Privacy Policy
- Effective Date: 14 Jan, 2024
At VirtualCare Assistants (VCA), your privacy and the security of sensitive healthcare data are core to our mission. This Privacy Policy outlines how we collect, use, share, and safeguard information—particularly Protected Health Information (PHI)—in full compliance with the Health Insurance Portability and Accountability Act (HIPAA) and applicable data protection laws.
1. Information We Collect
We collect personal, professional, and health-related data solely to support the delivery of secure, efficient, and compliant virtual medical assistant services.
Personal Information
- Name
- Email address
- Phone number
- Practice or business address
- Professional credentials (e.g., NPI, license numbers)
Protected Health Information (PHI)
As authorized by our clients, we may access limited PHI, including:
- Patient names and contact information
- Appointment and medical record details
- Insurance information
- Clinical notes, prescription details, or lab results (as part of documentation support)
Website & Communication Data
- IP addresses
- Browser/device data
- Interaction history with our website or communication platforms
- Preferences for contact or support
2. How We Use Your Information
At VCA, data is only used to enable and enhance our virtual medical assistant services. We do not sell or exploit data for marketing or unrelated business purposes.
Clinical and Administrative Support
 Our virtual assistants help your team manage tasks like patient intake, appointment scheduling, charting, and follow-up calls. When authorized, they may access EHR systems to document visits or support providers during telehealth sessions.
Communication Management
Assistants may communicate with patients (e.g., for reminders or documentation) and coordinate with staff or providers. All interactions are HIPAA-compliant and professionally handled.
EHR and Practice Software Integration
 Data may be used to manage logins, schedule updates, or documentation within your chosen platforms, always under secure and approved channels.
Quality Assurance and Process Optimization
 We analyze anonymized or aggregated data internally to improve our service delivery. No PHI is used in any way that compromises confidentiality.
Regulatory Compliance
All client and patient data is handled in line with HIPAA and applicable regulations. We assist our clients in meeting compliance goals by adhering to best practices in healthcare data management.
Contractual Responsibilities
 We store and process data to meet the obligations outlined in our service agreements, including staffing, training, and access provisioning.
3. HIPAA Compliance (Our Standard)
VCA operates as a HIPAA-compliant Business Associate and takes full responsibility for protecting the data we access on behalf of our healthcare clients.
Our Role as a Business Associate
 We sign Business Associate Agreements (BAAs) with all clients. As a Business Associate, we are legally obligated to maintain the privacy and security of PHI and to comply with breach notification requirements.
Technical Safeguards
- Encryption: All PHI is encrypted in transit and at rest using protocols such as AES-256.
- Secure Systems: Our platforms are protected by firewalls, intrusion detection, and secure access controls.
- Secure Communication: All data shared via email or file transfers is sent through encrypted, HIPAA-compliant channels.
Administrative Safeguards
- Access Restrictions: Staff access is role-based and logged. No one accesses data beyond what’s required for their duties.
- Staff Training:All team members complete HIPAA training at onboarding and annually thereafter.
- Policies & Agreements: All employees sign strict confidentiality and data use agreements.
Administrative Safeguards
- Device Security: Staff devices are protected with endpoint security, screen lock policies, and restricted access.
- Workspace Policies: Remote assistants work from secure, private environments monitored for compliance.
Breach Notification & Response
 In the event of a breach, we will notify you within the HIPAA-mandated timeframe and support incident response, documentation, and mitigation steps.
Compliance Monitoring
We conduct routine audits and partner with HIPAA consultants to ensure our practices meet current privacy and security standards.
4. Data Sharing and Disclosure
VCA respects your privacy. We do not sell, rent, or trade your data. Information is only shared when necessary to support our virtual assistant services or to comply with legal obligations.
We may share data in the following scenarios:
- With Your EHR or Practice Management Tools: Accessed only with your permission to support documentation, scheduling, or communication tasks.
- With HIPAA-Compliant Vendors: If third-party tools (e.g., communication platforms, cloud services) are used to deliver services, they are vetted for compliance and bound by BAAs.
- At Your Direction: If you authorize data sharing with a third party (e.g., consultant or legal counsel), we will do so upon written request.
- As Required by Law: We may disclose data to comply with legal obligations, court orders, or government audits—always minimizing data shared to what is legally necessary.
5. Data Retention
We retain data only as long as required for operational, legal, or contractual purposes. Retention timelines may vary based on the data type and applicable laws.
|
Type of Data
|
Retention Period
|
Governing Rule
|
|---|---|---|
|
PHI (under assistant access)
|
As directed by client
|
HIPAA/Client Policy
|
|
Internal records & notes
|
Up to 7 years
|
Practice & legal standards
|
|
Email/Chat Logs
|
2–5 years
|
Operational needs
|
Secure Disposal:
 All data is permanently deleted or securely archived using HIPAA-compliant methods after the retention period expires.
6. Your Rights
As a client or authorized party, you maintain control over the data we manage on your behalf.
Your Rights Include:
- Right to Access – Request a copy of data stored or processed by us.
- Right to Correction – Request updates to inaccurate or outdated data.
- Right to Restrict Use – Request limits on how your data is used or disclosed.
- Right to Audit – Audit access logs, request reports on task history, or review how we’ve used your data.
- Right to File Complaints – If you believe your data has been mishandled, you can contact our Privacy Officer or submit a complaint to the U.S. Department of Health and Human Services (HHS).
VirtualCare Assistants will never retaliate against anyone for exercising their privacy rights.
7. Data Security
Security is built into everything we do. Our multilayered safeguards protect your data against breaches, loss, or unauthorized access.
Core Security Measures Include:
- Encryption: All communications and stored files use end-to-end encryption.
- Access Controls: Only authorized personnel access data—governed by role, time, and task.
- System Monitoring: We conduct regular vulnerability scans, security testing, and third-party assessments.
- Incident Response: Our breach response team is trained to act swiftly and notify affected parties in compliance with HIPAA.
- Ongoing Staff Training: Team members undergo regular security awareness training to prevent social engineering and phishing threats.
8. Cookies & Website Analytics
Our website uses basic cookies and analytics tools to enhance your browsing experience.
Cookies Used:
- Essential Cookies – Enable core site features like navigation and security.
- Performance Cookies– Help us analyze site traffic and improve usability.
Important Note:
We do not collect PHI via cookies or analytics tools. Your interactions with our website remain confidential and secure.
Analytics Tools:
We use platforms like Google Analytics to measure non-identifiable usage data (e.g., time on page, browser type). This data is used solely to improve our website experience.
If you contact us via our site, your information is stored securely and only used to respond to your inquiry.
9. Children’s Privacy
VCA services are intended for licensed healthcare professionals and their staff. We do not knowingly collect or store data from individuals under 18 years of age.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect service changes or legal requirements. All updates will be posted here with a new effective date. We encourage you to review this page periodically.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to us:
