Staffing For Doctors · For your practice
Guides
Which Accounts Should Your Practice Own When Hiring Virtual Staff?
Your practice should retain administrative control of its EHR, phone system, business email and other practice accounts when it hires virtual staff. Give each approved worker an individual account with permissions suited to the role. Document who can create, change and revoke access so a staffing change does not interrupt patient communications.
Updated:
What does practice ownership actually mean?
Account ownership means your practice can administer the service, recover it and remove a worker without depending on that worker's personal login. It does not mean every employee needs administrator permissions. The office manager may control the phone platform while the receptionist has permission only to answer calls and manage approved queues.
This question is different from whether an assistant knows your EHR. A capable worker can still be placed into an unsafe arrangement if appointment reminders, forwarding rules or recovery emails belong to a personal account. Before approving access, record the platform owner, the person who authorizes permissions and the way a replacement would obtain approved access.
Which accounts belong in the access inventory?
Include the EHR, practice management system, business email, phone platform, fax service and approved document sharing tools. Add payer portals only when the role actually requires them and the payer permits the proposed access arrangement. A staffing agreement does not override a software license or a payer's rules for delegated access.
The following inventory is a planning example, not a universal configuration. Your security lead and software vendors should approve the actual permissions. Keep passwords and recovery codes out of the inventory itself.
| System | Practice decision | Departure check |
|---|---|---|
| EHR | Named user and approved role | Disable access and reassign open tasks |
| Phone platform | Call queues and forwarding permissions | Remove user and verify routing |
| Business email | Approved mailbox and recovery owner | Revoke sessions and preserve business records |
| Payer portal | Permitted individual delegation | Remove delegation using payer procedures |
| Document tools | Approved folders and sharing rules | Revoke access and check external sharing |
Why not share the office manager's login?
A shared credential makes it harder to identify who performed an action and harder to remove one person's access without disrupting everyone else. The HHS Security Rule summary describes access controls, audit controls and workforce security obligations. Ask your security lead how the applicable requirements are implemented in your systems.
A new assistant should not solve a provisioning delay by using the physician's credentials. If a platform cannot issue an appropriate account, pause that assignment and obtain an approved alternative. Keep multifactor authentication enrollment and account recovery under the practice's documented procedures rather than informally sharing verification codes.
How much access should a new worker receive?
Start with the duties that have actually been approved. A receptionist who schedules appointments may not need billing exports or configuration rights. A billing coordinator may need a different set of queues and reports. Review those differences explicitly instead of copying a senior employee's entire permission set.
The HHS minimum necessary guidance explains limits on unnecessary PHI use and disclosure, including important exceptions such as certain treatment disclosures. Do not turn that guidance into a simplistic rule that every access scenario is identical. Have your compliance lead apply it to the specific role.
What should happen when duties or staffing change?
Access review is not just a departure task. When an assistant moves from phones to insurance verification, the practice should approve the new permissions and remove rights that are no longer needed. Record who approved the change and where the current role description lives.
For a departure, name the person who disables accounts, the person who checks open patient work and the person who verifies phone routing. Preserve records according to your policies. Do not delete messages merely to make an inbox look clean, and do not promise immediate replacement access before provisioning and authorization are complete.
What should you ask a staffing provider before hiring?
Ask whether the assistant will work through your approved accounts, how role changes are communicated and how the provider coordinates a departure. Request an example of the handoff information the practice receives without asking for another client's records. The right answer should describe responsibilities rather than imply the provider owns your patient communications.
Use our HIPAA staffing vetting guide for the broader vendor review and our security page for published Staffing For Doctors safeguards. For the actual role, compare the access inventory with the job description checklist. Review system ownership with your office manager before granting access.
Frequently Asked Questions
Related reading
Can Virtual Staff Cover Lunches and Different Time Zones?
Set virtual medical staff hours around your practice, including lunch coverage, time zones, daylight saving changes and a clear plan for uncovered calls.
Read articleHow Can You Measure Physician Time Saved by Virtual Staff?
Measure physician time returned by virtual staff without double counting payroll savings, collections or hypothetical visits as guaranteed new revenue.
Read articleCan Virtual Staff Handle Insurance Peer to Peer Reviews?
Define what virtual staff can prepare for insurance peer to peer reviews, what the payer requires of clinicians and who owns deadlines and follow up.
Read articleRelated specialties