HIPAA Compliance for NextGen APCM Programs Checklist

Use NextGen System Administrator settings to limit APCM care management documentation access to specifically authorized clinical staff.

Activate and regularly review NextGen audit logs to track every instance of user access to APCM-eligible patient records and billing data.

Require MFA for all users accessing NextGen Mobile and the Desktop EHR to secure remote APCM monitoring activities.

Configure NextGen PM global settings to automatically log off users after 10 minutes of inactivity to prevent unauthorized office access.

Ensure care managers working remotely use a HIPAA-compliant VPN or secure VDI to connect to the NextGen database.

Verify that a comprehensive Business Associate Agreement is signed with any AI call center provider integrated via NextGen API.

Limit the NextGen Mirth or API credentials to only the specific data fields required for APCM outreach and scheduling.

Confirm that all AI-handled APCM patient calls are recorded and stored using AES-256 encryption at rest and in transit.

Program AI voice assistants to verify at least two patient identifiers before discussing APCM care plans or chronic conditions.

Use the NextGen Patient Portal for sharing detailed care plans rather than unencrypted email or standard SMS messaging.

Store patient consent for APCM services within the NextGen EHR 'Consent' module or as a specific document type in the chart.

Utilize the NextGen Care Management module to automatically log time spent on non-face-to-face APCM activities for audit readiness.

Setup NextGen PM to automatically apply the required modifiers for APCM codes (G0511) to ensure clean, compliant claims.

Establish a policy in NextGen to lock APCM encounter notes within 48 hours to prevent retrospective edits that compromise data integrity.

Validate that NextGen Population Health filters only export the minimum necessary data for identifying APCM candidates.