HIPAA Compliance: Tile Health vs ChartSpan APCM Checklist

Ensure Tile Health's Business Associate Agreement specifically covers AI voice synthesis and automated data processing of PHI.

Confirm that Tile Health uses de-identified data for AI model refinement to prevent accidental PHI exposure in future interactions.

Review which human staff members at ChartSpan have access to your EHR and verify their background checks and HIPAA training certifications.

Ensure all administrative logins for the Tile Health platform require multi-factor authentication to prevent unauthorized clinical data access.

Evaluate how long Tile Health stores AI call transcripts versus ChartSpan's recording storage to ensure compliance with state-specific laws.

Verify that Tile Health's AI accurately logs every second of patient interaction to meet the 20-minute APCM billing threshold.

Test the security of the API connection used by Tile Health to push automated clinical summaries back into your practice's EHR.

Perform spot checks on ChartSpan's manual entries to ensure human care coordinators are not introducing errors or omitting PHI details.

Compare how Tile Health's AI verifies patient identity via voice or DOB versus ChartSpan's human-led verification protocols.

Ensure both platforms provide a clear trail of who (or what AI agent) accessed or edited a patient's care plan.

Confirm that the cloud environment hosting the AI automation has undergone rigorous independent security audits.

If using ChartSpan, verify their physical office security to prevent unauthorized viewing of patient screens by non-medical staff.

Ensure all data moving between your EHR and Tile Health or ChartSpan uses AES-256 or higher encryption protocols.

Verify that Tile Health uses private instances of LLMs so your patient data is never shared with public AI models like ChatGPT.

Schedule a yearly review of your outsourced APCM partner's security posture, whether it is AI-driven or human-staffed.