HIPAA Compliance Checklist for APCM & CCM Software Comparison

Confirm that all patient data stored within the CCM platform is encrypted using AES-256 standards.

Verify the use of TLS 1.2 or higher for all data moving between the CCM software and your practice EHR.

Ensure the platform requires MFA for all staff logins to prevent unauthorized access to care plans.

The software must assign unique IDs to track individual staff actions within the CCM dashboard.

Verify that the software automatically terminates sessions after a period of inactivity to protect PHI.

The vendor must sign a Business Associate Agreement that specifically covers AI call handling and data processing.

Identify if the CCM platform uses third-party AI models and ensure they are also covered under a BAA.

The vendor should provide proof of HIPAA training for any of their employees who handle your patient data.

Review the vendor's formal plan for notifying your practice in the event of a data breach or security incident.

Ensure the contract defines how PHI is returned or securely destroyed if you terminate the software service.

AI call handlers must be programmed to verify the patient's identity before discussing CCM care details.

The system must automatically time-stamp and store patient verbal or digital consent for APCM services.

Verify that AI-generated call transcripts and recordings are stored in a HIPAA-compliant cloud environment.

AI should only sync the minimum necessary clinical data required for CCM billing and care coordination.

Any automated SMS or email must use secure links rather than sending unencrypted PHI in the message body.