HIPAA Compliance Checklist for AWV & APCM Programs

Ensure your AI scheduling partner has a signed Business Associate Agreement covering all AWV outreach and APCM enrollment calls.

Secure all Health Risk Assessment data transmitted between the patient portal and the EHR during the AWV process to prevent leaks.

Record verbal or written patient consent for APCM enrollment during the AWV visit as per Medicare requirements in a secure format.

If AWVs are conducted via telehealth, ensure the platform meets HIPAA-mandated end-to-end encryption standards for clinical discussions.

Restrict access to AWV results and APCM care plans to only authorized clinical and administrative staff using role-based controls.

Ensure AI voice agents do not disclose Protected Health Information (PHI) during initial AWV scheduling or APCM marketing calls.

Use secure protocols to verify the practice's identity during automated APCM enrollment outreach to build patient trust and compliance.

Offer clear, automated instructions for patients to opt-out of future AWV reminders or APCM follow-up communications.

Configure AI systems to leave only the minimum necessary information on unverified patient voicemails regarding upcoming AWV appointments.

Regularly review AI-patient interaction logs for any accidental disclosure of sensitive HRA data or unauthorized PHI sharing.

Ensure the HRA completed during the AWV is securely linked to the APCM care plan to justify the medical necessity of concurrent billing.

Document the specific time spent on APCM activities initiated during the AWV to meet G0438 and G0439 billing requirements.

Keep a secure, retrievable record of patient consent for APCM services for at least six years to satisfy CMS audit guidelines.

Review documentation for G0438 and G0439 to ensure they meet Medicare’s specific medical necessity criteria for the initial and subsequent visits.

Ensure your NPP includes language regarding third-party AI tools used for care coordination and preventive service outreach.