HIPAA Compliance Checklist for APCM in Epic EHR

Limit access to APCM registries and care plans to authorized clinical staff only via specific security points in Hyperspace.

Regularly review the 'Audit Record' for unauthorized access to chronic care management and APCM patient lists.

Ensure that caregivers accessing APCM care plans via MyChart have verified and documented proxy permissions on file.

Enable 'Break-the-Glass' for sensitive patient populations enrolled in high-touch APCM programs to track emergency access.

Configure automatic log-outs for workstations used by care managers to prevent unauthorized EHR access in clinical areas.

Verify that AI call center integrations use OAuth 2.0 and encrypted FHIR endpoints for all data exchange tasks.

Ensure all voice-to-text data from APCM outreach calls is encrypted in transit before being filed back to the Epic chart.

Confirm a current Business Associate Agreement is in place with any AI vendor handling Epic patient identifiers for APCM.

Use Epic's SlicerDicer or Cogito with strict de-identification protocols when analyzing APCM program performance metrics.

Ensure AI-triggered MyChart messages do not include PHI in the external email or SMS notification sent to the patient.

Use Epic SmartForms to capture and time-stamp patient consent for APCM services to meet both HIPAA and CMS rules.

Set specific visibility levels for APCM care plans to ensure they are only shared with the defined care team members.

If recording APCM calls for quality assurance, ensure recordings are stored in a HIPAA-compliant repository linked to Epic.

Honor 'Do Not Call' or 'Opt-Out' flags within the Epic Patient Header during all automated AI outreach attempts.

Cross-reference AI call logs with Epic's 'Communication Management' activity to ensure data consistency and privacy.