Compliance

HIPAA for Remote ABA Staff: The Safeguards That Matter

By the Remote ABA Staffing team · Published October 27, 2026 · 6 min read

Remote administrative staff handle PHI all day. The safeguards that matter most, and what to put in writing.

Intake, billing, authorization and scheduling staff create, view and transmit protected health information every working hour. When they work remotely, the HIPAA Security Rule’s administrative, physical and technical safeguards still apply. The office just moves to their home.

Workforce member or business associate?

A temporary or contract worker who works in your systems, under your direction and your policies, is generally treated as part of your workforce. A company that receives, maintains or transmits PHI on your behalf, such as an outsourced billing team running on its own systems, is generally a business associate and needs a Business Associate Agreement. Get this analysis right for each arrangement, and document it.

The safeguards that matter most

Access

• Unique user accounts for every person. No shared logins.
• Multi-factor authentication on every system that touches PHI.
• Access limited to what the role requires: the minimum-necessary standard.
• Same-day removal when someone leaves.

Devices

• Encrypted devices, ideally company-issued.
• Automatic screen lock and current security updates.
• No PHI saved to personal cloud storage or USB drives.

Communication

• No PHI in personal email or personal text messages.
• Approved, secure channels for internal messages that include PHI.
• Care with voicemail and email content sent to families.

Workspace

• A private room where screens cannot be seen and calls cannot be overheard.
• Headsets for calls, and no smart speakers listening during work.
• Printed PHI avoided; where unavoidable, locked storage and shredding.

What to put in writing

1. A remote-work policy that lists the safeguards above.
2. A signed acknowledgment from each remote worker.
3. HIPAA privacy and security training before access is granted, with an annual refresher.
4. Incident-reporting instructions: who to tell, how fast and how.
5. Your risk analysis, updated to include remote access.

A note on claims

There is no official "HIPAA certification" for individuals. Training records show that someone completed training, which is valuable, but compliance depends on how your organization implements and enforces its safeguards.

This article is general information, not legal advice. Consult your privacy officer or counsel for your organization’s specific obligations.