Dentists, chiropractors, med spas, therapists and clinics are among the businesses that benefit most from automated follow-up. They are also the ones with the strictest rules about patient information. That combination produces the same question in almost every healthcare sales call: can we use this legally?
This guide explains GoHighLevel HIPAA compliance in plain terms — what the HIPAA add-on is, what a business associate agreement covers, who is responsible for what, and the work that remains with the practice and its agency. It is general information, not legal advice. Have a qualified compliance adviser confirm the position for your own organisation.
Is GoHighLevel HIPAA compliant?
Not by default. A standard GoHighLevel account should not be used to store or transmit protected health information. HighLevel offers HIPAA compliance as a separate, paid, account-wide add-on. Once it is purchased and the business associate agreement is signed, the platform applies the additional safeguards and the legal agreement that HIPAA requires of a software provider.
Two things follow. First, software is never “HIPAA compliant” on its own; compliance describes how an organisation handles patient data, and the software is one part of that. Second, the add-on is a necessary step, not the whole job.
What the HIPAA add-on includes
According to HighLevel’s own documentation at the time of writing, the add-on provides:
- A signed business associate agreement (BAA) between HighLevel and the account holder.
- Encryption of electronic protected health information.
- Audit logging of activity within the account.
- Enforced multi-factor authentication for users.
There are commercial terms to understand before buying it:
- It applies to the whole agency account and every sub-account beneath it, not to a single location.
- Once enabled, it cannot be switched off, downgraded or refunded.
- It is billed monthly on top of the plan. HighLevel’s help centre has listed it at $297 per month; confirm the current price in your account before budgeting.
Because the add-on is permanent and account-wide, some agencies keep healthcare clients in a separate agency account from the rest of their business.
Who is responsible for what
HIPAA assigns roles, and it helps to be clear about them from the first conversation with a client.
| Party | HIPAA role | Main responsibilities |
|---|---|---|
| The practice | Covered entity | Patient consent, staff training, risk assessment, deciding what data is collected |
| The agency | Business associate | Its own HIPAA safeguards, a BAA with the practice, careful account configuration |
| HighLevel | Business associate | Platform security under the BAA once the add-on is active |
An agency that can see patient data is not a bystander. It needs its own policies, training and agreement with the practice. Many agencies overlook this and assume the software’s BAA covers them. It does not.
What the add-on does not do for you
- It does not make ordinary text messages and email secure. Standard SMS and email are not private channels. Keep clinical detail out of them, whatever plan you are on.
- It does not cover other tools. Automation connectors, form tools, AI services, call tracking and analytics each need their own BAA before patient data passes through them.
- It does not control advertising pixels. Tracking scripts on booking and intake pages can share health-related information with ad networks. Regulators have warned healthcare organisations about exactly this.
- It does not train your staff or stop someone sharing a login.
- It does not replace a risk assessment, which the practice must carry out and document.
A practical setup checklist
- Decide what data you actually need. Marketing rarely needs diagnoses or treatment notes. Collect the minimum.
- Enable the add-on and sign the BAA before any patient data enters the account.
- Sign a BAA between the agency and the practice.
- Give every user their own login with multi-factor authentication, and limit permissions by role. Our user roles and permissions guide explains how.
- Write reminder templates with minimal detail — date, time and practice name only.
- Review every integration and remove any that lacks a BAA.
- Audit tracking scripts on forms, funnels and booking pages.
- Separate marketing consent from appointment messages, and honour opt-outs at once.
- Document what you did and review it at least once a year.
Writing messages that respect privacy
Good practice is easy to show by example.
- Appropriate: “Hi Sam, this is a reminder of your appointment at Riverside Dental on Tuesday at 10:30am. Reply C to confirm or call us to reschedule.”
- Not appropriate: any message that names a condition, a procedure, a test result or an outstanding balance.
The same applies to review replies. Never confirm that a reviewer is a patient or refer to their treatment, even to thank them.
Which practices need this?
HIPAA is United States law and applies to covered entities — broadly, healthcare providers that bill electronically, health plans and clearinghouses — and to their business associates. Some businesses that feel medical, such as certain wellness or cosmetic providers, may not be covered entities, while others are. The answer depends on the facts, so the practice should take advice rather than guess. Practices outside the United States follow their own privacy laws instead.
For the marketing side of healthcare automation, see our guides for dental practices, chiropractors and med spas.
Questions to ask before you commit
- Is the practice actually a covered entity, and has that been confirmed by an adviser?
- What is the smallest amount of patient information the marketing system needs?
- Which other tools will touch that information, and does each have a BAA?
- Who at the agency will have access, and have they been trained?
- Does the agency have other, non-healthcare clients in the same account that would be affected by a permanent, account-wide add-on?
- What happens to the data if the practice ends the relationship?
Common mistakes
- Collecting too much on forms. A “reason for visit” free-text box invites patients to describe conditions in a system that only needed a name and a phone number.
- Using a standard account “just for marketing”. Contact details tied to a healthcare provider can be protected information.
- Sharing logins. One password used by the whole front desk defeats audit logging and access control.
- Connecting tools without checking. An automation connector or AI note-taker added later can quietly break the arrangement.
- Leaving ad pixels on intake pages.
- Assuming the add-on is the finish line. It is the starting point for a compliant setup, not the proof of one.
Most of these come from good intentions and a busy schedule. A written checklist, reviewed with the practice once a year, prevents nearly all of them.
Frequently asked questions
Can I enable HIPAA for just one sub-account?
No. The add-on applies to the entire agency account and all of its sub-accounts.
Can I turn it off later?
No. HighLevel states that it cannot be disabled or refunded once enabled, so decide carefully.
Is appointment-reminder texting allowed under HIPAA?
Reminders are widely used, provided they contain minimal information and the patient has agreed to be contacted that way. Confirm your approach with a compliance adviser.
Does the BAA cover my agency’s obligations?
No. It covers HighLevel’s role. The agency needs its own safeguards and its own agreement with the practice.
Do I need the add-on if I only collect names and phone numbers?
Contact details linked to a healthcare provider can still be protected health information. Do not assume a short form is exempt.
This guide is part of our GoHighLevel Setup Guides series — setup guides covering the whole topic.
