Do You Need a Business Associate Agreement With a Virtual Medical Assistant Provider?
If a virtual medical assistant provider will create, receive, maintain or transmit protected health information on your behalf, HHS guidance indicates the provider is a business associate, and the covered entity needs a written business associate agreement (BAA) before sharing that information. If no PHI is involved, such as in an initial workflow conversation, a BAA is not the first step.
What HHS says about business associates
HHS describes a business associate as a person or organization, other than a member of the covered entity's workforce, that performs services for a covered entity involving PHI. A covered entity may disclose PHI to a business associate only after obtaining satisfactory assurances in a written contract, called a business associate agreement.
What a BAA addresses
- Permitted uses and disclosures of PHI
- Limits on use beyond the agreed purpose
- Security Rule safeguards and incident reporting
- Handling of subcontractors that touch PHI
Minimum necessary access
HHS requires covered entities to take reasonable steps to limit PHI use and requests to what is needed for the purpose. Practically, this means defining which tasks an assistant performs and giving access only to the systems and information that those tasks require.
Questions to ask any provider
- At what point in onboarding is a BAA signed?
- How is access limited by role and revoked when work ends?
- Does the provider use subcontractors, and how are they covered?
- What happens if a security incident occurs?
Our approach to the first conversation
Our complimentary workflow assessment is a no-PHI conversation. For safeguards and how access is handled, see our security and privacy page and the guide are virtual medical assistants HIPAA compliant. Ask us about agreement terms directly during your assessment.
A note on accuracy
This article summarizes public HHS guidance and is not legal advice. Confirm your obligations with qualified counsel.
Related services from our team: Security and privacy | Complimentary workflow assessment.
Sources
Request Your Complimentary Workflow Assessment
A complimentary, no-PHI conversation about your practice's administrative workload.
Request Your Complimentary Workflow AssessmentFrequently Asked Questions
Is a BAA required for every vendor?
Not for every vendor. HHS guidance ties the requirement to vendors that create, receive, maintain or transmit PHI for a covered entity.
Do subcontractors need agreements too?
HHS states that subcontractors handling PHI for a business associate are also business associates and need their own agreements.
Does an initial consultation require patient data?
No. An initial workflow conversation should not require PHI.