On this page
Only with the paid HIPAA add-on. As of November 12, 2026, HighLevel says a signed BAA "is provided as part of the package" when an agency buys its HIPAA add-on, and that HIPAA must then be switched on for each sub-account. A GoHighLevel account without the add-on, or a sub-account where HIPAA was never turned on, has no BAA and should hold no patient details.
Checked November 12, 2026 on HighLevel's help article on HIPAA compliance, last modified November 10, 2026. Confirm the terms with HighLevel, or with the agency that provides your account, before patient details go in.
What does HighLevel say?
HighLevel sells HIPAA as an add-on at the agency level, on top of any of its plans, billed monthly. Its help article is blunt about the commitment: "Once enabled, HIPAA is permanent for your agency and cannot be canceled, refunded, removed, or downgraded."
The steps it describes:
- The agency owner buys the HIPAA add-on.
- In Settings, then Compliance, the owner opens the BAA section, reviews the agreement and signs it. The signed copy can be downloaded from the same place.
- For each sub-account that will hold patient data, the owner opens the sub-account's Advanced Settings and turns the HIPAA toggle on. HighLevel says "Once enabled for a sub-account, it cannot be deactivated."
HighLevel says the coverage reaches the objects that can store patient information, such as contacts, notes, messages, calendars and invoices, and that the mobile app is included. A HIPAA sub-account can move to another agency only if that agency also has HIPAA.
Who holds the BAA: you or your agency?
This is the part most practices miss. Many solo practices don't buy GoHighLevel from HighLevel. They get it from a marketing agency, often under the agency's own name, as one sub-account inside the agency's account.
In that setup, the add-on and the BAA with HighLevel belong to the agency. Your practice needs two things:
- Proof the chain exists. Ask the agency whether it has HighLevel's HIPAA add-on, and whether HIPAA is switched on for your sub-account. Ask for a screenshot of the sub-account setting.
- A BAA with the agency. The agency's staff can open your sub-account and read your contacts and messages. That makes the agency your business associate, and you need a BAA with it directly.
If the agency says "the platform is HIPAA compliant" but can't show either, treat the account as having no BAA.
What may go into GoHighLevel, and what to keep out
Without the add-on, use GoHighLevel the way you would any marketing CRM: for leads who have asked for information, with contact details only.
- Fine without HIPAA: name, email, phone, the ad or page they came from, and a pipeline stage such as "New lead" or "Call booked."
- Keep out without HIPAA: form answers about symptoms or goals, tags such as "weight-loss patient," lab status, visit notes and any text thread with an existing patient about their care.
With the add-on, the BAA signed and HIPAA on for your sub-account, patient follow-up can run there: reminders, reactivation messages and replies. Good habits still apply. Keep texts and emails general, because they land on a lock screen and in a personal inbox. Our follow-up message templates show wording that works without clinical detail.
What the add-on doesn't fix
- Connected tools. A workflow that sends contact data to Zapier, a spreadsheet, an AI tool or an ad platform moves it outside HighLevel's BAA. Each of those needs its own. See Is Zapier HIPAA compliant?
- Tracking pixels. A funnel page that asks health questions and also fires an ad pixel can send what the visitor did to the ad platform. Keep health questions off pages that carry ad tracking.
- Who can log in. Agency staff, contractors and former VAs often keep access. Give each person their own login and remove it when they leave.
- Snapshots and templates. A pre-built funnel from an agency may include a symptom quiz or condition tags. Check what it collects before you turn it on.
Where do practices slip up?
A typical case: a weight-loss practice signs with an agency that sets up a funnel, a "Do you qualify?" form and automated texts in GoHighLevel. The form asks about weight, health conditions and current medications. Leads become patients, and the same text thread carries on into dosing questions. Nobody asked about the HIPAA add-on, because the agency's sales page said "HIPAA-ready."
The fix isn't always to leave. It is to ask the two questions above, cut the health questions from the lead form if the answers are no, and move patient conversations to the EHR or a texting tool with a BAA. See HIPAA-compliant texting for a solo practice.
GoHighLevel or something else?
| Option | BAA | Plan |
|---|---|---|
| GoHighLevel | With the paid HIPAA add-on | Add-on bought by the agency, then HIPAA on per sub-account |
| HubSpot | Enterprise only | An Enterprise hub with sensitive data turned on |
| Your EHR's messaging and tasks | Covered by the EHR's BAA | Depends on the EHR |
| Spruce Health (texting and phone) | Yes | All trials and paid plans |
To check the rest of your stack, use the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does GoHighLevel sign a BAA?
Yes, as part of its paid HIPAA add-on. The agency owner signs it under Settings, then Compliance, and then turns HIPAA on for each sub-account (as of November 2026).
Can the GoHighLevel HIPAA add-on be cancelled?
No. HighLevel says that once enabled, HIPAA is permanent for the agency and can't be cancelled, refunded, removed or downgraded. A sub-account with HIPAA on can't have it turned off.
My agency gave me a GoHighLevel account. Is it covered?
Only if the agency bought HighLevel's HIPAA add-on and switched HIPAA on for your sub-account. Ask for proof, and sign a BAA with the agency too, since its staff can see your data.
Can I use GoHighLevel without the HIPAA add-on?
Yes, for leads and contact details only. Keep health questions, condition tags and patient conversations out of it.