HIPAA Compliance for Pulmonology APCM Programs Checklist

Ensure all AI-handled calls regarding COPD exacerbations or inhaler refills use TLS 1.2+ encryption during transit.

Encrypt PFT results, oxygen saturation logs, and sleep study data at rest using AES-256 standards.

Execute a formal Business Associate Agreement with any AI vendor handling chronic respiratory patient interactions.

Configure AI systems to avoid stating specific pulmonary diagnoses or medication names in unencrypted voicemails.

Ensure automated hand-offs to Respiratory Therapists occur via encrypted internal messaging or secure EMR portals.

Limit access to pulmonary rehab and smoking cessation data to only authorized clinical staff and billing managers.

Require MFA for all staff accessing the APCM dashboard or AI call logs containing patient PHI.

Assign individual credentials to every Respiratory Therapist and staff member to track data access for audit logs.

Configure APCM software to log out users after inactivity to prevent unauthorized access in busy pulmonary clinics.

Use secure VPNs or zero-trust frameworks for staff monitoring oxygen therapy patients from remote locations.

Program the AI to obtain and log verbal consent before discussing APCM benefits or COPD symptoms over the phone.

Establish a clear process for patients to opt-out of automated APCM check-ins and update preferences in the EMR.

Update the practice NPP to include how AI and third-party APCM tools manage respiratory health data.

Use AI to verify at least two patient identifiers before discussing inhaler adherence or lab results.

Ensure all automated interactions confirming APCM enrollment are time-stamped and saved to the patient record.