Athenahealth HIPAA Compliance Checklist for APCM Programs

Restrict access to the Care Management module and APCM-specific reports to only authorized clinical and billing staff.

Regularly review athenahealth audit logs to track which users are accessing custom reports used for identifying APCM-eligible patients.

Mandate 2FA for all athenahealth users, especially those accessing integrated AI call handling tools or marketplace apps.

Use the athenahealth patient portal for all electronic consent captures required for APCM enrollment to ensure encrypted documentation.

Verify that all remote care managers accessing athenaOne on mobile devices meet CMS and HIPAA encryption standards.

Verify that a Business Associate Agreement is in place with your AI call handling provider covering all athenahealth data exchanges.

Configure AI outreach scripts to use the minimum necessary PHI and verify patient identity before discussing chronic conditions.

Ensure all data captured by AI call handling is transmitted via secure, encrypted APIs directly into the athenaOne patient record.

Establish auto-deletion or secure HIPAA-compliant storage for any recordings of AI interactions related to APCM outreach.

Secure the data flow between AI platforms and athenahealth's eligibility checking tools to prevent unauthorized data exposure.

Add and map G0556, G0557, and G0558 codes within the athenahealth Fee Schedule to ensure accurate claim submission.

Use athenaOne's time-tracking features or integrated AI tools to log the exact minutes required for compliance with APCM billing.

Ensure APCM encounter notes in athenaOne include care plan updates, medication reconciliation, and patient consent indicators.

Update athenahealth billing rules to flag APCM claims that lack required documentation or exceed frequency limits.

Create a matrix within athenahealth to track different payers' specific documentation needs for APCM reimbursement codes.

Perform a quarterly audit of permissions granted to third-party APCM apps in the athenahealth Marketplace to limit data access.

Utilize athenahealth's interoperability tools to securely share APCM care plans with the patient's entire care team.

Establish a clear workflow in athenaOne to document and honor patient requests to opt-out of APCM outreach or data sharing.

Use athenahealth's secure document exchange for sharing APCM performance reports with CMS or private insurance payers.

Ensure that when an AI call escalates to a live staff member, the patient context is transferred securely within athenaOne.