Business Associate Agreement
We execute a Business Associate Agreement with every client practice before staff placement. It defines permitted uses and disclosures of protected health information and the obligations of both parties.
Security
Security and HIPAA Compliance | Staffing For Doctors
Staffing For Doctors acts as a Business Associate when placed staff access protected health information on behalf of a practice. We sign a Business Associate Agreement and provide HIPAA trained staff under the safeguards described in our HIPAA notice.
Updated
HIPAA training
All placed staff complete mandatory HIPAA training before placement, with annual refreshers and incident response procedures.
Individual accounts and access controls
Our safeguards include multi factor authentication, role based access controls and audit logs. Your practice approves individual accounts, minimum necessary permissions and communication tools before work begins.
Data protection and encryption
Our HIPAA notice describes 256 bit SSL encryption, encrypted communications, audited workstations and device security requirements for placed staff. We do not use protected health information for our own marketing or sell it to third parties.
Who our staff are and where they work
Our virtual assistants work from the Philippines and Latin America. Every candidate has at least 4 years of general healthcare experience. Specialty matching is a separate part of selecting staff for your practice.
Certifications and security documentation
Our enterprise page states that we are SOC 2 Type II certified. Ask our team to confirm the security controls and documentation applicable to your engagement.
Security incidents and breach reporting
We report breaches and security incidents involving protected health information. Our HIPAA notice states that we notify the affected practice without unreasonable delay and no later than 60 calendar days after discovering a breach. To report a potential breach or security concern, use the contact details in our HIPAA notice.
Vendor checklist
- Have a signed BAA in place before any access to patient records.
- Request the security documentation that applies to your engagement.
- Approve individual EHR accounts with only the access necessary for assigned work.
- Confirm how credentials and access are removed when someone leaves.
Frequently asked questions
Do you sign a BAA?
Yes. We execute a Business Associate Agreement with every client practice before staff placement. The agreement defines permitted uses and disclosures of protected health information and the obligations of both parties.
Are your virtual assistants HIPAA trained?
Yes. All placed staff complete mandatory HIPAA training before placement, with annual refreshers.
How do you control access to our EHR?
Your practice approves individual accounts and minimum necessary permissions before work begins. Our published safeguards include multi factor authentication, role based access controls and audit logs. Confirm the controls applicable to your engagement with our team.
Where do your virtual assistants work?
Our virtual assistants work from the Philippines and Latin America.
Are you SOC 2 certified?
Our enterprise page states that we are SOC 2 Type II certified. Ask our team to confirm the scope and security documentation applicable to your engagement.