Security, Privacy & HIPAA Practices
What VA.care actually does to protect patient data, described accurately, without overstatement. This page is for practices evaluating how PHI is handled and is not a substitute for legal review of your own HIPAA obligations.
Plain language on HIPAA claims
There is no official, government-recognized "HIPAA certification" for individuals or companies. We train our staff on HIPAA privacy and security, and we sign a BAA with your practice, but a BAA does not independently satisfy all of your HIPAA obligations. Your practice remains the covered entity responsible for its own compliance program.
What we actually do
The safeguards below are operational practices, not certifications. Ask your VA.care contact for the current BAA template and facility details.
HIPAA-Trained & Background-Checked Staff
Every assistant completes HIPAA privacy and security training and a background check before any patient interaction, with annual refreshers. HHS does not recognize any private 'HIPAA certification' as proof of compliance, so we say 'HIPAA-trained', that is what we can verify and stand behind.
Signed Business Associate Agreement (BAA)
We execute a formal BAA with every practice before onboarding begins. A BAA is a required contractual safeguard that allocates HIPAA responsibilities between your practice and VA.care. It is important, but it does not by itself satisfy every HIPAA obligation your practice still carries.
Encrypted Data Transmission
Protected Health Information (PHI) is processed through 256-bit AES encrypted channels and secure VPN tunnels, never personal email or unsecured chat.
Managed Call Center Security
Assistants work from monitored, access-controlled facilities with biometric entry, strict clean-desk policies, and hardware controls, not unverified home networks.
Role-Based Access Control
Each assistant accesses only the systems and records their role requires. Access is provisioned per role and revoked when an engagement ends.
Audit Logging & QA Monitoring
Dedicated QA and account managers monitor call quality and chart accuracy, with audit logging so every PHI touch is traceable and reviewable.
Where your assistants work, and how access is controlled
VA.care assistants are based in the Philippines and work from supervised, access- controlled call center facilities, not unverified home networks. This means:
- Biometric facility entry and strict clean-desk policies
- Hardware controls and monitored, high-speed fiber connections with backup power
- Role-based access to your EHR and systems, provisioned per role and revoked at engagement end
- Contractual confidentiality and HIPAA obligations enforced through the BAA and employment agreements
- Incident response procedures for suspected privacy or security events, with prompt notification to your practice
We are transparent that access to PHI is offshore. If your practice's payer contracts, state laws, or institutional policies restrict offshore access, tell us during onboarding so we can scope the engagement accordingly.
What our assistants do, and don't do
Our virtual assistants are non-licensed administrative staff. They answer calls, schedule appointments, verify insurance, submit prior authorizations, and document encounters per your protocols. For urgent clinical messages, they route and escalate to your on-call clinician, they do not independently triage, diagnose, or make clinical decisions. Clinical triage and medical decision-making remain the responsibility of your licensed providers.
Have security questions before you start?
Request the current BAA template, facility details, and access-control documentation.