HIPAA Checklist for Hiring a Therapist’s Virtual Assistant

Use it as a checklist before your VA’s first day. Every item below has been through a real BAA audit.

Why the HIPAA Question Comes Up First

Private practice therapy is one of the most admin-heavy jobs in healthcare. Scheduling. Intake paperwork. Insurance verification. Billing. Progress note follow-through. Referral coordination. Most therapists spend 12-18 hours a week on work that isn’t clinical.

That’s billable hours lost. Evening hours gained. Burnout earned. A properly set up virtual assistant for therapists at $1,400 to $2,400 a month can reclaim most of that time.

The HIPAA Checklist: 6 Requirements Before Day One

HIPAA doesn’t prohibit virtual assistants. It prohibits careless ones. The law requires three things:

One: a signed Business Associate Agreement (BAA) with anyone handling PHI (Protected Health Information).

Two: reasonable safeguards — administrative, physical, and technical — to protect PHI.

Three: breach notification procedures if something does go wrong.

A U.S.-based admin sitting in your office needs the same three things. A Filipino VA with proper setup meets the same bar. Geography isn’t the issue. Process is.

For a fuller treatment, read HHS’s HIPAA rules directly. For setting up the VA side specifically, our VA security and compliance guide walks through the layers.

What You Can Safely Delegate (HIPAA-Green Tasks)

Intake and Scheduling

Client intake coordination. Your VA sends new-client paperwork, tracks completion, and flags incomplete forms before the first session.

Appointment scheduling and confirmation. Booking new clients, confirming upcoming sessions, handling reschedules and cancellations.

Waitlist management. Tracking clients waiting for openings, filling same-day cancellations, minimizing revenue loss.

Insurance verification. Calling insurance companies to verify benefits, coverage, and authorization requirements. Tedious but essential.

Billing and Claims

Insurance claims submission. Submitting claims through SimplePractice, TherapyNotes, Headway, or your clearinghouse.

Payment processing and posting. Applying payments, handling copays, following up on outstanding balances.

Denial and appeal management. Tracking denied claims, gathering supporting documentation, resubmitting with corrections.

Superbill generation. Preparing monthly superbills for out-of-network clients who file their own claims.

Practice Operations

Client communication management. Responding to non-clinical questions, sending appointment reminders, managing your practice inbox.

Referral coordination. Sending and receiving referrals, maintaining your referral network, following up with referring providers.

Intake form review. Flagging completed forms for your clinical attention, never providing clinical interpretation.

Practice management software maintenance. Keeping SimplePractice, TherapyNotes, or your EHR organized and up to date.

Marketing (Non-PHI Only)

Psychology Today profile maintenance. Keeping your listing fresh, responding to new directory inquiries.

Social media and blog support. Posting educational content (not client stories) to your practice’s public channels.

Google Business Profile management. Handling reviews, posting updates, keeping hours current.

Newsletter for prospective clients. If you run one. Client newsletters involve PHI risks — those stay internal.

What You Must Never Delegate (HIPAA-Red Tasks)

The lines are sharp. Don’t blur them.

Provide clinical advice or interpretation. Even in response to “quick questions” from clients. All clinical communication goes through a licensed provider.

Document session notes. Progress notes are clinical documentation. Only licensed clinicians write them. A VA can format or upload them once written, but never create them.

Access PHI without documented need. Minimum-necessary standard. Your VA sees only what they need for their specific tasks. Not your full client roster.

Handle crisis or high-risk client communication. Anything involving suicide, self-harm, abuse, or acute symptoms goes directly to a clinician. Your VA’s script for those situations is one line: “Let me connect you with your provider immediately.”

Discuss client cases with anyone. Even internally. Even anonymously. HIPAA training covers this but reinforce it in your onboarding.

The HIPAA-Compliant Setup

Four layers. Do not skip any.

Layer 1: Business Associate Agreement. Signed BAA with your VA or their staffing agency before any PHI access. Your state bar or professional association usually has a template. If not, HHS provides sample BAA provisions.

Layer 2: HIPAA training. Your VA completes HIPAA training within their first week, ideally from a certified provider. Keep the completion certificate on file.

Layer 3: Technical safeguards. Encrypted laptop with full-disk encryption. Strong passwords with a password manager. Two-factor authentication on every system. VPN for accessing practice management software. No personal devices handling PHI.

Layer 4: Role-based access. Your VA gets access only to the parts of your EHR they need. Not full admin. Not full clinical. SimplePractice and TherapyNotes both support granular permissions — use them.

Reputable staffing partners handle Layers 1-3 as part of the service. If you’re DIY hiring, you’re building all four yourself. Budget a week of setup before your VA starts.

How to Structure the Role

Different practice sizes need different setups.

Solo practitioner (40-60 clients/week): One part-time VA, 15-20 hours per week. Focus on scheduling, intake paperwork, and basic billing. Budget $500-$1,100 a month. Expected time savings: 8-10 hours per week.

Group practice (2-5 clinicians): One full-time VA shared across the team. Covers intake, scheduling, insurance verification, billing support, and some practice management. Budget $1,500-$2,400 per month.

Group practice (6+ clinicians): Dedicated VA team. One lead, plus specialists for billing, intake, and scheduling. Usually 2-3 VAs per practice.

Tools Your Therapy VA Should Know

• EHR platforms: SimplePractice, TherapyNotes, TheraNest, Jane, Valant
• Billing: Headway, Alma, Grow Therapy (insurance-ready platforms with built-in billing), or your clearinghouse
• Scheduling: Calendly, Acuity, native EHR scheduling
• Communication: Spruce Health, OhMD, or encrypted messaging platforms
• Directory management: Psychology Today, GoodTherapy, TherapyDen
• Documentation: Word with encrypted storage, practice-integrated note templates

Onboarding Week by Week

Therapy VA onboarding runs slower than general onboarding. That’s by design.

Week 1: BAA signed. HIPAA training completed. Technical setup (laptop, VPN, 2FA, password manager). No PHI access yet.

Week 2: Shadow-mode access to EHR. Read-only. Your VA learns your workflows without touching records. They document what they observe.

Week 3: Limited write access for one task type — usually scheduling. You review every change for the first 10 appointments.

Week 4: Expand scope to intake and basic billing. Weekly supervision rhythm kicks in.

Compare to our general 7-day VA onboarding guide — therapy needs the extra time to set compliance foundations before live work.

Honest Answers to Common Worries

“Can an international VA handle U.S. insurance billing?” Yes. Filipino VAs regularly handle Medicare, Aetna, BCBS, UnitedHealth, Cigna, and regional payers. Platforms like Headway and Alma automate most of the complex parts. Your VA handles the submission and follow-up.

“What about time zones for client communication?” Most therapy VAs match U.S. business hours. Philippines is 12-15 hours ahead, which actually works well — your VA’s afternoon covers your morning.

“What if there’s a breach?” You report it under HIPAA breach notification rules, same as any breach. Your BAA with the VA or staffing partner defines liability. Document the incident, notify affected clients, and complete any required corrective action.

“What about mandated reporting situations?” Your VA’s protocol is zero discretion. Anything involving suspected abuse, neglect, or harm goes immediately to the clinician on call. Never handled by the VA.

When a Therapy VA Isn’t Right

Be honest.

If you’re a clinician who only sees 8-15 clients a week and your admin is 2-3 hours, a VA may be overkill. Invest in better practice management software first. SimplePractice’s automation alone handles much of what a part-time VA would.

If you practice in a specialty with unusually high PHI sensitivity (forensic evaluations, high-profile clients, certain legal contexts), in-house admin may be safer. The compliance setup for a VA works but adds complexity you may not want.

For most private practice therapists, group practice operators, and mid-size mental health clinics, a VA pays for itself in the first quarter.

Start Small

Don’t hand off everything day one. Start with scheduling and intake paperwork. Low PHI exposure, immediate time savings. Once the supervision rhythm is working, expand to insurance verification and billing.

The practices that succeed with a therapy VA are the ones that build the compliance layer before the first PHI touch. Skip that step and you’re rolling the dice with your license.

If you want vetted therapy VAs with HIPAA training and pre-signed BAAs, Armasourcing’s therapy VA service handles the setup. Otherwise, build your compliance layer first, then hire.

Related: Therapy VA Services | VA Security & Compliance | VA for Coaches | Book a Free Call