APCM Enrollment: HIPAA Compliance Checklist | Tile Healthcare

Confirm a signed BAA is in place for all AI call center providers and software vendors handling APCM data.

Audit the AI vendor's methods for processing voice-to-text PHI to ensure data is not used for unauthorized model training.

Ensure all enrollment data is encrypted both at rest and during transit between the practice and the APCM service.

Establish clear timelines for how long enrollment recordings and transcripts are stored based on state and federal laws.

Restrict access to enrollment records to only those staff members directly involved in the patient's care management.

Obtain signed consent that specifically mentions data sharing with third-party APCM service providers.

Use AI systems to record and timestamp verbal consent for both the service and the automated processing of health data.

Ensure your NPP includes language regarding chronic care management and the use of automated communication tools.

Clearly inform patients if an AI agent is being used to collect their health information during the enrollment phase.

Create a HIPAA-compliant process for patients to revoke consent and ensure their data is removed from active APCM lists.

Store the comprehensive care plan in a HIPAA-compliant EHR or a secure cloud environment with multi-factor authentication.

Track every instance an enrollment specialist or AI system accesses or modifies a patient's chronic care record.

If enrollment calls are recorded for quality assurance, they must be stored in an AES-256 encrypted repository.

Only collect the 'minimum necessary' PHI required to establish APCM eligibility and develop the initial care plan.

Update your incident response plan to specifically address potential data leaks within the APCM vendor pipeline.