HIPAA Compliance for APCM AI Checklist | Healthcare AI Automation

Ensure all AI vendors, including LLM providers and hosting services, sign a BAA that covers all PHI processed by the automation tool.

Confirm that all patient data is encrypted using AES-256 at rest and TLS 1.2 or higher during transit between the AI and your EHR.

Validate that the AI vendor does not use your practice's specific patient data to train global models without de-identification.

Request and review the AI platform's most recent SOC 2 report to verify internal controls for security, availability, and confidentiality.

Ensure that the integration between the AI clinical agent and your EHR uses OAuth 2.0 or similar secure authentication methods.

Require MFA for all staff members accessing the AI management dashboard or reviewing automated call transcripts.

Program the AI clinical agent to verify at least two patient identifiers (e.g., DOB, zip code) before discussing APCM details.

Review automated SMS and voice scripts to ensure they do not contain sensitive diagnostic information in initial notifications.

Set the AI administration portal to automatically log out users after a period of inactivity to prevent unauthorized PHI access.

Ensure that if a patient requests a human, the AI transfers the call via a secure, encrypted SIP trunk to the clinical team.

Ensure every note generated by the AI for APCM billing is clearly labeled as 'AI-generated' and reviewed by a licensed clinician.

Enable logging for every instance the AI accesses, modifies, or transmits PHI, ensuring logs are stored for at least 6 years.

If recording AI-patient calls for quality assurance, ensure recordings are stored in a HIPAA-compliant, encrypted cloud bucket.

Create a specific protocol for notifying patients and HHS if the AI platform experiences a data leak or unauthorized access.

Verify that AI-tracked time for chronic care management aligns with CMS requirements for G0511 or similar APCM codes.