What to hand a VA in a medical practice (and what to automate)

In a small cash-pay practice, automate anything that happens on a fixed trigger: booking confirmations, intake and lab fee links, reminders and missed-visit messages. Hand your VA the work that needs judgement: answering inquiries, chasing stalled patients by phone, fixing scheduling problems and checking that each patient is ready. Give the VA a BAA or workforce training, and only the access each task needs.

This guide is for solo NPs and physicians with one or two VAs, or thinking about hiring one. It sits under our HIPAA-safe tool stack for a solo practice, because what a VA can see depends on the tools you run. We cover tasks by stage, what to automate first, BAA and access, an SOP format, a daily checklist and how to measure the work.

What tasks can a medical VA do?

A medical VA can answer new inquiries, book and reschedule visits, chase unfinished intake forms and unpaid lab fees, check that labs are back before a consult, send program check-ins and keep the inbox clean. A VA should not give clinical advice, triage symptoms or decide on refills. Those go to the clinician.

The question is not whether a VA can do a task. It is whether a person needs to. Here is how we split it by stage.

Message wording for each stage is in our patient follow-up templates.

What should you automate first?

Automate the messages that fire on booking: confirmation, intake link and lab fee link. Next, automate reminders and the missed-visit text. These run on exact triggers, a missed one costs a patient, and none of them need judgement. Once they run, your VA's day shifts from sending to fixing.

A simple test for any task: if you could write the rule as "when X happens, send Y", automate it. If the rule starts with "it depends", give it to a person.

To see where patients stall before you decide, run your numbers through the patient drop-off calculator. Automate the stage with the biggest leak first.

Does a medical VA need to sign a BAA?

It depends on how the VA works for you. If the VA comes through an agency or works as an independent business, they are usually a business associate and you need a signed BAA. If the VA is your employee under your direct control, they are part of your workforce: no BAA, but you must train them and set access rules.

The rule comes from the HIPAA definitions. A business associate handles health information on your behalf "other than in the capacity of a member of the workforce". Workforce covers employees, volunteers, trainees and others whose work is "under the direct control" of the practice, paid or not.

• Agency VA: sign a BAA with the agency. Ask how the agency trains its staff and what happens to access when a VA leaves.
• Independent contractor: the line can blur. Many practices sign a BAA anyway. Ask a healthcare attorney if you are unsure.
• Employee: the Privacy Rule's training standard requires HIPAA training within a reasonable time after hire and again when your policies change. Many practices also retrain yearly. Keep a record.

Every tool the VA logs into also needs its own BAA with your practice. A VA with a BAA working inside a tool without one still puts patient data at risk. Check your stack against which practice tools sign a BAA.

Should a VA have EHR access?

Yes, but limited to the parts they need. HIPAA's minimum necessary standard asks you to decide which staff need which information. A VA who books visits and chases intake forms rarely needs full chart access, clinical notes or prescribing.

Access rules we recommend as a baseline:

• Own login for every person. Never share the owner's login. Shared logins break the audit trail.
• Two-factor sign-in on the EHR, email, phone system and payment tool.
• A front-desk or scheduler role in the EHR rather than a clinician role, where your EHR offers one.
• Practice devices or a managed browser profile, with no patient files saved to personal downloads.
• No patient details in personal texts or chat apps. Use the practice's messaging tool only.
• An offboarding list. On the VA's last day, remove every login the same day.

How to write a VA SOP

Write one short SOP per task, on one page. A VA should be able to follow it on day one without asking you. Keep the same five headings for every SOP so they are easy to scan.

Keep patient names out of the SOP itself. Use a role or a test patient such as "Dana M." in screenshots.

A daily and weekly VA checklist

A fixed checklist keeps a part-time VA on the work that matters. Put it in your task tool and have the VA tick it off each day.

Every day

1. Reply to every new inquiry from the last 24 hours.
2. Check intake status for visits in the next 2 days.
3. Check lab fees paid and results in for visits in the next 3 days.
4. Follow up on yesterday's missed visits that have not rebooked.
5. Read check-in replies and flag clinical questions to the clinician.
6. Clear failed payments the automation could not fix.

Every week

1. Count new inquiries, booked consults and no-shows.
2. List patients due for renewal or a program visit in the next 2 weeks.
3. Send personal notes to warm replies from the win-back sequence.
4. Note any question patients asked three or more times; it may need a saved reply or a website change.

How to measure a VA

Measure outcomes, not hours online. Pick four or five numbers the VA can affect and review them weekly with the owner. Use counts and rates, never patient details, in the weekly report.

If no-shows are high, start with how to reduce no-shows; most of that work is automation plus one VA check.

Sources

• 45 CFR 160.103: definitions of business associate and workforce
• 45 CFR 164.514(d): minimum necessary requirements
• 45 CFR 164.530(b): workforce training

This is general information, not legal advice. Confirm BAA terms with each vendor.