CCM/PCM Case Study: Excel to 8,000+ Patients

A US-based Chronic Care Management (CCM) and Principal Care Management (PCM) company was running their entire operation — roughly 3,200 patients at the time — out of Excel spreadsheets: patient rosters, care-minute logs, monthly progress verification, provider paycodes, invoicing, and payment tracking all lived in disconnected files with no access control, no audit trail, and no compliance posture.

The engagement started with a single goal — replace the spreadsheets. It evolved into a multi-phase platform build that eventually became a fully multi-tenant SaaS product other care coordination organizations now use independently. The operation has since scaled past 8,000 patients without the back office growing in step.

Phase 1 — Internal Operations Platform

The first version was a private internal system. The core architecture introduced RBAC (Role-Based Access Control) so each employee could only see and act on patients assigned to them. Managers had elevated access to their team's patient list. Administrators had organization-wide visibility. The platform was built to HIPAA requirements from day one: encrypted PostgreSQL storage with field-level encryption of patient identifiers (MRN/FIN), comprehensive audit logging, strict IAM policies, and API-level access controls enforced by FastAPI middleware.

Employee and manager dashboards were built as a Flutter web application with role-conditional rendering — the same codebase shows a different interface depending on who logs in. Automated report generation (Excel and PDF) was introduced early, replacing the manual monthly reporting cycle and giving operations leadership the first structured view of billing activity and employee output they had ever had.

Phase 2 — Time Tracking, Billing, and Automated Invoicing

CCM and PCM billing operates on documented time. For standard CCM, CMS requires at least 20 minutes of clinical staff care management time per patient per calendar month (CPT 99490), with an add-on code for each additional 20 minutes (99439). PCM, for a single high-risk condition expected to last at least 3 months, requires at least 30 minutes per calendar month: 99424 (physician or other qualified health professional time) and 99426 (clinical staff time) cover the first 30 minutes, with 99427 for each additional 30 minutes of clinical staff time. Every minute a care coordinator spends on a patient is a billable asset — or a compliance risk if it's undocumented.

This phase introduced per-patient time tracking at the employee level and, on top of it, fully automated invoice generation: monthly invoices are produced per clinic directly from CPT paycode counts, per provider, with Excel and PDF outputs — a process that was previously assembled by hand every month. Manager dashboards show team-level time distribution, identify patients consuming disproportionate time, and flag coordinators who are consistently underutilizing or over-extending.

Phase 3 — Predictive Scoring and Patient Reassignment

The third phase tackled a hard operational problem: by the time a manager realizes an employee isn't going to hit their monthly care-minute targets, it's often too late to do anything about it. An individual employee scoring system tracks progress against monthly targets on a rolling basis and generates a projected end-of-month coverage estimate. Employees falling behind threshold trigger alerts and surface into a reassignment workflow where managers can temporarily or permanently move patients to another coordinator to protect billing compliance. The platform also integrates with an external Remote Patient Monitoring (RPM) system, exporting enrolled-patient data so care programs stay in sync.

Phase 4 — Multi-Tenant SaaS Conversion

After the internal platform proved its value, partner organizations wanted onto the same infrastructure. The architecture was refactored from a single-tenant internal tool into a fully multi-tenant SaaS: isolated per-tenant data environments (schema-per-tenant PostgreSQL with row-level security), tenant-scoped encryption, invitation-based organization onboarding, and per-tenant role management. A care coordination organization can register, add their employees and patients, and be running the same operational infrastructure independently — in an environment designed so no tenant can reach another tenant's data.

We build comparable systems for other care-management organizations: Custom CCM, PCM & RPM operations software.

CMS time thresholds last reviewed 2026-09-25. Source: CMS MLN909188, Chronic Care Management Services.