HIPAA Compliance for Sleep Apnea APCM Programs Checklist

Ensure all CPAP usage data pulled from manufacturer clouds like AirView or Care Orchestrator is encrypted via TLS 1.2 or higher.

Regularly review which staff members and third-party DME providers are accessing patient compliance records and AHI data.

When generating CPAP adherence reports for APCM billing, include only the minimum necessary patient identifiers required by Medicare.

Verify that the AI call platform uses secure, authenticated API calls when fetching AHI or usage hours from the database.

Establish clear timelines for how long CPAP compliance raw data is stored within the AI call handling platform versus the EHR.

Confirm a Business Associate Agreement is in place with every DME provider sharing data for your APCM program.

AI agents must verify at least two patient identifiers, such as DOB and ZIP code, before discussing CPAP adherence or OSA symptoms.

Any recordings of AI-led sleep apnea coaching or adherence sessions must be encrypted at rest and in transit.

Use automated tools to redact sensitive health information, like social security numbers, from text transcripts of patient calls.

Provide a clear, immediate path for sleep apnea patients to opt-out of AI-driven APCM calls at any time.

Limit access to AI call logs and recordings to authorized sleep medicine clinical staff and compliance officers only.

Ensure AI systems do not leave detailed PHI, such as specific AHI numbers or diagnostic results, on unverified voicemail systems.

Capture and store patient consent for APCM services, specifically mentioning automated CPAP monitoring and AI outreach.

Securely log all interactions regarding hypertension, obesity, and cardiovascular risk management related to the patient's OSA.

Track every modification made to a patient's CPAP adherence record or APCM care plan within the system.

Use encrypted portals and secure file transfer protocols when submitting CPAP compliance proof for Medicare reimbursement.

Ensure all staff managing the sleep apnea APCM program receive specialized training on remote monitoring privacy and AI security.

Maintain a specific response plan for potential data breaches involving sleep study results or CPAP compliance data.