Is GoHighLevel HIPAA Compliant? What the BAA Covers

What HighLevel Says

HighLevel, often called GoHighLevel or GHL, publishes a help article on HIPAA. As of its June 11, 2026 update, it states that accounts are not HIPAA compliant by default and describes HIPAA as an optional, account-wide add-on.

• The add-on is listed at $297 per month, on top of the agency's regular plan
• It includes a Business Associate Agreement signed inside the platform
• It adds encryption of stored data, audit logging and enforced multi-factor login
• HighLevel says the add-on cannot be cancelled, refunded or removed once purchased

How It Works in Practice

HighLevel is built for agencies that set up accounts for client businesses. The HIPAA add-on is purchased by the agency. After the agency signs the BAA, HIPAA has to be enabled for each client account, called a sub-account, one at a time. HighLevel notes that once HIPAA is enabled for a sub-account it cannot be turned off.

HighLevel also says the agency must itself comply with HIPAA in order to provide a BAA to a client practice. In HIPAA terms the practice is the covered entity, and both HighLevel and the agency are business associates.

What This Means for a Practice

• Signing up for a standard GoHighLevel plan does not give you a HIPAA-ready account
• Someone has to buy the add-on, sign the BAA and enable HIPAA on your specific account
• You need a BAA with whoever provides your account
• Your own policies, training and setup still matter

What Stays Your Responsibility

A BAA and technical safeguards are necessary, but they are not the whole of HIPAA. Covered entities are expected to have their own policies, risk analysis and workforce training. Keep the wording of emails, texts and reminders to the minimum needed. Before you connect outside apps or AI features to an account that holds patient information, check whether they are covered, since services from other companies may fall outside the BAA.

Where Aspire Builder Pro Fits

Aspire Builder Pro is a white-labeled platform built on HighLevel infrastructure for health and wellness businesses. Our HIPAA plan is $297 per month and includes a signed BAA, with HIPAA mode set up on your account for you. The Standard plan at $97 per month is for businesses that do not handle protected health information. See HIPAA Compliance at Aspire Builder Pro for who is responsible for what.