How to Hire a HIPAA-Compliant Virtual Assistant

Yes, it is entirely legal to hire a virtual assistant, including an overseas one, to work with patient information, as long as you sign a business associate agreement first and limit their access to the minimum the job requires. The BAA requirement does not disappear because the person lives in another country or works as an individual contractor rather than a company. HHS's own guidance on business associates defines one as anyone who creates, receives, maintains, or transmits PHI on a covered entity's behalf, with no exception for location, so a contractor in Manila is covered by the same rule as one in Miami. This post covers when to hire at all, what to hand off first, what never leaves your desk, and the exact setup that keeps an offshore hire compliant.

1. Eliminate and automate before you hire

Hiring is the most expensive fix for an admin problem and, done first, usually the wrong one. Before you touch a job posting, ask whether the task needs to exist at all, then whether software can do it.

Eliminate the tasks that only exist because you built them badly. A prescriber we've watched build a practice killed her after-hours phone line entirely: it was never used appropriately and cost her hours of boundary enforcement. She also made herself hard to reach by phone on purpose, funneling prospective patients to an online contact form that shows fees before a conversation starts. Both moves removed the task instead of paying someone to do it.

Automate what's left before you delegate it. Card-on-file billing that fires before the appointment, self-scheduling links instead of back-and-forth email, and a saved reply with your booking link are the baseline. This is exactly the ground Eureka covers out of the box: self-serve booking, automatic pre-visit charging, patient email reminders, and an AI assistant that drafts routine patient messages are the automation layer most practices otherwise build by hand or hire a first VA to run manually. If your EHR makes you do these things by hand, that gap is what a hire will end up doing for you at $10 to $40 an hour instead of for free; it's worth checking what your options actually cost before you assume the fix has to be a person.

Only delegate what survives both filters. Skipping straight to hiring means you're paying someone to do a task inefficiently, since you haven't optimized it yet.

2. Know the signals that you're actually ready to hire

The signal to hire is a time shortage, and specifically a time shortage that's no longer solved by cash. You know your most draining recurring tasks, you've already eliminated and automated what software can handle, and the hour a hire frees up can be filled with a paying patient. Hiring before that point usually means paying someone to help you procrastinate on marketing or clinical work, and your startup budget has better places for that money in year one.

The math after that point is simple. If your effective hourly rate from seeing patients is $300 to $400, any task you can hire out for less is fair game financially. Weigh the full cost, though: a $10 to $20 an hour offshore rate looks cheap next to a $40 to $50 an hour hire, but the offshore rate can cost more in your own oversight time if the task wasn't well documented before you handed it off.

Expect roughly 70 percent of your own competence from a new hire, and treat that as fine. Nobody is as invested in your practice as you are. The recurring mistake practices report is moving too slowly to let someone go once judgment or trustworthiness problems show up; those two traits are much harder to train than any task, and a slow instinct to keep a struggling hire around costs more than the hire's hourly rate.

3. Decide what to hand off first, and what never leaves your desk

Hand off non-patient-facing admin you've already systematized: generating and sending superbills, chasing intake paperwork, logging routine refill requests into the EHR for your review, calling pharmacies about fills, uploading documents, sending templated emails, and enforcing the no-show and late-cancellation policy you've already written down. One nurse practitioner we've seen hire early brought on a Philippines-based assistant to chase intake paperwork and call pharmacies. Within two days, several patients who would otherwise have been cancelled for incomplete paperwork had completed it.

Keep anything that requires your license or your clinical judgment for yourself: diagnosis, the prescribing decision itself, controlled-substance management, and any patient-facing conversation that requires reading a person accurately, like declining a prospective patient you don't want to take or handling a crisis message. Patient-facing work in general deserves a higher bar than back-office work; if you delegate it at all, that role usually needs stronger written English, a closer time zone, and a higher rate than the back-office hire.

4. Set up the offshore hire the HIPAA-safe way

Philippines-based virtual assistants are the most common offshore hire in this work, and practices we've watched build this way typically land around $8 to $15 an hour for back-office tasks, rising well beyond that once someone graduates into managing other staff. The rate is attractive; the compliance setup is not optional, and it's where most first-time hires cut corners.

Get a signed business associate agreement before any PHI access starts. Two paths work: your staffing company signs one and its written policies cover its contractors, or the individual contractor signs one directly with your practice. What doesn't work is skipping this because the person is a freelancer rather than a company, or because they're overseas. HHS's guidance on business associates treats "a person" as the operative word, and a contractor who creates, receives, maintains, or transmits PHI on your behalf for a function you're paying them for meets that definition whether they're a corporation, a solo freelancer, or based in Manila. There's a narrow carve-out for people who are genuinely part of your workforce under your direct, employee-like control, but a remote contractor you found on a hiring platform and pay by the hour almost never clears that bar. Plan on the BAA, and confirm the classification with your own healthcare attorney before you rely on any exemption.

One popular pattern in this world, worth naming so you can avoid it: giving a VA one shared login through a password manager, then revoking access with a single password reset when they leave. It's convenient, and it's a genuine compliance gap. HIPAA's technical safeguards require unique user identification for anyone touching ePHI, precisely so an audit trail can show who did what and when. A shared login can't produce that trail, and shared credentials are a common finding when OCR investigates a breach. Give every hire, VA included, their own unique login to your EHR and any other system touching PHI, and revoke that one login individually when they leave. It's no harder to manage than a shared password and it actually satisfies the requirement.

Grant only the access each task requires. A VA generating superbills needs billing and CPT data; the clinical note stays out of scope. A VA chasing intake paperwork needs to see what's missing, never the diagnosis behind it. Configure access at the task level rather than handing over the same permissions you'd give a clinical hire.

Confirm audit logging is on wherever the VA works, so you can show exactly what was accessed if you're ever asked. Most modern EHRs log this by default; verify it rather than assume it for whatever system the VA touches, including shared drives and email.

5. Screen applicants for judgment before you screen for experience

Task knowledge is teachable in a week. Judgment and trustworthiness take much longer to build, and they're what separates a VA who protects your practice from one who creates a HIPAA incident or a patient-relations mess. Ask applicants to answer a couple of judgment scenarios in writing rather than talk about their resume: how would they decline a prospective patient you don't want to take, or what would they do if your phone was lost at a remote location. Practices that have run this screen report the gap between a strong and a weak answer is obvious immediately, and far more informative than years of stated experience with any particular EHR.

Trial the finalist on a small, paid, real task before committing to a schedule. A short paid trial doing the actual work (build a document, chase one paperwork item, draft one templated reply) tells you more in two hours than a full interview does.

6. Build the termination checklist before you need it

Write this down before you hire, so you're never improvising it under pressure after a bad hire:

• Revoke the unique EHR login the same day the relationship ends.
• Revoke access to email, shared drives, scheduling, and any billing tool separately; a unique login per person only helps if you actually track every system they touched.
• Use a shared role-based email address like assistant@yourdomain instead of a personal one, so patients and vendors aren't retrained every time staff turns over.
• Confirm in writing that the departing contractor has deleted any local copies of documents or exports, and that your BAA's data-return or destruction clause covers this.
• Log the offboarding date and what was revoked, so you have a record if a question ever comes up later.

A VA who worked out well is worth every bit of the setup above. Move fast on one who didn't; the checklist is what makes moving fast safe instead of messy.

BAA terms and contractor classification vary by state and by your specific arrangement. Confirm the setup with a healthcare attorney before PHI access starts.