HIPAA and VAs - Staying Compliant - Kate Walker Training

Why I Often Talk Clinicians Out of Hiring a VA

I want to start here, because this surprises people.

Sometimes, the most ethical move is not hiring a virtual assistant.

I see clinicians reach for a VA when what they really need is better automation. Scheduling software. A HIPAA-compliant EHR. Clear intake workflows. If the task can be handled by software, that’s usually safer than adding a human being into your protected health information ecosystem .

Before you hire anyone, ask yourself one question:

What am I actually trying to give away?

If the task is outside your zone of expertise or excellence—bookkeeping, accounting, back-end systems—then yes, outsourcing makes sense. But when the task involves client contact or records, we have to slow this down and think ethically, not just operationally.

What Makes Virtual Assistants Different in Private Practice

Most private practice owners don’t have a front office.

You’re not walking down a hallway to check on staff. You’re not overhearing phone calls. You don’t have informal oversight built into your environment.

That means a virtual assistant must be:

Highly self-directed
Able to follow written standard operating procedures (SOPs)
Comfortable asking for clarification without breaching confidentiality
Clear about boundaries around client information

This is not entry-level admin work. And it’s not something you “figure out as you go.”

The Biggest HIPAA Misunderstanding: Business Associate Agreements

This is where I see the most confusion.

A Business Associate Agreement (BAA) is something a company offers you—not something you offer an individual.

BAAs exist for entities that store protected health information, not just come into contact with it. Think Google Workspace, Zoom, EHR systems. These companies are saying, “If there’s a breach, we will share liability and responsibility with you” .

A virtual assistant is not doing that.

They are not storing your PHI.
They are not sharing financial liability with you.
They cannot realistically uphold the obligations outlined in a BAA.

So when I hear clinicians say, “I’ll just have my VA sign a BAA,” my response is usually: That doesn’t mean what you think it means.

What Actually Protects You When Using a VA

Training. Documentation. Due diligence.

HIPAA doesn’t require perfection. It requires that you do what a reasonable, ethical clinician would do to protect client information.

That starts with documented HIPAA training.

If a VA answers phones, touches billing, schedules clients, or interacts with client data in any way, they must complete formal HIPAA training and provide proof of completion .

This documentation matters.

In a HIPAA self-audit, you should be able to state:

All staff (licensed and non-licensed) complete HIPAA training
Training certificates are on file
Training is renewed regularly

HIPAA technically requires training once at hire. Texas House Bill 300 mirrors HIPAA but is more stringent. To stay on the safe side, annual training is a reasonable standard of care .

Due Diligence When Hiring a Virtual Assistant

If you’re hiring through platforms like Upwork or Fiverr, don’t assume you’re starting from zero.

Some virtual assistants specialize in working with protected health information. That matters.

When I interview VAs, I listen for language like:

“I already work with HIPAA-sensitive data.”
“I’ve completed HIPAA training and can provide documentation.”
“I understand client confidentiality expectations.”

If someone advertises HIPAA experience, you shouldn’t have to teach them from scratch. That’s part of your due diligence as a practice owner .

Passwords, SOPs, and the Myth of ‘Tech Fixes’

Let’s be clear: password managers and two-factor authentication are good practice—but they are not HIPAA compliance by themselves.

Tools like LastPass can help you share access without revealing passwords. Two-factor authentication adds another layer of protection. These belong in your SOPs.

But HIPAA is still about people.

It’s about whether you trained them, documented that training, and limited their access to only what they need to do their job .

When Software Is the Better Ethical Choice

I’ll say this plainly: most clinicians don’t need a VA to interact with PHI.

Modern EHRs handle:

Scheduling
Secure messaging
Notes and documentation
File storage

If it’s just you in practice, it’s worth asking why calls aren’t being returned directly, or whether the system—not a person—is the real problem .

Sometimes the most ethical move is tightening your systems, not expanding your staff.

The Ethical Bottom Line

Using a virtual assistant HIPAA compliant is not about paperwork tricks.

It’s about:

Knowing when a VA is actually needed
Understanding that BAAs don’t apply to individuals
Training and documenting thoroughly
Limiting access intentionally
Choosing systems over people when possible

HIPAA compliance is less about fear—and more about clarity.

When your systems are solid and your documentation is clean, you don’t have to panic. You can practice ethically, confidently, and sustainably.

HIPAA and VAs – Staying Compliant

Badass Therapists Building Practices That Thrive #166 Using a Virtual Assistant in Private Practice Without Violating HIPAA