HIPAA Compliance for APCM BHI Programs Checklist

Store screening results in encrypted fields within the EHR to prevent unauthorized access by non-clinical staff.

Obtain and document explicit patient consent for sharing behavioral health data with the primary care team and psychiatric consultants.

Only share mental health details necessary for the APCM care plan to comply with the HIPAA 'minimum necessary' rule.

Maintain secure logs of PHQ-9/GAD-7 frequency to justify G0568-G0570 add-on billing during CMS audits.

Update the clinic's NPP to specifically include behavioral health integration workflows and third-party AI processing.

Ensure AI call center providers sign a Business Associate Agreement covering all G0568-G0570 related data handling.

All AI-driven patient outreach for BHI must use end-to-end encrypted voice and data channels for transmission.

AI systems must verify at least two patient identifiers before discussing BHI care plans or screening results.

Configure AI call logs to redact sensitive mental health terms that are not required for the clinical billing record.

Route BHI-related calls to dedicated secure lines to prevent cross-departmental data leaks in integrated settings.

Limit BHI screening access to authorized APCM care managers and designated psychiatric consultants only.

Use secure HL7 FHIR standards for data exchange between primary care EHRs and behavioral health modules.

Regularly review access logs for users viewing G0568-G0570 documentation and PHQ-9/GAD-7 screening scores.

Verify that external psychiatric consultants used for BHI programs have signed BAAs and meet HIPAA standards.

Require Multi-Factor Authentication (MFA) for all care managers accessing BHI data or AI dashboards remotely.

Document the specific behavioral health intervention that qualifies the patient for G0568-G0570 add-on billing.

Use AI to accurately and securely track the time spent on BHI services to defend against billing audits.

Maintain secure, encrypted backups of BHI care plans and screening histories separate from general medical files.

Ensure all BHI-specific data is included in the practice's HIPAA-mandated disaster recovery and backup protocols.

Document HIPAA training sessions focused specifically on sensitive behavioral health data for all APCM staff.