HIPAA Compliance: Tile Health vs ChronicCareIQ for APCM

Ensure both Tile Health and ChronicCareIQ utilize AES-256 encryption for all stored patient records and APCM call logs.

Confirm that data moving between the practice EHR and the APCM platform uses TLS 1.3 or higher to prevent interception.

Tile Health must ensure AI models are isolated per tenant so practice data isn't used to train global models; compare this to ChronicCareIQ’s database structure.

Confirm both providers use HITRUST-certified or SOC2 Type II compliant cloud hosting environments like AWS or Azure.

Assess how long APCM interaction data is stored and the security of off-site backups for disaster recovery and compliance.

Ensure MFA is mandatory for all staff accessing the Tile Health dashboard or ChronicCareIQ portal to prevent credential theft.

Define specific roles for clinical staff vs. administrators to limit PHI exposure based on necessity within the CCM workflow.

Tile Health's AI call logs must be auditable to track who accessed recordings or transcripts of APCM patient calls.

Ensure the platform automatically logs out inactive users to prevent unauthorized access at shared clinical workstations.

Evaluate if the platform integrates with your existing identity provider for centralized management of APCM staff access.

Ensure Tile Health's AI accurately verifies patient identity (e.g., DOB, Zip) before discussing APCM care plans on the phone.

Confirm that all voice recordings of APCM interactions are stored in HIPAA-compliant repositories, not general cloud storage.

Check that Tile Health’s transcription accurately captures PHI for APCM documentation without leaking data to third-party APIs.

Verify that the system captures and logs patient consent for receiving automated APCM outreach calls and AI voice interaction.

Determine if the AI can automatically redact sensitive non-medical info from APCM call transcripts before they are saved.