Guide

VAs — domestic and offshore: BAA, training, minimum access

Summary

Yes — a virtual assistant can work in a medical practice, domestic or offshore, if the arrangement satisfies HIPAA: a signed business associate agreement with the VA or their staffing company, role-based EHR access limited to what the task requires, and documented HIPAA training before their first login. The BAA is non-negotiable; skip it and every PHI disclosure to that VA is unauthorized, regardless of where the VA sits.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

Does HIPAA let you hire a virtual assistant?

Yes, and the mechanics are the same whether the VA works from your city or another country: HIPAA does not ban virtual assistants, it just treats any VA who creates, receives, maintains, or transmits protected health information on your behalf as a business associate — which means a signed business associate agreement has to exist before that access starts 1Ref 1HHS Office for Civil Rights (2026).Business Associates.Establishes that a VA (or VA staffing agency) handling PHI is a business associate requiring a signed BAA, and what that BAA must contain, regardless of the vendor's location.. If your practice already passes the covered-entity test, everything downstream about a VA follows from that same starting point.

A VA who only manages your personal calendar with zero patient names never triggers this. The moment the VA can see a patient name attached to an appointment reason, a phone message, or a portal inbox, the BAA requirement is live — there is no volume threshold and no grace period for "just a few hours a week." And if the VA's job later expands into marketing — posting photos and testimonials, or adding a tracking pixel to your website for ad targeting — that's a separate HIPAA question worth its own read before you hand off login access.

Domestic or offshore — what actually changes

Almost nothing changes on paper. The BAA and safeguard requirements attach to the vendor relationship handling your PHI, not to the vendor's location — the same contract elements apply whether the VA sits in Ohio or overseas 1Ref 1HHS Office for Civil Rights (2026).Business Associates.Establishes that a VA (or VA staffing agency) handling PHI is a business associate requiring a signed BAA, and what that BAA must contain, regardless of the vendor's location.. What changes in practice is your ability to audit and enforce it, and how quickly you can act if something goes wrong.

Many solo practices flag an offshore contract for an extra look at where the data actually lives and whether the staffing agency's own subcontractors are named — not because the law treats the arrangement differently, but because distance makes a bad BAA more expensive to discover late.

The BAA — five terms worth checking yourself

The BAA is a contract, and a VA staffing platform's boilerplate version does not always cover a solo practice's needs. HHS requires the agreement to describe permitted and required uses of PHI, mandate appropriate safeguards, require the business associate to report any breach back to you, and require return or destruction of PHI when the relationship ends 1Ref 1HHS Office for Civil Rights (2026).Business Associates.Establishes that a VA (or VA staffing agency) handling PHI is a business associate requiring a signed BAA, and what that BAA must contain, regardless of the vendor's location..

Permitted-use clause — spells out exactly what the VA may do with PHI (scheduling, insurance verification calls) and nothing broader.
Subcontractor flow-down — if the VA's staffing agency uses its own subcontractors, the same BAA terms must bind them too.
Breach-notice-back clause — sets how fast the VA or agency must tell you, so your own notification clock doesn't start late.
Termination return/destruction — what happens to PHI on the VA's device or shared drive once the contract ends.
Audit rights — your ability to request the agency's security documentation on request, not just at signing.

Minimum necessary access, not full chart access

The Privacy Rule's minimum necessary standard means a VA gets the narrowest slice of access their task requires, not a login that mirrors yours 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.Supports the minimum necessary access standard applied to VA role-based EHR permissions.. A VA who confirms insurance eligibility does not need to see progress notes; a VA who manages your inbox does not need billing history. Most EHRs support role-based permission tiers — use them from the VA's first day, not as a later cleanup project.

VA task	Typical access tier	What stays out of reach
Scheduling / reminders	Calendar and demographic view	Clinical notes, diagnoses
Insurance verification	Eligibility and demographic view	Progress notes, billing adjustments
Billing support	Claims and ledger view	Clinical documentation
Inbox triage	Message routing only	Full chart, unless the message requires it

Training before the VA's first login

A BAA sets the legal floor; training is what keeps a VA from tripping over it in week one. Build HIPAA basics into onboarding before credentials go out — what counts as PHI, why a patient's name plus an appointment reason is already protected, and what to do the moment something looks like it went to the wrong person.

Privacy Rule basics: what PHI is, minimum necessary in practice, no PHI in personal email or text messages.
Device and password policy: no shared logins, no PHI on personal devices without an approved setup.
Breach-reporting reflex: tell you immediately, not after trying to fix it quietly.
If the VA handles new-patient intake, add handing out the NPP correctly to their checklist.
A short written acknowledgment the VA signs — cheap insurance if you're ever asked what training you provided.

If the VA's access goes wrong

A misdirected fax, an email to the wrong patient, a shared drive left open — if it happens on the VA's watch, the notification clock is still yours. Breach of unsecured PHI requires notice to affected individuals without unreasonable delay and no later than 60 days, notice to HHS, and notice to the media if over 500 people are affected 3Ref 3HHS Office for Civil Rights (2026).Breach Notification Rule.Supports the 60-day breach notification timeline and to-whom requirements when a VA's access leads to a PHI breach..

If the VA is the one who discovers it, your BAA's notice-back clause should shrink how much of that 60 days you lose to finding out. And if the mistake touches a records request rather than a disclosure — the VA logged a request but didn't route it — the underlying right doesn't pause: patients get access within 30 days, with one 30-day extension available 4Ref 4HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.Supports the 30-day (plus one 30-day extension) patient records access timeline referenced when a VA handles records requests..

Employee or contractor — who's actually the employer

A domestic VA you hire directly and a VA sourced through an agency sit on opposite sides of a line that has nothing to do with HIPAA. Hire one directly, set their hours, and dictate how the work gets done, and the FLSA's minimum wage, overtime, and recordkeeping rules attach to you as their employer 5Ref 5U.S. Department of Labor (2026).Fair Labor Standards Act.Supports FLSA minimum wage, overtime, and recordkeeping obligations when a practice hires a domestic VA directly as an employee..

Source the VA through a staffing agency that controls scheduling, pay, and supervision, and the agency is usually the employer of record — your obligation narrows to the BAA and the access controls above. Either way, a first hire is also the point where federal EEO thresholds start counting toward you: 15 employees for Title VII and the ADA, 20 for the ADEA 6Ref 6U.S. Equal Employment Opportunity Commission (2026).Employers.Supports the federal EEO employee-count thresholds (15 for Title VII/ADA, 20 for ADEA) that a VA hire starts counting toward.. One VA won't reach those numbers, but note when the count begins.

Common questions

Yes. A phone message with a patient's name and callback reason, or a scheduling entry tied to an appointment type, is already PHI. The moment a VA can see, hear, or route that information, they meet HIPAA's definition of a business associate, and the BAA has to be signed before access starts — not after the first shift.

HIPAA does not prohibit an offshore VA by itself. The same BAA terms, safeguard requirements, and breach-notice-back clause apply regardless of where the vendor sits. Check your EHR vendor's and payers' own contract terms too — some restrict offshore data access separately from HIPAA, so the BAA is necessary but not automatically sufficient.

There's rarely a reason to grant it. Minimum necessary access means matching each VA's login to their actual task — scheduling, eligibility checks, inbox triage — rather than issuing a blanket clinician-level account. If a task genuinely needs broader access, document why; a login that outruns the job is the first thing an audit flags.

The notification obligation to affected patients, HHS, and — if over 500 people are affected — the media is yours as the covered entity, not the VA's or their agency's. A well-written BAA requires the VA to notify you immediately, which is what keeps your 60-day clock from running out before you even know.

It depends on who controls how, when, and where the work happens. Hire and direct the VA yourself and FLSA employer obligations likely attach; source them through a staffing agency that sets schedules and pay, and the agency is usually the employer of record. Either way, the HIPAA access rules above apply the same.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkEstablishes that a VA (or VA staffing agency) handling PHI is a business associate requiring a signed BAA, and what that BAA must contain, regardless of the vendor's location.
2.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkSupports the minimum necessary access standard applied to VA role-based EHR permissions.
3.HHS Office for Civil Rights (2026). Breach Notification Rule. U.S. Department of Health and Human Services. linkSupports the 60-day breach notification timeline and to-whom requirements when a VA's access leads to a PHI breach.
4.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkSupports the 30-day (plus one 30-day extension) patient records access timeline referenced when a VA handles records requests.
5.U.S. Department of Labor (2026). Fair Labor Standards Act. U.S. Department of Labor (Wage and Hour Division). linkSupports FLSA minimum wage, overtime, and recordkeeping obligations when a practice hires a domestic VA directly as an employee.
6.U.S. Equal Employment Opportunity Commission (2026). Employers. U.S. Equal Employment Opportunity Commission. link ✓Supports the federal EEO employee-count thresholds (15 for Title VII/ADA, 20 for ADEA) that a VA hire starts counting toward.

https://www.gale.care/for-providers/hsf-virtual-assistants-hipaa · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers