On a normal Tuesday, a dermatology or primary care office might take four skin biopsies before lunch. Each one generates a specimen container, a requisition form, a courier handoff, a pathology report, a portal release, a claim, and — eventually — a records request. That is seven points where protected health information moves, and the 11102 CPT code sits in the middle of all of them.

This guide is written for the person who owns that chain: the practice administrator, the billing lead, the privacy officer. It covers what the code family actually describes, what documentation your coders need, and where the specimen and the claim carry PHI outside your walls. It is administrative guidance on process and documentation, not clinical guidance on which procedure to perform or which code fits a given lesion.

What the 11102 CPT Code Describes, in One Paragraph

CPT 11102 is the code for a tangential biopsy of skin — a shave, scoop, saucerize, or curette technique that removes a sample of a lesion — for a single lesion. Its add-on companion, 11103, is reported for each separate or additional lesion biopsied by that technique. Two parallel families exist: 11104 and 11105 for punch biopsy, and 11106 and 11107 for incisional biopsy. This structure replaced the older 11100/11101 pair effective January 1, 2019, and it distinguishes biopsies by technique rather than treating all skin biopsies as one code.

CPT instructions also establish a hierarchy when more than one biopsy technique is used on the same date: one primary biopsy code is reported for the highest-complexity technique performed, and the remaining biopsies are reported with the matching add-on codes. Your coders apply that hierarchy from the operative or procedure note. They do not infer it from the specimen count alone.

The distinction that drives most denials

Biopsy codes describe sampling. When a lesion is removed in its entirety by excision, destruction, or shaving for treatment purposes, CPT and the National Correct Coding Initiative address when a separate biopsy code is and is not separately reportable. Your billing team should be working from current NCCI Procedure-to-Procedure edits and the associated policy manual, published by CMS at cms.gov, rather than from a laminated card someone printed in 2019.

The Documentation Your Coders Need Before Anyone Selects a Code

Code selection is a documentation exercise. If the note does not support the technique and the lesion count, the coder should query — not guess. Build your procedure note template so that the following elements are captured every time:

  • Technique used, stated in the clinician's own words (tangential/shave, punch, incisional).
  • Anatomic site of each lesion, specific enough to distinguish separate lesions.
  • Number of distinct lesions sampled and a separate description for each.
  • Intent — whether the tissue was taken for diagnostic sampling or the lesion was removed.
  • Specimen labeling and container count, matched to the lesion descriptions.
  • Anesthesia, hemostasis, and closure, documented as performed.

Assign the query workflow to a named role. In most practices that is the certified coder or the billing supervisor, with a 48-hour turnaround target and a documented query log. The log matters twice: once for coding accuracy, and once when a payer audits and asks how your practice arrived at the codes it submitted.

Who is allowed to fix a note

Only the author amends the clinical note. Coders annotate, query, and document the response. If your EHR lets billing staff edit signed clinical documentation, that is an access-control finding, not a workflow preference. Pull the audit report on who has amendment rights and reduce it to the people whose job requires it.

Where the 11102 CPT Code Sends PHI Outside Your Building

Here is the part administrators underestimate. A single biopsy generates outbound PHI on at least four channels, and each one has a vendor behind it.

1. The pathology requisition

The requisition carries patient name, date of birth, MRN, insurance identifiers, clinical history, and the site of the lesion. It is PHI in transit on paper or through an interface. Two operational failures show up repeatedly: requisitions with a second patient's demographics carried over from a stack, and clinical history fields containing far more narrative than the pathologist needs. The second is a minimum necessary problem. Standardize the history field and train to it.

2. The courier

A courier transporting labeled specimens and paper requisitions is handling PHI on your behalf. Whether that courier is the lab's own service or an independent contractor determines who owes you a Business Associate Agreement. Ask the question in writing and keep the answer. Also ask where the vehicle sits between stops and whether requisitions travel in a sealed pouch separate from the specimen bags.

3. The pathology lab or dermatopathology group

If the lab bills the patient or payer directly under its own TIN, it is generally acting as a covered entity in its own right for that work — but the moment it performs services for your practice, hosts your results, or provides an interface, a BAA analysis is required. Practices routinely have a signed BAA with the primary reference lab and nothing on file for the specialty dermatopathology group the physician started sending cases to eighteen months ago. That gap is easy to find and easy to close.

4. The billing chain

The claim itself carries diagnosis and procedure codes, which are PHI. It moves through your practice management system, your clearinghouse, sometimes a coding contractor, and sometimes an outsourced denial-management firm. Each is a business associate. Each needs an agreement, and each needs to be on a list you can produce in under ten minutes.

Build the Vendor List Around the Specimen, Not Around the Software

Most practices build their vendor inventory from the accounts-payable ledger. That misses subcontractors and free tools. Build it instead by tracing one biopsy end to end and writing down every organization that touched the data. For a typical biopsy encounter you should end up with the EHR vendor, the practice management vendor, the reference lab, the dermatopathology group, the courier, the clearinghouse, the patient portal or secure messaging provider, the transcription or documentation-assistance tool if one is in use, the release-of-information vendor, and the shredding service that destroys the paper requisition copies.

For every name on that list, you need a current, signed Business Associate Agreement with the required elements — permitted uses, safeguards, subcontractor flow-down, breach notification timelines, and return or destruction of PHI at termination. If you have vendors operating without one, or on a two-page agreement that predates the Omnibus Rule, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase, and it is considerably faster than chasing a lab's legal department for a template they will send you in six weeks.

The Results Loop: Portal Release, Cures Act, and Angry Phone Calls

The pathology report comes back and immediately creates a second set of obligations. Under the information blocking rules, your practice cannot delay or restrict access to electronic health information without an applicable exception. HHS and ONC maintain the current framework at healthit.gov, and the practices most exposed are the ones still running an informal "hold pathology results for 72 hours so the doctor can call first" policy that no one has documented or evaluated against an exception.

Decide this deliberately and write it down. Who reviews incoming pathology? What is the target turnaround for clinician notification? What is your documented basis if any result is delayed in the portal? Front desk staff need a script for the patient who calls having read a report before the clinician saw it, and that script cannot be "I can't discuss that."

Results routing failures are a breach category

Pathology reports filed to the wrong chart, faxed to a prior referring provider, or mailed to a stale address are among the most common small-practice incidents. Assign a weekly reconciliation: every specimen logged out should have a matching result logged in, with a named owner and an escalation path for anything outstanding past the lab's stated turnaround.

When a Patient Asks for the Biopsy Report

The right of access clock is 30 days from receipt of the request, with one 30-day extension available if you notify the patient in writing of the reason and the expected date. HHS guidance on individuals' right of access is the controlling reference, and enforcement in this area has been persistent for years.

For biopsy encounters, the request usually spans two record sets: your clinical note and the pathology report. If the report lives only in the lab's system and not in your chart, you still hold it if it is in your designated record set. Confirm where your practice's copy resides and whether your release-of-information vendor can retrieve it. Fees must be limited to the reasonable, cost-based amounts permitted under the rule.

Quick Answer: What Is the 11102 CPT Code Used For?

CPT 11102 reports a tangential skin biopsy — shave, scoop, saucerize, or curette technique — of a single lesion. Code 11103 is the add-on reported for each additional lesion sampled by that technique on the same date. Punch biopsies use 11104 and 11105; incisional biopsies use 11106 and 11107. Code selection follows the documented technique, lesion count, and CPT's biopsy hierarchy, and it is determined by the clinician's note rather than by the number of specimen containers sent to the lab.

A 30-Day Audit You Can Actually Run

  1. Days 1–3: Pull 20 biopsy encounters from the last quarter. Check that each note documents technique, site, and lesion count. Record the query rate.
  2. Days 4–7: Reconcile specimens sent against reports received for one full month. Flag anything unmatched.
  3. Days 8–14: Trace the specimen path end to end and list every vendor. Compare it to your BAA folder.
  4. Days 15–21: Request current BAAs from any vendor without one on file. Set a hard response date.
  5. Days 22–26: Review your portal release policy against the information blocking exceptions and document the rationale for any delay.
  6. Days 27–30: Time one records request from intake to fulfillment. If it exceeds 30 days, fix the bottleneck before a patient files a complaint.

Practices that treat the 11102 CPT code as a billing question alone will pass a coding audit and fail a privacy one. The code is the visible end of a chain that starts with a container of tissue and ends with a report in a portal, and every link in that chain belongs to a vendor you either have an agreement with or you don't.

Next Step

Start with the vendor list, because it is the shortest path from unknown risk to documented control. Trace one biopsy, name every organization that touched the data, and close the gaps — you can draft and export a compliant BAA in a single sitting without waiting on outside counsel. If your broader documentation set is also overdue, automated risk analysis and policy generation will get the rest of the file in order.