Data Protection & Compliance
Patient privacy starts with clear responsibilities and careful control over who can access your information. Our approach brings together contractual safeguards, HIPAA training and secure remote working practices.
BAA before PHI access
A Business Associate Agreement is signed before access to protected health information. Request a sample BAA for your review.
HIPAA-trained assistants
Assistants receive HIPAA training before starting, with confidentiality and appropriate handling of patient information central to the role.
Secure working practices
Encrypted workstations and no local PHI storage support work within your practice’s approved systems.
Access designed around the role
Your practice controls access to its EHR, practice management software, phone systems and other tools. During onboarding, define the permissions needed for each task and keep access limited to those responsibilities.
- Use individual accounts so activity can be attributed to the correct person.
- Enable multi-factor authentication where your systems support it.
- Approve communication channels and procedures for sharing patient information.
- Document access changes and revoke access promptly when an assignment ends.
Set expectations before work begins
Agree on the tasks an assistant may perform, the information they need and the situations they must escalate. Your onboarding plan should cover patient identity verification, record requests, sensitive communications and suspected security incidents.
Documents for your review
You can request a sample BAA and insurance certificates through our team. Discuss any vendor assessment, workstation, VPN or access requirements before placement so the proposed setup can be reviewed against your practice’s policies.
Privacy is an ongoing process
Review permissions when responsibilities change. Keep procedures current and give your assistant a clear route to report a misdirected message, suspicious login or other concern. Incident notification responsibilities are set out in the applicable agreement and BAA.
Each practice’s requirements differ. The agreed services, BAA and your approved systems determine the safeguards and responsibilities for your engagement.
Common questions
Can we review the BAA before hiring?
Yes. Request a sample BAA so your team can review the terms before access to patient information is arranged.
Will an assistant need full access to our systems?
Access should reflect the assigned duties. Your practice can create role-specific permissions and expand or remove them as responsibilities change.
Can you accommodate our security requirements?
Share your requirements during the consultation. We’ll review the proposed working setup and identify what needs to be agreed before work begins.
Read more about HIPAA-compliant medical virtual assistant workflows.
Build the right support team for your practice
Tell us about your workflow, systems and staffing needs. We’ll help you plan the next step.
Talk to MedicalVirtual →