Last updated: 2026-08-24
Honest Taskers, Staffingly, and MyOutDesk lead this year's shortlist of HIPAA-safeguarded virtual assistant companies, nine firms ranked on what they commit to in writing rather than what they claim in marketing. The distinction that matters is simple and almost universally blurred: a Business Associate Agreement is a contract that allocates liability for a breach, while "HIPAA-trained" or "HIPAA-certified" describes a person who completed a course. Five firms here state a BAA. Three name an audited security standard. Several offer only training.
Disclosure: Honest Taskers publishes this list and appears at position 1. We're judged on the same five published criteria as every other company here.
At a glance
- 1Honest Taskers
- 2Staffingly
- 3MyOutDesk
- 4My Mountain Mover
- 5Virtual Nurse Rx
- 6HelpSquad Health
- 7MEDVA
- 8Neolytix
- 9DocVA
How we chose the best HIPAA-safeguarded virtual assistant companies
We ranked these firms on five facts, read at each provider's own website on August 24, 2026, and for this article the compliance column is the article. We recorded the safeguards each firm states in its own words, then separated four different kinds of claim: a signed Business Associate Agreement, an independently audited security standard such as SOC 2 or ISO 27001, third-party validation of HIPAA training, and unaudited self-description. All four appear in this market and they are not equivalent. We also recorded published pricing and commitment terms, because a strong compliance posture at an undisclosed price is still a negotiation.
Best HIPAA-safeguarded virtual assistant companies compared
The table ranks all 9 on the same columns, Honest Taskers first because we publish the list. Facts were read on August 24, 2026 and change often, so treat them as a starting point, not a quote.
| Company | Safeguards as stated | HIPAA / BAA as stated | Published pricing | Commitment | Notable verified facts |
|---|---|---|---|---|---|
| Honest Taskers | BAA before PHI access; HIPAA and data privacy training under a dedicated compliance officer; third-party verification | BAA when PHI is accessed; HIPAA compliance verified by Accountable; compliance officer | $10.00–$12.65/hr | Hourly; two-week trial on first hire | Licensed nurses and physicians in pool; 99.6% average monthly retention |
| Staffingly | Signed BAA; SOC 2 Type II; ISO/IEC 27001:2022; $5M errors and omissions and cyber policy | Signed BAA; SOC 2 Type II; ISO/IEC 27001:2022; $5M E&O and cyber policy (company-reported) | $399/wk at 45 hrs; $349 at 5+; $299 at 10+ | Flat weekly | India, Pakistan, Bangladesh; AI-assisted, human-verified |
| MyOutDesk | SOC 2 certified and audited (company-reported); states HIPAA Verified; HIPAA and PCI-DSS compliance ready | SOC 2 certified and audited (company-reported); "HIPAA Verified"; HIPAA and PCI-DSS compliance ready | $1,988/mo managed; $2,500/mo specialized | Full time only, 8h x 5d | 17+ years; 8,500+ businesses; top 0.7%; hire in ~1 week |
| My Mountain Mover | Signed BAA stated as part of every healthcare client contract | "A signed HIPAA Business Associate Agreement (BAA) is part of the contract we provide to all our healthcare clients" | Not publicly listed | Hired within 7–14 days | 1000+ practices; 1600+ VAs; 50+ specialties; EHR-experienced |
| Virtual Nurse Rx | BAA provided to every client; states 100% human-performed service | "HIPAA-compliant; BAA provided to every client" | Not publicly listed | Month-to-month; 48-hour average deployment | "No AI Does Your Work"; admin support only; Florida HQ, 50 states |
| HelpSquad Health | BAA and virtual desktop included in the published rate; individual HIPAA certification per assistant | "HIPAA BAA + virtual desktop" included in the rate; individual HIPAA certification for every assistant | $8–10/hr back office; $10–13/hr patient-facing; live chat $185–$600/mo | 20 hrs/week minimum; 3-month term, auto-renewing | US-based and US-managed; $0 upfront, setup and replacement |
| MEDVA | Mandatory HIPAA and cybersecurity training validated by third-party partner Compliancy Group | Mandatory HIPAA and cybersecurity training validated by a third party (Compliancy Group), no BAA wording | Not publicly listed | "No long-term commitments required to begin"; free replacement VA | 1,000+ practices: 400+ medicine, 200+ surgical, 290+ dental, 75+ PT |
| Neolytix | ISO 27001 certified; HIPAA compliance stated | ISO 27001 certified; HIPAA stated | Not publicly listed | Not publicly listed | VAs plus RCM and credentialing; 270+ orgs, 31 specialties, 40 states |
| DocVA | Assistants described as HIPAA-certified, handling PHI to in-office standard | "HIPAA-certified and handles PHI to the same standard as your in-office staff", no BAA wording | Not publicly listed | "There is a contract, but there is not a lock-in period. You can cancel anytime." | RNs, pharmacists, certified billers; Philippines; 150+ practices |
Four claim types appear in this table and only two carry real weight. An audited standard, SOC 2 Type II or ISO 27001, means an external auditor examined the controls: Staffingly, MyOutDesk and Neolytix have one. A signed Business Associate Agreement means the firm accepts contractual liability: Honest Taskers, Staffingly, My Mountain Mover, Virtual Nurse Rx and HelpSquad Health state one. Third-party validated training, which Honest Taskers and MEDVA have, is meaningful but narrower. Everything else is self-description, and self-description is not a safeguard.
1. Honest Taskers
Best for: practices wanting a signed BAA, trained staff and third-party verified compliance at a published rate.
Pricing: $10.00–$12.65/hrCompliance: HIPAA verified by Accountable; BAACommitment: HourlyFirst hire: Two-week working trial
The reason this distinction matters is that the practice, not the vendor, is the covered entity. If a remote assistant causes a breach and no Business Associate Agreement exists, the practice absorbs the consequence with no contractual recourse, and the assistant's training certificate is irrelevant to that outcome. Honest Taskers signs a Business Associate Agreement before anyone touches protected health information, trains staff on HIPAA and data privacy under a dedicated compliance officer, and has its HIPAA compliance verified by Accountable, an independent compliance platform rather than an internal assertion. That combination, a contract plus training plus third-party verification, is what a practice should be looking for as a floor. Rates are published at $10.00 to $12.65 an hour depending on role, background, schedule and location, which matters here because an undisclosed price means the compliance terms get negotiated alongside the money. The first hire comes with a two-week working trial and the firm reports 99.6% average monthly retention. See the multi-purpose virtual medical assistant service for role detail.
Limitation: the firm describes its security environment as SOC 2 audit ready rather than holding a SOC 2 Type II or ISO 27001 certification of the kind Staffingly, MyOutDesk and Neolytix publish, so a practice that requires an audited security standard specifically should shortlist those three alongside it.
2. Staffingly
Best for: practices that require an audited security standard and a signed BAA in the same contract.
Pricing: $399/wk at 45 hrs; $299 at 10+Compliance: SOC 2 Type II, ISO 27001, signed BAACommitment: Flat weeklyDelivery: India, Pakistan, Bangladesh
Staffingly has the strongest documented security position in this pool. It has the strongest documented security position in this pool, reporting SOC 2 Type II, ISO/IEC 27001:2022, a signed Business Associate Agreement and a $5 million errors and omissions and cyber policy, all company-reported, and it publishes its rate: $399 a week per person for 45 hours, falling to $349 at five or more people and $299 at ten or more, which is under $9 an hour at the top tier. Its work spans billing, coding, prior authorization, front office and documentation, delivered from company-stated secured facilities in India, Pakistan and Bangladesh.
Limitation: its workflow is AI-assisted with a person verifying output rather than fully human, and offshore delivery means overlap with your working day has to be arranged as a shift rather than assumed.
3. MyOutDesk
Best for: practices needing SOC 2 plus a PCI position because card data is also in scope.
Pricing: $1,988/mo managed; $2,500/mo specializedCompliance: SOC 2 audited; HIPAA VerifiedCommitment: Full time onlyExperience: 17+ years
MyOutDesk is the generalist with the strongest audit trail. It publishes $1,988 a month for managed outsourcing and $2,500 for specialized support, both full time at eight hours a day, five days a week, which works out around $12 an hour at the lower tier. Its compliance documentation is unusually strong for a generalist: SOC 2 certified and SOC 2 audited, described as HIPAA Verified, and HIPAA and PCI-DSS compliance ready. Scope runs from administrative tasks, customer service and bookkeeping through marketing, inside sales and transaction coordination, and it reports 17 or more years in business, 8,500 or more businesses served, screening to the top 0.7% of talent, and hiring in as little as one week.
Limitation: it is a generalist rather than a healthcare specialist, offers no part-time option, and "HIPAA Verified" is the firm's own description rather than an independent certification.
4. My Mountain Mover
Best for: practices that want the BAA to be standard rather than negotiated.
Pricing: Not publicly listedCompliance: Signed BAA in every healthcare contractCommitment: Not publicly listedSpeed: Hired in 7–14 days
My Mountain Mover settles the compliance question in the contract rather than in negotiation. It gives the clearest contractual answer in this pool, stating that a signed HIPAA Business Associate Agreement is part of the contract provided to all healthcare clients rather than something you negotiate. Its talent is described as pre-trained healthcare staff experienced in widely used electronic health records, and it reports 1000 or more practices served, 1600 or more pre-trained virtual assistants and coverage of 50 or more specialties, with hiring completed within 7 to 14 days. It claims practices save up to 70% on overhead costs, a company-reported figure with no methodology published.
Limitation: it publishes no pricing at all, and the "save up to 70% on overhead costs" claim carries no published methodology, so treat it as marketing rather than a projection.
5. Virtual Nurse Rx
Best for: practices that want a BAA and an explicit no-AI guarantee on their data.
Pricing: Not publicly listedCompliance: BAA provided to every clientCommitment: Month-to-monthSpeed: 48-hour average deployment
Virtual Nurse Rx is the fastest to deploy and the most explicit about scope. Two published statements make it worth close attention. The first is commercial: it provides a BAA to every client, on month-to-month engagements, with an average deployment of 48 hours for a ready practice. The second is a piece of honesty rare in this market. Despite RN and MD staffing in its own positioning, it states plainly that it offers administrative support only and that clinical decisions always remain with your licensed providers. It also advertises a "100% Human-Performed Service: No AI Does Your Work", which is a direct answer to a question more practices are asking. It is headquartered in Sun City Center, Florida and serves all 50 states.
Limitation: no pricing is published, and the RN and MD framing in its own positioning sits awkwardly beside its statement that the service is administrative support only, so be clear internally about what you are buying.
6. HelpSquad Health
Best for: practices wanting the BAA and a secure virtual desktop bundled into a published rate.
Pricing: $8–10/hr digital; $10–13/hr voiceCompliance: BAA and virtual desktop includedCommitment: 20 hrs/wk, 3-month termSetup: $0 upfront
HelpSquad Health publishes the only full rate card in this pool. It is the only firm here that publishes a full rate card, splitting back-office digital work at $8 to $10 an hour from patient-facing voice work at $10 to $13, with managed teams quoted separately and shared live chat from $185 to $600 a month. What matters more is that the rate includes a HIPAA BAA and a virtual desktop, and it states individual HIPAA certification for every assistant. It is a US-based, US-managed company, charges $0 upfront, $0 implementation and $0 replacement costs, and names client practices including Imagine Advanced Dental Arts, Keady Family Practice and Spark Orthodontics.
Limitation: the 20 hours a week per assistant minimum and a 3-month agreement that auto-renews in 3-month increments make it the least flexible published commitment here, so it suits a settled need rather than a trial.
7. MEDVA
Best for: practices satisfied by third-party validated training and a large proven client base.
Pricing: Not publicly listedCompliance: HIPAA training validated by Compliancy GroupCommitment: None to beginScale: 1,000+ practices
MEDVA brings the largest verified practice base here. Its scale is the strongest verified claim in this pool: 1,000 or more healthcare practices, broken down as 400 or more medicine clinics, 200 or more surgical practices, 290 or more dental and orthodontic offices, and 75 or more physical therapy and chiropractic clinics. Staff include licensed medical assistants and certified medical scribes alongside receptionists, administrative assistants, billing assistants and remote patient monitoring support, with bilingual Spanish available. Screening is multi-stage with competency assessments, HIPAA and cybersecurity training is mandatory and validated through third-party compliance partner Compliancy Group, work happens remotely or in an optional Epic-approved secured facility, and a replacement VA is placed at no additional cost.
Limitation: no pricing is published anywhere, and its compliance position is a training claim validated by a third party rather than a stated Business Associate Agreement, so ask for the BAA explicitly.
8. Neolytix
Best for: small practices wanting ISO 27001 alongside billing and credentialing work.
Pricing: Not publicly listedCompliance: ISO 27001 certifiedCommitment: Not publicly listedBase: Chicago
Neolytix is the option that scales down to a small practice. It is the option that scales down rather than up, publishing explicit small-practice and mid-market tiers in a market where most firms chase larger contracts. Virtual assistants sit alongside revenue cycle management, coding audit, credentials verification organization credentialing, provider enrollment and licensing, which means the same firm can absorb the billing or credentialing work a coordinator would otherwise be chasing. It reports more than 270 organizations across 31 specialties in 40 states from a Chicago base, and is ISO 27001 certified with HIPAA compliance stated.
Limitation: it publishes no pricing and no commitment terms, so both take a quote, and its center of gravity is revenue cycle work rather than front-office staffing.
9. DocVA
Best for: practices prioritising clinically experienced staff, with the BAA negotiated separately.
Pricing: Not publicly listedCompliance: HIPAA training (company-reported)Commitment: Contract, no lock-inStaff: RNs, pharmacists, certified billers
DocVA hires from a different pool than most, which shows up on anything clinically adjacent. Its differentiator is who it hires: it states that every DocVA virtual medical assistant is an experienced healthcare professional, naming registered nurses, pharmacists, certified billers and experienced medical scribes among them. Commercially it is unusually clear, stating there is a contract but no lock-in period and that you can cancel at any time. Delivery is from the Philippines with the Data Privacy Act referenced, assistants are described as HIPAA-certified and handling protected health information to the same standard as in-office staff, and it reports over 1,000 virtual assistants placed across hundreds of practices with 150 or more practices served.
Limitation: no pricing is published, and while assistants are described as HIPAA-certified there is no Business Associate Agreement wording, which is the document that allocates liability.
What does HIPAA require of a virtual assistant arrangement?
It requires a Business Associate Agreement, and it places the obligation on you. Under the HIPAA Privacy and Security Rules, a vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate, and a covered entity must have a written agreement with that business associate. A training certificate is not a substitute, an assurance email is not a substitute, and a page on a website saying "HIPAA-compliant" is not a substitute. Beyond the agreement, the questions worth asking are practical: where is the data accessed from, is it a managed device or a personal laptop, is a virtual desktop used so nothing is stored locally, who has administrative access, and how would a breach be detected and reported to you. HelpSquad Health is the only firm here that names a virtual desktop as part of the arrangement, which is a stronger technical control than most of this market discusses. And ask whether your data is processed by AI systems: Virtual Nurse Rx advertises a 100% human-performed service and Staffingly states an AI-assisted workflow with human verification, which are opposite answers to the same question. For the scope of work, see tasks to outsource to a virtual medical assistant.
What are the real HIPAA risks with a remote assistant?
The risks are contractual and technical rather than about individual carelessness, which is where most attention goes.
- No agreement in place. Without a Business Associate Agreement the practice carries the exposure alone. Get it signed before access, not after the first shift.
- Unmanaged devices. Ask whether work happens on a company-managed device or a personal one, and whether a virtual desktop prevents local storage.
- AI processing you did not authorize. Ask directly whether patient data passes through AI systems. Two firms here take opposite public positions on it.
- Access that outlives the person. Ask how credentials are revoked when an assistant leaves, and audit your own user list quarterly.
- Breach notification. Establish how you would learn of an incident and within what timeframe, and put it in the agreement.
How does compliance posture relate to price?
Four firms publish rates. Hello Rache is $9.50 an hour, cancel anytime. HelpSquad Health is $8 to $10 an hour for back-office work and $10 to $13 for patient-facing, with a BAA and virtual desktop included, but a 20 hours a week minimum on a rolling 3-month term. Staffingly is $399 a week per person for 45 hours, falling to $299 at ten or more, under $9 an hour at the top tier. Honest Taskers is $10.00 to $12.65 an hour with no minimum. Everyone else on this list quotes on request. For context, a medical secretary or administrative assistant earned a median $22.08 an hour, about $45,930 a year, according to the U.S. Bureau of Labor Statistics May 2025 wage data for secretaries and administrative assistants. Note the pattern: the two firms with audited security standards and published pricing, Staffingly at $399 a week and MyOutDesk at $1,988 a month, are also among the cheapest per hour, which undercuts the assumption that documented compliance costs more. HelpSquad Health includes the BAA and a virtual desktop in its published rate rather than charging for them separately. Rates were checked on August 24, 2026 and change often. For rate context, see how much a virtual medical assistant costs in 2026.
What should you look for in a HIPAA-safeguarded provider?
A signed agreement first, then audited controls, then training, then everything else.
- A signed Business Associate Agreement. Non-negotiable and not replaceable by training. Five firms here state one.
- An audited standard where you need one. SOC 2 Type II or ISO 27001 means an external auditor looked. Three firms have one.
- Device and access controls. Managed devices, virtual desktops, least-privilege access and revocation on exit.
- A stated AI position. Ask whether patient data is processed by AI systems and get the answer in writing.
- Breach notification terms. How fast you would be told, and by what route.
How do you verify a provider is HIPAA-safeguarded?
Ask for documents rather than assurances, because every firm in this market will tell you it is compliant.
- Request the Business Associate Agreement and read it before any access is granted.
- Ask for the SOC 2 or ISO 27001 report or certificate if the provider claims one, and check the scope and date.
- Ask where work is performed, on what device, and whether a virtual desktop is used.
- Ask in writing whether patient data is processed by any AI system, and by which.
- Set up least-privilege access, then audit your own user list quarterly and on every staff change.
For a fuller hiring walkthrough, read how to hire a virtual medical assistant.
Methodology and sources
We read each company's own website on August 24, 2026, recording the safeguards each firm states in its own words, the HIPAA and Business Associate Agreement position exactly as each firm words it, published pricing, commitment terms, and the facts each firm publishes about itself. Wage context is from the U.S. Bureau of Labor Statistics May 2025 Occupational Employment and Wage Statistics. Business Associate Agreement obligations are set by the HIPAA Privacy and Security Rules. Where a company didn't publish a fact we marked it "not publicly listed"; practice counts, retention rates and savings claims are company-reported and were not independently audited. Portiva was excluded because its site redirects to a domain that refuses automated requests.
Related compliance guides
The compliance question decides the shortlist before price does, and it is worth settling before you interview anybody. Our explainer on what a virtual medical assistant is covers what a remote hire can access in a practice, and therefore why a signed Business Associate Agreement is the floor rather than a bonus.
Speak with Honest Taskers about a compliant staffing arrangement.