Yes, if safeguards follow the worker. A business associate agreement means that the vendor accepts Health Insurance Portability and Accountability Act (HIPAA) duties in writing. Remote health staff are here to stay, since flexible work helps retain them.

Government public health workers whose work setting matched their preference reported higher job satisfaction, lower burnout and lower intent to leave. Flexible work helps keep staff, so it is not going away.

According to a 2025 analysis of the 2024 Public Health Workforce Interests and Needs Survey (PH WINS), those effects were strongest among younger and highly educated workers, who, in the authors’ words, “experience more difficulty in achieving this alignment.” Health care front offices have moved too. A 2024 staffing survey put about 12% of nonclinical administrative or customer support roles in health care at hybrid and 8% at fully remote.

Only 52.2% of US government public health workers had the work setting they preferred in 2024, and flexible arrangements now shape who answers health care phones and handles records.

According to research on the Public Health Workforce Interests and Needs Survey, 2021 data showed flexibility, including telework, was a leading reason employees intended to stay. Patients weigh something else: trust. A 2022 study of 127 respondents diagnosed with cancer found trust significantly predicted their intent to use a virtual assistant. The study covered software, not staff. In my view, location is the wrong test; contracts, training, managed devices and supervision are the right ones.

Why are doctors’ offices moving front-desk work to remote staff?

Patient demand and staff burnout push practices toward remote help. A 2023 Wolters Kluwer Health survey found 66% of patients left the doctor’s office having forgotten questions they meant to ask.

An analysis of four sources shows three pressures behind the move. I think of them as a three-pressure test:

• Follow-up demand: According to the survey, reported by Fierce Healthcare, 19% of that group came up with new questions after the visit. Each one becomes a call or message someone must answer.
• Burnout and turnover: According to the 2024 PH WINS survey of government public health workers, nearly 20% reported burnout and 24.8% planned to leave their organisation within a year. Workers whose setting matched their preference reported less of both.
• Cost: One practice owner seeking a healthcare virtual assistant in 2025 “almost hired in office,” then decided going virtual “can be a lot cheaper.” The owner still listed HIPAA compliance and patient data privacy first among four hiring criteria.

The reality is that remote staff cannot create appointments. One commenter in a 2024 discussion among Australian junior doctors traced booking friction to too many requests for too few appointments.

In practice, remote staff absorb the calls, not the shortage. The takeaway: in my view, a remote voice on the line is a staffing choice, not a warning sign.

Is it safe for a remote worker to see your medical records?

Yes, when the office controls the worker’s device and connection. A 2020 study found hacking and information technology (IT) incidents were the most common cause of healthcare data breaches.

According to that study, published in Healthcare (Basel), unauthorised internal disclosures ranked second. In 2019, 41.2 million healthcare records were exposed, stolen or illegally disclosed across 505 healthcare data breaches. In my view, the insider risk turns on access and supervision, not on the worker’s address.

Location matters in one way: the device. According to Splashtop, a remote-access vendor, the US Department of Health and Human Services (HHS) has flagged HIPAA risk when remote access to patient records runs through portable devices or hardware “not owned or managed by the covered entity.” Splashtop also cited a 2021 Healthcare IT News article in which only 2 in 10 IT teams said they had given long-term remote staff adequate tools.

The record also travels far beyond the front desk. A 2024 privacy discussion estimated a single visit sends data through “5 or 6 different intermediaries” at the low end and “20 different entities” at the extreme. Change Healthcare, a claims clearinghouse, was hit by BlackCat ransomware.

In practice, a remote scheduler is one link in a long chain. What this means for patients: devices and vendors deserve as much scrutiny as the desk.

What safeguards should cover remote staff who handle your records?

Ask whether the vendor signed a business associate agreement, how staff were trained and who supervises them. At HelpSquad, for example, virtual assistants are HIPAA-certified through HIPAATraining.com.

A business associate agreement (BAA) is the HIPAA contract between a practice and a vendor that handles patient data. In a 2025 forum thread on healthcare virtual assistants, one commenter wrote: “BAA is signed as well by the company and not the VA which I think is a green flag.”

Not every firm signs one. According to Remote Technology, Inc., BAAs are “not required under HIPAA in relation to the employment services we provide,” because placed workers act “under the client’s instructions, management and supervision.” In practice, that puts supervision squarely on your doctor’s office.

According to a 2024 thread among medical assistants, commenters described remote work agreements, virtual private network (VPN) sign-ins and one clinic’s manager-led video tour of the home workspace. Yet one clinic supervisor “didn’t really know” whether charting from home was allowed. For practices weighing freelancers against managed virtual medical assistants, I’d ask the BAA question first.

Here is the five-point remote access checklist I’d use:

The takeaway: clear answers matter more than where the worker sits.

What will protect your medical records over the next 12 to 24 months?

Remote billing and scheduling work is settling in for good. Over the next 12 to 24 months, patient privacy will depend less on where staff sit and more on written controls.

What most patients miss: the home desk is not the weak point on its own. A 2021 cross-industry security survey found 9 out of 10 respondents were concerned or very concerned about staff returning from home with unpatched systems and out-of-date software. The risk follows the device, not the address. I’d change my view only if a major breach were traced to a home workstation.

What should you ask your doctor’s office on your next call?

Remote front-office work is here to stay. In a July 2024 poll of medical group leaders, 60% planned to hold their remote and hybrid share steady, 22% expected to increase it and 18% planned to cut it. According to the PH WINS researchers, the workplace is “an area over which public health organisations have considerable influence.” Doctors’ offices hold that lever over your records. Policy, not location, decides what happens to your file. On your next call, I’d ask one thing: which company stands behind the person on the line, and did it sign a business associate agreement?

FAQs

• Which front-office jobs are most likely to be done remotely? Billing and scheduling lead the list. Medical group polling from early 2022 found about 59% of medical practices moved workers to permanent remote or hybrid settings in 2021. The roles most affected included revenue cycle management (the coding, billing, insurance verification and authorisation work that gets a practice paid), patient schedulers and call centre representatives. In practice, the person who books your visit may never set foot in the clinic.
• What happens to a practice if a remote worker leaks records? The practice can face steep penalties. A 2022 guide from a remote-access vendor put HIPAA penalties at up to $1.8 million per violation, and regulators may also require a corrective action plan, a required list of fixes such as a risk analysis, workforce training and an independent monitor. Those penalties reach business associates too, not only the doctor’s office. Peachstate Health Management negotiated its penalty down to $25,000, yet its plan still required that monitor. What this means for you: a vendor that signs the agreement has its own money on the line.
• Why does trust matter when a practice uses virtual assistants? Trust shapes whether patients accept a virtual assistant at all. According to a 2022 study in BMC Health Services Research, trust (β = 0.210) was one of four factors that together explained 80% of the variance in patients’ intention to use one. The authors wrote: “The high relevance of trust indicates the need for a reliable, secure service that should be promoted as such.” The study tested software assistants, not remote staff. In my view, the lesson still holds: offices should explain their safeguards before patients have to ask.
• Who sets the privacy rules if a larger company owns my doctor’s practice? The decision may sit above the front desk. Recent reporting on health care consolidation found 82% of physicians are employed by hospitals, other corporate entities such as insurers, or private equity firms. So the vendors and privacy policies behind your local office may be set by a parent organisation. I’d ask who owns the practice, then take privacy questions there too.

Maria De Jesus-Rush is marketing team lead at HelpSquad, a healthcare business process outsourcing company, with a background in content development, digital marketing, and project management.