What to Include in a Business Associate Agreement With a Virtual Assistant
A business associate agreement with a virtual assistant is the contract that lets a remote assistant handle your clients' protected health information under HIPAA. Federal rules require it to spell out what the assistant's company may do with that information, the safeguards it will use, how it will report problems, how it will help with client record requests, and what happens to the information when the work ends. It also has to bind any subcontractors to the same rules and give your practice the right to end the contract if the company violates a material term. The agreement should be signed before the assistant logs into anything.
Most pages that come up for this topic are written by virtual assistant companies, and many stop at "make sure they sign a BAA." That's the right start, but it doesn't tell you what a good one looks like. This guide walks through the required pieces clause by clause, the practical details worth adding, and the warning signs to watch for.
This article is general information, not legal advice. Talk with your compliance advisor or healthcare attorney about your specific situation.
When a virtual assistant needs a BAA
HHS describes a business associate as a person or organization that performs certain functions or activities involving protected health information on behalf of a covered entity, other than a member of that entity's workforce (HHS Business Associates guidance). A company whose assistants answer your phones, book appointments, verify insurance, or work in your EHR fits that description.
The workforce part matters. HIPAA defines workforce as employees, volunteers, trainees, and others whose conduct in their work is under the direct control of the covered entity (45 CFR 160.103). Here's how that usually sorts out.
- An assistant you hire as your own employee is generally part of your workforce and is covered by your practice's HIPAA policies and training.
- An assistant placed by a virtual assistant company works for that company, so the company is your business associate and signs the BAA.
- A freelance assistant you contract with directly is a gray area worth asking your advisor about. In many setups they'll be a business associate who needs their own BAA.
HHS also notes that the narrow "conduit" exception only applies to services that just transmit information, like a mail carrier. A company that regularly works with your clients' information to do a job for you isn't a conduit.
The clauses HIPAA requires
The required contents come from the Privacy Rule at 45 CFR 164.504(e). HHS also publishes sample business associate agreement provisions that follow the same outline. Use this as a checklist when you read a virtual assistant company's agreement.
- Permitted uses and disclosures. The agreement has to say what the company may do with your clients' information. For a front desk assistant, that should tie to the services you're buying, such as scheduling, intake paperwork, insurance verification, and billing follow-up.
- No other use. The company agrees not to use or share the information beyond what the contract allows or the law requires.
- Safeguards. The company agrees to use appropriate safeguards and to comply with the HIPAA Security Rule for electronic information.
- Reporting. The company agrees to report any use or disclosure the contract doesn't allow, including breaches of unsecured information.
- Subcontractors. Anyone the company brings in who touches your clients' information has to agree to the same restrictions.
- Client access. The company helps you respond when a client asks for a copy of their records.
- Amendments. The company helps you make corrections when a client asks to amend their records.
- Accounting of disclosures. The company keeps the information you'd need if a client asks who their records were shared with.
- Your obligations they carry out. If the company handles a HIPAA duty for you, it follows the same rules you would.
- Access for HHS. The company makes its practices, books, and records available to HHS if HHS is checking compliance.
- Return or destruction. When the contract ends, the company returns or destroys your clients' information, or explains why it can't and keeps protecting what it retains.
- Termination. Your practice can end the contract if the company violates a material term.
HHS is careful to say its sample language isn't required word for word and may not be enough on its own to form a binding contract under state law. That's one reason to have someone qualified review the final version.
Details worth adding beyond the minimum
The required clauses set a floor. A few practical terms make the agreement much more useful for a therapy practice.
A specific reporting timeline
The Breach Notification Rule gives business associates up to 60 calendar days after discovering a breach to notify the covered entity, and the standard is "without unreasonable delay" (45 CFR 164.410). Sixty days is the outer limit, not a target. Many practices ask for a much shorter window so they have time to investigate and meet their own deadlines. Also ask the company to report smaller mistakes, like a message sent to the wrong client, and not just events it has already decided are reportable breaches.
Named systems and access limits
List the systems the assistant will use, such as your EHR, phone system, and payer portals. State that each assistant gets their own login with multifactor authentication and that no one shares passwords. Some practices also note that the assistant's role won't include access to clinical notes. Psychotherapy notes have extra protection under HIPAA (HHS FAQ on mental health information), and administrative work doesn't require them.
Where the work happens
Ask the agreement or the service contract to say where assistants are located and whether that can change without your written approval. HIPAA doesn't ban offshore access, but some Medicare Advantage and state Medicaid contracts restrict it. Our guide to HIPAA-compliant virtual assistants covers that in more detail.
A clear offboarding process
Spell out who turns off access, how fast, and how the company will confirm that your clients' information was returned or destroyed. Put it in writing so no one has to remember it later.
Cooperation during an investigation
If something goes wrong, you'll need the company's help to figure out what happened. A cooperation clause, and clarity on who pays for notification costs, can save a lot of back and forth.
Why the signature date matters
A BAA only helps if it's in place before any information changes hands. HHS says a covered entity may share protected health information with a business associate once it has satisfactory assurances in the form of a written agreement (HHS).
HHS enforcement actions show this isn't a paperwork technicality. In 2017, the Office for Civil Rights announced a $31,000 settlement with a seven-location pediatric practice in Illinois that had shared records with a storage vendor for years without a signed BAA (HHS). In 2016, a Minnesota health system settled for $1.55 million after failing to have a BAA with a major contractor and failing to complete an organization-wide risk analysis (HHS). Neither case involved a therapy practice, but the lesson carries over.
Running a practice with more than one location taught me how easy it is for a vendor to get access before the paperwork catches up. Someone needs coverage fast, and the agreement feels like it can wait a week. I try to hold the line on "no BAA, no access," and I'm still refining how we track it.
Signing it is the start, not the finish
A signed agreement doesn't end your part. HHS says that if a covered entity knows of a pattern of activity or practice by a business associate that is a material breach of the agreement, it has to take reasonable steps to fix it, and if that doesn't work, end the agreement if feasible (HHS). HHS also says business associates are directly liable for complying with certain parts of the HIPAA Rules, so a good company will take its own obligations seriously.
A few habits help on your side.
- Keep every BAA in one folder with the signature date, the services it covers, and a renewal or review date.
- Add the new workflow to your risk assessment before the assistant starts.
- Review access every few months and remove anything the assistant no longer needs.
- Revisit the BAA when services change, like when an assistant who only scheduled starts working on billing.
Red flags in a virtual assistant company's BAA
These are worth pausing on before you sign.
- The company offers only an NDA or a confidentiality clause and calls it a BAA
- The agreement leaves out subcontractors, or the company can't say whether it uses any
- There's no reporting timeline, or it only covers events the company decides are breaches
- Nothing addresses what happens to your clients' information at the end
- The company wants access to start before the agreement is signed
- The agreement lets the company use your clients' information for its own marketing or product development
An NDA protects business information. A BAA carries the specific HIPAA requirements above. A healthcare practice working with a virtual assistant usually needs the BAA, and some also use an NDA for business information.
The bottom line
A business associate agreement with a virtual assistant should do more than check a box. It needs every clause HIPAA requires, a reporting timeline you can live with, clear limits on access, and a plan for the day the relationship ends. Read it closely, ask questions, and have your advisor review it before anyone logs in.
If you're still deciding what an assistant could take off your plate, our guide to virtual assistants for therapists is a good place to start, and our therapy practice intake process guide shows where an assistant fits in the first-call workflow. Our How It Works page explains how Front Desk Friday sets up privacy. If you'd like to talk through a BAA, ours included, you're welcome to book a fit call. No pressure either way.
Frequently asked questions
Does a virtual assistant need to sign a BAA?
In most cases, yes, when the assistant works for an outside company or as an outside contractor and will handle your clients' protected health information. An assistant you hire as your own employee is generally part of your workforce and is covered by your practice's policies instead.
What must a business associate agreement include?
Under 45 CFR 164.504(e), it must set permitted uses, require safeguards and reporting, bind subcontractors, support client access, amendment, and accounting requests, allow HHS access to records, require return or destruction of information at the end, and let you terminate for a material violation.
How quickly does a business associate have to report a breach?
The federal rule says without unreasonable delay and no later than 60 calendar days after discovery. Many practices negotiate a shorter window in the BAA itself.
Is an NDA the same as a BAA?
No. An NDA protects confidential business information. A BAA includes specific HIPAA requirements for protecting client health information, and an NDA alone doesn't meet them.
Who should draft the BAA, my practice or the virtual assistant company?
Either side can provide it. Many companies have a standard BAA, and that's fine as long as it covers every required clause and you have it reviewed before signing.
Christina started Front Desk Friday after years of running a multi-location mental health practice in Houston. She writes about the front desk side of private practice and what she keeps learning along the way.