Independent practices are under constant administrative pressure: phones, portals, prior authorizations, eligibility checks, billing queues. Remote administrative assistants can take on much of that work — but health information carries specific legal obligations. This guide explains the essentials. It's general information, not legal advice; consult your compliance advisor or counsel.
Start with the Business Associate Agreement
Under HIPAA, a service provider that creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity is generally a business associate. HHS explains that a covered entity may disclose PHI to a business associate only with satisfactory written assurances — a business associate agreement (BAA) — that the business associate will safeguard the information (HHS Business Associates FAQ).
HHS also notes that a business associate must have a BAA with its own subcontractors before disclosing PHI to them. So if a provider places an assistant who works with your PHI, there should be a BAA between your practice and the provider, and appropriate downstream agreements.
Rule of thumb: no BAA, no PHI access. ExecWing requires a signed BAA before any assistant accesses PHI.
What remote admin assistants can do
Administrative tasks commonly delegated:
- Scheduling: booking, confirming and rescheduling appointments; managing waitlists and recalls
- Eligibility and benefits verification in payer portals
- Prior authorization paperwork: gathering documentation for clinician review and tracking status
- Demographics and insurance updates
- Billing support: payment posting, EOB entry, working denial queues under a billing lead
- Non-clinical patient communication: directions, forms, appointment logistics
What they must not do
- Give medical advice, triage symptoms or interpret results
- Make clinical decisions or represent themselves as clinical staff
- Handle anything clinical without routing it to licensed staff
Write these boundaries into scripts and SOPs, and train on them.
Minimum necessary and access controls
HIPAA's minimum-necessary principle and the Security Rule's safeguards translate into practical controls:
- Named user accounts in the EHR and practice-management system — never shared logins
- Role-based access limited to the assistant's tasks
- MFA on all systems (CISA MFA)
- No local storage of PHI; work stays inside your systems
- Secured devices: encryption, screen lock, endpoint protection
- Audit logs reviewed periodically
- Immediate offboarding when the engagement ends
Training
Assistants handling PHI should complete HIPAA privacy and security training before access and periodically after, covering:
- What PHI is and the minimum-necessary standard
- Permitted uses and disclosures for their tasks
- Phishing and social-engineering awareness
- How to report a suspected incident — immediately
Incident response
Agree in advance how incidents are reported: who to contact, how quickly and what information to include. Breach notification obligations under HIPAA can be time-sensitive; your BAA should address reporting.
Workflow design tips
- Scripts for phones and portals, including when to transfer to staff
- Checklists for eligibility and prior-auth work by payer
- Daily queue reports so your practice manager sees what's done and pending
- Weekly QA: spot-check a sample of work for accuracy
Choosing a provider
Ask:
- Will you sign our BAA, and do you have BAAs with subcontractors?
- What HIPAA training do assistants complete, and how often?
- What are your device and access standards?
- How do you handle incidents?
- Do assistants have prior US healthcare admin experience?
- What's explicitly out of scope?
A worked example: a day for a remote front-office assistant
Here is how a remote administrative assistant might support a three-provider outpatient practice. Each task is mapped to the HIPAA concept that governs it.
| Time (practice local) | Task | Minimum-necessary access | Control |
|---|---|---|---|
| 7:30 | Confirm today's appointments by phone and text | Schedule, patient phone numbers | Approved script; no clinical detail on voicemail |
| 8:30 | Verify insurance eligibility for tomorrow's patients | Demographics, insurance IDs | Payer portal account in the assistant's own name |
| 10:00 | Process referral faxes into the EHR inbox | Referral documents | e-fax inbox, not personal email |
| 11:30 | Prior-authorization follow-up calls | Specific auth requests | Notes logged in the EHR, not a spreadsheet |
| 1:00 | Recall list outreach for overdue visits | Patient name, last visit, recall reason code | Messages sent through the practice's patient portal or approved texting tool |
| 3:00 | Prepare the next-day schedule huddle sheet | Schedule, visit reasons | Stored only in the EHR or practice drive |
| 4:30 | Inbox cleanup and handoff note | — | Handoff in the secure messaging tool |
Nothing on this list requires downloading PHI to a personal device. If a workflow seems to need that, redesign the workflow.
The Security Rule in plain terms
HIPAA's Security Rule requires administrative, physical and technical safeguards for electronic PHI. For a remote assistant, that usually looks like this:
| Safeguard type | What it means for remote work |
|---|---|
| Administrative | A risk analysis that includes remote staff, written policies, HIPAA training at onboarding and annually, a sanctions policy, documented access approval and removal |
| Physical | A private workspace where screens can't be seen by others, no printing of PHI, locked screens when away |
| Technical | Unique user IDs, MFA, automatic logoff, encryption on devices, audit logs in the EHR |
HHS's Office for Civil Rights publishes guidance and settlement summaries. Many enforcement actions cite the lack of a thorough risk analysis, which is worth doing before you add any remote staff.
Checklist: before PHI access is granted
- [ ] Signed Business Associate Agreement with the provider (and any subcontractor BAAs it requires)
- [ ] HIPAA training completed and documented
- [ ] Individual named account in the EHR, practice-management system and phone system
- [ ] Role-based permissions set to the minimum the job requires
- [ ] MFA enabled on every system holding PHI
- [ ] Device encryption and screen lock confirmed
- [ ] Clear written instructions on what not to do: no personal email, no screenshots, no local downloads
- [ ] A named person at the practice for privacy questions and incident reports
Incident examples and responses
| What happened | First step |
|---|---|
| Wrong patient's records faxed or emailed | Report to the practice privacy officer immediately; don't try to fix it alone |
| Laptop lost or stolen | Report within the hour; the practice and provider assess whether it was encrypted and what was on it |
| Phishing email clicked | Report, disconnect, reset credentials |
| Patient asks the assistant a clinical question | Route to clinical staff using the practice's script |
The Breach Notification Rule sets timelines for notifying affected individuals and HHS once a breach is discovered. That's why fast internal reporting matters.
Questions to ask a remote staffing provider
- Will you sign a BAA, and do you have BAAs with your own subcontractors who may touch PHI?
- How is HIPAA training delivered and documented, and how often is it refreshed?
- What devices do staff use, and how are encryption and screen locks enforced?
- Do you allow PHI on personal devices or personal email? (The answer should be no.)
- How quickly will you notify us of a suspected incident, and who will call?
- How is access removed when someone leaves, and how fast?
The bottom line
Remote medical administrative support works when compliance is designed in: a BAA first, minimum-necessary access, MFA, trained staff, clear non-clinical boundaries and an incident plan.
See Medical Administrative Assistants and Healthcare Practices.
Sources
- U.S. Department of Health and Human Services, Business Associates FAQ.
- CISA, Multifactor Authentication.
- HHS, Summary of the HIPAA Security Rule.
- HHS, Breach Notification Rule.
- HHS, Guidance on Risk Analysis. ---SOURCES---
Want a dedicated assistant who already knows this playbook?
ExecWing places full-time, managed assistants from the Philippines with US leaders. Month-to-month, from $1,900/mo. See pricing or how it works.
Book a 20-minute fit call