166 HIPAA, VAs, and the Truth About Delegation in Private Practice

If the idea of delegating in your practice immediately brings up fear about HIPAA, confidentiality, or losing control, this episode is for you. In this solo episode, I’m breaking down exactly what you can delegate right now (and what you shouldn’t) so you can protect your license while still getting critical tasks off your plate.

I walk through real-world examples of delegation, from marketing tasks and intake calls to inbox management and follow-ups, and I clear up a lot of the myths therapists carry around about HIPAA. I explain how HIPAA actually works in practice, why delegating the wrong things first can waste time and money, and how proper training—not avoidance—is what keeps your practice safe as you grow.

If your practice feels like you’re “building the plane while flying it,” or you know an uptick in clients is coming and your systems aren’t ready yet, this episode will help you get grounded and move forward with confidence instead of fear.

In this episode, you’ll learn:

• What I recommend delegating first in a therapy practice, like intake calls, follow-ups, basic marketing workflows, and inbox management, without violating HIPAA
• How I think about training and onboarding VAs, including HIPAA education, clear boundaries, and realistic expectations
• Why I stopped using long written SOPs and switched to short screen-recorded workflows, and how that reduced mistakes
• How to tell the difference between tasks that actually move you toward revenue and ones that just keep you busy

If you’re ready to stop doing everything yourself and start building systems that support your growth, this episode gives you a practical, HIPAA-aware place to start.

If you’re ready to lead with confidence, join the 2026 Supervisor Course waitlist for early access to bonus tools, templates, and fast-track grading. Strengthen your systems today with the free Supervision Onboarding Checklist, and get ongoing CEUs and live coaching inside the Step It Up Membership. You’re not just building a practice, you’re building a legacy.

Get your step by step guide to private practice. Because you are too important to lose to not knowing the rules, going broke, burning out, and giving up. #counselorsdontquit.

Chapters

• 0:00 Welcome & Why Delegation Matters
• 1:02 Do You Really Need A VA
• 2:41 Zones Of Genius And What To Outsource
• 4:46 What A Great VA Must Do
• 6:10 HIPAA 101: Companies vs People
• 9:10 What A BAA Actually Covers
• 11:27 Free December Bonus Announcement

Transcript

SPEAKER_00: 0:00

Does that guarantee that there will never be a breach, right? No, nothing can guarantee that. But you can at least do your due diligence. Welcome to Bandest Therapists, building practices of life. It's all about working smarter, not harder. And here's your host, Dr. Kate Wilhelm. Recruiting who leads in the power of a positive mindset. I hope you're having a wonderful holiday season. December 25th is my birthday. So just like you, I'm taking a well-deserved break. But I still wanted to get this episode to you because it's a big one. What to delegate first? If you want 2026 to feel different, this is the move that changes everything. And yes, the December bonus will help get you started. Now, let's get to work. Hey, I'm Dr. Kate Walker. Welcome to your coaching. Let's talk about HIPAA and your VA. All right, so the first thing with a VA, and I talked about this a little bit last time, is to think about why you want to use a VA, right? Because I know uh last time, I think when we talked about this, I talked somebody out of getting a VA because it was something that could be automated with scheduling software. If you're thinking about a VA, I would love to have some conversation around why you think you need one and what exactly you're trying to give away. Because if you have been with me for any period of time, you know that if it is something outside of your zone of genius or even your zone of expertise, and these are from Gay Hendrick's book, The Big Leap, great book, highly recommend. But if it's outside of your zone of expertise or excellence or genius, you probably should farm it out. So things like bookkeeping or accounting or you know, financial planning, if that is not in your zone of competence, excellence, genius, yes, hire it out. But what we're talking about with a virtual assistant is especially for those of you who are standalone practices, you're kind of off by yourself. You want, you don't have a building, you don't necessarily have a chair and a desk for someone to sit in at the front office where you can just walk down the hallway and knock on the door and say, Hey, do you need anything? A virtual assistant has to be very, very self-motivated, very self-starter, the ability to follow directions. And we've talked about SOP or a standard operating procedure. They should be able to follow an SOP very, very well. They should be great communicators. So if they do hit a point in your SOP and they don't know what to do, they should know how to contact you and know not to just bug you about things, but to be able to say, hey, I'm stuck, I need help here. But when it gets down to HIPAA, you know, a lot of folks will talk about a BAA, which is a great thing. But when you're talking about a person, it's not a great thing. And here's why. So a business associate agreement is something that a company will offer you, not the other way around. A company will offer you, and it's a company generally that stores protected health information, not just comes in contact with it, but actually stores protected health information. And so with that BAA, they offer it to you by and they say, hey, look, we're gonna partner with you in liability. So we're not saying we're perfect, we're not saying that we can end all, be all, and guarantee 100% that there will never be a breach. And if they do, check that they may have some oceanfront property in Arizona that they're selling as well. But I mean, if they do, great. But what the BAA does, it says, okay, if something bad happens, we will partner with you financially. We will partner with you as far as informing clients. Because remember, if it's less than 500, you do one thing. If it's more than 500 people, you have to contact the media. So there's a lot you have to do if there's an information breach. And that's why you want a company, especially a big company like Google or Zoom, to be able to offer you that guarantee, the guarantee they'll partner with you if they are offering a HIPAA compliant product. And so, you know, telehealth is relatively new to us because of COVID, but I mean, medicine has been doing this for a long, long time. So having a company that stores files or who provides telehealth, and they say, hey, we have this HIPAA compliant product over here that costs a little bit more, but we will sign the BAA. The BAA, you take it, you download it, you put it in a file, or you know, drag and drop or whatever. That does not work with people, right? Because you may have someone, a virtual assistant, who's going to come in contact with your PHI, but they're not storing your PHI. And they're not going to share financial liability with you for being in contact with that PHI. So if they offer you a business associate agreement, I would be like, no, I don't, I don't, I don't believe you could hold up to that BAA and that level of liability. Quick break. If you haven't grabbed December's bonus yet, go get it. I put together the practice reset cheat sheet to help you clean up your systems, tighten your HIPAA basics, and walk into 2026 without dragging this year's mess behind you. It's totally free for podcast listeners. Just go to KateWalkertraining.com slash bonus. And the same thing, you know, you offering them a BAA doesn't make any sense because you're not going to protect their protected health information. So you if you follow me. But what can help if you are going to use a person to interact with protected health information, either they're answering the phone, they're helping you file, they are doing your billing, something where they're coming in contact with clients and or protected health information is to train them. Right. So remember in the HIPAA self-audit that won't make you panic, and that should be going in your profile this month. But if you were there, if you were there live, you saw this, you do a self-audit every year identifying the things that you're doing well and identifying the things that you're not doing so well, or the, you know, I think of them as holes in the fence, right? So, you know, if you can document that every year, everybody on your team, from licensed personnel to non-licensed personnel to virtual assistants in the Philippines, are taking a HIPAA training and they have to provide documentation. So they have to give you a certificate that says they took the HIPAA training, then you can confidently report in your self-audit that you require HIPAA training and 100% of your office staff is compliant with that. Now, does that guarantee that there will never be a breach, right? No, nothing can guarantee that. House Bill 300, which mirrors HIPAA, it's a little bit more stringent with the training. So just to be on the safe side, you could require HIPAA training once a year. And now not only are you doing the whole CYA, but your staff is actually well trained. The other thing going uh the virtual assistant route, if you're gonna have them interact with protected health information, you know, if you're going to a company like Fiverr or Upwork, I've used both, you can look for specialists who interact with protected health information. So if you attended the live webinar where I interviewed Urban and I interviewed Jennifer, my virtual assistants, you know, that's one of the things Urban says is, you know, when you hire us, you're hiring skilled labor. So you shouldn't have to, in other words, if I'm advertising that I interact with HIPAA, I can communicate with clients, I have training in this. You shouldn't have to reteach me that. So do your due diligence as well. So when you're starting out with your interview process, make sure that you find skilled personnel who understand protected health information. So, you know, that's half the battle. Other things that, you know, things like passwords, you know, there's software. That's not necessarily HIPAA, but I know it's concerning, right? You don't want to share passwords with folks. But there are other software out there. One of the ones I use is called LastPass, LastPass. And you can use that to share passwords without making it visible. Now, that doesn't outsmart two-factor identification. So if you have something like Google, it seems like every time I switch Google profiles, it's like you got to log in again. You have to, you know, we want to double check. We're gonna send you a six-digit code. So that's one thing to incorporate into your SOP, but I digress a little bit because that's not really HIPAA. HIPAA is going to be more about the training, making sure that you document that you've trained and that there's an official HIPAA training out there somewhere. You can take mine, you can take anybody's, but that you have someone reliable that they can go interact with and learn HIPAA so that you can plug them into those client interacting spots. But part of my presentation today is I was actually going to try to talk you out of using books to interact with HIPAA because most software, I mean, it does that for you, right? So if you're taking notes, if you have a filing system, you should be able to have a HIPAA-compliant filing system. The other thing would be maybe answering calls. And in that case, you know, I'm wondering if you have a great practice, definitely probably need to hire someone. And we've got Amanda Escabel going to give us a presentation on that. But if it's just you, I would wonder, okay, why aren't you returning your own phone calls? Before you go, grab December's bonus, the practice reset cheat sheet. It's your quick guide to starting 2026 with clearer systems and less chaos. Get it at KateWalker Training.com/slash bonus. See you next week. If you love today's episode, be sure to leave a five-star review. It helps other badass therapists find the show and build practices that thrive. Big thanks to Ridgely Walker for our original fun facts and podcast intro, and to Carl Guyanella for editing this episode and making us sound amazing. See you next week.