HIPAA Compliance for APCM: Medicare Chronic Care FAQ Guide

PHI is protected through data minimization, where only necessary information is used for the call, and through secure API integrations that ensure patient data is never stored on unencrypted local devices or non-compliant servers.

Voice recordings containing PHI must be encrypted and stored in a secure environment. Access must be restricted to authorized personnel, and the system should allow for automated deletion based on the practice’s retention policy.

Advanced AI systems used for APCM can be configured to automatically identify and redact highly sensitive PHI from transcripts and logs, reducing the risk of exposure while still maintaining accurate care management records.

Your Notice of Privacy Practices (NPP) should be updated to reflect that patient data may be shared with Business Associates for the purpose of care management and coordination, specifically mentioning APCM activities.

Yes, texting PHI requires the patient's express consent after being informed of the risks of unencrypted communication. For APCM, it is best practice to use secure, HIPAA-compliant messaging platforms rather than standard SMS.

For patients with substance use disorder (SUD) records, APCM providers must ensure even stricter confidentiality. AI systems must be configured to flag these records to prevent unauthorized disclosure without specific Part 2 compliant consent.

A breach is the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the information. Examples include emailing unencrypted care plans or unauthorized access to call recordings.

If a Business Associate discovers a breach, they must notify the covered entity (the practice) without unreasonable delay and no later than 60 days. The practice is then responsible for notifying the affected patients and the HHS.

APCM data should be encrypted using NIST-validated cryptographic standards, such as AES-256 for data at rest and TLS 1.2 or higher for data in transit, to ensure the information is unreadable to unauthorized users.