Count the vendors your practice would need to deliver round-the-clock clinical advice, a shared electronic care plan, and population-level risk stratification. If that number is greater than zero, you have Business Associate Agreements to sign before you submit your first APCM Medicare claim.

Advanced Primary Care Management is Medicare's monthly bundled payment for primary care coordination. It replaced the stopwatch model of chronic care management with a service-element model — and in doing so, it moved your compliance exposure from time logs to consent documentation, vendor contracts, and records access. This guide walks administrators, billing leads, and privacy officers through the operational build and the privacy obligations that ride along with it.

What APCM Medicare Pays For, in One Section

APCM is billed once per calendar month, per beneficiary, by a single billing practitioner who assumes responsibility for the patient's primary care. There is no minimum minutes threshold. Payment is stratified across three HCPCS G-codes based on patient complexity and Medicare status:

  • G0556 — the base level, for patients with fewer chronic conditions.
  • G0557 — the intermediate level, for patients meeting a higher chronic condition threshold.
  • G0558 — the highest level, tied to Qualified Medicare Beneficiary status alongside the chronic condition threshold.

Level selection is a documentation exercise, not a judgment call your billing staff should be making alone. Your clinical team determines and records the patient's condition count and Medicare status; your billers translate that documented determination into a code. Build the workflow so the chart supports the level before the claim goes out, not after a payer asks.

CMS bundles a defined set of service elements into that monthly payment: patient consent, an initiating visit for new patients or those not seen within three years, 24/7 access to a care team member who can access the patient's record, continuity with a designated practitioner, a comprehensive electronic care plan, management of care transitions, coordination with home- and community-based providers, enhanced digital communication methods, population-level risk stratification, and performance measurement. Check the current Physician Fee Schedule materials on CMS.gov for the operative element list and concurrent-billing restrictions before you configure anything, because APCM cannot be billed in the same month as several other care management services for the same patient.

Patient consent for APCM is not a HIPAA authorization — it is a Medicare program requirement — but it lives in your chart and it will be the first thing an auditor asks for. Your consent record needs to show that the patient was told about cost-sharing, that only one practitioner can bill APCM per month, and that the patient may stop the service at any time.

Decide now where that lives. A scanned paper form dropped into a media folder is retrievable but not reportable. A discrete field or structured note template lets you run a monthly reconciliation: every claim line matched to a dated consent record.

Assign the reconciliation to a named person. In most practices it belongs to the billing supervisor, run in the first week of the month against the prior month's claims. Any claim without a matching consent gets held, not appealed later.

Cost-sharing and QMB patients

Coinsurance and deductible apply to APCM the way they apply to other Part B services, which means patients will see a monthly line item they did not expect. Your front desk will field those calls. Give them a two-sentence script and a named escalation contact, because "I don't know what this charge is" is how a care management program loses half its panel in the first quarter.

QMB billing protections prohibit charging cost-sharing to qualified beneficiaries. Confirm your eligibility verification process flags QMB status before statements generate, not after.

24/7 Access Means You Just Added a Business Associate

Almost no independent practice staffs its own overnight clinical line. So the 24/7 access element gets met with an answering service, a nurse triage vendor, or a contracted after-hours group — and every one of those arrangements involves a third party creating, receiving, or maintaining protected health information on your behalf.

That is the textbook definition of a business associate. HHS's business associate guidance is unambiguous: the agreement has to be in place before PHI flows, and the covered entity remains accountable for what the associate does with the data.

The wrinkle specific to APCM is that CMS expects the after-hours contact to have access to the patient's electronic record. An answering service that only takes messages does not satisfy the element. An answering service with a read-only EHR login absolutely handles PHI, and its BAA needs to reflect record access, not just call handling.

Five questions before you sign the after-hours contract

  1. Where are the call agents physically located, and does any portion of the work sit offshore? Offshore handling is not prohibited, but it changes your risk analysis and may conflict with payer contracts.
  2. How is EHR access provisioned and deprovisioned when an agent leaves? Ask for the termination SLA in hours.
  3. Are call recordings retained, and for how long? Recordings containing PHI are discoverable and breach-reportable.
  4. Does the vendor subcontract any portion of overnight coverage? Subcontractors need their own downstream agreements.
  5. What is the notification timeline for a suspected breach, and does it give you enough runway to meet your own 60-day obligation?

If you are standing up two or three of these relationships at once and your current template is a decade old, generate a clean, signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase, not another subscription line on your vendor spend report, and it gets the paperwork done before the first call is routed.

Population-Level Management Pushes PHI Out the Door

The risk stratification element is where the data volume lives. Somebody has to segment your Medicare panel by condition burden, utilization, and gaps in care — and in most practices, that means a nightly or weekly extract to an analytics platform, a health information exchange feed, or an ACO's population health tool.

Apply minimum necessary at the extract level, not the report level. Ask your vendor what fields the stratification model actually consumes. If the answer includes full narrative notes and the model only uses problem list, claims, and demographics, you are sending more PHI than the purpose requires and expanding the blast radius of any incident on the vendor's side.

Two contract terms deserve specific attention. First, prohibit any use of your data for the vendor's own product development, benchmarking, or de-identified resale unless you have affirmatively agreed to it in writing. Second, confirm the vendor cannot use PHI for marketing to your patients — enrollment outreach performed on your behalf is treatment or health care operations; a vendor cross-selling its own services is not.

The Care Plan Lands in the Designated Record Set

APCM requires a comprehensive electronic care plan available to the care team and to the patient. That plan is used to make decisions about the individual, which puts it squarely inside your designated record set — even if it physically lives in a care management platform your EHR does not own.

Which means the 30-day clock in the HIPAA right of access applies to it. When a patient requests their chart, your records staff needs to know the care plan exists in a second system and needs a documented method to retrieve and produce it.

Test this before you go live. Have your privacy officer submit a dummy access request and time how long it takes to produce a complete record including the care plan, care team communications, and any patient-reported data collected through the platform. If the answer is "we'd have to ask the vendor," you have an access-request failure waiting for a complaint to OCR — and right-of-access cases remain one of the most consistently enforced areas in HHS's portfolio.

Amendment requests follow the same logic

A patient who disputes something in the care plan has a right to request amendment. Your amendment procedure needs to name who edits the care management platform and how the amendment or denial propagates back to the EHR. Write it down now; do not improvise it during a live request.

Documenting Service Elements With No Time Clock

Losing the minutes requirement does not lower your documentation burden — it changes its shape. Under chronic care management, your audit defense was a time log. Under APCM Medicare billing, your audit defense is evidence that the service elements were actually available and delivered.

Build a monthly attestation record that captures, at minimum: consent on file, the designated billing practitioner, the level determination and its clinical basis, the date the care plan was last reviewed or updated, and any care coordination activity performed. Make these discrete and reportable so you can produce a panel-wide export on request rather than opening 400 charts.

Keep the practice-level evidence too: your after-hours coverage contract, the coverage schedule, your risk stratification methodology, and your performance measurement pathway. When a contractor asks how you met the 24/7 element for a specific month, you want a document, not a recollection.

Audit Requests Are Permitted Disclosures — Log Them Anyway

Responding to a records request from a Medicare Administrative Contractor, RAC, or UPIC is a permitted disclosure for payment and health oversight purposes. You do not need patient authorization. You do need to send only what was requested.

The common failure is over-disclosure: someone exports an entire longitudinal record when the request covered three claim dates. That is a minimum necessary problem, and it is entirely self-inflicted. Route audit responses through one trained person with a checklist that includes scope verification, transmission method, and a log entry.

A 30-Day Rollout Sequence

  • Days 1–5: Inventory every vendor the program will touch — after-hours coverage, analytics, care management platform, patient messaging. Confirm which have current BAAs and which do not.
  • Days 6–12: Execute missing agreements. No data flows before signature.
  • Days 13–18: Build the consent workflow and level-determination template in the EHR. Run five test patients end to end.
  • Days 19–23: Update your notice of privacy practices if new data flows warrant it, and update your risk analysis to reflect the new systems and the new PHI paths. If your risk analysis is a spreadsheet from 2022, automating the risk analysis and policy set is faster than rebuilding it by hand.
  • Days 24–27: Train front desk on the cost-sharing script and records staff on retrieving the care plan.
  • Days 28–30: Run the first monthly reconciliation as a dry run before any claim is submitted.

Start With the Paperwork That Gates Everything Else

Every other step in an APCM Medicare rollout is blocked by one thing: whether the third parties handling your patients' data are under contract. Get the agreements executed first, then build the workflow on top of them.

If you need agreements drafted this week rather than next quarter, build your Business Associate Agreement here — six steps, PDF and DOCX export, one-time purchase. Sign it before the first extract runs.