itself requires a unique name or number for identifying and tracking each user (45 CFR 164.312(a)(2)(i), checked Oct 2026).

Step 5: Require two-factor authentication

HighLevel’s security and compliance overview says portal administrators may require all users to have two-factor authentication enabled on the native login. Authenticator apps are supported; each user sets theirs up under Settings > My Profile > Security (2FA article). An admin can’t do it for them through Login As, so schedule a short session with each person rather than assuming it’s done.

Step 6: Put the audit logs on a calendar

Audit logs record who changed what, with field-level before-and-after values, at Sub-Account > Settings > Audit Logs for each location (Audit Logs article). The line to underline: “Audit Log entries are retained for 60 days and then purged.” If your process needs a longer record, export to CSV on a schedule — monthly is the obvious cadence — and store the files with your other compliance records.

Step 7: Close the gaps the docs don’t answer

You’ve probably noticed the pattern by now. HighLevel documents what’s covered. It doesn’t publish what isn’t. So step 7 is a list of written questions to HighLevel support and your compliance advisor, covered in the next section.

What’s covered, and what you still need in writing

The HIPAA article lists the objects that can store PHI and fall under the add-on: contacts, notes, custom fields, SMS/MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars and invoices. Conversations, Calendars and Contacts in the HighLevel mobile app “inherit the same encryption & MFA controls,” and Reviews AI responses in HIPAA-enabled sub-accounts follow HIPAA-compliant handling automatically.

What the article doesn’t address: Conversation AI and Voice AI, social and messaging channels, and third-party integrations. Silence isn’t a yes.

Area	What HighLevel’s docs say	Your move	Source
Contacts, notes, custom fields	Covered by HIPAA encryption	Map which fields hold PHI	HIPAA article
SMS/MMS, email bodies, voice recordings	Covered	Keep message content minimal anyway	HIPAA article
Forms, surveys, calendars, invoices	Covered	Review intake forms field by field	HIPAA article
Mobile app (Conversations, Calendars, Contacts)	Inherits encryption and MFA	Enforce 2FA for app users too	HIPAA article
Reviews AI	HIPAA handling automatic in enabled sub-accounts	Still never confirm someone is a patient in a public reply	HIPAA article
Conversation AI, Voice AI	Not addressed	Get a written answer before enabling	Ask HighLevel support
Social / messaging channels	Not addressed	Get a written answer per channel	Ask HighLevel support
Zapier, Make, other integrations	Not addressed	Separate BAA, or no PHI through it. Zapier says it doesn’t sign BAAs (Zapier)	Ask your compliance advisor
Audit logs	60-day retention	Scheduled CSV exports	Audit Logs article
Data deletion / retention	Recycle bin up to 30 days; no custom retention policies; deletion by written request	Write a deletion procedure	Security overview

Feature claims checked October 2026 against HighLevel’s help center and HIPAA page.

If you’re building AI agents for a practice, read the Conversation AI setup guide for the mechanics — then hold the switch until you have the support answer in writing.

Data handling: what stays on your desk

And that’s where most practices get it wrong. The platform’s part is encryption, a signed BAA, permissions and logs. Yours is everything people do with them.

Start with the two things the HIPAA Security Rule puts squarely on you: an accurate and thorough risk analysis, and a security awareness and training program for your workforce (45 CFR 164.308, checked Oct 2026). No vendor setting does either.

The security overview spells out a few customer responsibilities worth copying into your procedure doc: capture only appropriate information, manage your users and privileges, submit written requests when data must be deleted, and back up what you need. It also notes deleted contacts and opportunities sit in a recycle bin for up to 30 days, and that HighLevel doesn’t currently offer custom data retention policies. If a practice needs a retention schedule, that lives in your process, not a setting.

Then the habits no setting enforces. Generic appointment reminders — time and location, no treatment. Email subject lines that say “Your appointment” and nothing more. No PHI in tags or pipeline names that show up in dashboards and exports. A named owner for the monthly audit-log export.

Bear with me on this last one: write down who’s allowed to buy add-ons, connect integrations and toggle sub-accounts. On a platform where one checkbox is permanent, that list is a safeguard.

What it costs, all in

The add-on is the easy number: $297 a month, or $2,970 a year, account-wide. It sits on top of an agency plan — Starter $97, Unlimited $297 or Agency Pro $497 a month (pricing, checked Oct 2026) — plus usage for texts, calls and email. A single practice on Starter is looking at $394 a month before usage; an agency on Unlimited, $594. Put your message volume into the true-cost calculator and see what the GHL bill actually says for the usage lines. If you’re unsure which plan the practice needs, Starter vs Unlimited vs Agency Pro walks the tiers.

FAQ

Is GoHighLevel HIPAA compliant? Not by default. HighLevel says accounts are not HIPAA compliant until you buy the HIPAA add-on and sign its Business Associate Agreement. The add-on gives you encryption of ePHI, a BAA, audit logging and MFA enforcement, which support compliance. HighLevel’s HIPAA page still says your organization is ultimately responsible for meeting HIPAA requirements.

How much does the GoHighLevel HIPAA add-on cost? US$297 per month, or $2,970 per year, on any agency plan (checked October 2026). It covers every sub-account in the agency rather than billing per location, and HighLevel describes it as non-cancellable and non-refundable.

Can I turn HIPAA off in GoHighLevel later? No. HighLevel’s help article says the package can’t be cancelled, refunded, removed or downgraded, and that once you switch HIPAA on for a sub-account the setting cannot be turned off. Treat it as a permanent decision for the agency account.

Where do I sign the GoHighLevel BAA? Inside the app. HighLevel’s article says HIPAA documents live in its Documents & Contracts system: go to Settings > Compliance, open the BAA section, click View Details, then View Document. You can edit signer details, sign, and download the signed copy from the same place.

Does the HIPAA add-on cover Zapier or other third-party tools? HighLevel’s HIPAA article doesn’t cover third-party integrations. The BAA is between you and HighLevel. Assume any outside tool that receives patient data needs its own BAA with you, or must not receive PHI at all. Zapier, for one, says it doesn’t sign BAAs. Confirm the arrangement with your compliance advisor.

Do I need the HIPAA add-on if I only run marketing for a clinic? HighLevel positions the add-on for agencies that handle PHI and need contractual and product-level controls, including a BAA. Whether your specific workflows involve PHI is a legal question, so ask a qualified healthcare compliance professional before you decide you don’t need it.

One checkbox, a lot of homework

Back to that Tuesday morning and the person who wanted HIPAA “on before lunch.” They can have it — the buy button takes two minutes. But the checkbox is permanent, the BAA covers only one link in the chain, and the audit logs forget after 60 days unless someone exports them.

Do the pre-flight list, get the open questions answered in writing, then flip the switch. Check the current terms on HighLevel’s HIPAA page on the day you buy, because the only thing worse than a permanent checkbox is one you clicked on last year’s terms.

---

Related: HIPAA CRM in 2026: the shortlist · Multi-channel communications pillar · GoHighLevel pricing 2026