Virtual Assistant for a Medical Practice: What Needs a BAA?

Flu season can put extra pressure on a small medical practice. Appointment questions are coming in, the front desk has its usual workload, and the website still needs updating. Meanwhile, someone needs to keep the practice’s Google Business Profile and social content current.

Hiring a virtual assistant sounds like an obvious way to get some of that work moving.

But healthcare brings a question that doesn’t come up in quite the same way for an ordinary online business: Can a general virtual assistant help a medical practice without handling protected patient information?

Yes, there is useful work that can stay outside patient data. Other seemingly routine tasks, including appointment reminders and billing follow-ups, generally involve protected health information (PHI) and call for a different arrangement.

For a HIPAA-covered practice, the important distinction isn’t whether a task is called administration, marketing, or customer support. It’s what information the assistant must handle to complete it.

The one question that decides what a VA can do for your practice

Before hiring a virtual assistant for a medical practice, consider this:

Will the assignment require the assistant to create, receive, maintain, or transmit protected health information on behalf of the practice?

That question comes from the US Department of Health and Human Services’ explanation of business associates.

Under HIPAA, a business associate is generally someone outside a covered entity’s workforce who performs certain functions or services involving PHI on its behalf.

When the assistant’s role falls within that definition, the practice generally needs a business associate agreement (BAA) with the provider before the work begins.

Such an agreement is more than a confidentiality promise. It sets out permitted uses and disclosures of PHI, required safeguards, reporting obligations, and other responsibilities.

HHS provides sample business associate agreement provisions showing what these arrangements need to address.

This is different from a standard virtual assistant contract covering ordinary business matters such as scope, fees, deadlines, and confidentiality.

What counts as PHI in an ordinary working day?

Protected health information isn’t limited to medical charts or detailed diagnoses.

In a HIPAA-covered practice, information connecting an identifiable person to healthcare services or payment can qualify as PHI.

That may include a patient’s name alongside appointment details, an insurance claim, an intake form, a message about treatment, or an identifiable billing record.

Consider two spreadsheets.

One records the practice’s website updates, directory listings, marketing deadlines, and supplier information. It contains no patient information.

The other lists patients who need appointment reminders, along with their contact details and appointment dates.

Both look like ordinary administrative spreadsheets. Yet the information inside them changes the legal considerations substantially.

The same issue can arise in email, WordPress forms, scheduling software, shared drives, and customer relationship management systems.

A seemingly harmless assignment can become PHI-related if the assistant needs to open patient messages or records to complete it.

Business associate, workforce member, or neither?

Not every person working for a medical practice has the same HIPAA status.

Business associate: An outside provider whose work involves creating, receiving, maintaining, or transmitting PHI on behalf of the covered practice generally falls into this category. The required BAA and HIPAA safeguards must be addressed.

Workforce member: HIPAA’s workforce definition includes employees and other people whose conduct is under the covered entity’s direct control while performing their work. Employment status alone is not the deciding factor, and working remotely does not automatically rule out workforce status.

Neither: Someone performing work that does not involve PHI, with any exposure being incidental at most, may fall outside the business-associate requirement for that assignment.

HHS specifically explains that a business associate contract is not required for work that does not involve the use or disclosure of PHI and where any contact would be incidental, if it occurs at all. Routine handling of records is different.

See HHS guidance on incidental PHI contact.

The workforce route should not be treated as an easy alternative to a BAA. It depends on actual direct control and the working arrangement, not simply what the practice calls its contractor.

For an independent remote assistant, have your compliance adviser or legal counsel assess that distinction before relying on it.

Where general VA work can stay outside patient information

Medical practices still have plenty of work that does not require access to patient records.

Think about the information the public sees before contacting the practice.

The website may need new staff biographies, revised office hours, updated service descriptions, or an approved article uploaded to WordPress. These can be suitable website maintenance tasks for a general VA, provided the assistant’s access does not expose patient submissions or other PHI.

Local search is another example.

Someone can help check the practice’s published name, address, phone number, website details, business directory listings, and location-page information without opening patient records. Those activities fit within ordinary local SEO support.

The practice’s Google Business Profile also needs attention. Updating approved public photos, preparing posts, and checking business information can be separate from patient communications. See my guide to Google Business Profile support for the wider publishing and management work involved.

Social media offers similar opportunities. The assistant could maintain a content calendar, format approved practice announcements, schedule general wellness content, or prepare graphics that use no patient information. Any medical advice or clinical claims should still be reviewed by an appropriately qualified professional.

Behind the scenes, a VA might research office suppliers, compare non-patient software features, organize publicly available continuing-education opportunities, prepare job advertisements, or gather information for a practice manager.

Such research assignments do not inherently require patient data.

The same applies to reports built from genuinely anonymous or appropriately aggregated marketing information, provided the underlying access and data cannot expose identifiable patients.

The boundary is not the task’s name. It is the information and system access required to perform it.

Someone may be able to prepare a social post without opening a patient database. Someone updating the website may not be able to avoid PHI if the same account exposes appointment requests.

That is why the next distinction matters.

Same task, two versions: where helpful work crosses the line

These examples show how familiar assignments can sit on opposite sides of the PHI boundary.

Google reviews: acknowledging feedback versus revealing care

Suppose someone leaves a negative review saying their appointment ran late.

An assistant could prepare a neutral response that doesn’t confirm whether the reviewer is a patient. The practice should approve a suitable response policy and avoid unnecessary patient-record access.

The situation changes when someone replies:

“We checked your appointment from Tuesday, and your treatment started on time.”

That statement reveals information about an identifiable person’s care. The fact that the person posted a public review does not automatically authorize the practice to disclose information from its records.

This isn’t just a hypothetical concern.

In a 2022 enforcement action involving Dr. U. Phillip Igbinadolor, D.M.D. & Associates, HHS’s Office for Civil Rights imposed a $50,000 civil money penalty following an impermissible PHI disclosure in response to a negative online review.

OCR also announced a $23,000 settlement involving New Vision Dental in 2022 and a $30,000 settlement involving Manasa Health Center in 2023 over patient-information disclosures in review responses.

Those enforcement actions show why review management in healthcare needs more care than simply assigning someone to answer every comment.

Website updates: the hidden risk inside contact forms

Updating the public pages of a clinic website may seem straightforward.

The VA receives approved text, replaces an outdated paragraph, checks the formatting, and publishes the change.

That work can remain outside PHI.

Now suppose the practice uses WordPress to collect appointment requests, including names, symptoms, and preferred consultation dates.

If the VA’s website account also allows access to those submissions, the role may involve PHI even if the original assignment was only to update public content.

The practice should check the actual permissions, form storage, notifications, integrations, and information visible to the assistant before granting access.

Sometimes the right approach is a narrower publishing role or a separate content workflow that does not expose patient submissions.

Social content: general information versus patient-based campaigns

Consider an approved social post reminding the public that the practice’s holiday opening hours have changed.

It can be prepared and scheduled without patient information.

Now consider a promotional campaign based on patient birthdays, appointment histories, or contact lists exported from the practice’s CRM.

The work involves identifiable patient information. Depending on the message and purpose, HIPAA’s separate marketing rules may apply as well.

HHS explains that uses or disclosures of PHI for marketing generally require written authorization, subject to defined exceptions.

Not every communication about a practice’s services is HIPAA marketing. The content, purpose, and applicable exceptions matter.

But using a patient list for a promotional campaign should not be treated as an ordinary newsletter assignment for a general VA.

Scheduling tools: researching one is different from operating one

Comparing scheduling software is ordinary business research.

The assistant can gather prices, features, public demonstrations, and vendor responses without viewing any patient information.

Operating the practice’s actual appointment calendar is different.

Seeing patient names, phone numbers, consultation dates, or appointment-related messages may involve PHI.

Even when the assistant only needs to send reminders or reschedule appointments, those routine actions generally belong within a properly assessed HIPAA arrangement.

Analytics: a public website isn’t always a simple case

Website reporting needs a closer look because not every analytics setup processes the same information.

Reviewing high-level traffic information about ordinary public content may be possible without PHI. But patient portals, authenticated areas, appointment forms, and tracking integrations can present additional privacy concerns.

HIPAA’s treatment of online tracking also has legal distinctions. Following litigation involving the American Hospital Association, part of HHS’s tracking guidance concerning combinations of IP addresses and visits to unauthenticated public pages was vacated.

That does not remove HIPAA obligations for tracking that actually collects or discloses PHI.

For a healthcare website, the safer approach is to have the practice’s compliance and technical advisers assess what data the tools collect before giving a VA access to tracking systems or reports.

Patient-facing tasks usually need a BAA-backed provider

Some of the busiest parts of a medical practice are also the most likely to involve PHI.

Appointment scheduling and reminders, patient intake, insurance verification, claims processing, billing follow-ups, electronic health record updates, and patient messaging commonly require identifiable health or payment information.

That doesn’t mean these functions cannot be outsourced.

It means a HIPAA-covered practice generally needs an appropriate business-associate arrangement with an outside provider performing them, unless a properly assessed workforce or other applicable exception applies.

HHS also explains in its software-vendor guidance that a vendor requiring PHI access to provide its service can qualify as a business associate.

Before engaging a specialist provider, the practice should establish whether the provider will enter into the required BAA, what safeguards apply, how subcontractors are handled, and which systems will create or store PHI.

The systems themselves matter.

HHS’s cloud computing guidance explains that a cloud provider maintaining electronic PHI can be a business associate even when the information is encrypted and the provider does not have the decryption key.

Encryption is an important security safeguard, but it does not automatically eliminate business-associate obligations.

Likewise, using a password manager or giving someone limited access does not replace the required legal and security arrangements. My guide to sharing passwords safely with a virtual assistant covers access hygiene more generally, but healthcare work involving PHI needs the additional HIPAA considerations addressed here.

Three questions before handing over the next task

You don’t need to classify every job by its title.

Instead, consider the information behind it.

First, does completing the task require the assistant to see, create, store, or send information linking an identifiable patient to care or payment?

Think about the actual work rather than its description. “Help with the inbox” sounds harmless until you realize the inbox contains appointment requests and treatment questions.

Second, could the tools or accounts needed for the assignment expose that information even if the task doesn’t call for it?

WordPress access, shared mailboxes, CRM roles, reporting platforms, and exported spreadsheets deserve attention here. The permissions may be broader than the assignment.

Third, if PHI is involved, is the appropriate HIPAA arrangement already in place, or should the assignment remain with authorized practice staff or a properly contracted provider?

Where the answer isn’t clear, have the practice’s compliance adviser assess it before the assistant begins.

This is not about assuming every confidential assignment is prohibited. It’s about recognizing that some work needs controls and contractual arrangements beyond an ordinary VA engagement.

For wider examples of work that needs an owner’s judgment or additional expertise, see tasks not to delegate to a VA alone.

Where HIPAA rules stand as of October 2026

Two regulatory developments are worth separating from the rules that currently apply.

The proposed HIPAA Security Rule overhaul, intended to strengthen protections for electronic PHI, has not become a final rule. The regulatory agenda moved its targeted final action to July 2027.

The existing HIPAA Security Rule continues to apply.

Separately, the coordinated-care HIPAA Privacy Rule action has been undergoing federal regulatory review. The OMB review record shows that the final-rule-stage action was received on April 2, 2026, but it remains pending as of this article’s October 2026 review.

Neither development eliminates the existing business-associate considerations for outsourcing work involving PHI.

This regulatory-status section should be checked again before publication if the article is published after its October 2026 review date.

Outside the US? Similar concerns, different requirements

HIPAA is a US framework and does not automatically govern every medical practice elsewhere.

For UK practices, health information is treated as special category data under the UK GDPR. The Information Commissioner’s Office explains that processing such data requires an appropriate Article 6 lawful basis and an Article 9 condition, along with any other applicable requirements.

When a practice engages a processor to handle personal data on its behalf, the UK GDPR generally requires a written contract containing specified terms under Article 28. The ICO provides guidance on controller-processor contracts.

Canada and Australia have their own privacy and healthcare information requirements.

The practical lesson remains useful across jurisdictions: define what information the outside assistant would handle and assess the relevant rules before providing access.

This article provides general information, not legal advice. Practices should confirm their specific obligations and contractor arrangements with qualified compliance or legal advisers.

Choose the right kind of support for the work

The decision isn’t between hiring a virtual assistant and keeping everything in-house.

It’s between different kinds of work, the information involved, and the arrangements needed to perform it responsibly.

At Boost VA, my support includes WordPress updates, SEO, Google Business Profile content, social media operations, research, and general administrative work. For a medical practice, the suitable scope would be work that can genuinely be completed without handling PHI.

Patient scheduling, insurance follow-ups, EHR administration, and similar patient-data functions belong with appropriately authorized in-house staff or providers operating under the required HIPAA arrangements.

If your practice needs help with the non-patient side of its website, marketing, or business operations, contact me at Boost VA to discuss which assignments can be clearly separated from patient information.

The useful starting point is not simply finding someone who can take work off your hands. It’s knowing where the work can safely be handed over and where a different arrangement is required.