HIPAA Compliant APCM Billing Code Setup Checklist

Ensure your AI-powered APCM service provider has signed a comprehensive Business Associate Agreement before data exchange.

Confirm that any cloud storage or transcription services used by the APCM vendor are covered by downstream BAAs.

Check that the BAA clearly defines liability for data breaches occurring during automated APCM outreach.

Maintain a log of BAA execution dates to ensure coverage throughout the billing cycle and audit periods.

Map out which vendor employees or automated systems have access to patient data for APCM billing purposes.

Ensure all recorded APCM patient calls and digital care plans are encrypted using AES-256 standards.

Use the latest Transport Layer Security protocols for data moving between your EHR and the APCM platform.

Use AI tools to automatically redact sensitive PHI from call transcripts that are not required for billing documentation.

Require multi-factor authentication for any staff accessing APCM billing reports or call logs.

Regularly review access logs to ensure only authorized personnel are viewing APCM-specific patient data.

Update your NPP to include the use of third-party AI for care management and billing support services.

Ensure patient consent forms specifically mention data sharing with the APCM vendor for care coordination.

Program AI agents to verify and record patient consent at the start of every APCM outreach call session.

Clearly state how long APCM call recordings and billing data will be stored per HIPAA and state rules.

Provide a clear path for patients to revoke consent for AI-driven APCM outreach at any time via phone or portal.