Healthcare Virtual Assistants for Patient Follow-Up: What to Vet Before Sharing PHI
A prospective patient fills out an orthopedic practice’s appointment form after clicking a campaign ad. An automated email promises a reply, nobody follows up, and the patient eventually calls, waits on hold and hangs up. The dashboard shows a converted lead, but the practice never booked the visit.
For practices and the healthcare marketing agencies that run their campaigns, that gap is usually an ownership problem. Someone has to pick up each inquiry, confirm the details and log what happened. A healthcare virtual assistant can take on that follow-up, but only if the provider handles patient data as carefully as the practice is required to.
Before handing patient follow-up to a virtual assistant, here is what to verify: the agreement that must be in place before any protected health information (PHI) is shared, the security controls to ask for, how to scope the role and how to test the setup before expanding access.
Key Takeaways
- Inquiries stall when no one owns the next step, and front-desk phone work is already stretched thin.
- A provider handling PHI for a practice usually needs a business associate agreement (BAA). An NDA alone is not enough.
- Ask for documented controls: individual logins, role-based access, encryption, training records and an offboarding process.
- Keep clinical decisions with clinical staff and prove the setup with a short, measured pilot.
Why Patient Inquiries Stall After the Campaign Works
Phones are still the front door for most practices, and that door is already crowded. In a March 10, 2026 MGMA Stat poll, practice leaders named eligibility and prior authorization (45%) and scheduling (31%) as their staff’s most time-consuming phone tasks, ahead of intake (9%) and prescription refills (6%). The poll drew 294 responses, so it reflects how leaders see the workload rather than measured staff time.
That phone work spills into other systems too. A March 31, 2026 MGMA Stat poll found that 61% of practices have staff logging into seven or more payer portals every week, mostly for eligibility checks and prior authorizations. Every one of those tasks competes with the web form that just arrived from a campaign.
With the front desk stretched that thin, a new inquiry can sit for hours or days. MGMA’s advice for phone backlogs is to map request types, set clear escalation rules and track time to resolution and the number of touches per request. The same discipline works for web inquiries: every inquiry gets a named owner, a status and a next action. A virtual assistant can be that owner.
Lead generation brings the inquiry in. Lead management is everything after that, from the first reply to a booked visit or a documented reason the patient didn’t book. Agencies usually own the first half and practices the second, which is why the handoff between them so often goes unmeasured.
Those inquiries are rarely just contact details. Once a practice holds a form that pairs a name or phone number with symptoms, a requested service or insurance details, that record can count as protected health information under the HIPAA Privacy Rule, which covers identifiable information about a person’s health, care or payment for care. That is why vetting the virtual assistant provider comes before the staffing decision, not after it.
The Compliance Basics to Settle Before Sharing Patient Data
HIPAA applies to covered entities, such as most medical practices, and to their business associates. A company that handles PHI to perform administrative work for a practice will usually fall into that second group, so the practice’s privacy lead or counsel should confirm the relationship early.
HHS guidance says covered entities generally need a written business associate agreement with those partners. An NDA does not replace it. Review the BAA for permitted uses of PHI, required safeguards, breach reporting duties, subcontractor obligations and what happens to the data when the contract ends.
Enforcement shows why this matters. On August 18, 2025, the HHS Office for Civil Rights announced a $175,000 settlement with BST & Co. CPAs, a business associate that had failed to conduct an accurate and thorough risk analysis before a ransomware attack exposed client PHI. The resolution also came with a two-year corrective action plan.
The takeaway for practices is that a vendor’s compliance claims need documents behind them. Ask to see those documents before any login is created.
Security Controls to Ask Every Provider to Document
The HIPAA Security Rule expects access to electronic PHI to match each user’s role, and it requires workforce training on security policies. In practice, that becomes a short list of things a provider should be able to show you.
- Individual logins with no shared credentials, scoped to the systems and records the role needs
- Encryption for patient data in transit and at rest
- Independent security attestations, such as ISO 27001 or SOC 2 reports
- Confidentiality agreements and written policies that match the practice’s own standards
- Named supervision, plus a documented process for incidents and for removing access when the engagement ends
Managed providers differ most on how much of this is built in. A dedicated healthcare virtual assistant from Wing works inside systems such as Epic, Athenahealth and Kareo under HIPAA protocols, comprehensive NDAs and role-based access controls. The company is ISO 27001 compliant, SOC 2 certified and HIPAA compliant, with patient and billing data encrypted in transit and at rest.
Each assistant is supervised by Team Captains and Supervisors, with a dedicated success manager on the account. Published plans start at $1,099 per month for part-time support (80 hours) and $1,799 for full-time (160 hours).
Whichever provider you shortlist, get the documents in writing. Have the privacy lead approve the setup before the assistant accesses any patient records.
Scope the Role So Compliance Holds Up Day to Day
The quickest way to lose a patient’s trust is to let an administrative role drift into clinical territory. Draw that line in writing before the assistant’s first day. HIPAA’s minimum necessary standard points the same way: a practice’s policies should name who needs access to which categories of PHI to do their job, and limit access to that.
| Task | Virtual assistant | Clinical team |
|---|---|---|
| Replying to new inquiries and booking visits | Owns | Not involved |
| Collecting insurance and referral details | Owns | Not involved |
| Questions about symptoms or urgency | Logs and routes the same day | Owns the answer |
| Test results, prescriptions, treatment advice | Routes only | Owns the answer |
A shared tracker, approved by the practice, is where that ownership becomes visible. Each inquiry gets one record with its source, arrival time, current status and a dated next step. Five statuses cover most practices:
- New: received, no human reply yet
- Waiting on patient: missing details such as an insurance card or referral
- Waiting on practice: needs a clinical or scheduling decision
- Booked: appointment confirmed
- Closed: no visit, with the reason recorded
A next step like “follow up” tells the next person nothing; “Call Thursday at 10 a.m. to confirm the insurance card upload” tells them exactly what to do. Closed reasons matter too, because they show the agency which campaigns attract patients the practice can’t serve.
Agree in advance how a clinical question leaves the assistant’s hands: one named contact at the practice, one agreed channel and a set response window. Scripts should never leave a patient guessing. After-hours replies say when a person will be back in touch, and every script tells anyone describing an emergency to call 911 instead of waiting for a callback.
The same patient list can serve two very different purposes, and HIPAA treats them differently. Under HHS marketing guidance, a message sent for the patient’s own treatment, such as a refill reminder, is not marketing, and appointment reminders generally sit on the same side. Promoting another company’s product, or passing the list to a third party that pays for it, requires the patient’s written authorization. Messages about the practice’s own services can fall under a narrower exception, so the privacy lead should approve any campaign built on a reminder list.
Help Patients Stay Engaged After Booking
Booking is only the first step. According to an ASTP data brief, 77% of individuals were offered online access to their medical records or patient portal in 2024, while 65% were both offered access and used it. People encouraged by their provider to use the portal accessed it at higher rates than those who weren’t.
Self-scheduling also has room to grow. In a July 29, 2025 MGMA Stat poll, 71% of practices reported that fewer than a quarter of their patients used digital tools to book. An assistant can help patients with first logins, send approved preparation instructions and keep a phone or secure message route open.
When a caregiver asks to act for a patient, follow the practice’s authorization procedure. Never request or share patient passwords, and forward clinician-written instructions such as fasting rules without interpreting them.
Test the Setup With a Short Pilot
Before granting wider access, run a four-week pilot on one channel, such as a campaign landing-page form. Name a practice supervisor and hold a weekly review with the provider, the front desk and the privacy lead.
Measure the same channel before and during the pilot using the same definitions:
- Median time to first human response during staffed hours
- Contact rate and booking rate, based on eligible unique inquiries
- Attendance rate for appointments scheduled in the period
- Complaints, opt-outs and any access or script issues
Use the weekly review to check whether permissions still fit the work and whether activity logs raise concerns. Booking numbers show administrative follow-through, not patient satisfaction or clinical outcomes, so read them alongside complaints before expanding.
Put Privacy Ahead of Speed
Faster follow-up only helps if patient data stays protected along the way. Start with the BAA and documented security controls, write a scope that keeps clinical decisions with clinicians and prove the setup in a pilot. Practices that do this get inquiries that turn into visits and an outside partner they can defend in an audit.
FAQ
Does a remote administrative assistant need to sign a BAA?
The agreement is usually signed between the practice and the provider organization, not the individual assistant. If the provider will create, receive, maintain or transmit PHI for the practice, HHS generally expects a business associate agreement to be in place before work starts.
What tasks should stay with clinical staff?
Triage, urgency decisions, treatment questions, test results and prescriptions. A remote assistant can log and route those requests and tell the patient when the practice will respond.
Can an assistant send appointment reminders without patient authorization?
Generally yes, because HHS treats appointment reminders as treatment communications. Other rules on automated calls and texts may still apply, and promotional messages need separate review.
What security documents should a practice request?
A sample BAA, access-control documentation, security attestations such as ISO 27001 or SOC 2, training records, the incident-response process and the offboarding procedure for removing access.
