HIPAA does not name an add on, so the honest answer is that a practice needs a business associate agreement and safeguards with any vendor that handles its patients' information, and in GoHighLevel the $297 a month HIPAA add on is how that agreement and those safeguards are provided. The bottom line: if the account stores patient names with appointment or care information, treat the vendor as a business associate and buy the add on, and if the account holds no patient information, the question changes.
What HHS says about vendors
HHS's guidance on HIPAA and cloud computing, as summarized by Mintz and Bricker Graydon, says a cloud service provider that creates, receives, maintains, or transmits electronic protected health information for a covered entity is a business associate, even if it stores only encrypted information and has no key to read it. It says the conduit exception is limited to transmission only services with temporary storage incident to the transmission, and that OCR does not endorse, certify, or recommend specific technology or products. So no vendor is HIPAA certified, and no add on makes a practice compliant by itself. What matters is whether the vendor signs an agreement and whether the practice uses the tool safely.
Does a reminder count as protected health information
HHS permits appointment reminders as treatment communications, and a reminder that a named person has an appointment with a medical practice relates to the provision of care, so a list of patient names with appointment times in a CRM is generally treated as protected health information. A generic message with no name and no practice detail is lower risk, but the CRM that sends it still holds the list. Vendor guides add that GoHighLevel recommends avoiding protected health information in text and email messages even with the add on.
What GoHighLevel documents
GoHighLevel's help portal says accounts are not HIPAA compliant by default, and that HIPAA Compliance is a paid upgrade, $297 a month as an account wide add on, that must be enabled for the agency and then configured for the sub accounts that need it. Third party guides add that the add on provides a business associate agreement, encryption, audit logging, and multi factor authentication, that the practice also needs its own agreement with the agency, and that GoHighLevel itself recommends avoiding protected health information in SMS and email even with the add on. Whether the AI features are covered by the agreement is a question to put to HighLevel in writing before any patient data reaches them.
| Situation | What to do |
|---|---|
| The CRM stores patient names, appointment times, or notes | Buy the HIPAA add on, sign the agreements, and enable it for the sub account |
| The practice sends reminders from the EHR's own system and uses the CRM only for new patient leads with no care information | Ask counsel whether the lead data is protected, and keep the two separate |
| The practice uses Voice AI, Conversation AI, or the chat widget with patients | Get written confirmation that the AI features and the widget are covered |
| An agency runs the account | Confirm that the agency has its own agreement with the practice, since the chain has three parties |
Build it right
- List every place patient information would enter GoHighLevel: forms, calls, texts, the chat widget, and the calendar.
- Decide with your privacy officer whether the practice treats GoHighLevel as a business associate. For most practices that use it for patients, the answer is yes.
- Buy the HIPAA add on at the agency level, sign the agreement, and enable HIPAA on the practice's sub account.
- Sign a separate agreement between the practice and the agency, if an agency manages the account.
- Turn on multi factor authentication and role based access for every user.
- Write the reminder text so it carries no health information, and document patient texting preferences.
- Review third party integrations, since each one that touches patient information needs its own agreement.
Worked example
For example, at $297 a month the add on costs $3,564 a year (297 times 12). For a practice with 1,000 visits a month that is about 30 cents a visit (3,564 divided by 12,000), which is small next to the settlement amounts OCR has announced for small practices, such as $10,000 to $30,000.
Mistakes to avoid
- Assuming the add on makes the practice compliant. Policies, training, and safe use remain.
- Skipping the practice's own agreement with the agency. The chain has three parties.
- Putting health details in texts. Vendors advise against it.
- Forgetting integrations. Each needs review.
How this was handled before
Practices used reminder services from their EHR vendor or an automated calling company, each with its own agreement. HHS's cloud guidance clarified that a vendor that stores patient information is a business associate, which is why the agreement, not a product label, is the test.
What to measure after launch
Track sub accounts with HIPAA enabled, users with multi factor authentication, integrations reviewed, and agreements on file. Review the list of integrations each quarter.
Check before you switch it on
US text messages sent from a standard 10 digit number need A2P 10DLC registration. The HighLevel support portal says registration is required for texts to US recipients from 10 digit long code numbers and that toll free numbers do not require it. HighLevel's opt in guidelines also say a person cannot be forced to agree to text messages in order to submit a form, so keep the consent box optional. One compliance guide separates informational texts, which need documented consent, from marketing texts, which need prior express written consent. Ask your attorney which category your reminders fall into. This is general information, not legal advice. Have your privacy officer and counsel confirm the agreements before patient information enters the account. This is general information, not legal advice.
Questions people ask
Does HIPAA require a specific add on?
No. HIPAA requires safeguards and a business associate agreement with vendors that handle patient information. GoHighLevel provides its agreement through the add on.
Is any vendor HIPAA certified?
OCR does not endorse, certify, or recommend specific technology or products, according to its cloud computing guidance.
What does the GoHighLevel add on cost?
GoHighLevel's help portal says $297 a month as an account wide add on.
Ready to try it yourself? Start a GoHighLevel account here.
You can also see this in action in our GoHighLevel capabilities demo.