HIPAA Compliance for APCM: Tile Health vs Phamily

Ensure both platforms utilize AES-256 encryption for data at rest and TLS 1.2+ for data in transit during AI call processing.

Confirm that the vendor maintains current SOC 2 Type II reports to validate security, availability, and confidentiality controls.

Compare how Tile Health and Phamily redact sensitive PHI from AI training logs to prevent accidental exposure during model tuning.

Check for mandatory MFA for all staff accessing the Phamily dashboard or Tile Health administrative console to prevent unauthorized access.

Ensure all patient data and AI processing occur on US-based servers to comply with standard healthcare security expectations.

Confirm the BAA specifically covers AI-generated voice data for Tile Health or the human-in-the-loop interactions used by Phamily.

Identify any third-party AI models (like GPT-4 or Whisper) used by the platforms and ensure they are covered under the BAA.

Verify that the platform's insurance covers data breaches resulting from AI automation errors or platform vulnerabilities.

Ensure the AI automatically generates logs that meet the 20-minute minimum requirement for APCM billing without manual staff entry.

For Phamily's augmented model, ensure their staff—not just the software—undergo regular HIPAA and security awareness training.

Verify that Tile Health's AI uses at least two patient identifiers before discussing health information during an outbound call.

Implement a system to track and honor patient preferences for AI voice calls versus human care manager outreach via Phamily.

Ensure all SMS or chat engagement initiated by the AI platform is conducted through secure, encrypted links or HIPAA-compliant portals.

Confirm that any recordings used for AI quality assurance are stored in a HIPAA-compliant manner with restricted access logs.

Ensure patients can easily opt-out of AI-driven care management, with the platform immediately updating the EHR to prevent further contact.

Review the use of FHIR or HL7 interfaces to ensure secure, real-time data exchange between the EHR and Tile Health or Phamily.

Verify that the platform provides detailed logs showing which AI processes or staff members accessed specific patient charts.

Ensure Tile Health's automated documentation into the EHR doesn't overwrite existing clinical notes without an audit trail.

Confirm that the AI platform only requests access to the specific EHR fields required for APCM and chronic care management.

Review how the platform handles data discrepancies between the AI's patient interaction and the existing EHR data.