Skip to main content
Send Us Your Form, and  We’ll Convert It Into an Online Form  For Free.
phone icon(210) 809-6809
phone iconLog In

HighLevel

The HighLevel integration sends form submissions from HIPAAtizer into your HighLevel (GoHighLevel) location as contacts. Each time someone submits a connected form, HIPAAtizer creates a new contact or updates an existing one, using the fields you map. This lets you run your HighLevel automations, pipelines, and campaigns off HIPAAtizer form activity while all Protected Health Information stays inside HIPAAtizer.

Setup has two parts:

  1. Connect your HighLevel account once under Integrations → Integrated Accounts.
  2. Enable and map the integration on each form under Form Settings → Integrations → HighLevel.
HIPAA Notice

HighLevel is not HIPAA-compliant by default. Do not map fields that may contain Protected Health Information into HighLevel unless your organization has an executed Business Associate Agreement (BAA) with HighLevel and has configured the account for HIPAA compliance.

Map only non-PHI contact details (name, email, phone). If you need to reach the submission from the contact record, map a secure submission link into a custom field instead of copying answers across.

What counts as PHI?

Prerequisites​

Before you begin, make sure you have:

  • An active HIPAAtizer account with at least one published form. The integration is available on the Simple Compliance Gold plan and above.
  • A HighLevel sub-account (location) you have admin access to.
  • A HighLevel Private Integration token and the Location Id for that sub-account. Step 1 explains where to find both.
API version

HIPAAtizer supports HighLevel API V2, which uses a Private Integration token. This is the version you should use.

V1 is HighLevel's legacy API key format and remains in the interface only for connections that were set up before HighLevel migrated to V2. New keys issued by HighLevel are V2 keys and will not work if V1 is selected.

Step 1: Get Your HighLevel Credentials​

You need two values from HighLevel: a Private Integration token and the Location Id of the sub-account that should receive the contacts.

Private Integration token​

  1. In HighLevel, open the sub-account you want to connect.
  2. Go to Settings → Private Integrations.
  3. Click Create new integration, give it a name (for example, HIPAAtizer), and select the scopes it needs:
    • contacts.readonly
    • contacts.write
    • locations.readonly
    • locations/customFields.readonly (required if you plan to map custom fields)
  4. Create the integration and copy the token. It begins with pit-.
caution

Copy the token immediately. HighLevel will not show it again after you close the dialog, and you would need to create a new integration.

Location Id​

Your Location Id identifies the HighLevel sub-account that will receive the contacts. You can find it in Settings → Business Profile, or read it from the browser address bar while the sub-account is open: it is the value after /location/ in the URL. It looks similar to pOG38bJkqYt2LzbUGaVn.

Step 2: Connect Your HighLevel Account​

This is a one-time setup at the account level and applies to every form in the account.

  1. Go to Integrations (top menu) → Integrated Accounts → HighLevel.
  2. Under API Version, select V2.
  3. Paste your Private Integration token into the API Key field.
  4. Paste your Location Id.
  5. Click Authenticate your HighLevel Account.

If the credentials are valid, the connection is saved and becomes available to every form in your account. If authentication fails, see Troubleshooting.

tip

You can return to this page at any time to update the token, for example after rotating it in HighLevel, or to disconnect the account.

Step 3: Enable the Integration on a Form​

Repeat this step for each form whose submissions should reach HighLevel.

  1. Go to My Forms and click the Form Settings (gear) icon for the form you want to connect.
  2. In the left-hand menu, select Integrations, then choose HighLevel.
  3. Confirm the green Connected to HighLevel banner appears. If it doesn't, the account-level connection in Step 2 hasn't been completed.
  4. Check Automatically create a contact in your HighLevel account when the form is submitted. The mapping options appear below it.
note

The WorkflowId shown at the top of this panel identifies the form. If you contact support about this integration, include it: it lets us find the form and its integration logs quickly.

Step 4: Choose How Repeat Submissions Behave​

Under When a contact already exists, decide what HighLevel should do when someone submits the form more than once.

OptionBehavior
Update existing contact (recommended)Creates the contact if no match is found, otherwise updates the existing one. Matching uses the mapped Email and Phone values. This is the "upsert" behavior.
Create new contact onlyAlways creates a new contact, which produces duplicates when the same person submits multiple times.

Choose Create new contact only if each submission genuinely represents a separate record in your workflow. For patient intake, appointment requests, and most other forms, Update existing contact is the right choice.

Step 5: Map Standard Fields​

The Standard field mapping section connects HIPAAtizer form fields to HighLevel's built-in contact fields (Email, Phone, First Name, Last Name, Date of Birth, and so on).

  1. In the Field column, pick the HighLevel contact field.
  2. In the Form Field column, pick the form field that supplies the value.
  3. Click Add another field to map more fields.
  4. Use the delete (trash) icon to remove a row you don't need.
At least one is required

You must map Email or Phone, ideally both. These are the values HighLevel uses to identify a contact, so without one of them the integration cannot create or match a record.

caution

Map only fields that do not contain PHI. Diagnoses, symptoms, medications, insurance details, and free-text clinical notes should stay in HIPAAtizer.

Step 6: Map Custom Fields (Optional)​

The Custom fields section maps form fields to custom fields you've created in HighLevel. It works the same way as standard mapping: choose the HighLevel custom field on the left and the form field on the right.

Custom fields are useful for non-PHI context you want visible on the contact record: referral source, preferred location, appointment type, or a secure link back to the HIPAAtizer submission.

UTM values

HighLevel's API does not accept values into its built-in UTM fields. If you're capturing UTM parameters on your form, push them into HighLevel custom fields instead, then use a HighLevel workflow to copy those values wherever you need them.

Tagging contacts

To tag contacts in HighLevel based on which form they submitted, add a Paragraph element containing the tag value inside a row marked Internal Use Only, then map that field into a HighLevel custom field. The paragraph can hold a static value or a dynamic one built from other fields using ${uniqueName} variables. You can then drive tag automations from that value in HighLevel.

When your mapping is complete, click Save.

Step 7: Test the Integration​

  1. Open the form and submit a test entry. The Embed Form icon on the My Forms page gives you a shareable link or QR code for testing.
  2. Return to Form Settings → Integrations → HighLevel and expand Recent logs. A successful delivery shows a success status alongside the submission ID and time.
  3. Open Contacts in HighLevel and confirm the contact appears with the values you mapped.
note

The Recent logs panel is the first place to look whenever contacts stop arriving. The Details column carries the error returned by HighLevel, which usually points straight at the cause.

How It Works​

Once configured, the integration runs automatically on every submission of the connected form:

  1. Submission received: HIPAAtizer stores the full submission, including any PHI, inside your HIPAAtizer account.
  2. Mapped values extracted: only the fields you mapped in Steps 5 and 6 are collected for HighLevel. Nothing else leaves HIPAAtizer.
  3. Contact created or updated: HIPAAtizer calls the HighLevel API for your Location Id. With Update existing contact selected, HighLevel matches on the mapped Email or Phone and updates that record; otherwise it creates a new one.
  4. Result logged: the outcome is written to Recent logs on the form's HighLevel panel.

The integration is configured per form, so enabling it on one form does not affect any other.

Troubleshooting​

Authentication fails on the Integrated Accounts page​

Most often the API Version doesn't match the key format.

  1. Confirm V2 is selected. Keys issued by HighLevel today are V2 Private Integration tokens (beginning with pit-) and will be rejected under V1.
  2. Verify the token was copied in full, with no leading or trailing spaces.
  3. Confirm the Location Id belongs to the same sub-account the token was created in.
  4. In HighLevel, check that the private integration includes the locations.readonly scope: authentication uses it to validate the location.

The form panel shows no "Connected to HighLevel" banner​

The account-level connection hasn't been completed, or it was removed. Go to Integrations → Integrated Accounts → HighLevel and authenticate, then reopen the form's integration panel.

Save is rejected: no Email or Phone mapped​

HighLevel requires at least one identifying value. Map Email, Phone, or both in the Standard field mapping section before saving.

Contacts are not being created after submissions​

  1. Confirm Automatically create a contact in your HighLevel account when the form is submitted is checked and the settings were saved.
  2. Open Recent logs and read the Details column for the failed attempt.
    • A 401 or 403 means the token is invalid, was revoked, or lacks contacts.write. Create a new private integration in HighLevel with the required scopes and re-authenticate.
    • A validation error usually means the mapped Email or Phone field was left blank on that submission. Consider making the field required on the form.
  3. Verify the Location Id still points at the sub-account you're checking. Contacts created in a different location won't show up where you're looking.

Duplicate contacts appear in HighLevel​

Create new contact only is selected. Switch to Update existing contact (recommended) so repeat submissions update the matching record instead.

Duplicates can also appear when the form collects only a phone number on some submissions and only an email on others, leaving HighLevel nothing consistent to match on. Mapping both fields makes matching far more reliable.

A form field is missing from the Form Field dropdown​

The dropdown lists the fields on the current published version of the form. If you recently added the field, save and republish the form, then reopen the integration panel.

If a previously mapped field stops working after a form edit, its Unique Name most likely changed. Open the form in the Form Builder, confirm the field's Unique Name, then re-map it in the HighLevel panel.

A HighLevel custom field is missing from the Field dropdown​

HIPAAtizer reads your custom fields from HighLevel through the API. Confirm the custom field exists in the connected sub-account, and that your private integration includes the custom fields read scope. After adding a scope in HighLevel, re-authenticate on the Integrated Accounts page so HIPAAtizer picks up the change.

ON THIS PAGE