Patient data stays in your systems.
Every Cloverpo placement starts with a signed business associate agreement and runs on clear security rules: individual logins, encrypted computers, HIPAA training before day one and regular checks after that.
How we protect your patients’ information
These safeguards apply to every VA and every client.
A BAA before any access
We sign a business associate agreement with your practice before your VA sees any patient data.
HIPAA training, then refreshers
Every VA completes HIPAA privacy and security training before first access, with refresher training every quarter.
One login per VA
Your VA gets their own login to your systems, with multi-factor sign-in wherever available. Logins are never shared.
Only the access a task needs
VAs open only the records they need for the task in front of them, never out of curiosity.
Encrypted, checked computers
Full-disk encryption, current updates, antivirus, an automatic screen lock and a separate work profile, checked every quarter.
A private workspace
A private room where no one else can see the screen or hear calls, a headset for every call, and no public Wi-Fi.
What our VAs never do
Every VA signs our HIPAA rules before they get any access, and we check that they follow them.
- Use personal email, Messenger, Viber or WhatsApp for anything with patient information
- Put patient information into AI tools, unless you approve the tool in writing under your own BAA
- Save your files, screenshots or downloads on their computer
- Share a login, or save passwords anywhere but an approved password manager
- Work from public Wi-Fi, internet cafes or shared computers
- Take patient calls on speakerphone or where others can see their screen
You stay in control of access
Access is set up carefully, reviewed regularly and removed promptly.
- You decide what your VA can seeYou give your VA their login and choose their permissions in your systems.
- Quarterly access reviewsWe confirm your VA still needs every login they have, and ask you to remove any that are no longer needed.
- Access removed when work endsWhen an assignment ends, we ask you to remove access the same business day and confirm it within 24 hours.
- Incidents reported to youIf anything ever goes wrong with your patients’ information, we tell you within 5 business days, as our agreement requires.
Security questions
Ask us anything else on a free call.
Will you sign a BAA?
Yes, always, before your VA has any access to patient data.
Are your VAs “HIPAA certified”?
There’s no official government HIPAA certification for people or companies. What matters is training and safeguards: every Cloverpo VA is HIPAA-trained before day one, with refreshers every quarter, and works under a signed BAA.
Where is patient information stored?
Only in your systems. Our VAs don’t save files, screenshots or downloads on their computers, and our own business tools never hold patient information.
Can my VA use AI tools?
Not with patient information, unless you approve a specific tool in writing under your own BAA.
Questions about security? Let’s talk.
Book a free call and we’ll walk you through how your VA would work inside your systems.
Book a free consultationThis page describes Cloverpo’s practices. It isn’t legal or compliance advice; check your own obligations with your compliance advisor.