A medical virtual assistant takes the administrative work off your front desk: calls and confirmations, insurance eligibility checks, prior authorization paperwork, document triage, chart prep and patient balance calls. They work inside your EHR and practice management system, during your hours, under a named supervisor at your practice.
Two things decide whether it works. First, a signed business associate agreement before anyone gets access, because a VA company that handles patient data on your behalf is a business associate under HIPAA. Second, a written task list with defined supervision, so the assistant is accountable for specific work rather than “helping out”.
Everything else (price, time zone, EHR experience) matters less than those two. Practices that skip them end up with a compliance problem, an idle assistant, or both.
What a medical VA is, and is not
A medical VA is a trained remote administrative worker, employed by a service company or by you directly, who logs into your systems and does defined front-office or back-office tasks. They are staff, not software. An AI phone answering tool is a different product with different risks.
A virtual medical receptionist is the narrow version: phones, scheduling, messages and routine patient questions during your business hours. A healthcare virtual assistant usually means the wider role, including eligibility, authorizations, document handling and billing follow-up.
Most practices get the best result by starting narrow. Give one assistant the phones and the schedule, prove the SOPs work, then add back-office tasks in the second month.
In short: A medical VA is a remote administrative employee working in your systems on a written task list, with a business associate agreement in place and a supervisor checking the work daily.
What does a medical virtual assistant do?
| Area | Typical tasks | What to track |
|---|---|---|
| Scheduling | Inbound and outbound booking, reschedules, waitlist fills | Calls answered, abandon rate |
| Confirmations | Reminder calls and texts, same-day confirmations | Confirmed share of schedule |
| Eligibility and benefits | Coverage checks before the visit, copay, deductible, plan changes | Visits verified before arrival |
| Prior authorizations | Build and submit requests, attach records, chase decisions | Turnaround days, approval rate |
| Referrals | Incoming referral intake, outgoing referral tracking | Referrals booked, open referrals |
| Recalls and no-shows | Overdue recall lists, no-show callbacks, rebooking | Rebooked share of no-shows |
| Inbox, fax, documents | Sort, label and route faxes, forms and portal messages | Items older than 24 hours |
| Data entry and chart prep | Demographics, insurance cards, next-day chart prep | Errors found in QA sample |
| Billing and A/R | Claim status checks, simple corrections, payer follow-up | Claims touched per day |
| Patient balance calls | Statement questions, payment plans, card-on-file setup | Patient payments collected |
| After-hours overflow | Evening and weekend call coverage, triage to your protocol | Voicemails cleared |
Two of these areas pay for themselves fastest in most practices. Front-end eligibility and benefits verification stops the denials that start with wrong or inactive coverage. Patient billing and support calls recover balances that otherwise sit until they are written off.
If your A/R is the bigger problem, a VA can run the repetitive side of accounts receivable follow-up (status checks, portal lookups, worklist notes) while your biller handles appeals and payer escalations.
What a medical VA should not do
Keep the line clear and put it in writing.
- No clinical judgment. No deciding whether a symptom needs to be seen, and no interpreting results.
- No medical advice. No dosing questions, no “is this normal”, no changing instructions a clinician gave.
- No triage beyond your written protocol. If you want a VA on the phones, give them a script that routes anything outside it to a licensed person immediately.
- Nothing that needs a license in your state. Scope-of-practice rules for clinical and some administrative tasks are set by state law and vary. Where the answer is not obvious, check with your health care attorney.
- No signing or attesting as a provider. Credentialing forms, attestations and clinical documentation stay with the person whose name is on them.
A good VA company will agree to these limits without argument. One that promises “nurse-level” phone triage from an unlicensed assistant is selling you a risk.
HIPAA rules for virtual assistants
The business associate agreement comes first
If a VA company creates, receives, maintains or transmits protected health information on your behalf, it is a business associate. HHS says a business associate is directly liable for complying with certain provisions of the HIPAA Rules, and that you may disclose PHI to one only with satisfactory assurances in the form of a written contract.
That is the rule in 45 CFR 164.502(e), and the contract terms it points to are listed in 45 CFR 164.504(e). Among other things, the agreement must require the business associate to use PHI only as permitted, apply appropriate safeguards, report breaches to you, bind its own subcontractors to the same terms, help you answer patient access and amendment requests, and return or destroy PHI when the contract ends.
Practical version: no BAA, no logins. Sign it before onboarding, not after the first week.
Minimum necessary, unique logins and audit logs
The minimum necessary standard in 45 CFR 164.502(b) requires reasonable efforts to limit PHI to what is needed for the purpose at hand. For a VA that means a role, not blanket access. A scheduling assistant does not need the clinical notes.
The Security Rule backs that up with specific controls. 45 CFR 164.312 requires a unique name or number for identifying and tracking each user, and audit controls that record and examine activity in systems holding electronic PHI. Encryption, decryption and automatic logoff are addressable specifications, which means you implement them or document why an equivalent measure is reasonable.
Three questions to ask your vendor and your own IT: does every assistant have their own named account, can you pull an access log for any date, and does access get switched off the day someone leaves.
Devices, remote work and training
OCR’s 2006 HIPAA Security Guidance is still the clearest federal statement on remote and offsite access to electronic PHI. It groups the risks into three buckets: access (who can get in), storage (what sits on the device) and transmission (how it moves). Its suggested safeguards include two-factor authentication, role-specific remote access, session time-outs, device inventory and tracking, encryption, limits on downloading PHI to remote devices, and strong encryption for anything crossing a network.
45 CFR 164.308 adds the administrative side: an accurate and thorough risk analysis, workforce clearance and termination procedures, access authorization and review, and a security awareness and training program for the whole workforce including management. Ask the VA company for dated training records per assistant, not a company-wide certificate.
Offshore teams
HIPAA does not prohibit using workers outside the United States. The same obligations apply: a BAA, a risk analysis that accounts for the setup, and the administrative, physical and technical safeguards.
Payer and government contracts are the real constraint, and they vary. An HHS Office of Inspector General review of 56 Medicaid agencies found that 15 had a state-specific requirement addressing offshore outsourcing: 4 prohibited it and 11 allowed it, with all 11 maintaining business associate agreements with their contractors. That review is from 2014 and state rules change, so read your current state Medicaid contract and your commercial payer agreements rather than assuming. If a contract requires disclosure of offshore subcontracting, disclose it.
VA cost compared with an in-house hire
Compare total cost, not salary against hourly rate.
For an in-house hire, start with national pay data. The Bureau of Labor Statistics puts the median annual wage for medical secretaries and administrative assistants at $45,930 in May 2025, and for receptionists at $38,010, or $18.27 an hour. Your local market may sit well above or below those figures.
Then add employer costs. BLS Employer Costs for Employee Compensation data for June 2026 shows that for private industry workers, benefits made up 30.0% of total compensation, at $14.07 of $46.89 per hour worked, with wages and salaries the other 70.0%. Paid leave was 7.5% of compensation, and an annual salary already pays for vacation and holidays, so leave it out: the other benefits are 22.5% of total compensation. Dividing the medians above by 0.775 puts total compensation near $59,300 for a medical secretary and $49,000 for a receptionist. That is an illustration using a national average, not a quote for your practice, and it still leaves out recruiting, training, desk space and cover for turnover.
VA services are usually priced one of two ways: an hourly rate for a set number of hours a week, or a monthly fee for a part-time or full-time block of hours. Monthly blocks are easier to budget and easier to compare. Watch for setup fees, minimum contract length, overtime rules and what happens to unused hours.
Ask any VA company, including us, to quote the same hours you would give a local hire, then set that number next to your own payroll cost for the role.
How onboarding works
A clean start takes about two weeks of calendar time and a few hours of yours.
- Scope the tasks and systems. List the work, the volume, the hours it needs covering and every system involved (EHR, practice management, clearinghouse, payer portals, phone system).
- Sign the business associate agreement. Before any access is created. Your HIPAA compliance and BAA terms should be settled here, not later.
- Set up access. Named user per assistant, role limited to the task list, multi-factor authentication on, logging on.
- Write the SOPs. From your workflow, not a template: what to say, where to click, what to do with exceptions, who to escalate to.
- Shadow. The assistant listens and watches your staff for two to three days, then works supervised.
- Go live with daily QA. A supervisor samples calls and records every day for the first two weeks, with a short written error log.
- Review at 30 days. Volume handled, error rate, what to add, what to drop, whether the hours are right.
Reliable Care goes live in as little as one to two weeks when the BAA and system access are ready on time. Access delays are the usual reason a start slips, so put the IT request in on day one.
How to choose a VA provider: a checklist
Ask for each of these in writing before you sign.
- A signed BAA on your terms, reviewed by your attorney if the vendor’s version is unfamiliar.
- Background checks on every assistant who will touch patient data, with the check type named.
- HIPAA training records per person, dated, with the content covered and a sanction policy behind it.
- Supervision and daily QA, with a named supervisor, a sampling method and an error log you can see.
- Backup coverage for sick days and holidays, by a trained assistant who already knows your SOPs.
- U.S. time-zone hours that match your schedule, stated as hours of coverage, not “overlap”.
- Systems experience with your EHR, practice management system, clearinghouse and main payer portals. Ask which ones by name.
- A trial period of 30 days with clear exit terms.
- Month-to-month flexibility so hours scale up or down as your volume moves.
- A reference. Ask to speak with a current client. Reliable Care does not publish client names, but will put you in touch with a current client when that client agrees.
One more test: ask what the assistant will not do. A vendor with a clear answer has thought about scope and liability. A vendor who says “anything you need” has not.
How our virtual assistant service works
Our HIPAA-trained virtual assistants are background-checked, work in your systems and your time zone, and follow SOPs written from your workflow rather than a generic script. A supervisor runs daily QA, backup coverage is in place for absences, and hours scale up or down month to month. Where the work touches authorizations, we run it alongside our prior authorization team so nothing stalls between the front desk and the payer.
There is no published price. We scope the tasks, hours and systems on a free call first, then quote. If a VA is not the right answer for the problem you describe, we will say so.
Call +1 786-788-7313 or email info@reliablecarercm.online to set up the scoping call.
Frequently asked questions
Administrative work that does not need a clinician: answering and returning calls, booking and confirming appointments, checking insurance eligibility and benefits, submitting and chasing prior authorizations, working recalls and no-shows, triaging the fax and email inbox, prepping charts, posting and following up on claims, and calling patients about balances. The task list should be written down before anyone starts, not worked out as you go.
A VA company that creates, receives, maintains or transmits patient data on your behalf is a business associate, so you need a signed business associate agreement before access is granted. Compliance after that depends on real controls: unique logins per person, role-based access limited to the minimum necessary, audit logs you can pull, encrypted devices and connections, documented training, and a sanction policy. Ask for evidence, not a logo.
VA services are usually priced by the hour or as a monthly block of part-time or full-time hours, so the number depends on hours, task mix and how many systems are involved. Compare it against the full cost of a local hire, which is salary plus benefits and payroll taxes, not salary alone. Reliable Care quotes after a free scoping call rather than publishing a rate.
Yes, under your control. You create a named user account for each assistant with a role that fits the tasks, the same way you would for an on-site employee, and you keep the ability to review activity and switch access off. Do not share one login between people. If your vendor asks for a shared account, treat that as a reason to stop and ask why.
A virtual medical receptionist is the narrow version: phones, scheduling, messages and basic patient questions during your hours. A medical virtual assistant usually covers that plus back-office work such as eligibility, prior authorizations, document triage, chart prep and billing follow-up. Many practices start with phones and scheduling, then add back-office tasks once the first set is running cleanly.
Plan on one to three weeks for a single assistant on a defined task list. The time goes into scoping the tasks, signing the business associate agreement, setting up system access, writing SOPs from your actual workflow and shadowing your staff before go-live. Reliable Care goes live in as little as one to two weeks when access and SOPs are ready on time.
Sources
- 45 CFR 164.502 - Uses and disclosures of protected health information: general rules, eCFR
- 45 CFR 164.504 - Uses and disclosures: organizational requirements, eCFR
- Business Associates, HHS Office for Civil Rights
- 45 CFR 164.308 - Administrative safeguards, eCFR
- 45 CFR 164.312 - Technical safeguards, eCFR
- HIPAA Security Guidance (remote use and access to electronic protected health information), HHS Office for Civil Rights
- Secretaries and Administrative Assistants: Occupational Outlook Handbook, U.S. Bureau of Labor Statistics
- Receptionists: Occupational Outlook Handbook, U.S. Bureau of Labor Statistics
- Employer Costs for Employee Compensation - June 2026, U.S. Bureau of Labor Statistics
- Employer Costs for Employee Compensation, Table 4: Private industry workers by occupational and industry group, U.S. Bureau of Labor Statistics
- Offshore Outsourcing of Administrative Functions by State Medicaid Agencies (OEI-09-12-00530), HHS Office of Inspector General
Rules, payer policies and figures change. This article explains them in general terms as of October 21, 2026; it is not legal advice.
