The seven questions that vet any medical virtual assistant company
You can vet a medical VA company in an evening with its own website, if you know what to look for. These are the seven things that matter, in the order that eliminates providers fastest.
Practice Standards Review is reader-supported. We may earn a referral fee when you contact a provider through our links; it does not affect how we answer the vetting questions. How we make money · How we vet
1. Will you sign a Business Associate Agreement before any patient information is shared?
Under HIPAA your practice must have a BAA with any vendor whose people handle PHI on your behalf. It is your liability, not theirs. A provider that volunteers the BAA on its pricing page is telling you compliance is part of the product.
A good answer
A BAA stated on the public site, signed before onboarding.
A bad answer
"HIPAA compliant" as a badge with no mention of a BAA.
2. Who trains the assistant on HIPAA, when, and how often is it refreshed?
Business associates must train their own workforce. You want the provider's training before the first login and your own practice-specific training after it.
A good answer
Training before start, an annual refresher, and a curriculum you can see.
A bad answer
"All our VAs are HIPAA certified" — there is no such certification.
3. Where does the assistant physically work, and what are your hours in their time zone?
Latin American assistants work US daytime as their day. Philippines- and India-based assistants work it as a night shift. Night work is a known driver of turnover, and turnover is the cost you are paying a company to absorb.
A good answer
A named region and a straight answer about shift times.
A bad answer
"We have assistants all over the world" with no specifics.
4. What is the minimum commitment, and can I leave?
The minimum is the unit you pay for whether or not you use it. Exit terms decide whether a bad match costs you a month or a year.
A good answer
Part-time from 15–20 hours; month-to-month after a short initial period.
A bad answer
Full-time only, annual prepay, or auto-renewal with long notice.
5. What happens, step by step and in what timeframe, if the first assistant is wrong?
The first match is not always right. A stated replacement policy means the provider expects that and has a process; silence means the risk is yours.
A good answer
Free replacement within a stated number of days, covering absence as well as fit.
A bad answer
Nothing on the website; "we'll work something out" on the call.
6. Who manages the assistant's device, VPN and EHR access, and who revokes it on exit?
The Security Rule requires you to assess the devices and locations from which PHI is accessed. You need named accounts, MFA, no local PHI storage, and a revocation process you control.
A good answer
Managed device or virtual desktop, named logins, provider describes a device policy.
A bad answer
Shared logins proposed "to save time".
7. Who is the employer of record, and who do I call when something goes wrong?
The provider should carry employment obligations to the assistant and give you one accountable contact. If you are asked to take on employer duties, the price is not what it looks like.
A good answer
Provider is employer or contractor of record; named account manager.
A bad answer
A marketplace that connects you and steps back.
How to verify without a sales call
- Open the pricing page, not the homepage. Note what is stated and what is missing.
- Search the site for "BAA" and "business associate". No result is an answer.
- Read the FAQ for replacement and minimum terms.
- Check the careers or talent page for where assistants are recruited.
- Only then book calls — with the two or three providers left.
Published 8 November 2026 · Last reviewed 8 November 2026 · Report an error