Last updated: 2026-09-08
Every system named on this page belongs to the practice rather than to the assistant, and that one fact shapes the rest. Which EHR system the work happens inside comes first, along with who creates the account and how far its rights reach. A password manager and the credential habits around it follow, because a shared login ruins an audit trail faster than anything else on the list. VPN and endpoint rules cover the device itself next, down to the backup connection and the power behind the router. Where secure messaging has to replace email for patient details is a channel decision your practice makes, and a signed Business Associate Agreement is what turns that decision into a term. The document intake queue, still fed by fax across most of US healthcare, is the messiest piece here and gets a section of its own. Which phone system the calls land on comes after that, with Nextiva named because Honest Taskers uses it. How much of the scheduling tool one person should see turns out to be a scoping question rather than a software question. Screen and workspace controls describe what happens in the room while these tools are open, from the door to a screenshot that should never exist. Audit logs and access reviews close the working sections, since a granted account nobody reads is a liability with a login. Where these HIPAA safeguard and software facts come from finishes the page.
A HIPAA-safeguarded virtual assistant works in the practice's own EHR, through a named account somebody inside the practice creates, with rights set module by module. That's the whole arrangement. No staffing company can hand over an EHR login, because no staffing company holds one, and the client controls which systems and permissions are granted.
Candidates may have worked in Epic, eClinicalWorks, AdvancedMD, Athenahealth, Tebra, Elation, NextGen, DrChrono, Kareo, Practice Fusion, Cerner or Allscripts, and Honest Taskers can prioritize professionals who already know the platform your front desk runs on. Nobody knows all of them. Four years inside Athenahealth and one week shadowing Epic don't make somebody an Epic user, so ask one named candidate about one named system instead of reading a logo wall. More than two hundred EHR systems are in use across US healthcare, which makes the honest version of this promise a matching exercise plus role-specific training, never fluency in everything.
Scoping happens before the first shift, and writing it down takes ten minutes. Named accounts only, since a shared credential turns an audit trail into fiction the moment two people use it. Then go module by module. Most arrangements need write access in the scheduler module and eligibility, reading rights on chart notes without editing rights, and separate grants for billing, the clearinghouse portal, portal messaging, the fax platform and the phone system, whether the person you hire works as a receptionist, a scheduler or a records specialist. None of those grants arrives automatically with the first one.
Volume is the reason any of this gets delegated at all. The American Medical Association's work on administrative burden ties heavy EHR and inbox loads to physician burnout, and moving keying, queue work and follow-up off clinical staff is the response most practices reach for.
A password manager fits in as the single place a practice credential is allowed to live, which keeps logins out of chat threads, email bodies, spreadsheets and sticky notes. One person, one named account, one entry in the vault. Two assistants sharing one login is the failure this section exists to prevent, and it happens more than practice owners expect, because sharing is the fastest thing to do on a busy Monday.
Handling matters more here than the brand of the tool. A credential should reach a new professional through the manager rather than through a message, and the person who sends it belongs in your onboarding notes by name. Multi-factor prompts need a home too. Route one-time codes to a practice-controlled number or authenticator app rather than to a personal phone in another country, or your second factor quietly becomes somebody else's property.
Honest Taskers publishes the requirement that each professional works from a dedicated password-protected work computer meeting stated minimum specifications. A named password manager isn't part of what the company publishes, so treat that as not publicly listed and settle it during the interview. Ask which vault the arrangement uses, who holds the master credential, and what gets rotated on the day somebody leaves. A written answer beats an assumption, and getting one takes a single email.
Rotation is the step that rots. Revoking a login gets remembered during an offboarding conversation, while the shared clearinghouse password three people knew stays alive for months afterwards. Put a named owner on rotation and give the task a deadline measured in hours.
VPN and endpoint rules cover the one machine that touches your systems, the connection it rides on, and the power behind the router. Remote work screening checks them before anyone receives a login. Five items carry most of the weight in the Honest Taskers arrangement, and each one is checkable by somebody who asks.
Read that list as a practice manager and notice what it leaves out. Nothing there concerns typing speed or a broadband advertisement. Each line closes a route by which patient data walks out of a home office, such as a family member reading an open chart, a laptop shared with somebody who has no reason to see any of it, or a records request abandoned halfway through when the power cut.
Some controls sit outside what Honest Taskers publishes. Screen-lock timeouts, device encryption and removable-media rules aren't part of the screening list the company states, so a practice that wants them written into the arrangement should raise them and get an answer in writing. Asking costs nothing. Assuming has a price.
A HIPAA-safeguarded virtual assistant uses secure messaging the moment a message would carry a patient detail, and the line holds for internal coordination as much as for anything sent outward. Internal chatter about workload, shift cover and a payer call that went nowhere can live in Microsoft Teams, Slack or Google Workspace. Anything naming a patient belongs in the chart or the portal thread, where it sits logged against the record inside a system the practice controls.
Email is the channel that leaks. Autocomplete pulls a similar name out of last month's thread, a reply-all catches somebody outside the practice, and an attachment settles into a mailbox nobody reviews. A chart screenshot pasted into a chat window is the same failure wearing a different coat, and it's the habit most worth breaking in week one.
Which channel may carry what isn't a software question at all. Your practice decides it, and a signed business associate agreement turns that decision into a term rather than a preference. Honest Taskers signs a BAA with healthcare clients when the professional will access protected health information, so the workspace and access rules that read as good practice beforehand become contractual on the day of signature.
Video needs the same discipline as text. Webex, Teams and whatever telehealth platform the practice already runs all end up hosting a conversation with a name in it, which makes the room the call happens in matter as much as the encryption on the wire.
The practice's fax platform and its document intake queue handle it, and both live inside systems the practice owns rather than anything a staffing firm brings along. Fax hasn't died in US healthcare. Referral packets, imaging reports, signed orders, prior authorization decisions and records releases still arrive that way, which makes the intake queue the messiest tool on this page and the one where a mistake costs the most.
Queue work is indexing work. An inbound document gets read, matched to the right chart, named by whatever convention the practice already uses, then routed as a task to the person who has to act on it. Two patients sharing a surname is how the wrong chart collects the wrong PDF. A merge that drops two releases into one file is how a records request goes out with a neighbour's history attached to the back of it.
No fax vendor appears in Honest Taskers' published materials, so the tool here stays whatever your practice already runs, and a candidate's familiarity with it varies. Ask the person you're interviewing to describe the last intake queue they worked, including how they logged a document they couldn't match to a patient. The same stack seen from the records side is set out in our guide to medical records specialist tools and software.
Calls land on the practice's phone system, reached through a softphone on that same dedicated computer rather than on a personal mobile. Extensions, queues, transfer rules and voicemail all behave the way they do for onsite staff, because it's the same tenant with one more seat inside it.
Nextiva is the phone tool Honest Taskers uses, and candidates may also have worked in RingCentral, OpenPhone, Dialpad, Webex or the voice side of Microsoft Teams. Seat configuration stays yours. Which queue the assistant sits in, which extensions can transfer to a clinician, what the after-hours path does at six in the evening, and whether voicemail routing sends audio to an inbox outside the practice are all settings, and every one of them deserves a check before go-live.
Recording is the setting practices skip. Whether calls get recorded, where the audio sits, how long it's kept and who can play it back are decisions for the practice and its own counsel, never for a staffing firm and never for an article that can't see your policy. Settle it before the first patient call, because retrofitting a recording policy onto six months of stored audio is nobody's good afternoon.
How these pieces sit together across a whole front office, phone system included, is set out in our explainer on the software virtual medical assistants use.
Enough to run the book, and nothing past it. Write access to the calendar, the template rules, block reasons, the recall list, the waitlist and reminder settings covers the job as most practices define it. Billing screens, payroll, provider contracts and practice reporting sit outside that boundary, and a scheduler who can reach them holds more room than the role needs.
Scheduling tools come in two shapes. Either the calendar lives in the EHR, where scope is a permission question inside a system you already run, or the practice bolts on a separate booking platform, where a second account, a second review and a second revocation now exist. Practices forget the second one. It's the account still open three months after somebody left.
Reminder and recall settings deserve a slower look than they get. A reminder text carrying a procedure name tells a whole household more than the patient chose to share, and the assistant working the recall list didn't write that template. Read what your messages say today, then decide who can change them. Role-specific training covers the rest, which is the ground our guide to medical scheduler tools and software walks through.
Physical controls apply, and they carry as much weight as anything running on the machine. A door that closes. The screen angled so no housemate reads a chart. Then a headset instead of a speaker, and a room where a call about a biopsy result doesn't carry through a partition wall.
Honest Taskers screens for a dedicated workspace suitable for privacy and a company-approved home office meeting security and privacy requirements before a first shift for the client. Habits sit on top of the screening. Records stay in the practice's systems rather than on a personal drive. Chart screenshots don't become chat attachments. Personal phones stay off the desk during a shift with patient data on screen, which a practice can state plainly and a professional can follow without argument.
Home offices aren't the only model on offer. Work-from-office arrangements exist for qualifying enterprise clients hiring five or more professionals, which puts supervision and an added security structure in one building. Smaller practices stay on the screened home-office model, where the screening list does the work.
One habit is worth copying at any size. Re-check the room instead of assuming it froze in place, because people move house, routers die and a sibling takes over the spare bedroom that used to be an office. Candidates setting up their own room can read the same requirements from the other side in our guide to a virtual assistant home office setup.
Audit logs and access reviews cover a HIPAA-safeguarded virtual assistant by tying every action in a system to one named account, then putting a named person in front of what the log says on a fixed cadence. The Department of Health and Human Services sorts the HIPAA Security Rule's requirements into administrative, physical and technical safeguards, and its published HIPAA rules place access control and audit controls in the technical group. Shared logins break both at once.
A review is a calendar item rather than a feeling. Pick the cadence, list every system the professional can reach, check each account against the role as it stands today instead of as it read in March, and close whatever nobody needs. Revocation is the step that slips. Give it a named owner and a deadline in hours, then run it as a replacement arrives so the departing account closes while the new one opens. Honest Taskers gives every client a dedicated Customer Success Advocate who coordinates onboarding and replacement, and your practice still performs the account changes, because your practice holds the systems.
Turnover is the hidden cost sitting under all of this. Each departure means another workspace screening, another set of grants, another revocation and another person learning which two of your patients share a surname. Honest Taskers reports 99.6% average monthly retention, and the programs behind that number include healthcare coverage for eligible team members, interest-free loans through a safety net program, wellness care packages, performance-based raises and continuing training. Rates run $10.00 to $12.65 an hour depending on the role, candidate background, schedule and location. New clients may receive a two-week working trial with their first selected professional, subject to current service terms, and unlimited replacement support applies afterwards, where a performance-related replacement may qualify for a credit covering the replacement professional's first two weeks.
Compliance posture belongs in the same conversation as access. Honest Taskers puts its Virtual Healthcare Assistants through quarterly HIPAA training and quarterly data privacy training under a dedicated HIPAA compliance officer, has its HIPAA compliance verified by Accountable, describes its security environment as SOC 2 audit ready, and carries professional liability, cyber liability and general liability insurance. None of that makes a person compliant, because HIPAA sets out safeguards an organization puts in place rather than a badge an individual can hold. What to ask before you create that first account is covered in our piece on whether a virtual assistant can work in your EHR.
Honest Taskers' remote work screening list, quarterly training cadence, HIPAA compliance officer, BAA timing, Nextiva as its phone tool, the rate range, the two-week working trial, replacement terms, retention figure, insurance lines and SOC 2 audit-ready posture all come from the company's own published service terms and compliance materials (Honest Taskers, 2026), and the third-party verification named on this page is Accountable. EHR, phone and collaboration platforms appear by name because candidate experience across them varies, never because one professional knows all of them. Safeguard categories come from the U.S. Department of Health and Human Services, which administers the "Health Insurance Portability and Accountability Act of 1996" and publishes the rules written under it, while the administrative burden material comes from the American Medical Association. No password manager, fax vendor, encryption standard, log retention period or breach statistic appears above, because Honest Taskers doesn't publish those and a practice's own policy decides them. Counting electronic health record systems in use across US healthcare runs past two hundred, which is why software experience is a question to ask a named candidate rather than a claim to accept about a pool.
Once the stack makes sense and the question turns into which provider will commit to these controls in writing, see our ranking of HIPAA-safeguarded virtual assistant companies.
Request candidates with experience in your specialty and software.
