If you're not sure whether you need a virtual assistant yet, start with these 5 signs your practice needs admin support. If you already know you do, here's what to look for in terms of HIPAA compliance specifically.

Hiring a virtual assistant for your therapy practice sounds straightforward until you remember that your clients' most sensitive personal information runs through every part of your admin operation. Scheduling systems, billing platforms, intake forms, insurance records — all of it touches protected health information. The wrong hire doesn't just create administrative problems. It creates HIPAA liability.

Most general virtual assistants have no training in healthcare privacy requirements, no experience with therapy-specific platforms, and no understanding of what's actually at stake when something goes wrong with a client's protected data. Here's exactly what to look for before you hand anyone access to your practice.

Start with the BAA — before anything else

A Business Associate Agreement is a legally required contract under HIPAA between you and any vendor who handles protected health information on your behalf. It is not optional. It is not something you sort out later. If a virtual assistant has access to your EHR, your scheduling system, your billing platform, or your client emails, a signed BAA must be in place first.

If a VA hesitates when you ask about a BAA — or doesn't know what one is — that's your answer. End the conversation.

"A BAA isn't paperwork. It's the legal foundation that makes the entire working relationship compliant. It has to come first."

The full checklist before you hire

What to verify before giving anyone access to your practice
✦
They will sign a BAANon-negotiable. Ask upfront. If they don't know what it is, stop there.
✦
They have real experience with your platformsSimplePractice, ZocDoc, Headway — not just general admin tools. Training someone on therapy-specific software takes weeks you don't have.
✦
They understand what PHI isAsk them directly. They should be able to define protected health information and explain how they handle it.
✦
They communicate on HIPAA-compliant channelsStandard Gmail and consumer messaging apps are not HIPAA compliant. Ask what platforms they use for client-related communication.
✦
They have mental health practice experience specificallyGeneral medical admin is different from therapy practice admin. The culture, the sensitivity, and the tools are not the same.
✦
They can handle high-pace, independent workA busy practice doesn't slow down to hand-hold its admin support. The right VA is self-directed and keeps up without being managed.
✦
They have a clear process for billing follow-upAsk specifically how they handle denied claims and overdue invoices. Vague answers here cost you money.

The agency problem

Many therapists turn to VA agencies because they seem like the safer, more professional option. In practice, agencies introduce a problem that solo admins don't: you don't know who's actually handling your client data. Agencies assign staff, rotate team members, and operate at a distance from the specific needs of your practice. Every new person assigned to your account is a new person with access to your systems — and a new training cycle you have to run.

When you hire an individual directly, you know exactly who has access, you build a real working relationship, and the person handling your practice becomes genuinely familiar with how it runs. That familiarity has real value — and it's nearly impossible to achieve through an agency.

One thing to watch for: Some VAs market themselves as "HIPAA compliant" without having a real compliance process in place. HIPAA compliance is not a certification you earn — it's a set of ongoing practices. Ask for specifics: what platforms do they use, how do they store client information, what happens in the event of a data incident? Confident, specific answers are a good sign. Vague reassurances are not.

What good looks like

A genuinely qualified virtual admin for a therapy practice brings a BAA to the table without being asked. They know SimplePractice well enough to train you on features you didn't know existed. They handle billing follow-up without being prompted — and they're persistent enough to chase overdue invoices until they're paid. They pick up the phone when clients call, handle the conversation professionally, and keep your clinical headspace protected.

That combination — compliance knowledge, platform fluency, billing tenacity, and strong client-facing communication — is specific. It's not what most general VAs offer. But it's exactly what a therapy practice needs.

Virtual assistant vs. admin assistant — does the distinction matter for HIPAA?

Therapists searching for help often use the terms interchangeably — HIPAA compliant virtual assistant, HIPAA compliant admin assistant, HIPAA compliant VA. The label doesn't matter. What matters is whether the person actually understands what HIPAA compliance requires in a mental health practice context and operates accordingly.

A general admin assistant with no healthcare background is not automatically HIPAA compliant just because they sign a BAA. Compliance is a set of ongoing practices — how they communicate, where they store information, which platforms they use, how they handle a potential breach. It requires specific knowledge and specific habits, not just a signed document.

The safest hire for a therapy practice is someone who has worked inside one — who already knows what a superbill is, why insurance claim timing matters, why you can't use standard Gmail for client communication, and what "minimum necessary" means in the context of PHI access. That institutional knowledge takes months to develop and can't be shortcut by a training course or a checklist.

Questions to ask before you hire

Beyond the BAA, here are the specific questions that separate a genuinely HIPAA compliant virtual assistant or admin from someone who says they are:

What email platform do you use for client-related communication? Standard Gmail is not HIPAA compliant. Google Workspace with a signed BAA with Google is. If they can't answer this specifically, that's a red flag.

Where is client data stored and who has access to it? PHI should never sit in personal cloud storage, consumer apps, or shared drives without proper access controls and encryption.

What is your process if a data incident occurs? HIPAA requires a documented breach notification process. A compliant admin knows this and can describe their protocol.

Have you worked directly in SimplePractice, ZocDoc, or Headway? These platforms are the standard in mental health private practice. Fluency in them is not optional — it's the difference between hitting the ground running and spending weeks in training.

Can you provide a BAA before we begin? Not after. Not once you've shared access. Before. If they push back on this timing, the conversation is over.

Wallace Admin checks every box on this list.

BAA signed before anything begins. Years inside a real therapy practice. SimplePractice, ZocDoc, and Headway fluency from day one.

Talk to Amy →