ModMed HIPAA Compliance: APCM Program Checklist

Ensure all third-party AI call handlers use secure OAuth tokens for ModMed access to prevent unauthorized data breaches.

Track every user and system access point within the ModMed APCM documentation module to maintain a HIPAA-required audit trail.

Confirm signed Business Associate Agreements are on file for all AI call handling and APCM automation vendors.

Verify that chronic care patient lists exported for APCM outreach are encrypted on all local servers and cloud environments.

Limit APCM billing and chronic care documentation access to authorized clinical staff within the ModMed user settings.

Ensure only authorized ModMed endpoints are accessible by external automation tools to minimize the attack surface.

Use de-identified data when testing ModMed APCM integrations or training staff on new chronic care workflows.

Use the ModMed Patient Portal to document patient agreement for APCM services and acknowledgment of cost-sharing.

Ensure AI-driven chronic care calls are transcribed and stored in a HIPAA-compliant cloud that integrates with ModMed.

Require MFA for any staff member or care manager accessing the ModMed APCM billing dashboard from remote locations.

Program AI call handlers to verify at least two patient identifiers before discussing chronic disease care plans or medications.

Use ModMed's time-tracking features to log the required 20 minutes of care coordination for APCM billing codes.

Ensure any missed APCM outreach calls or voicemails are stored in encrypted, ModMed-compatible storage systems.

Provide patients with easy access to their chronic care plans and APCM logs via the ModMed portal to meet HIPAA access rules.

Review ModMed templates for dermatology or orthopedics to ensure they meet CMS APCM documentation criteria.

Securely document communications between specialists and primary care teams within the ModMed patient chart.

Regularly audit billing logs for codes G0511 and G0512 to prevent unbundling or duplicate billing within ModMed.

Ensure all APCM-related messages sent via ModMed are encrypted and routed only to the assigned chronic care manager.

Maintain HIPAA-compliant backups of all APCM patient outreach logs and specialty care plans outside of the main EHR.

Ensure virtual APCM check-ins are preceded by a documented telehealth consent form stored in the ModMed document folder.

Conduct annual HIPAA training specifically focused on chronic care outreach and ModMed APCM data entry protocols.