HIPAA Compliance for FQHC APCM Programs Checklist

Ensure all voice-to-text transcriptions of APCM outreach calls are encrypted at rest and in transit using AES-256 or higher.

Verify that AI call center platforms use secure OAuth2 or HL7 FHIR protocols for syncing APCM documentation with eClinicalWorks or NextGen.

Assign unique credentials to FQHC staff accessing the AI dashboard to track who is reviewing chronic care management logs.

Configure AI dashboards to log out users after 15 minutes of inactivity to prevent unauthorized access in busy clinic environments.

Enable detailed logging of every automated patient touchpoint, including the date, time, and specific PHI accessed by the AI.

Execute a Business Associate Agreement that specifically addresses AI data processing and FQHC-specific liability for PPS billing data.

Audit the AI vendor's sub-processors (e.g., cloud hosting or LLM providers) to ensure they are also HIPAA compliant.

Align the vendor’s breach notification timeline with the FQHC’s internal compliance policy and HRSA reporting requirements.

Confirm all PHI processed by the APCM AI is stored on servers located within the United States to simplify jurisdictional compliance.

Schedule an annual SOC2 Type II report review or independent security audit of the AI call handling platform.

Ensure Notice of Privacy Practices and APCM enrollment forms are available in the top 5 languages spoken by your FQHC patient population.

Program the AI to capture and timestamp verbal consent from the patient before proceeding with APCM care coordination questions.

Provide an immediate, automated way for patients to opt-out of AI calls, ensuring this preference is synced back to the EHR.

Treat Social Determinants of Health (SDOH) data collected by AI as PHI, applying the same level of protection as clinical diagnoses.

Design AI scripts to verify patient identity using two identifiers before disclosing the nature of the chronic care outreach.

Ensure AI-captured data for APCM (e.g., blood pressure checks) is formatted to satisfy HRSA Uniform Data System (UDS) reporting.

Verify that the AI logs provide the necessary documentation to support APCM claims under the FQHC Prospective Payment System.

Ensure that discussions regarding sliding fee scales or financial eligibility during AI calls are kept strictly confidential.

Maintain a centralized log of all community resource referrals made by the AI to demonstrate comprehensive care coordination.

Conduct HIPAA training specifically focused on how staff should handle PHI generated by the APCM automation tools.