Can a Virtual Assistant Be HIPAA Compliant? What Every Therapist Needs to Know Before Hiring
Your clients trust you with the most vulnerable parts of their lives. Your VA setup should honor that. Here is how to make sure it does.
If you are a therapist or mental health professional considering virtual admin support, I already know what question is sitting at the top of your mind: Is this actually safe? Can I really hand off admin work without putting my clients' privacy at risk?
These are exactly the right questions to ask. And I want to answer them honestly, because the answer is yes — you absolutely can get meaningful admin support while maintaining full HIPAA compliance. But it requires choosing the right partner and asking the right things upfront.
I have worked in admin and operations for over 17 years, including extensively with healthcare and mental health practices. Here is what every therapist needs to understand before hiring a VA.
Does HIPAA apply to virtual assistants who work with therapists?
Yes. Under HIPAA, any individual or organization that handles Protected Health Information (PHI) on behalf of a covered entity — including therapists in private practice — is considered a Business Associate. That classification applies to virtual assistants who access client records, scheduling systems that contain client information, or any other PHI in the course of their work.
This means a Business Associate Agreement (BAA) is not optional. It is a legal requirement before any PHI changes hands.
What is a Business Associate Agreement (BAA)?
A BAA is a formal, signed contract between you and your VA (or VA service) that outlines exactly how Protected Health Information will be used, stored, protected, and disposed of. It establishes accountability and ensures both parties understand their responsibilities under HIPAA.
Any reputable VA service that works with healthcare or mental health clients should be familiar with BAAs and willing to sign one without hesitation. If they are not, that is your answer right there.
Does a VA need access to client records to help my practice?
Often, no — and this is an important nuance. A great deal of valuable admin work can be done with minimal or no access to sensitive clinical data. Calendar management, email filtering, invoicing, SOP creation, and general operations support can frequently be structured so that PHI exposure is limited or entirely avoided.
HIPAA calls this the minimum necessary standard — share only what is genuinely needed for the task at hand. A skilled VA partner will help you think through what access is actually required, rather than defaulting to broad access.
What should a HIPAA-aware VA be able to tell you?
How they handle and store any client-related information they access
What secure, encrypted tools they use for communication and file sharing
Their process for disposing of sensitive information when the working relationship ends
That they are willing and prepared to sign a BAA before work begins
That they understand the particular sensitivity of mental health client data
What are the red flags to watch for?
A VA who seems unfamiliar with HIPAA or dismisses your concerns about it
Insistence on using personal email, unencrypted messaging apps, or insecure file-sharing tools for client data
No clear data handling policy or confidentiality protocol
Reluctance to sign a BAA
Here is what I want you to walk away knowing: you do not have to choose between getting support and protecting your clients. Those two things are not in conflict — not when you work with a partner who takes privacy as seriously as you do.
At Savvy Assistant Inc, HIPAA compliance is not an afterthought. It is built into how we work from day one. Because we understand that your clients trust you with the most vulnerable parts of their lives — and that trust is not something we take lightly.
I am Tai, founder of Savvy Assistant Inc. With over 17 years in admin and operations, I built Savvy Assistant Inc to give solopreneurs and small businesses — especially therapists and mental health professionals — the behind-the-scenes support they deserve. If you are ready to stop doing it all alone, I would love to help. Visit SavvyAssistantInc.com to book a free discovery call.
