HIPAA, BAAs & Our Employment Model
Why HIPAA matters in ABA operations staffing
The staff we place, including intake, billing, authorization and scheduling staff, routinely create, access and transmit protected health information (PHI). We take that seriously, and we are precise about what we claim.
Staff working in your systems
Contract and temporary staff who work inside a client’s systems, under the client’s direction, operate as part of the client’s HIPAA workforce under the client’s policies and procedures. The client controls system access, provisions accounts and can revoke them at any time.
When we are a business associate
When Remote ABA Staffing itself receives, maintains or transmits PHI on a client’s behalf, for example a project billing team or AR clean-up run on our systems, we act as a business associate and sign a Business Associate Agreement with the covered entity before any PHI is shared.
Training and safeguards
Candidates complete HIPAA privacy and security training before placement, and contract staff complete an annual refresher. We reinforce the minimum-necessary standard, multi-factor authentication, encrypted devices, private workspaces, no PHI in personal email, text or cloud storage, and prompt incident reporting. We never describe staff as "HIPAA certified," because no official certification exists, and we do not guarantee any organization’s HIPAA compliance.
Payroll and day-to-day work
We handle payroll for the staff we place. Clients direct day-to-day work and decide which systems and data staff can access.
Direct hires
Direct-hire candidates become the client’s employees on their start date and are covered by the client’s payroll, benefits and policies.
Offshore staff, only on request
If a client requests nearshore or offshore virtual staff, they are engaged through a compliant contractor or employer-of-record structure disclosed to the client in writing, and staff handling PHI are covered by HIPAA safeguards and a Business Associate Agreement.