EyeCareWorks is built exclusively for optometry and ophthalmology practices. Every virtual assistant we place completes formal HIPAA training, holds a HIPAA Certificate of Completion, and signs a Business Associate Agreement directly with your practice. Your VA works inside your systems, under your permissions, with every access logged.
HIPAA compliance at EyeCareWorks is not a feature we advertise. It is the operating system our entire service runs on. Before a virtual assistant ever logs into a practice's systems, three things have already happened: they have completed formal HIPAA training and earned a HIPAA Certificate of Completion, they have signed confidentiality agreements covering all PHI handling, and they have signed a Business Associate Agreement (BAA) directly with your practice. From that point forward, the safeguards required under the HIPAA Security Rule, administrative, physical, and technical, are actively maintained, documented, and available for your review.
Our VAs are trained on optometry and ophthalmology workflows before placement: vision plans versus medical insurance, refraction data, OCT imaging, and recall protocols. PHI is handled by people who understand exactly what it is.
You work with the same assistant every day. No rotating pool, no shared logins, no unknown hands on your patient data. The result is a smaller attack surface and a cleaner audit trail.
HIPAA Certificate of Completion, signed confidentiality agreements, secured workstations, and documented incident response procedures, all in place before day one, not bolted on afterward.
A flat $10/hour includes every safeguard described on this page. There is no "security package" upsell, because compliance is not optional equipment. Your practice stays secure, efficient, and focused on patient care.
The HIPAA Security Rule organizes a business associate's obligations into three categories of safeguards. Here is how EyeCareWorks and every assistant we place implement each one, not as policy language, but as daily practice.
Workforce screening, formal HIPAA training, and a HIPAA Certificate of Completion before placement. Signed confidentiality agreements covering all PHI handling, documented policies and procedures, a zero-tolerance sanction policy for mishandling, and incident response procedures written down before they are ever needed.
Secured, dedicated workstations on hardwired internet connections. No personal devices in the workspace, locked screens when unattended, and restricted local storage so patient data never leaves your systems. The workstation environment is part of the compliance program, not an afterthought.
Encrypted remote sessions, multi-factor authentication on assistant accounts, role-based access built on least privilege, and automatic session timeouts on every workstation. All work happens inside your systems under permissions you control, so every access lands in your own audit trail, backed by secure time and activity tracking.
HIPAA compliance is not a property of virtual assistants as a category. It is a property of a specific arrangement, built from four layers you can verify before any patient information moves. Here is what each layer means and how EyeCareWorks meets it.
Anyone who handles protected health information on your behalf is a business associate, and HIPAA requires a written BAA before any PHI flows. It binds the assistant to safeguard patient information, report incidents, and use data only for the work you assign. Your EyeCareWorks assistant signs a BAA directly with your practice before day one. No BAA, no arrangement.
HIPAA requires workforce training, and that requirement follows the work wherever it sits. Every assistant completes Privacy and Security Rule training and earns a HIPAA Certificate of Completion before placement, with dates and content you can ask to see. Eye care adds its own detail: appointment history, optical purchases and diagnoses are all PHI, and the minimum-necessary principle governs every task.
Individual, scoped credentials rather than shared logins, so every action is attributable in your audit trail. Multi-factor authentication on assistant accounts. Encrypted remote sessions into your EHR or practice management system. Controlled workstations with no local storage of patient data. A written incident response process the assistant can describe without looking it up.
Compliance is bilateral. Grant access role by role (the biller does not need the optical sales module), keep the audit logs your systems already generate, include remote staff in your own policies and risk analysis, and deactivate credentials promptly when a role ends. We walk every practice through these steps during onboarding.
Remote placement done properly is not a compliance compromise. Done well, it is often tighter than the in-office equivalent, because access is scoped, logged and monitored in ways a shared front-desk terminal never was.
If you are evaluating remote staffing for your practice, ours or anyone's, these are the questions a diligent practice administrator should ask before signing anything. Here is where EyeCareWorks stands on each.
Yes. Your assistant signs a BAA directly with your practice before any PHI access begins, and we make sure it is executed as part of onboarding. A provider who hesitates on this question has already answered it.
Formal HIPAA training plus a HIPAA Certificate of Completion before placement, kept current throughout the engagement. Ask any vendor who issued their certificate, and when it expires.
In your systems, full stop. Our VAs work inside your EMR under permissions you control. PHI is never downloaded, exported, or stored on the assistant's workstation.
Secured workstations, hardwired connections, multi-factor authentication, encrypted sessions, automatic timeouts, and activity logs are available for your review.
Documented incident response procedures, prompt notification to your practice, and a zero-tolerance policy for PHI mishandling: enforced, not aspirational.
Yes. Compliance documentation, including training records, certificate status, and security protocols, is available to your practice on request, before and during the engagement.
No contracts. No setup fees. Cancel anytime.
