How to Hire a Virtual Assistant for Your Therapy Practice (Without Breaking HIPAA)

Hiring a virtual assistant (VA) can be one of the most freeing decisions you make in private practice. Delegating the right tasks can create more time, reduce stress, and help you stay focused on your clients instead of your scheduler, your emails, or marketing chores.

But as a therapist, you can’t just hire anyone and start handing over responsibilities, especially when client information is involved. HIPAA compliance, ethical boundaries, and clarity around roles matter.

So how can you safely hire a VA without putting your practice (or license) at risk?

There are four safe paths forward, each with different benefits, risks, and requirements — depending on what kind of help you need and how closely your VA will be involved in your therapy practice.

Path 1: Hire a VA for Non-PHI Tasks (No HIPAA Risk)

This is the most straightforward option: hire a VA to take care of things that do not involve client information. These roles help you grow and maintain your business but not help with tasks related to the direct delivery of care. Separating things out means HIPAA usually doesn’t apply.

Common Non-PHI Tasks

• Social media management (e.g., Instagram posts, Pinterest pins)
• Website updates and blog publishing
• Email marketing (writing newsletters, uploading blog links)
• Creating downloadable PDFs, workshop slides, or lead magnets
• Outreach to potential referral sources or podcast hosts
• Research or admin tasks that don’t touch client info

What You Still Need to Do

• Set clear outline of their responsibilities including what they can and cannot access
• Ensure you don’t give access to email inboxes or anything that contains client communication (EHR, full Google Workspace account)
• Choose secure tools for sharing files (e.g., Google Drive with permissions)

Who It’s Great For

Therapists who want marketing, visibility, and organizational help but don’t want the complexity of training for HIPAA compliance. This can help you majorly start to free up your time.

Path 2: Hire a VA for PHI-Related Tasks (HIPAA Applies)

If you want your VA to help with anything client-related, HIPAA is in play. That includes seemingly small tasks like scheduling or sending reminders. In this case, your VA becomes a Business Associate and your legal and ethical obligations increase.

Common PHI-Related Tasks

• Scheduling clients using your EHR (e.g., SimplePractice)
• Managing intake paperwork or secure forms
• Sending or responding to client emails or voicemails
• Processing payments or submitting superbills
• Tracking client sessions or billing issues

What You’re Required to Do

• Sign a Business Associate Agreement (BAA) with the VA
• Ensure they complete HIPAA training
• Limit their access to the minimum necessary info
• Ask about security practices: device encryption, password managers, antivirus, secure Wi-Fi
• Document their training in case of audit

HIPAA Training Options

I’m a huge fan of Liath and team over at Person Centered Tech for all things HIPAA training. While there’s no VA-specific HIPAA training from Person-Centered Tech, these are excellent options to share with your VA:

• Practical Application of HIPAA and Mental Health Ethics for Admin Staff
• HIPAA Security Awareness for Remote Workspaces

Path 3: Hire a VA Service That Specializes in Supporting Therapists

If you want the benefits of delegation without having to vet, train, and monitor an individual VA from scratch, consider hiring a VA service that already works with therapists.

These providers typically:

• Understand HIPAA requirements
• Provide built-in training and supervision
• Offer staff who are already experienced in EHRs and therapy admin

A Trusted Therapist VA Service

• Productive Therapist (Uriah Guilford): U.S.-based VAs trained specifically to support therapy practices with intakes and admin.

This company can handle the hiring, oversight, and even HIPAA compliance onboarding for you, giving you peace of mind and freeing up your time faster.

Path 4: Hire a VA Who Is a Therapist (or Therapist-to-Be)

Another smart and often overlooked option is hiring a VA who is already a therapist — or someone currently in grad school or training to become one.

These individuals often seek part-time, flexible work and already have:

• A strong grasp of HIPAA and confidentiality
• Familiarity with clinical language and practice operations
• Experience with tools like EHRs, intake paperwork, and scheduling
• A natural sensitivity to the needs of both clients and clinicians

While they’re not offering a full VA service, they often excel in PHI-related roles and may even bring additional insight from their clinical lens.

Common Tasks They Can Support:

• Scheduling and calendar management
• Intake paperwork and EHR onboarding
• Responding to client inquiries in a compassionate, informed way
• Email drafting, form setup, and client portal organization
• Support around sliding scale, superbills, or FAQs about therapy

What You Still Need to Do

Even though they understand HIPAA conceptually, they’re still acting as Business Associates, so you’ll want to:

• Have them sign a BAA
• Provide or confirm formal HIPAA training
• Align expectations clearly since they’re not a full-service agency

Where to Find Them

• Grad school communities or therapist Facebook groups
• Referrals from colleagues with students or pre-licensed clinicians seeking side work
• Job boards like Indeed or Handshake for students

Who It’s Great For

Therapists who want a thoughtful, aligned collaborator who understands the therapy world but don’t need a full agency or large VA support system.

Even with a BAA, You Still Carry Risk

Hiring a virtual assistant for your therapy practice, especially one who handles client information, doesn’t remove your responsibility to safeguard client information. Even if your VA signs a Business Associate Agreement (BAA), you are still ultimately responsible for protecting client data under HIPAA.

For example, if your VA:

• Uses an unencrypted device that gets hacked
• Sends PHI over unsecured email
• Mishandles client information in any way

…you could still be liable. That can include:

• Fines
• Mandatory breach notifications to clients
• Audits from the Office for Civil Rights (OCR)
• Reputation damage

This is why HIPAA training, contracts, and role-based access controls aren’t just red tape, they’re essential protections for you and your clients. Whether your VA is handling intake paperwork or just posting blog content, set them up for success by being crystal clear about what they can access and how.

Check Your Insurance Coverage (Just in Case)

When you bring someone new into your practice, especially someone handling client data, it could be good to get curious about your liability coverage.

You may already have coverage through your malpractice insurance or a business liability policy, but it’s not always clear what’s included when it comes to virtual assistants or independent contractors.

Here are a few good questions to ask your insurance provider:

• Does my policy include cyber liability or data breach coverage?
• Would a breach caused by a VA or independent contractor be covered?
• Are there requirements (like having a BAA in place) to maintain that coverage?

Hopefully you never need it but understanding what protections you have in place (or don’t) could help you make more informed, confident decisions as you grow your team and delegate more of your practice operations.

How to Hire a Virtual Assistant for Your Therapy Practice The Smart, Secure Way

If you’re feeling stretched thin by admin tasks, behind on marketing, or simply ready to grow without burning out, hiring a virtual assistant for your therapy practice can make all the difference.

Here are four secure paths forward:

1. Hire a virtual assistant for non-PHI tasks – such as marketing, blogging, or outreach (no HIPAA risk)
2. Hire a HIPAA-compliant virtual assistant – for help with scheduling, EHR, billing, or intake (requires training + BAA)
3. Hire a VA service that supports therapists – like Productive Therapist or My Solution Services
4. Hire a therapist or therapist-in-training as your VA – someone who already understands confidentiality and client care

Each of these options allows you to delegate with confidence, depending on your comfort level, needs, and risk tolerance.

You don’t have to do it all yourself. Whatever it is that you’re needing help with, know that there’s a therapist-friendly VA solution out there. Finding the right support will help you and your practice thrive long-term.

Disclaimer: This post is for informational purposes only and does not constitute legal, financial, or insurance advice. I’m not an attorney or HIPAA compliance officer. Always consult with a qualified professional before making decisions related to client data, contracts, or liability coverage.