Remote and hybrid work are no longer new in medical practices. The challenge today is that most organizations have already made the obvious moves — shifting some business functions off-site, letting a few roles go hybrid, and experimenting with physician telehealth blocks.  

Now comes the part that separates sustainable flexibility from operational drift: deciding which roles truly should be remote or hybrid, building policies that don’t collapse under stress, and treating privacy/security incidents (even the “small” ones) as predictable operational events, not surprises. 

A Jan. 13, 2026, MGMA Stat poll finds that about one in 10 (10%) of medical practices reported an incident in the past 12 months involving remote/hybrid work that required remediation, while most (78%) did not and another 12% were unsure. The poll had 269 applicable responses. 

• Among the small group of practices that had incidents requiring remediation, most leaders indicated they already have formal remote/hybrid work policies, and in most cases they did not change those policies after the incident. A smaller number reported adjusting, typically tightening accountability or making limited case-by-case changes. 
• Among the majority without an incident, most respondents said they do have formal policies for remote/hybrid work and off-site device security (often treating remote work as a privilege and applying the same expectations as on-site), even if some noted the policies aren’t very detailed. 
• A small share of remaining respondents noted that they have made remote/hybrid hiring less common or have no remote workers and no policy regarding remote work. 

MGMA’s recent polling on remote work has consistently shown stabilization, not a rush to extremes: 

• In July 2024, most medical groups reported they were holding steady on their remote/hybrid workforce. 
• In a June 2023 poll, most groups were not reporting very high levels of remote work — an early signal that healthcare would not copy-paste other industries’ swings between fully remote and return to office. 

That “just right” mix, however, comes with potential failure points: Workflow friction (especially handoffs), culture and fairness (especially between patient-facing and non-patient-facing teams), and data protection. 

The operational cost: Workflow friction 

Medical practice workflows are chains of small, high-frequency handoffs: phone calls become appointments; appointments become visits; visits become documentation; documentation becomes claims; claims become cash. Every step has compliance implications. 

Remote and hybrid models can improve throughput in parts of that chain, particularly work that is queue-based and measurable. Our 2024 reporting highlighted that many groups would expand remote/hybrid roles in revenue cycle functions (coders, billers, denial/appeals staff), scheduling, call centers, HR, IT, accounting/payroll and other administrative areas. The 2023 poll data similarly noted leaders looking “primarily for coders and billers to work remotely,” while keeping other roles office-based. 

But the same model can degrade performance if the work depends on fast clarifications, in-person coaching, or rapid problem-solving. The damage is often subtle: longer cycle times on prior authorizations, more dropped balls on referral follow-up, and increased rework on incomplete documentation. 

Clinicians are “hybrid” differently than staff, with different risks 

One key lesson is to stop treating remote/hybrid as a staffing benefit and instead treat it as an operating design decision. Clinician remote/hybrid work often splits into: 

1. Patient-facing telehealth, and 
2. Non-visit clinical work (results review, messages, refills, documentation, care plan updates). 

Privacy dynamics change based on the individual, too: A provider doing virtual visits from a home office creates different exposure risks than a coder working a claims queue. The practice should treat these as separate risk profiles with separate controls. 

Deciding eligibility: start with the work, not the person 

The most defensible remote/hybrid decisions are grounded in role design, not a supervisor’s preference or comfort with one person. Read our “Assessing place and time” framework, which prompts leaders to consider geographic and time constraints, then mapping roles accordingly. 

Picture each role as a bundle of tasks, then ask: Which tasks are truly place-bound? Which are time-bound? A surgery scheduler may be able to work anywhere but cannot work at any time if they must coordinate with clinic hours and real-time patient calls. A financial analyst may be both place-unconstrained and time-flexible, as long as deadlines and meeting cadences are clear. 

You also can build “personas” for roles, considering relationship-building needs, collaboration intensity, technology requirements, and how often the role interacts with internal or external “clients.” It’s not a question if an individual can work from home, but rather, “Does this job succeed when done away from the clinic, and under what conditions?” 

Then add a second filter: readiness and ramp-up. Many practices that succeed with remote work require an on-site training period and performance proof before remote eligibility. Our previous reporting includes examples such as requiring months of on-site phone work before remote scheduling eligibility, and using defined training/evaluation periods before allowing remote arrangements. 

It’s not distrust. You’re protecting the operation and your patient-centered reliability, especially as some roles depend on tacit knowledge that is hard to teach at a distance. 

Clarity beats complexity in your policies 

Strong remote/hybrid policies do a few unglamorous things exceptionally well: 

• They define what success looks like in objective terms. Some practice leaders froze expansion of remote hiring until they could measure KPIs for remote workers. Remote work should be measurable in a way similar to in-office work that is fair, role-appropriate, and tied to patient/service outcomes. 
• They define how exceptions work. Your policy should be explicit about core in-office days, coverage expectations, meeting norms, and what happens during weather events, childcare disruptions, internet outages, or surge volumes. 
• They define what tools are allowed (and what are not). If your culture tolerates “just this once” use of unapproved texting or personal email, the policy is already broken. 
• They define where work can be done. “At home” is not a control. “In a private workspace where screen visibility is managed, conversations cannot be overheard, and paper is secured” is a control.