GoHighLevel (GHL) signs a BAA only when an agency buys its paid HIPAA add-on, and each sub-account must then be enabled by hand. Accounts without the add-on are outside the BAA.
Is GoHighLevel HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available on any GoHighLevel agency plan with the paid HIPAA Compliance add-on; accounts and sub-accounts without the add-on enabled are excluded (last verified 2026-10-28).
The question is not whether the product is "compliant." It is whether a signed BAA covers the account where your PHI sits. For GoHighLevel, that depends on the add-on, the sub-account setting and the agency's own agreements with its clients.
Short answer
A BAA is available only with the HIPAA add-on, priced at US$297/month or $2,970/year, on any agency plan. The agency signs it self-serve in Settings > Compliance (Agency view). HIPAA then activates, and each sub-account is enabled manually. The add-on is non-refundable and cannot be removed once enabled. The vendor's help article states that accounts are not HIPAA compliant by default.
For other tools checked the same way, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
The BAA is tied to the add-on, not to a plan tier. No plan includes it by default. For background on the agreement itself, see business associate agreement (BAA) in the HIPAA glossary.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Any plan with the HIPAA Compliance add-on | Available | Self-serve purchase and signing; sub-accounts enabled manually | US$297/month or $2,970/year per agency account |
| Any plan without the HIPAA add-on | No | Not obtainable without the add-on | Not applicable |
Entry pricing: the Starter plan is $97/month, so the lowest cost of a plan with a BAA is $97/month plus the $297/month add-on ($2,970/year if paid annually).
What the BAA covers and what it excludes
Covered:
- The HighLevel platform (CRM, marketing automation, messaging) in sub-accounts where HIPAA has been enabled.
Excluded:
- Accounts and sub-accounts without the add-on enabled. A clinic's lead-intake sub-account that nobody switched over stays outside the BAA even if the agency has purchased the add-on.
- The agency's own HIPAA program and its downstream BAAs with client practices. The vendor's BAA covers the agency's relationship with HighLevel, not the agency's obligations to the practices it serves. An agency running appointment reminders for a dental group needs its own BAA with that group.
Security controls the vendor publishes
Only controls the vendor states are marked. Nothing is inferred.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
An evaluator who needs a SOC 2 report or confirmation of transport encryption should request them from HighLevel directly before approving PHI use.
How to use GoHighLevel with PHI
The BAA is one part of the arrangement. A shared-responsibility checklist for agencies and practices:
- Buy the HIPAA add-on and sign the BAA before any PHI enters the platform.
- Enable HIPAA on each sub-account that will hold PHI.
- Confirm no PHI sits in sub-accounts that are not enabled, for example old test accounts or imported contact lists.
- Execute downstream BAAs between the agency and each client practice.
- Configure role-based permissions so staff see only what their job needs, and review activity logs.
- Set staff policies and training for handling PHI in messages and forms.
- Check any automation that moves data out of GoHighLevel. Tools such as Zapier carry their own BAA questions; see Is Zapier HIPAA compliant?.
Compliance depends on the signed BAA, correct configuration and the organization's own policies. The add-on does not make an organization HIPAA compliant by itself. Because it is non-refundable and cannot be removed once enabled, decide before purchase. For program-level guidance, see HIPAA guides.
Alternatives with a BAA
These tools also offer a BAA under conditions. The list is alphabetical and implies no ranking. Verdicts and BAA starting plans are as recorded in this directory.
- ActiveCampaign: conditional; BAA from the Enterprise plan.
- Constant Contact: conditional; BAA on request, all plans.
- HubSpot: conditional; BAA from Marketing Hub Enterprise. See Is HubSpot HIPAA compliant?
- monday.com: conditional; BAA from the Enterprise work management plan.
- Piwik PRO: conditional; BAA from the Enterprise plan.
For marketing and CRM tools grouped by category, see HIPAA-compliant software by category.
Sources
- HIPAA Compliance With HighLevel — Help article, checked 2026-10-28. "enables encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement."
- HIPAA Compliance With HighLevel — Help article, checked 2026-10-28. "HighLevel accounts are NOT HIPAA compliant by default."
- HIPAA Compliance With HighLevel — Help article, checked 2026-10-28. "Our database automatically encrypts all data before it is written to disk."
- HIPAA Compliance in HighLevel — Vendor page, checked 2026-10-28. "The HIPAA add on is $297 per month (or $2,970 per year)."
- HIPAA Compliance in HighLevel — Vendor page, checked 2026-10-28. "Access Control: Role-based permissions and detailed user activity logs."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-28.
Does GoHighLevel sign a BAA?
Yes, with the paid HIPAA add-on on any agency plan. The agency signs self-serve in Settings > Compliance (Agency view). Without the add-on there is no BAA.
How much does the GoHighLevel HIPAA add-on cost?
US$297/month or $2,970/year. It is non-refundable and cannot be removed once enabled.
Is a GoHighLevel account HIPAA compliant by default?
No. The vendor's help article states that accounts are not HIPAA compliant by default. The add-on, the BAA and per-sub-account enablement come first.
Do I need to enable HIPAA on every sub-account?
Yes, on every sub-account that will hold PHI. Activating the add-on does not cover sub-accounts automatically; each is enabled manually. Sub-accounts without it are excluded from the BAA.