If your VA leaves or isn't performing, your Customer Success Manager coordinates a replacement at no cost. Managed plans include free replacements, forever.
Quick answer: A virtual assistant's HIPAA compliance depends on the working arrangement, not a credential. You need a signed business associate agreement (BAA) with whoever employs the assistant, access limited to the minimum necessary, unique logins with audit logs, controlled devices, and a written duty to report breaches. HHS does not certify anyone as HIPAA compliant, so a badge on a website proves little. Whichever provider you choose, including Stellar Staff, get the BAA terms and the safeguards in writing before any patient data is shared.
Why No Virtual Assistant Is HIPAA Compliant on Their Own
Search for a HIPAA-compliant virtual assistant and you'll find many providers that advertise HIPAA compliance on the homepage. HHS says no rule requires an organization to certify its compliance and that HHS "does not endorse or otherwise recognize private organizations' 'certifications'" (HHS FAQ 2003). A course certificate shows that a person finished a course. It doesn't show how your patients' records will be handled in day-to-day work.
Compliance depends on the safeguards around the assistant: the contract with the VA's employer, the access you grant, the devices the VA uses, and the records that show who opened which chart. Your practice is the covered entity. A business associate is a person or company outside your workforce that "creates, receives, maintains, or transmits protected health information" for you, including for billing and practice management (45 CFR 160.103). A VA who books appointments, checks eligibility, or follows up on claims does exactly that kind of work.
Our explainer on what a virtual medical assistant does covers the role itself. This guide covers what to verify before you hand over a login.
Who Signs the Business Associate Agreement When an Agency Places Your VA
That depends on who employs the assistant and who directs the work. Under 45 CFR 160.103, your workforce includes people whose work for you is "under the direct control" of your practice, even if you don't pay them. A business associate sits outside that workforce. Whether a directly hired contractor counts as workforce or as a business associate is a call for your privacy officer or counsel.
With an agency, more parties are involved. The agency employs the VA, and a payroll provider, an employer of record abroad, or a software vendor may sit behind it. HHS says a business associate must have a BAA with any subcontractor before disclosing PHI to it, and each of those subcontractors is a business associate too (HHS business associate guidance, reviewed July 30, 2026). You should know who they are.
Liability runs both ways. A covered entity can face a civil money penalty for the act of an agent, "including a workforce member or business associate, acting within the scope of the agency" (45 CFR 160.402(c)). Business associates are directly liable for Security Rule compliance, impermissible disclosures, minimum necessary, and breach notification, per HHS's direct liability fact sheet.
A managed agency such as Stellar Staff handles recruiting, payroll, HR, tracking, and replacements, while your practice directs the daily work. That split is why the BAA question needs a written answer: you direct the work, but someone else employs the person. Ask three things in writing. Will you sign a BAA with our practice? Who employs the assistant? Which other companies touch PHI, and do you have a BAA with each one?
The BAA Clauses to Read Before You Sign
The required contents of a BAA are set out in 45 CFR 164.504(e). HHS also publishes sample BAA provisions, which it calls "only sample language," so a provider's template can look different and still be valid. Check that each required term is there and fits remote VA work.
| Required term | 164.504(e)(2)(ii) | What to check for a VA |
|---|---|---|
| Permitted uses and disclosures | (A) | Tasks match the job, such as scheduling and billing follow-up, and nothing broader |
| Safeguards, including the Security Rule | (B) | Named safeguards: multi-factor login, managed devices, no local copies |
| Reporting incidents and breaches | (C) | A reporting window in days and a named contact on each side |
| Subcontractors bound to the same terms | (D) | A list of the companies working with the provider that can access PHI |
| Patient access, amendments, and accounting of disclosures | (E) to (G) | Turnaround when a patient asks for records or a disclosure history |
| Books and records open to HHS | (I) | Cooperation if OCR investigates |
| Return or destruction of PHI | (J) | What happens to files, accounts, and devices when an assistant is replaced or you cancel |
If you learn of a pattern of activity that amounts to a material breach of the BAA, you must take reasonable steps to cure it, and end the contract if that fails and termination is feasible (164.504(e)(1)(ii)).
Minimum Necessary Access for Schedulers, Billers, and Intake Staff
The minimum necessary standard requires reasonable steps to limit the PHI used, disclosed, or requested to what the task needs. HHS says your policies must identify who needs access and the categories of PHI each role needs (HHS minimum necessary guidance). Build the VA's EHR role from scratch instead of copying a front-desk login. A starting point:
- Scheduling: demographics, contact details, appointment history, and basic insurance. No clinical notes.
- Insurance verification and prior authorizations: payer and member details, plus the codes and limited clinical facts each request asks for.
- Billing and claims follow-up: claims, remittances, and codes. Rarely the full chart.
- Patient messages and refill requests: broader access, with a rule that routes clinical questions to licensed staff.
Write the access list down and set a date to review it. A VA who started on scheduling can end up with billing access no one remembers granting.
Security Rule Safeguards for a Remote Assistant
HHS calls the Security Rule "flexible, scalable, and technology neutral," so it doesn't name products. It does require a risk analysis, and it says an "addressable" item is not optional: you adopt it or document a reasonable alternative (HHS Security Rule summary, reviewed August 7, 2026). These safeguards matter most when the person is remote.
| Safeguard | 45 CFR | Status today | Question for the provider |
|---|---|---|---|
| Risk analysis | 164.308(a)(1)(ii)(A) | Required | Is the remote setup covered in the risk analysis, yours and theirs? |
| Activity review | 164.308(a)(1)(ii)(D) | Required | Who reviews the assistant's access records, and how often? |
| Termination procedures | 164.308(a)(3)(ii)(C) | Addressable | How quickly is access removed when an assistant leaves? |
| Security awareness program | 164.308(a)(5)(i) | Standard | Who runs it for the assistant, and is completion recorded? |
| Unique user identification | 164.312(a)(2)(i) | Required | Does the assistant have an individual login on every system? |
| Encryption | 164.312(a)(2)(iv) | Addressable | Is PHI encrypted on the device and in transit? |
| Audit controls | 164.312(b) | Standard | Do your systems log what the assistant views and changes? |
| Authentication | 164.312(d) | Standard | Is multi-factor login on for every system that holds PHI? |
Devices and home connections
The physical safeguards in 45 CFR 164.310 cover workstation use, workstation security, and device disposal. The simplest approach for a remote VA is to keep PHI on your systems: a practice-managed laptop or a virtual desktop, downloads and printing blocked, and no texting patients from personal phones. Put the device terms in the BAA or a written security addendum.
Audit logs only help if someone reads them
Most EHR and practice management systems record who opened which record, and the Security Rule asks you to "regularly review" that activity. Look for after-hours access, records with no visit or open task behind them, and bulk exports. On an assistant's last day, remove access and confirm it in the log.
Offshore Assistants and PHI: What HIPAA Allows and What It Leaves to You
HIPAA has no offshore ban. HHS's FAQ on overseas cloud storage, the closest official statement, says the HIPAA Rules have no requirements specific to PHI held outside the United States and allows it with a BAA (HHS FAQ 2083). It also warns that "the risks to such ePHI may vary greatly depending on its geographic location." Those risks belong in your risk analysis.
Your contracts may be stricter than HIPAA. A 2014 HHS Office of Inspector General report found no federal regulation prohibiting offshore outsourcing of Medicaid administrative work, but 4 of 56 state Medicaid agencies prohibited it (OIG, OEI-09-12-00530). Check your Medicaid managed care, payer, and health system contracts for location limits first.
Stellar Staff's talent comes primarily from the Philippines, so this applies to any practice considering us. The controls are the same anywhere: PHI stays on U.S.-hosted systems you control, the assistant works through a virtual desktop, and the BAA is signed by a party you can enforce it against. Our guide to hiring a virtual assistant in the Philippines covers local data rules.
Answering Services and Virtual Receptionists Count Too
A phone service is not just passing calls along. HHS limits the "conduit" exception to entities that only transmit PHI and says those that regularly access it to perform a service are not conduits. A HIPAA-compliant answering service or a HIPAA-compliant virtual receptionist takes messages like "calling about my biopsy results," so it needs a BAA. HHS also lists AI chatbot vendors that handle PHI on patient portals among its examples of business associates. Before you sign with any phone or messaging vendor, ask:
- Where are messages and call recordings stored, and for how long?
- Are messages delivered through a secure portal or by plain text and email?
- Who at the vendor can hear calls or read transcripts?
- Are agents dedicated to your practice or shared across clients?
For pricing, see what a virtual receptionist costs. A dedicated customer service VA is another route, with the same BAA questions.
Breach Reporting Deadlines and Current HIPAA Penalty Amounts
A business associate must notify you of a breach of unsecured PHI "without unreasonable delay and no later than 60 days from the discovery of the breach." Your practice then has up to 60 days to notify patients. Breaches affecting 500 or more people go to HHS within 60 days, and smaller ones can be reported annually (HHS Breach Notification Rule). Sixty days is the outer limit, so negotiate a shorter reporting window in the BAA.
The latest HHS inflation adjustment, published in the Federal Register on January 28, 2026, sets these HIPAA civil money penalties (FR Doc. 2026-01688):
| Culpability tier | Minimum per violation | Maximum per violation | Calendar-year cap |
|---|---|---|---|
| Did not know | $145 | $73,011 | $2,190,294 |
| Reasonable cause | $1,461 | $73,011 | $2,190,294 |
| Willful neglect, corrected within 30 days | $14,602 | $73,011 | $2,190,294 |
| Willful neglect, not corrected | $73,011 | $2,190,294 | $2,190,294 |
Under a 2019 notice of enforcement discretion, HHS applies lower annual caps to the first three tiers, set before inflation at $25,000, $100,000, and $250,000 (84 FR 18151). Business associates are not exempt. In March 2025, OCR announced a $227,816 settlement with Health Fitness Corporation, a business associate, after a server misconfiguration exposed ePHI online, and found it had not completed an accurate and thorough risk analysis until January 2024 (HHS press release).
Security Rule Changes Proposed in 2025, and Where They Stand
HHS proposed a Security Rule overhaul in the Federal Register on January 6, 2025 (90 FR 898). As of October 2026 it is still a proposal: the Unified Regulatory Agenda lists final action for July 2027 (RIN 0945-AA22), and the current rule applies until then. Proposals in the HHS fact sheet that bear on remote assistants:
- End the split between "required" and "addressable" specifications, with limited exceptions.
- Require encryption of ePHI at rest and in transit, and multi-factor authentication.
- Require notice within 24 hours when a workforce member's access is changed or terminated, for certain entities.
- Require business associates to verify their technical safeguards at least once every 12 months, with a written expert analysis.
None of this is law yet, but asking a vendor about these points now is a fair test of how it handles security.
A Checklist to Send Any Medical VA Provider Before Day One
If you're comparing HIPAA-compliant medical virtual assistant services, send each one these questions in writing and file the answers with your HIPAA records:
- Will you sign a BAA with our practice, and can we review it before we choose a candidate?
- Who legally employs the assistant, and which other companies can access our PHI under a BAA with you?
- How many days do you take to report a security incident or breach to us?
- Will the assistant use a device we manage, a device you manage, or a virtual desktop?
- Can PHI be downloaded, printed, or copied to a personal device?
- Is multi-factor login on for every system the assistant uses?
- Who runs the assistant's security awareness program, and can we see the record?
- How fast is access removed when an assistant leaves or is replaced?
- Where is the assistant located, and do our payer contracts limit that?
- What happens to PHI, accounts, and equipment when the agreement ends?
Keep hiring checks separate from these answers. Stellar Staff's vetting includes reference checks, an equipment check, and background checks, which help you judge a candidate. They are hiring steps, not HIPAA safeguards, and they don't replace a BAA, a risk analysis, or your access controls. Use this checklist to evaluate every provider you shortlist, including those in our roundup of top medical virtual assistant companies. For interviews and test tasks, see how to hire a virtual assistant.
What Practice Managers Ask About HIPAA and Remote Assistants
Is there such a thing as a HIPAA-certified virtual assistant?
Not in any official sense. HHS says no rule requires certification and that it does not endorse or recognize private HIPAA certifications. Compliance depends on the BAA, access controls, devices, and audit logs around the assistant.
Does a virtual assistant need to sign a business associate agreement?
The BAA is signed by the business associate, which is usually the company that employs the assistant. If you hire a contractor directly, your practice decides whether that person is workforce under your direct control or a business associate who signs a BAA. Either way, bind the assistant in writing to your privacy and security policies.
Can an offshore virtual assistant access patient records?
HIPAA does not prohibit offshore access, but HHS says the location of PHI affects risk and belongs in your risk analysis. Some state Medicaid programs and payer contracts restrict offshore work, so check yours first. Keeping PHI on U.S.-hosted systems reached through a virtual desktop reduces exposure.
Is a HIPAA-compliant answering service different from a virtual medical assistant?
An answering service usually handles calls and messages with agents shared across many clients. A virtual medical assistant is typically dedicated to one practice and works inside its systems. Both handle PHI, so both need a BAA and the same security checks.
How quickly must a VA provider report a breach?
A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach. That is the legal maximum, and you can negotiate a shorter window in the BAA.
What does a full-time medical VA cost through Stellar Staff?
A full-time Pro VA through Stellar Staff costs $1,999 a month for 160 hours, about $12.50 an hour, month to month with 14 days' notice. The search takes 5 to 10 business days. Settle the BAA terms and safeguards in writing before the assistant receives any patient data.
Put the Safeguards in Writing Before the First Login
A remote assistant can handle scheduling, eligibility checks, billing follow-up, and patient messages within HIPAA's rules, as long as the BAA, the access list, the device setup, and the log reviews are settled first. A remote VA isn't right for every practice, though. If the job means rooming patients or staffing the front desk, hire locally. If your payer contracts bar offshore access, look at U.S.-based options.
If the work fits a remote role, see how Stellar Staff supports medical practices, compare plans and pricing, or start a search. You interview 2 to 3 finalists, replacements are free on managed plans, and you can cancel with 14 days' notice. Ask for the BAA terms and the safeguards in writing first, from us or anyone else you consider.
This article is general information about federal HIPAA rules, not legal advice. State privacy laws and payer contracts can add requirements, so have counsel or your privacy officer review any BAA. Regulations and HHS guidance were checked October 14, 2026. Stellar Staff pricing is current as of October 2026.