HIPAA Compliance for APCM: CCM Automation FAQ Guide

Yes, provided they are stored in a secure, encrypted environment with strict access controls. TileHealthcare ensures that recordings are only accessible to authorized personnel and are part of the secure audit trail required for HIPAA compliance.

Our AI processes PHI within a secure, isolated environment. We utilize 'least privilege' access models and automated de-identification techniques where possible to ensure that only the minimum necessary information is used to facilitate the APCM service.

HIPAA requires specific retention periods for documentation, often up to six years. Our systems are configured to retain call logs, consent records, and care plan updates in accordance with both federal HIPAA mandates and state-specific medical record laws.

Standard practice is to avoid leaving PHI on voicemails unless the patient has provided specific authorization to do so. Our AI is programmed to leave only generic 'callback' messages unless a secure, authorized communication path is confirmed.

For patients with substance use disorder (SUD) records, we implement enhanced privacy filters. The AI is configured to identify and segregate this sensitive data, ensuring it is not disclosed without the specific, heightened consent required under 42 CFR Part 2.

Before disclosing any PHI, the AI performs a multi-factor identity verification, typically asking for the patient's date of birth or the last four digits of their social security number to ensure the person on the line is the authorized recipient.