Why Secure Messaging Now Belongs in Medicare Primary Care Operations

The Centers for Medicare & Medicaid Services (CMS) now requires practices that bill for Advanced Primary Care Management (APCM) services to offer patients an asynchronous communication option in addition to phone calls. 

The options include secure messaging, email, and patient portals.

The requirement recognizes a basic truth—primary care doesn't end when the patient leaves the exam room.

Patients still ask medication questions, report new symptoms, share recovery updates, and ask what to do between visits long after they've returned home.

With secure messaging as part of modern primary care operations, the biggest question then becomes—how can practices use it securely, manage responses, and document patient conversations correctly?

In addition, how can they protect patient information and set boundaries for urgent concerns?

A well-designed APCM secure messaging workflow brings these responsibilities together. 

What follows is a walkthrough of who this requirement applies to, how to create the workflow, and how iPlum’s HIPAA-compliant texting gives practices a secure mobile channel for patient communication.

‍

‍

Table of Contents

‍

1. Who must meet the APCM communication requirement?

2. What does CMS require for APCM communication?

3. Why phone-first workflows are no longer enough

4. What should an APCM secure messaging workflow address?

5. How iPlum brings secure messaging into APCM operations 

6. Build your APCM secure messaging with iPlum baked in

‍

‍

Who must meet the APCM communication requirement?

The APCM communication requirement does not apply to every practice that treats Medicare patients. 

It applies when an eligible practitioner bills Medicare for APCM services. CMS allows these practitioners to bill once per patient during a calendar month when they meet the relevant service requirements.

An APCM billing practitioner must:

• Be a physician, nurse practitioner, physician assistant, or clinical nurse specialist.
• Be responsible for all primary care services the patient receives.
• Serve as the continuing focal point for the patient’s healthcare needs.
• Obtain written or verbal consent before starting APCM services and record it in the medical record.
• Use the APCM code that matches the patient’s medical and social complexity: G0556, G0557, or G0558.

CMS says these codes are primarily intended for general internal medicine, family medicine, geriatric medicine, and pediatric care. 

However, eligibility depends on the practitioner’s responsibility for the patient’s primary care, not on the practice name alone.

Once a practitioner bills APCM, enhanced communication becomes part of the required service model when clinically appropriate. 

The practice must offer an asynchronous consultation method other than phone calls. Secure messaging is one accepted option.

‍

‍

What does CMS require for APCM communication?

CMS treats APCM communication as more than secure messaging. Practices must provide 24/7 access for urgent needs and offer digital options for nonurgent care. 

They must have the capabilities below available when clinically appropriate, although they do not have to furnish every APCM service every month.

24/7 access and continuity of care

Practices must:

• Allow patients or caregivers with urgent needs to contact the billing practitioner or another authorized care professional at any time.
• Give the responding professional real-time access to the patient’s medical information.
• Allow patients to schedule future routine appointments with a designated practitioner.
• Offer care outside traditional office visits, such as home visits or expanded hours.

Enhanced communication opportunities

Practices must also:

• Offer an asynchronous consultation method other than phone calls, such as secure messaging, email, internet communication, or a patient portal.
• Conduct remote evaluations of prerecorded patient information.
• Receive patient-initiated digital communication that requires a clinical decision, such as virtual check-ins, online assessments, or e-visits.

Secure messaging addresses the asynchronous consultation requirement, but it does not replace the separate 24/7 urgent-access responsibility. 

Therefore, the workflow must tell patients when to send a message, where to send urgent concerns, who reviews each request, and how clinicians record decisions and follow-ups.

‍

‍

Why phone-first workflows are no longer enough

A phone call remains appropriate when a patient needs urgent guidance or when a clinician must discuss a complex issue. 

However, a phone-first workflow requires patients and clinicians to be available at the same time. As a result, routine questions can turn into repeated callbacks, voicemail exchanges, and long delays.

Common problems are:

• Missed connections: A patient misses the return call, calls back, and reaches voicemail again.
• Limited context: Clinicians may receive a brief voicemail with too little information to assess the request.
• Incomplete documentation: Phone conversations may go unrecorded unless the clinician documents them in the medical record.
• Unassigned message ownership: A voicemail may remain in one inbox when the intended practitioner is unavailable.
• Personal number exposure: Clinicians who return calls from personal phones can expose private contact information.

Meanwhile, secure messaging gives routine patient questions a written channel. With text SMS, patients can send information as issues arise, and authorized professionals can review, route, and document the conversation.

Indeed, phone calls still serve urgent and complex needs. However, secure messaging gives practices another channel for routine communication between appointments.

‍

‍

What should an APCM secure messaging workflow address?

Secure messaging requires more than choosing a communication platform. Practices must define how the channel operates before inviting patients to use it.

An APCM secure messaging workflow must answer four questions:

• Which patient messages belong in the secure channel?
• Who reviews incoming messages, and when should they respond?
• Which concerns require escalation to a call, appointment, or emergency service?
• How will the practice protect and document each patient conversation?

The following four steps explain how to establish these rules.

Step 1: Define how patients should use secure messaging

Begin by deciding which messages belong in the secure channel. A channel with no stated purpose can attract emergency requests, vague questions, and administrative messages in the same queue.

Written instructions should tell patients when secure messaging is appropriate and when they need another contact method.

Suitable uses are:

• Nonurgent medication questions and prescription refill requests.
• Follow-up questions after an appointment or hospital discharge.
• Updates about symptoms that do not require immediate assessment.
• Blood pressure, glucose, weight, or other home readings requested by a clinician.
• Questions about referrals, care plans, preventive services, or appointment preparation.
• Photos and documents, when the practice permits attachments.

Patients should not use secure messaging for:

• Chest pain, breathing difficulty, severe bleeding, stroke symptoms, or another medical emergency.
• Symptoms that are becoming worse and require immediate attention.
• A complex concern that requires an examination or real-time conversation.

Give patients these instructions during APCM enrollment. In addition, place them in the welcome message and automated reply.

State when the practice reviews messages, the expected response period, the urgent contact number, and when to call 911. Also, explain whether caregivers can send messages and which attachments the practice accepts.

Defining the channel's purpose from the beginning protects patients and prepares the practice to create routing and escalation rules.

Step 2: Assign message ownership and response times

A secure messaging channel cannot work if authorized professionals assume another person is monitoring the inbox. Therefore, assign responsibility for all published messaging hours and designate a backup for any absences.

Routing rules should state:

• Who monitors new messages during each shift or business day.
• Who takes over when the assigned person is unavailable.
• Which administrative messages go to scheduling, billing, or referral personnel.
• Which medication, symptom, and care-plan questions require clinician review.
• How users mark messages as new, under review, awaiting information, or resolved.
• When unanswered messages move to another authorized professional.

Next, define response targets. APCM requirements do not set a universal reply time for secure messaging. Therefore, the practice should choose time frames based on its operating hours, available personnel, and clinical policies.

For example, the practice may:

• Send an automated acknowledgment as soon as a message arrives.
• Respond to administrative questions within one business day.
• Review routine clinical questions by the end of the next business day.
• Review symptom updates received during business hours on the same day.

An automated acknowledgment should state that the practice has received the message. However, it should not imply that a clinician has reviewed it.

While at it, tell patients the expected response period during enrollment and repeat it in the automated acknowledgment. Once the practice defines who reviews each message and by when, it can establish rules for urgent concerns. 

Step 3: Set escalation rules for urgent concerns

Not every message can wait for the standard response period. Therefore, create written triage rules that guide authorized professionals in classifying and escalating patient concerns.

Divide incoming messages into three categories:

• Emergency: Chest pain, severe breathing difficulty, stroke symptoms, heavy bleeding, loss of consciousness, or another life-threatening concern.
• Urgent: Worsening symptoms, medication reactions, post-discharge problems, or concerns that require same-day clinical review.
• Routine: Refill requests, nonurgent medication questions, home readings, care-plan questions, and appointment preparation.

Next, define the required action for each category.

An emergency message should trigger the practice’s emergency procedure. Depending on the situation, the assigned professional may need to call the patient, contact emergency services, or take other action in accordance with the practice’s clinical policy.

Meanwhile, an urgent message should move to an authorized clinician for same-day review. The clinician can then decide whether to reply, call the patient, arrange an appointment, or recommend urgent care.

An automated reply should tell patients that secure messaging is not an emergency channel. It should also provide the 24/7 urgent contact number and instruct patients to call 911 during an emergency.

However, an automated warning does not absolve the practice of its responsibility after an authorized professional has read an urgent message.

Finally, train all users to recognize concerning symptoms, record the escalation, and confirm that the patient received further instructions.

Step 4: Protect and document patient conversations

An APCM secure messaging workflow must protect electronic protected health information and preserve clinically relevant communication.

The HIPAA Security Rule requires regulated healthcare organizations to apply administrative, physical, and technical safeguards to electronic protected health information.

Before using a messaging platform, practices should:

• Enter into a Business Associate Agreement with a provider that creates, receives, maintains, or transmits electronic protected health information. HHS explains the BAA requirement here.
• Use encrypted communication rather than ordinary SMS for protected patient information.
• Give every authorized user an individual account.
• Limit access according to job responsibilities.
• Require secure passwords and, when available, multifactor authentication.
• End account access promptly after a role change or departure.
• Record account activity through audit logs.
• Protect mobile devices with screen locks and other approved security settings.
• Verify a caregiver's authority before discussing a patient's care.

Next, create a documentation standard. The record should state:

• When the patient sent the message.
• Who reviewed and answered it.
• What concern the patient reported.
• What clinical decision or instruction followed.
• Whether the message moved to a call, appointment, or emergency procedure.
• When the practice resolved the request.

Clinically significant information should also be documented in the patient's medical record or care plan. A messaging archive preserves the conversation, but it does not replace the medical record.

In addition, retain messages according to applicable federal, state, payer, and practice requirements. Once the privacy and documentation rules are established, the practice can choose a secure messaging platform that follows the workflow.

‍

‍

What should an APCM secure messaging workflow address?

Secure messaging requires more than choosing a communication platform. Practices must define how the channel operates before inviting patients to use it.

An APCM secure messaging workflow must answer four questions:

• Which patient messages belong in the secure channel?
• Who reviews incoming messages, and when should they respond?
• Which concerns require escalation to a call, appointment, or emergency service?
• How will the practice protect and document each patient conversation?

The following four steps explain how to establish these rules.

Step 1: Define how patients should use secure messaging

Begin by deciding which messages belong in the secure channel. A channel with no stated purpose can attract emergency requests, vague questions, and administrative messages in the same queue.

Written instructions should tell patients when secure messaging is appropriate and when they need another contact method.

Suitable uses are:

• Nonurgent medication questions and prescription refill requests.
• Follow-up questions after an appointment or hospital discharge.
• Updates about symptoms that do not require immediate assessment.
• Blood pressure, glucose, weight, or other home readings requested by a clinician.
• Questions about referrals, care plans, preventive services, or appointment preparation.
• Photos and documents, when the practice permits attachments.

Patients should not use secure messaging for:

• Chest pain, breathing difficulty, severe bleeding, stroke symptoms, or another medical emergency.
• Symptoms that are becoming worse and require immediate attention.
• A complex concern that requires an examination or real-time conversation.

Give patients these instructions during APCM enrollment. In addition, place them in the welcome message and automated reply.

State when the practice reviews messages, the expected response period, the urgent contact number, and when to call 911. Also, explain whether caregivers can send messages and which attachments the practice accepts.

Defining the channel's purpose from the beginning protects patients and prepares the practice to create routing and escalation rules.

Step 2: Assign message ownership and response times

A secure messaging channel cannot work if authorized professionals assume another person is monitoring the inbox. Therefore, assign responsibility for all published messaging hours and designate a backup for any absences.

Routing rules should state:

• Who monitors new messages during each shift or business day.
• Who takes over when the assigned person is unavailable.
• Which administrative messages go to scheduling, billing, or referral personnel.
• Which medication, symptom, and care-plan questions require clinician review.
• How users mark messages as new, under review, awaiting information, or resolved.
• When unanswered messages move to another authorized professional.

Next, define response targets. APCM requirements do not set a universal reply time for secure messaging. Therefore, the practice should choose time frames based on its operating hours, available personnel, and clinical policies.

For example, the practice may:

• Send an automated acknowledgment as soon as a message arrives.
• Respond to administrative questions within one business day.
• Review routine clinical questions by the end of the next business day.
• Review symptom updates received during business hours on the same day.

An automated acknowledgment should state that the practice has received the message. However, it should not imply that a clinician has reviewed it.

While at it, tell patients the expected response period during enrollment and repeat it in the automated acknowledgment. Once the practice defines who reviews each message and by when, it can establish rules for urgent concerns. 

Step 3: Set escalation rules for urgent concerns

Not every message can wait for the standard response period. Therefore, create written triage rules that guide authorized professionals in classifying and escalating patient concerns.

Divide incoming messages into three categories:

• Emergency: Chest pain, severe breathing difficulty, stroke symptoms, heavy bleeding, loss of consciousness, or another life-threatening concern.
• Urgent: Worsening symptoms, medication reactions, post-discharge problems, or concerns that require same-day clinical review.
• Routine: Refill requests, nonurgent medication questions, home readings, care-plan questions, and appointment preparation.

Next, define the required action for each category.

An emergency message should trigger the practice’s emergency procedure. Depending on the situation, the assigned professional may need to call the patient, contact emergency services, or take other action in accordance with the practice’s clinical policy.

Meanwhile, an urgent message should move to an authorized clinician for same-day review. The clinician can then decide whether to reply, call the patient, arrange an appointment, or recommend urgent care.

An automated reply should tell patients that secure messaging is not an emergency channel. It should also provide the 24/7 urgent contact number and instruct patients to call 911 during an emergency.

However, an automated warning does not absolve the practice of its responsibility after an authorized professional has read an urgent message.

Finally, train all users to recognize concerning symptoms, record the escalation, and confirm that the patient received further instructions.

Step 4: Protect and document patient conversations

An APCM secure messaging workflow must protect electronic protected health information and preserve clinically relevant communication.

The HIPAA Security Rule requires regulated healthcare organizations to apply administrative, physical, and technical safeguards to electronic protected health information.

Before using a messaging platform, practices should:

• Enter into a Business Associate Agreement with a provider that creates, receives, maintains, or transmits electronic protected health information. HHS explains the BAA requirement here.
• Use encrypted communication rather than ordinary SMS for protected patient information.
• Give every authorized user an individual account.
• Limit access according to job responsibilities.
• Require secure passwords and, when available, multifactor authentication.
• End account access promptly after a role change or departure.
• Record account activity through audit logs.
• Protect mobile devices with screen locks and other approved security settings.
• Verify a caregiver's authority before discussing a patient's care.

Next, create a documentation standard. The record should state:

• When the patient sent the message.
• Who reviewed and answered it.
• What concern the patient reported.
• What clinical decision or instruction followed.
• Whether the message moved to a call, appointment, or emergency procedure.
• When the practice resolved the request.

Clinically significant information should also be documented in the patient's medical record or care plan. A messaging archive preserves the conversation, but it does not replace the medical record.

In addition, retain messages according to applicable federal, state, payer, and practice requirements. Once the privacy and documentation rules are established, the practice can choose a secure messaging platform that follows the workflow.

‍

‍

How iPlum brings secure messaging into APCM operations 

After setting rules for patient messages, response times, urgent concerns, and documentation, a practice needs a secure channel to carry out the workflow.

iPlum gives clinicians a separate business line on their existing smartphones, along with encrypted patient texting, calling, user permissions, and message archiving.

More specifically, iPlum allows your practice to:

Add a secure business line to existing smartphones

With an iPlum secure second line, practices can separate patient communication from personal calls, texts, and contacts. The setup allows clinicians to communicate through an established practice identity while protecting their personal numbers.

Furthermore, if a message requires real-time discussion, they can call the patient through the same business line.

Create encrypted conversations with patients

Clinicians can move medication questions, symptom updates, home readings, post-discharge follow-ups, and approved attachments into an iPlum secure patient texting channel instead of ordinary SMS.

iPlum encrypts these conversations from sender to recipient and provides a Business Associate Agreement as part of its HIPAA service. Better yet, patients can reply through a free iPlum account or a secure app-less online portal.

Consequently, your practice can offer the asynchronous communication required under APCM while maintaining a protected message history.

Manage responses from mobile and web

iPlum allows authorized users to review messages through its mobile app or web portal. 

The platform’s collection of texting features lets the designated inbox owner send automatic acknowledgments, add signatures, mark conversations unread, pin priority discussions, and create templates.

What’s more, the iPlum multi-user account allows administrators to add users and restrict permissions. That way, practices can apply the ownership, access, and response rules established earlier in the workflow.

Preserve patient communication records

Step 4 of creating an APCM secure messaging workflow requires your practice to preserve patient conversations and record clinically significant decisions. iPlum’s text archiving provides the message history needed for that process.

The Professional plan stores texts for one rolling year, whereas the Enterprise plan provides a 10-year rolling archive. 

With iPlum, authorized administrators can review usage logs and download text records to complete internal reviews or respond to documentation requests.

The archive shows what the patient sent and how the practice responded. 

However, it does not replace the medical record. Clinicians must still transfer diagnoses, treatment decisions, medication instructions, and follow-up actions into the EHR or care plan. 

That said, iPlum can integrate call and message usage logs with external EHR systems through its REST API.

‍

‍

Build your APCM secure messaging with iPlum baked in

Building an APCM secure messaging workflow begins with rules.

So, define what patients may send, assign responsibility, publish response times, route urgent concerns, and record clinical decisions.

After that, loop in iPlum to provide your practice with a secure channel to apply those rules via a separate business number, encrypted texting, mobile and web access, user permissions, message archiving, and EHR connections via its REST API.

That said, your practice remains responsible for clinical oversight, emergency access, and medical record documentation.

Sign up for iPlum today to experience HIPAA-compliant texting and create a secure patient communication channel for APCM services, while giving clinicians a separate line on their existing smartphones.

‍

Get started with iPlum

‍