HIPAA Compliance for APCM Enrollment Checklist

Audit logs for all staff performing APCM eligibility queries to ensure only authorized personnel are viewing patient charts.

Ensure any lists of eligible patients exported for outreach analysis are encrypted both at rest and in transit.

Limit PHI visibility in bulk enrollment spreadsheets to only the data points required for outreach, such as name and contact info.

Store all data used to identify high-risk APCM candidates in a HIPAA-compliant environment with restricted access.

Perform periodic checks on manual chart reviews to ensure staff are not accessing information outside the scope of APCM eligibility.

Ensure automated query tools use secure, authenticated APIs rather than insecure scraping methods to pull EHR data.

Confirm that your AI call handling platform has signed a Business Associate Agreement (BAA) before processing any patient data.

Ensure automated outreach scripts include a step to verify the patient's identity before discussing APCM program details.

Store all recordings of verbal APCM consent in a HIPAA-compliant cloud environment with strong encryption and audit trails.

Program AI outreach tools to avoid disclosing specific diagnoses or sensitive clinical info in initial voicemails.

Keep a real-time 'Do Not Call' list for patients who opt out of APCM outreach to prevent unauthorized future contact.

Establish encrypted protocols for transferring a patient from an AI caller to a live care coordinator for complex questions.

Document the exact date and time verbal consent was obtained to satisfy CMS audit requirements and HIPAA documentation rules.

Verify that all patient education materials explicitly state the right to opt out of APCM at any time without penalty.

Ensure all consent records, whether captured via AI or manually, are automatically synced to the patient's EHR record.

Document that the patient was informed of potential coinsurance or deductible responsibilities associated with APCM services.

If using digital forms, store electronic signatures in a repository that provides a full audit trail of the signing event.

Audit consent logs against monthly billing cycles to ensure no patient is billed without a valid, documented consent on file.

Perform a specific security risk analysis focused on the flow of PHI through the APCM enrollment and tracking software.

Require multi-factor authentication for all staff and coordinators accessing the APCM enrollment dashboard.

Verify SOC2 or HITRUST certifications for any third-party AI platforms used to automate the enrollment workflow.

Create a clear response plan for potential PHI exposure during bulk patient outreach campaigns.

Train the enrollment team on the specific privacy differences between traditional CCM and the new APCM consent rules.

Set automated retention policies to keep APCM consent records for the CMS-mandated minimum of 6 years.