Last updated: 2026-09-23

Deciding between a HIPAA-trained virtual assistant and in-house staff starts with what separates the two, and the split is presence and paperwork rather than ability. From there the questions get concrete. Which safeguards the remote professional works under is answerable as a list, running from quarterly training through to the computer on the desk. How protected health information reaches a virtual assistant off site has an answer most buyers find reassuring, because the records don't travel at all. Its mirror image matters more, and that is the system access a practice should never hand a virtual assistant. Then comes the limit nobody selling remote staffing likes to lead with, meaning what an on-site employee can do that a remote one can't, and it belongs before any price. Who carries the HIPAA obligation once a virtual assistant touches a record is a two-sided answer worth settling before the money. Cost follows scope rather than the reverse, so the fully loaded total for an in-house administrative hire comes next, then what a HIPAA-trained virtual assistant costs per hour with no employer load on top. Timing follows cost, meaning how long it takes to put a virtual assistant behind a signed BAA. After that, which practices should keep protected work with in-house staff, put as tests you can apply rather than adjectives. Whether a signed BAA makes a virtual assistant HIPAA compliant gets a short answer and an important one. When a practice needs both a virtual assistant and in-house staff closes the argument, and where these figures come from is set out last.

What separates a HIPAA-trained virtual assistant from in-house staff?

A HIPAA-trained virtual assistant and in-house staff separate on presence and on paperwork, not on ability. The remote professional signs in to your existing software from a screened home office and works the administrative queues living inside it. In-house staff sit on your payroll, walk into the building, and can handle anything the building itself demands. Both touch protected health information. What changes is how that access gets granted, logged and switched off.

A second split decides the money, and it's the one that catches practices out. An employee costs a salary plus the employer load stacked on top, whether or not there's work for every hour of the week. A remote hire costs an hourly rate carrying none of that load. Setting $22 an hour against $12 an hour reads the wrong number on both sides, because the employer's real cost isn't $22 and the remote hour has no minimum underneath it.

Which safeguards does a HIPAA-trained virtual assistant work under?

A HIPAA-trained virtual assistant works under a stack of safeguards that starts with training and ends with the hardware on the desk. Honest Taskers Academy provides the HIPAA training and issues a certificate of completion, and HIPAA compliance is verified by Accountable. Training runs quarterly, alongside quarterly data privacy training, under a dedicated HIPAA compliance officer. Screening covers the workspace as well as the person, which means a dedicated password-protected work computer, a minimum internet line with a backup, power backup, and a private room nobody else walks through.

Read that table as safeguards rather than guarantees. Each row lowers the chance of an avoidable exposure, and no row promises an outcome. One line in the last column is yours rather than the staffing company's, and it's the line that decides how much damage a single mistake can do.

How does protected health information reach a virtual assistant off site?

Protected health information reaches a virtual assistant off site through your own systems rather than through anything you send. The assistant signs in remotely to the EHR, the practice management system, the fax portal and the phone platform using a named account your practice creates, over a VPN-secured connection from a dedicated password-protected work computer. Records stay in the source system, so the chart gets read and updated in place instead of copied to a local drive.

That route doesn't change with the job title. A virtual medical assistant working scheduling, a remote intake coordinator and a billing support professional all reach PHI the same way, because the axis is the login rather than the contract. Two details are worth writing into the engagement before day one. Sessions end when the shift ends, and every action carries the assistant's own name in your audit log rather than a shared account somebody else also uses.

Which system access should a practice never hand a virtual assistant?

A practice should never hand a virtual assistant a shared login, blanket administrator rights, or a permission set wider than the queue the role works. Access is the one safeguard the practice controls outright, and it's the one most often granted loosely because tightening it later feels like an insult. Scope it as you would for a new on-site employee, then review it on a date in the calendar.

• A shared or generic login, since access under a name nobody owns erases the audit trail.
• System administrator access, including the power to create accounts or change other users' permissions.
• Bulk export or full-database report access, where the role only ever needs one record at a time.
• Access to modules the role never touches, such as clinical documentation sign-off, payroll, or your banking portal.
• Access that outlives the engagement, because an unrevoked account is an open door nobody is watching.

What can an on-site employee do that a remote virtual assistant cannot?

An on-site employee can do everything the building requires, and that's the honest limit of the remote model. It belongs here, before a single cost figure, because opening with price and burying this list is how these pages mislead people. A remote virtual assistant can't perform any of the following.

• Room a patient, take vitals, draw blood, or assist with a patient procedure.
• Greet a patient at the front desk, hand over a form, or take a cash co-pay.
• Open a patient's physical mail, file paper charts, handle paper faxes, or receive specimens.
• Set up a treatment room for a patient, count visit supplies, or handle equipment.
• Make a clinical decision about a patient, which stays with your licensed providers wherever they sit.

Where most of your open role sits in that list, the comparison is already settled and you're hiring in-house. Read on where a real share of the work is administrative. In most practices it is, for a structural reason rather than a filing failure, since verification, prior authorizations and callbacks land on whoever is at a desk.

Who carries the HIPAA obligation once a virtual assistant touches a record?

Both sides carry it, and neither side hands its share to the other. Your practice stays a covered entity with its own obligations under the HIPAA rules, and outsourcing a queue doesn't move them somewhere else. The staffing company becomes a business associate and picks up obligations of its own, directly, because the rules reach business associates on their own terms rather than only through whatever the contract says. You can read the rules themselves, plus plain-language guidance, from the US Department of Health and Human Services on HIPAA, which beats a vendor's summary of them.

Practically, that shared obligation means you keep doing the things a covered entity does. Your risk analysis still covers the remote seat. Access reviews still include the assistant's named account, and breach procedures still name who calls whom at 6pm on a Friday.

What does an in-house administrative hire cost a practice in total?

An in-house administrative hire costs a practice about $68,252 a year at the national median, which is roughly half again the salary line. US medical secretaries and administrative assistants earned a median $45,930 a year, occupation code 43-6013 (Source: Bureau of Labor Statistics, "Occupational Employment and Wage Statistics", May 2025). The employer load sits on top and gets broken into components below so nothing gets counted twice (Source: Bureau of Labor Statistics, "Employer Costs for Employee Compensation", March 2026).

Two notes on that arithmetic. The five components add to 48.6% while the same release reports total benefits at 48.7% on top of wages, and the gap is rounding rather than a missing line. Recurring cost is also all the table holds. Filling the seat averages $5,475 per hire for non-executive roles (Source: SHRM, "2025 Benchmarking Report"), and equipment, space and coverage during leave vary too much between practices to carry a national number, so they aren't in the table at all.

What does a HIPAA-trained virtual assistant cost per hour?

A HIPAA-trained virtual assistant costs $10.00 to $12.65 an hour through Honest Taskers, varying with role, candidate background, schedule and location. At 40 hours a week that works out around $1,600 to $2,024 a month, or about $20,800 to $26,312 a year. Twenty hours a week runs roughly $800 to $1,012 a month, about $10,400 to $13,156 a year. None of the employer load applies, since you're buying hours rather than employing a person, so there's no payroll tax, no insurance, no paid leave and no workspace.

The part-time line is the one most practices underweight. An in-house administrative hire is a full-time decision in most offices even where the work fills 20 hours, because half-time front-office roles are hard to recruit and they're harder to keep. Work the numbers on your own wage band rather than the national median, and price only the administrative hours that move, not your whole payroll. For the hourly side in more detail, our guide to how much a virtual medical assistant costs carries the full breakdown.

How long does it take to put a virtual assistant behind a signed BAA?

Most Honest Taskers placements complete within one to three weeks of a signed agreement, and the Business Associate Agreement gets signed inside that window, before any system access is granted. Sequence matters more than speed here. The service agreement and the BAA come first, then your practice creates the named account and sets the permission scope, then work starts. A first hire also comes with a two-week working trial, so fit gets tested in the real environment rather than in an interview.

Compare that against recruiting an in-house administrative hire in most US markets, where posting, screening, interviewing and notice periods run longer before onboarding even begins. The seat sits empty meanwhile and the queue lands on whoever's already there. For what the contract itself covers, see our explainer on what a BAA business associate agreement is.

Which practices should keep protected work with in-house staff?

Practices whose protected work is inseparable from the building should keep it with in-house staff, and four tests settle it faster than a pros and cons list. Apply them in order, since any one can end the decision on its own.

• Does the protected work need hands on a patient, on paper, or on a specimen? Where it does, that work stays.
• Does your EHR support named remote accounts with per-module permissions? Where it doesn't, remote work has no access control to rest on.
• Does a payer contract, a state rule or a grant condition restrict where your data may be reached from? Check that before you shop the work out.
• Can somebody on your side own the access review and the offboarding? Remote work nobody supervises is a risk whoever fills the seat.

One more test applies to offshore arrangements specifically. Honest Taskers recruits in the Philippines, Latin America, India and Pakistan, and professionals work your US time zone, so confirm that your own policies and payer contracts address access from outside the United States before you start.

Does a signed BAA make a virtual assistant HIPAA compliant?

No, a signed BAA doesn't make a virtual assistant HIPAA compliant. A Business Associate Agreement is a contract that allocates obligations between a covered entity and a business associate. Compliance is a state of affairs the covered entity and its business associates hold up together, through training, access controls, risk analysis, audit logs and incident response, and a contract alone doesn't produce it.

The same line applies to training certificates. A person is HIPAA-trained, and an Honest Taskers Academy certificate records that the training was completed. It doesn't confer compliance on that person and it doesn't remove the need for a signed BAA. Treat the certificate as evidence that a safeguard is in place and the BAA as the document that says who owes what. That distinction gets worked through with examples in our explainer on whether a virtual assistant can be HIPAA compliant.

When does a practice need both a virtual assistant and in-house staff?

A practice needs both as soon as its protected work splits cleanly into tasks requiring presence and tasks requiring only a login, which is what most medical and dental offices look like. The arrangement that holds up keeps in-house staff on the front desk, clinical support and anything physical, then moves the phone queue, insurance verification, documentation support and follow-up to a remote seat. Nobody gets displaced. The queue simply stops landing on people hired to do something else.

Watch for the signal that tells you the split has already happened without anyone deciding it. An in-house employee spending hours a day on verification and callbacks is being paid at a loaded employee rate for output an hourly remote hire could deliver, and is unavailable meanwhile for the work only somebody in the building can do. Practices that struggle here moved a whole role instead of a queue, then found nobody was covering the on-site half. For firms running this model, our roundup of the best HIPAA-trained virtual assistant companies is the shortlist to start from.

Where do these HIPAA-trained virtual assistant figures come from?

Wages come from the Bureau of Labor Statistics "Occupational Employment and Wage Statistics" program for May 2025, occupation code 43-6013, medical secretaries and administrative assistants. Load percentages come from the same agency's "Employer Costs for Employee Compensation" series for March 2026, office and administrative support in private industry, applied as separate components so paid leave and legally required benefits aren't double counted. Cost per hire comes from SHRM's "2025 Benchmarking Report". HIPAA obligations come from the US Department of Health and Human Services HIPAA pages, with no figure attached. Honest Taskers rates and safeguards come from the company's own published information. Wage figures are national medians.

For the same cost question run on a general administrative role rather than a healthcare one, and for the load percentages applied to a non-clinical wage band, see our virtual assistant vs in-house employee cost comparison.

Talk to Honest Taskers about which half of your protected workload can move.