This guide covers what a business associate agreement is, whether a virtual assistant company counts as a business associate, who signs a BAA, what the agreement covers, when a virtual assistant arrangement needs one, and how a practice puts a BAA in place.
The agreement spells out how patient information gets used, stored, protected, and returned. It's the document that lets a practice share PHI with a vendor without breaking HIPAA.
At a glance
- A BAA is a written contract HIPAA requires before an outside party handles a practice's PHI.
- It's signed between the practice (the covered entity) and the company that handles the data (the business associate).
- When a VA comes through a staffing company, that company is the practice's business associate and signs the BAA, not the individual assistant.
- A BAA is needed once the work involves creating, receiving, storing, or sending a practice's PHI.
- The agreement sets safeguards, breach reporting, and return of data, but it doesn't hand a practice finished compliance.
What Is a Business Associate Agreement?
A business associate agreement is a written HIPAA contract that lets a covered entity share protected health information with an outside party, setting the rules for how that party protects the data. HIPAA calls the practice the covered entity and the outside party the business associate. The agreement binds the business associate to the same protective duties the practice carries.
The requirement comes from the HIPAA Privacy Rule and the HITECH Act, not from any single vendor's policy. A practice can't legally hand PHI to a billing service, a transcription vendor, or a virtual assistant company without this contract in place. The BAA is what makes that handoff allowed.
People sometimes shorten the term to "BAA," and the two names mean the same thing. The contract can stand alone or sit inside a larger service agreement. Either way, the protective terms have to be there in writing before any patient data moves. Onboarding an assistant is walked through in our guide on onboarding a virtual medical assistant.
Does a Virtual Assistant Company Count as a Business Associate?
Yes, a virtual assistant company counts as a business associate when its assistants handle PHI for a practice, because HIPAA defines a business associate as any outside party that works with patient data on a covered entity's behalf. A VA who schedules patients, verifies insurance, or works the EHR is handling PHI, so the company that places that VA falls under the rule.
The test isn't the job title. It's the data. When the assistant creates, receives, stores, or transmits protected health information for the practice, the staffing company is a business associate and a BAA applies. Our guide to what counts as PHI walks through which information triggers the rule.
A narrow set of VA tasks never touches PHI, such as booking the practice's own travel or managing a public social media page. Those tasks alone might not pull a company into business associate status. Most healthcare admin work does, so a practice should assume a BAA is needed and confirm it during vetting. The hiring steps are walked through in our guide on how to hire a virtual medical assistant.
Who Signs a BAA, the Virtual Assistant or the Staffing Company?
The staffing company signs the BAA with the practice, not the individual virtual assistant, because the company is the business associate and the assistant is part of its workforce. HIPAA places the agreement between two organizations, the covered entity and the business associate, so the contract names the practice and the VA company.
The individual assistant still carries duties, just through a different document. Each assistant signs a confidentiality agreement with the staffing company and completes HIPAA training before any access. That keeps the chain intact, the practice holds the BAA with the company, and the company holds confidentiality terms with each person.
One more link matters. When the staffing company uses its own subcontractors who also touch PHI, HIPAA requires those subcontractors to sign agreements with the same protective terms. A practice can ask a VA company how it handles that chain. Honest Taskers places healthcare-trained professionals as part of its own workforce and provides BAA support when the engagement requires one. More on this sits in our guide on remote staff HIPAA compliance checklist.
What Does a Business Associate Agreement Cover?
A business associate agreement covers how PHI may be used, the safeguards the business associate keeps, breach reporting, subcontractor terms, and the return or destruction of data when the work ends. Each term is something a practice can read and check before signing.
| BAA term | What it sets |
|---|---|
| Permitted uses of PHI | The specific reasons the business associate may use or share patient data, limited to the services described |
| Safeguards | The administrative, physical, and technical protections the business associate keeps in place for the data |
| Breach reporting | The duty to report a suspected breach to the practice within a set timeframe |
| Subcontractor terms | The rule that any subcontractor handling PHI agrees to the same protections |
| Return or destruction | What happens to the PHI when the agreement ends, either returned to the practice or destroyed |
The thread running through all of it is accountability. The agreement makes the business associate answerable for the data, gives the practice a way to act if something goes wrong, and sets a clean end point for the information. A practice that reads these terms knows exactly what it's agreeing to.
When Does a Virtual Assistant Arrangement Need a BAA?
A virtual assistant arrangement needs a BAA before the assistant first touches PHI, which in healthcare admin work means before the first shift in nearly every case. The trigger is the data, not the start date, so the agreement has to be signed ahead of access, never after.
Think about what a healthcare VA does on day one. Scheduling pulls up patient names and appointment details. Insurance verification reaches policy and demographic data. Billing follow-up sits inside the claims system. Each of those is PHI, so each requires the BAA to already be in place.
The cleaner question is when a BAA might not be needed. When a practice hires a VA purely for non-PHI work and the assistant never reaches patient data, the trigger may not apply. That setup is rare in clinical practices. A safer habit is to put the BAA in place at the start and scope the assistant's access to the minimum the role needs. Our post on whether a virtual assistant can be HIPAA compliant covers those access controls in detail.
How Does a Practice Put a BAA in Place With a VA Company?
To put a BAA in place, a practice asks the VA company for its agreement, reviews the terms, signs it before granting access, and keeps a copy on file alongside the training and confidentiality records. Most established healthcare VA companies have a standard BAA ready, so the step is usually quick.
- Ask the VA company whether it signs a BAA and request the document during vetting.
- Read the permitted uses, safeguards, breach reporting, and data-return terms before signing.
- Have the practice's own decision-maker sign, and get the signed copy back from the company.
- Store the BAA with the assistant's HIPAA training records and signed confidentiality agreement.
- Grant system access only after the agreement is signed, scoped to the minimum the role needs.
When a VA company can't produce a BAA, that's a reason to look elsewhere. A company that handles patient data should know the requirement and meet it without hesitation. For more on this, our guide on how to vet virtual assistant companies lists the other questions worth asking, and the post on who is liable if a VA causes a breach explains how the BAA shapes responsibility.
For comparison, the U.S. Bureau of Labor Statistics put the median wage for medical secretaries and administrative assistants at $22.08 an hour, or $45,930 a year, in its "Occupational Employment and Wage Statistics" release for May 2025.
Ask Honest Taskers for the business associate agreement before any access is granted.