HIPAA and virtual assistants: what a medical practice must put in place

A HIPAA virtual assistant is not a special category of person, it is a normal administrative assistant working under a signed business associate agreement with role-based access, documented training and audit logging. Your practice stays the covered entity. Get those four controls in place before the first login is issued and the rest follows.

This is a plain-language summary, not legal advice.

Who is the covered entity and who is the business associate?

HIPAA splits the world into two roles, and mixing them up is where most trouble starts.

You are the covered entity. Health plans, health care clearinghouses and providers who transmit health information electronically in connection with covered transactions are covered entities. A dental practice billing insurance electronically is one. A solo therapist submitting claims is one.

A virtual assistant company is a business associate. HHS defines a business associate as a person or entity that creates, receives, maintains or transmits protected health information on behalf of a covered entity. Scheduling, eligibility verification, prior authorization follow-up, referral coordination, patient calls and billing support all qualify.

Subcontractors are business associates too. If your assistant company uses a transcription vendor, a cloud storage provider or a telephony platform that touches PHI, each of those needs its own agreement in the chain. Ask the question directly: who else touches this data, and do you hold a BAA with them?

One thing the rules do not care about is geography. HIPAA imposes no US-only staffing requirement. What it requires is the agreement, the safeguards, the training and the ability to show who accessed what. A practice that cannot produce an access log for its in-house front desk is in a weaker position than one that can produce it for a remote team.

What has to be in the business associate agreement?

The BAA is signed before access, not after. HHS publishes sample provisions you can start from. At minimum it should nail down the following.

Add two practical clauses that are not required but save arguments later: a named point of contact on both sides for incidents, and a same-day access revocation commitment when a staff member leaves the account.

What does minimum necessary look like for a remote front desk?

The minimum necessary standard asks you to limit uses, disclosures and requests to what the job actually needs. In a practice management system that means building a role, not handing over a copy of the doctor’s login.

A workable scheduling and intake role:

• Full access: appointment book, patient demographics, contact preferences, insurance carrier and plan fields, recall and continuing care lists, referral tracking.
• Read only: treatment plan line items where scheduling or eligibility depends on the procedure code.
• No access: clinical notes, imaging, lab results, medication history, anything outside the administrative workflow.
• Never: shared logins, exported spreadsheets of patient data, screenshots in chat, PHI in email subject lines, full card numbers anywhere outside your payment portal.

The standard has exceptions. It does not apply to disclosures to a provider for treatment, to the individual, made under a valid authorization, or required by law. Most administrative work sits outside those exceptions, so build to the tighter rule.

What training is required, and how do you prove it?

Two separate requirements, both explicit.

The Privacy Rule requires training on your policies and procedures for every workforce member, as necessary and appropriate for their functions, plus retraining when policies change materially. The Security Rule separately requires a security awareness and training program covering malicious software, login monitoring and password management.

What proof looks like:

• A named curriculum with a version and a date.
• A roster of who completed it, with completion dates and an assessment score.
• A signed confidentiality acknowledgment per person, per client account.
• Refresher cadence written down, usually annual, plus event-driven training after a policy change or an incident.
• Role-specific modules, because a scheduler and a billing assistant handle different risks.

When you evaluate a provider, ask for the roster for the people who would work on your account, not a generic certificate. Names, dates, module versions. If that does not exist, the training probably does not either.

How do you log and review access?

The Security Rule is specific here, and it is the part practices most often skip.

• Unique user identification. Every person gets their own login in the practice management system. Shared credentials break the audit trail and end the conversation.
• Audit controls. Hardware, software or procedural mechanisms that record and examine activity in systems containing PHI.
• Information system activity review. Someone actually reads the logs on a schedule. Access reports, audit logs, security incident tracking.
• Automatic logoff and session limits. Particularly for remote desks.
• Authentication. Multi-factor authentication is the baseline expectation in 2026; CISA’s guidance is a good plain-English reference, and HHS has proposed making explicit technical controls of this kind mandatory in an update to the Security Rule.
• Risk analysis. A documented, accurate assessment of risks to the confidentiality, integrity and availability of PHI, refreshed when things change. HHS’s risk analysis guidance sets out what a real one contains.

A monthly review takes about twenty minutes: pull the access report for each remote user, check volume against expected workload, look for after-hours access and bulk exports, and file the result. Twenty minutes a month is also the evidence that you were monitoring.

Why can nobody be HIPAA certified?

Because there is no certifying authority. HHS does not endorse or recognize certifications issued by private organizations, and no federal program certifies a company as HIPAA compliant. Compliance is an ongoing state that depends on your policies, your controls and what actually happens day to day. A vendor can complete a course, pass a private audit or hold a SOC 2 report, and those can be useful. None of them is a HIPAA certificate, because that is not a real credential.

So when a provider offers a HIPAA certified badge, replace it with a document request:

1. The signed BAA, unredacted.
2. The training roster for the assigned staff.
3. A summary of the most recent risk analysis and remediation status.
4. The access control model they will apply in your system.
5. The incident response runbook with named contacts and timelines.
6. The subcontractor list for anything touching PHI.

AssistBPO staffs healthcare desks with HIPAA-trained staff and a BAA, with per-user logins, least-privilege roles set in your system and no PHI stored on local devices. Assistants are employed, managed staff working your hours. Plans depend on hours, desks and coverage. Get a staffing plan within 1 business day.

What happens when something goes wrong?

Assume it will, and rehearse it. Under the Breach Notification Rule, a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery. You then notify affected individuals within 60 days, notify HHS, and notify media where 500 or more residents of a state are affected.

Sixty days is the legal ceiling. Your operational deadline should be much shorter. A practical runbook:

• Hour 0: the assistant reports the incident to the team lead and to your named contact. Access suspended if needed.
• Hour 4: scope established. Which records, which users, which window, what was viewed or sent.
• Day 1: written incident summary to the practice. Preservation of logs and recordings.
• Day 3: risk assessment on whether the incident is a reportable breach under the four-factor test.
• Day 10: remediation confirmed, policy or access change made, training refreshed where relevant.

A go-live checklist before the first login

Work through this in order. Nothing below the line starts until everything above it is done.

• BAA signed by both parties, countersigned copy filed.
• Subcontractor chain confirmed, with agreements in place.
• Risk analysis reviewed or refreshed to cover remote administrative access.
• Role built in the practice management system with minimum necessary permissions.
• Unique login created per assistant, MFA enforced, no shared credentials.
• Session timeout and automatic logoff configured.
• Training roster received, with names, dates and module versions.
• Confidentiality acknowledgment signed per assistant for your account.
• Communication channels agreed: where PHI may and may not appear, never in chat or email subject lines.
• Call recording notice set, and patient identity verified before any detail is discussed.
• Monthly access review scheduled with a named reviewer at the practice.
• Incident contacts exchanged on both sides, with phone numbers.
• Offboarding process agreed: same-day revocation, return or destruction of any data, written confirmation.

Print it, tick it, file it. That file is the answer to almost every question an auditor or a worried patient will ask, and it takes an afternoon to build.