Practice Operations
Office Based Allied Health Virtual Assistants: Why Your Clinic’s Offshore Admin Should Not Be Working From Home
Almost every allied health virtual assistant on the market works from home, alone, unsupervised, and very often for somebody else at the same time. That is not a character problem, it is what the freelance model was built to do. Here is what the gaps in your VA’s day actually mean, and what changes when the person doing your clinic’s admin works in a monitored office for a real employer.
We run an office based model. Our team members are employed by Yoonet in Balanga City, Bataan, they come into a managed office, and we are obviously going to think that is the better way to do this. So read the rest knowing exactly who is writing it. We have no affiliate relationships, we are not paid by any software vendor, and where the evidence is thin we will say so rather than dress it up.
A clinic owner in Sydney said something to me last week that I have now heard, in almost the same words, from about a dozen practice owners across Australia and New Zealand. He had been using an offshore allied health virtual assistant for a couple of years. He liked her. And he had started to suspect that she was not really working for him.
His words were that his assistants were not working exclusively for his practice, that he thought they were juggling another job, or a baby, or both, and that the giveaway was the gaps. Hours in the day where nothing had moved and no explanation that quite added up. He had also had a VA resign on the morning she was rostered on and not turn up that day. That was the thing that made him pick up the phone, and the question he asked me was not about price or scope. It was whether there was an option for his people to be working in an office rather than at home, with somebody supervising them.
I want to be careful here, because it would be easy to turn this into a story about untrustworthy offshore workers, and that is not what is happening. The people are fine. Most of them are excellent. What is broken is the structure they have been put into, and almost nobody selling virtual assistants to healthcare clinics will explain it to you, because the whole industry is built on it.
Where allied health virtual assistant arrangements break
Almost always in the same place, on roughly the same timeline.
Work from home virtual assistant arrangements fail in a recognisable pattern, and the failure is structural rather than personal. If you have used one for any length of time you will know the arc already. Once you have seen it two or three times it stops feeling like bad luck.
Most clinic owners read that arc as a people problem. They hired the wrong person, they should have screened harder, they will be more careful next time. So they hire again, from the same market, into the same arrangement, and eight months later they are standing in the same place wondering what is wrong with them.
It is not a people problem. It is a capacity problem, and the capacity is being sold to somebody else at the same time as it is being sold to you. If you want the version of this argument that runs on money rather than risk, we laid out what admin is really costing your clinic in a separate piece.
Overemployed is a movement, not an accident
There is a word for this, and a community of several hundred thousand people around it.
Holding two or more full time remote jobs at once is an organised, openly discussed practice with its own community and its own vocabulary. Overemployed.com exists to help people do it. The r/overemployed community on Reddit was created in May 2021 and reported more than 430,000 members by mid 2025, with community trackers putting it above 600,000 by 2026. The advice traded there is practical and quite specific: how to schedule overlapping stand ups, which roles have the least observable output, how to keep a LinkedIn profile quiet.
US Bureau of Labor Statistics series LNU02026631 recorded 416,000 Americans holding two full time jobs simultaneously in January 2024, rising to an all time high of 488,000 in December 2025. That is the most conservative and most verifiable anchor available, because it counts formally reported jobs only.
The most cited survey is softer. ResumeBuilder.com asked 1,000 fully remote United States workers in January 2023 and found that 79 per cent had worked two or more remote jobs in the previous year, with 36 per cent holding at least two full time jobs at the time. It is a vendor survey of self reported behaviour, so treat it as indicative rather than settled.
No equivalent study exists for offshore freelancers, and anyone who quotes you a precise offshore figure has made it up. What clinic owners describe is consistent even without a number: unexplained gaps during core hours, replies that arrive at predictable times rather than promptly, work quality drifting down over months, and a departure with no notice.
Nobody sets out to hire half a person. It is just that the freelance market only sells halves, and it does not tell you which half you are getting.
The model is doing what it was built to do
This is the part that reframes everything else.
Freelance platforms are not a slightly worse version of employment. They are a different product, built deliberately for short term, project based, multi client work, and they are extremely good at being that. Upwork lists more than 18 million registered freelancers across 180 or so countries. OnlineJobs.ph, Freelancer.com and Truelancer are all built on the same premise, and a 2022 study by GCash and Payoneer put around 1.5 million Filipinos on international freelancing platforms.
Nothing in the freelance model is designed to deliver exclusivity, continuity, supervision or accountability, because those are not features of freelancing. They are features of employment. A freelancer holding three clients is not cheating. They are using the platform exactly as intended, and doing the sensible thing in a market with no protection, no sick leave and no guarantee that any one client will still be there in March.
So when a clinic buys a freelancer and expects an employee, the disappointment is baked in from the first day. You are not being let down by a person. You have bought the wrong instrument for the job, and the seller had no reason to mention it.
Security of tenure
A regular employee under the Labor Code of the Philippines cannot be dismissed at will, which cuts both ways. It is the thing that makes staying rational.
SSS, PhilHealth and Pag-IBIG
Social security, health insurance and housing fund contributions are paid by the employer. A marketplace freelancer receives none of them and funds their own safety net by holding more clients.
13th month pay
Presidential Decree 851 requires a legally mandated extra month of salary each year. It is one of the clearest tells of whether a provider actually employs anybody or simply resells.
A departure you see coming
Employment carries notice periods, handovers and a documented exit. None of those obligations attach to a freelancer engaged through an online marketplace.
The clinics we work with, practices likeOptimise Health in Toowoomba, almost never open the conversation by asking about offshore staff. They open it by describing a Tuesday. The recalls did not go out, the referral inbox has two weeks in it, and a practitioner spent forty minutes chasing a health fund instead of seeing patients. What they are actually short of is somebody whose whole working day belongs to their clinic, and who is still there in a year.
The provider that does not employ anyone
There is a middle layer in this market worth knowing about.
A meaningful number of businesses that present themselves as outsourcing providers do not employ a single one of the people they place. They source from OnlineJobs.ph or Upwork, add a margin, and pass the person through. No office, no employment relationship, no infrastructure, no governance, and no ability to hold anybody to anything. When a clinic tells me their agency supplied VA disappeared, this is very often what was underneath it.
Philippine law has a name for the shape of this. Department Order 174 of 2017 penalises labour-only contracting, where a contractor supplies workers without substantial capital, tools or control over the work. A provider that employs nobody, owns nothing and supervises no one sits close to that line, and its ability to protect your clinic is close to zero.
The fastest way to tell the difference is to ask to visit. Genuine providers are proud of the office and will offer you a tour before you ask. Discouraged visits are the tell. Beyond that, look for legal Philippine employment with all mandated benefits paid, a physical monitored office, and a published retention figure the provider is willing to explain rather than simply assert.
| What you are actually buying | Freelance VA working from home | Employed, office based team member |
|---|---|---|
| Employment status | Independent contractor. No employer, no mandated benefits, no legal obligation to anyone. | A regular employee under the Labor Code of the Philippines, with SSS, PhilHealth, Pag-IBIG and 13th month pay. |
| Exclusivity | None by design. Nothing in the arrangement prevents other clients or other jobs. | Contractually exclusive to your clinic, on a rostered shift. |
| Supervision | Self supervised. You are the only person who would notice a problem. | A team leader on the floor, plus operations management above them. |
| Device and network | A personal computer on a home connection you have never seen. | A managed machine on a managed corporate network, patched and logged centrally. |
| Physical security | Whoever else lives in the house. No control over screens, printing or storage. | Access controlled floor, CCTV, USB storage disabled, no printing, no paper. |
| Cover when away | None. A sick day means nothing gets done that day. | A trained colleague picks the work up the same morning. |
| Who carries the privacy risk | Your clinic does, and it cannot evidence the reasonable steps APP 8 asks for. | Your clinic still does, but now it can evidence exactly what protects the data. |
| A 30 day breach assessment | No managed device, no network logs, no supervisor. Close to impossible to complete. | Access logs, device records and a named manager who was in the room. |
| When they leave | Often no notice at all. You find out because a Monday goes quiet. | Notice, a handover, and a managed replacement. |
Australian Privacy Principle 8 makes your clinic liable, not the assistant
The obligation is not "do not go offshore". It is "be able to show your working".
Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 (Cth) make the Australian clinic accountable for what an overseas recipient does. Before disclosing personal information overseas you must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, and if they do breach them, your practice is taken to have committed that breach itself. The liability does not travel with the worker. It stays in your clinic.
The Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to health service providers regardless of turnover, so the three million dollar small business threshold does not help a clinic.
Getting patient consent for every cross border disclosure is not workable at clinic scale, so the whole obligation rests on reasonable steps. OAIC guidance treats an enforceable contract as the expected baseline rather than the finish line. What the contract has to say, and what monitoring sits behind it, both turn on the circumstances, and the guidelines call for more rigorous steps where the information is sensitive. Health information always is.
Two hard limits sit alongside that. Section 77 of the My Health Records Act 2012 (Cth) prohibits the System Operator, registered repository operators, registered portal operators and registered contracted service providers from holding, taking, processing or handling My Health Record information outside Australia, and no patient consent waives it. It does not by its own terms bind a clinic, but a clinic whose offshore provider is registered as a contracted service provider brings itself inside the prohibition. And on 06/03/2026 the Australian Government Department of Health, Disability and Ageing issued Hearing Services Program Provider Notice 2026-1, directing service providers to stop using offshore call centres to access program client records under clause 42 of the service provider contract. That is a program contract direction rather than a privacy enforcement action, and it applies to a specific provider cohort rather than to clinics generally, but it is the clearest official signal yet about how uncontrolled offshore access to Australian health records is viewed.
Part IIIC of the Privacy Act 1988 (Cth) gives you 30 days to complete an assessment once you suspect an eligible data breach. That window is close to unworkable when the person involved is a home based offshore worker with no managed device, no network logs and no supervisor who can tell you what happened.
Hold that standard against an unsupervised freelancer on a personal computer at home, with live USB ports, personal cloud storage on the same machine, a household that shares the room, and no employer standing behind them. It is very difficult to describe that arrangement as reasonable steps, and much harder still to evidence it if somebody asks.
I should be straight about the limits of this argument. There is no publicly known OAIC determination or New Zealand Privacy Commissioner enforcement action against an Australian or New Zealand clinic over an offshore home based administrator. None appears to exist. The absence of a test case is not evidence that the model is safe, only evidence that it has not yet been tested, and this article is not going to pretend otherwise. What can be said is that the OAIC recorded 1,113 notifiable data breaches across all Australian sectors in 2024, up 25 per cent on the 893 notified in 2023, and health service providers were the top reporting sector in both halves of the year, with 102 notifications from January to June and 121 from July to December. Human error, not hacking, caused 156 of the 527 breaches notified between January and June 2024, with personal information emailed to the wrong recipient the single largest subcategory.
New Zealand: IPP 12 and the Health Information Privacy Code 2020
The New Zealand rule has one feature that catches clinics out.
New Zealand’s Privacy Act 2020 permits offshore disclosure under information privacy principle 12 only where the clinic believes on reasonable grounds that the overseas recipient is subject to comparable safeguards, most commonly established through a written agreement between the two agencies. Rule 12 of the Health Information Privacy Code 2020 applies that same test specifically to health information, so a New Zealand clinic sending patient data to an offshore administrator must satisfy the comparable safeguards test for health information, not merely for general personal information.
The Office of the Privacy Commissioner publishes model contract clauses, drafted by Chapman Tripp, that New Zealand agencies can use to satisfy IPP 12 when disclosing personal information overseas. Asking a provider whether it will sign them is a fast and unambiguous test.
Whether an offshore login even counts as a disclosure is less settled than it is usually presented. Section 11 of the Privacy Act 2020 treats information held by an agent purely on your behalf as still held by you, which can take a properly managed arrangement outside IPP 12 altogether. Where the offshore party uses the information for any of its own purposes, IPP 12 engages and the comparable safeguards test applies in full.
That distinction is thinner than most clinics assume, and it turns on facts you would have to prove after something went wrong. So the practical answer is to contract for the safeguards either way, and to stop treating remote access as a way around the offshore question. The same thinking applies to who holds the logins to your practice software, which we covered when we comparedCliniko, Halaxy and Nookal.
What an office actually changes
Six controls, and none of them are about trust.
An office turns a set of promises into a set of controls you can point at, which is what both the law and your own peace of mind actually run on. The argument is not that people are more honest inside a building. It is that the following six things exist inside one and structurally cannot exist in a private home.
- A managed corporate network replaces a home broadband connection shared with a household, so access is scoped to the systems your clinic uses and egress is logged.
- USB mass storage disabled at operating system level prevents patient information being copied to a stick and carried out of the building. It is a small control that closes a large hole.
- A paperless clean desk rule means no printing, no scanning to personal devices and nothing on a desk at the end of the day, so patient details are never left on a kitchen table.
- Biometric or card entry with CCTV covering the floor creates a record of who was in the room while your clinic’s records were open, which is the evidence a breach assessment actually needs.
- Personal phones stored outside the work area removes the easiest and least traceable way for information to leave a screen.
- A team leader who can see the work notices a quiet week before you do and steps in while it is still a small conversation rather than a resignation.
Put those together and the compliance conversation changes shape entirely. Instead of assuring your patients and yourself that your VA is probably careful, you can describe a building, a network, a device policy, an access log and a named supervisor. That is what reasonable steps looks like when it is written down.
There is a quieter benefit too, and it is the one I care most about. People who work alone at home, on short term contracts, with no colleagues and no progression, leave. People who work in a decent office with a team, a career and an employer who is still there next year mostly stay. Continuity is not a nice extra in clinic admin. It is the whole product, because the value of the person doing your recalls is almost entirely in what they have learned about your practice over eighteen months. It is also why we would rather youmap your admin load before you hire anyone, including before you hire us.
Why not just hire an Australian or New Zealand VA
It is the strongest objection to everything above, and it deserves a straight answer.
Hiring locally removes the cross border question entirely, and for some clinics that is the right call. If your work is unavoidably tied to My Health Record access, or you are a Hearing Services Program provider, or the thought of offshore admin will genuinely keep you awake, hire onshore and stop reading. We would tell you the same thing on a call.
But notice what most onshore virtual assistant offers actually are. They are usually a sole operator working from home, on a few hours a week, across a handful of clients. That solves the jurisdiction problem and solves none of the others. The device is still personal, the room is still a spare bedroom, the attention is still split between clients, there is still nobody covering the work when they are sick, and there is still no supervisor. Being in Brisbane rather than Manila changes which privacy principle applies. It does not change whether anyone can see the screen.
So the honest comparison is not onshore against offshore. It is supervised, employed and exclusive against unsupervised, contracted and shared, and that line runs straight through both countries. An Australian based freelancer working alone at home has most of the same operational weaknesses as a Philippine based one. The difference is only that the paperwork is simpler when it goes wrong.
Why Bataan and not Manila
Where the office sits turns out to matter as much as whether there is one.
Almost all offshore healthcare admin runs through Metro Manila, and Metro Manila is a genuinely punishing place to commute into. The TomTom Traffic Index 2023 ranked Metro Manila the worst of 387 metro areas worldwide for congestion, at 25 minutes and 30 seconds to travel 10 kilometres, a 52 per cent congestion level and 117 hours lost per driver in rush hour each year. That is close to three working weeks.
On 27 April 2024, PAGASA recorded 38.8 degrees Celsius at its NAIA station in Pasay City, the highest air temperature ever measured in Metro Manila. It broke a record of 38.6 degrees set at Port Area, Manila on 17 May 1915. The heat index at NAIA reached 45 degrees the same day.
People absorb that before they start work, twice a day, every day. It shows up in attrition figures long before anybody writes it down as a reason for leaving.
Our office is in Balanga City in Bataan, well outside Metro Manila, and that is a deliberate choice. Colliers reported in July 2026 that provincial BPO office take up has reached near parity with Metro Manila, within about eight per cent, and attributes the shift to rising Manila rents, labour costs, congestion and limited Philippine Economic Zone Authority space rather than to any single advantage. It also credits provincial hubs with stronger retention. That matches what we see. People live near where they work, they go home to their families, they are not competing with forty other employers on the same street, and they arrive at work as a person rather than a survivor of the commute. Yoonet publishes staff retention of 89.29 per cent, which is our own figure and should be read as such. That is a little under 11 per cent attrition, against a Philippine market IBPAP put at around 40 per cent in 2023, the highest of any sector.
I will not overclaim the cultural side of this, because the honest position is that it is interpretive. Filipino workplace values are real and well documented, kapwa and pakikisama and utang na loob among them, and the human resources literature links them to loyalty and retention. But that link is argued rather than measured, and I would rather say so than lean on it.
Questions worth asking any provider
The list works on us as well as on anybody else, and we would rather you used it.
If you take nothing else from this article, take the list. It works on any provider in this market, and the answers separate the real operations from the resellers in about ten minutes. If you want to see the sort of work an office based team can carry, our guide toNDIS billing and allied health claiming is a fair picture of the detail involved.
Do you employ this person, or do you source them?
A straight answer names the employing entity and the country. A vague one usually means a freelance marketplace and a margin.
Can I visit the office?
A provider with a real office will be pleased you asked. If visits are discouraged, treat that as the answer.
What is your retention rate, and how do you calculate it?
The second half matters as much as the first. Voluntary only, or total. Rolling twelve months, or a good year picked out of five.
Are they exclusive to my clinic?
Ask for it in writing. If the answer involves the word "generally", it is a no.
What is on the machine they will use?
USB storage, printing, personal cloud drives and personal email on the same device. Every one of those is a route out for patient information.
Who supervises them day to day, and what is that person’s name?
If the honest answer is that you supervise them, you have not outsourced a role. You have taken on a remote employee without any of the support.
What happens on the day they are sick?
You want a named person who already knows your clinic, not a promise to find somebody.
What will you sign about how our patient information is handled?
A data handling agreement, access limited to what the role needs, audit rights and breach notification. In New Zealand, ask whether they will sign the Privacy Commissioner’s model clauses.
If we had a suspected breach, could you give us access logs within a week?
Australian clinics have 30 days under Part IIIC of the Privacy Act to assess a suspected eligible data breach. Ask the question before you need the answer.
Frequently asked questions
Is it legal to give an offshore virtual assistant access to patient records in Australia?
Is it legal for a New Zealand clinic to use an offshore virtual assistant?
Does office based versus work from home actually matter for patient privacy?
How do I know my virtual assistant is not working other jobs?
What is the difference between a real BPO and a freelancer reseller?
What happens when an office based virtual assistant is sick or resigns?
Are offshore virtual assistants in the Philippines reliable for allied health admin?
Why should an allied health virtual assistant work in an office rather than from home?
The clinic owner in Sydney told me at the end of our call that he had assumed an office based model was something only enterprise clients could get, and that he had not expected it to be available to a practice his size. That surprised me, and then it did not, because almost nobody in this market talks about where the work physically happens. It is the single most important thing about the arrangement and it is the thing least often mentioned.
If your VA has ever gone quiet, it is worth a conversation.
Bring the list of questions above and point it at us first. If an office based model is not right for your clinic we will tell you so on the call, and if what you actually need is to fix a process rather than hire anybody, we will tell you that too and there is no next step after it.
Book a 15 minute chatSources & further reading
Figures checked on 08/08/2026. Statutory positions, statistics and market figures below were current at the time of writing. Privacy guidance in particular changes, and none of this is legal advice for your practice.
- Office of the Australian Information Commissioner, APP 8 guidelinesfor cross border disclosure, the reasonable steps test and section 16C accountability, with theNotifiable Data Breaches reportssupplying the 2024 figures.
- My Health Records Act 2012 (Cth), section 77, for the prohibition on handling My Health Record information outside Australia.
- Department of Health, Disability and Ageing, Hearing Services Program Provider Notice 2026-1, published 06/03/2026, directing providers to cease offshore call centre access to program client records. The notice is distributed to contracted providers rather than published openly, so cite it by that reference and date if you need to raise it.
- Office of the Privacy Commissioner, New Zealandfor the Privacy Act 2020, information privacy principle 12, rule 12 of the Health Information Privacy Code 2020, and the model contract clauses drafted by Chapman Tripp.
- United States Bureau of Labor Statistics, Current Population Survey series LNU02026631, for multiple jobholders with two full time jobs. Community size figures for r/overemployed come from Fortune reporting and third party trackers, and the 79 per cent and 36 per cent prevalence figures come from a ResumeBuilder.com survey of remote workers in January 2023.
- Philippine outsourcing attrition: IBPAP, and the Contact Center Association of the Philippines survey run with Willis Towers Watson putting total industry attrition at 45 per cent in 2022.
- TomTom Traffic Index 2023for the Metro Manila congestion ranking, and PAGASA for the Metro Manila temperature record set on 27 April 2024.
- Philippine employment and contracting: the Labor Code of the Philippines, Presidential Decree 851 on 13th month pay, Department of Labor and Employment Department Order 174 of 2017 on labour-only contracting, and the National Privacy Commission work from home guidelines issued in April 2020 under the Data Privacy Act of 2012.
- Provincial versus Metro Manila outsourcing: Colliers Philippines research published July 2026 on provincial BPO office take up reaching near parity with Metro Manila, and the rising Manila rents, labour costs, congestion and limited Philippine Economic Zone Authority space driving the shift.
- Freelance workforce scale in the Philippines: the 2022 GCash and Payoneer study on Filipinos working through international freelancing platforms.
- Breach cost: IBM Cost of a Data Breach Report 2024, Australian average of AUD 4.26 million.
