A dermatology practice ran a routine reconciliation last quarter and found eleven biopsies logged in the EHR with no matching pathology report on file. Some were more than sixty days old. Two of those patients had already called the front desk asking for results, and the staff member who took the call told them "nothing's back yet" without checking anything.

That is a clinical safety problem, a billing problem, and a records problem at the same time. Every procedure billed under the 11104 CPT code creates a chain of protected health information that leaves your building — a labeled specimen, a requisition form, a courier handoff, an outside lab report, and eventually a claim. This guide walks the operational mechanics of that chain and then makes the privacy and vendor obligations explicit, because your reader-facing staff will handle every link in it.

What the 11104 CPT Code Covers

CPT 11104 is the code that describes a punch biopsy of skin, subcutaneous tissue, and/or mucous membrane, including simple closure when performed — single lesion. Its companion add-on code, 11105, describes each separate or additional lesion biopsied by the same technique during the same encounter.

It sits in a family introduced in the 2019 CPT cycle that separates biopsies by technique rather than by a single generic code:

  • 11102 / 11103 — tangential biopsy (shave, scoop, saucerize, curette), first lesion and each additional
  • 11104 / 11105 — punch biopsy, first lesion and each additional
  • 11106 / 11107 — incisional biopsy, first lesion and each additional

Which code applies to any given encounter is determined by the technique the provider actually performed and documented — not by the coder's inference, not by a default in a superbill, and not by what the practice usually bills. Your job as an administrator is to make sure the documentation supports whatever gets submitted, and that the record trail behind it is handled like the PHI it is.

How Your Practice Decides Which Biopsy Code Gets Billed

The determination is clinical. The workflow that captures it is administrative, and that is where practices lose money and audit defensibility.

The five elements your coder needs in the note

Build these into your template or your pre-bill review checklist:

  1. Technique explicitly named. "Punch biopsy" and the punch size, versus "shave" or "incisional." A note that says only "biopsy performed" forces a query.
  2. Anatomic site, specific. "Left upper back, 4 cm inferior to scapular spine" beats "back." Site specificity drives lesion counting and supports distinct-service determinations later.
  3. Lesion count and per-lesion detail. Each additional lesion needs its own site and technique, because the add-on code is reported per lesion.
  4. Intent. Removal of a lesion for diagnostic purposes reads differently from a definitive excision or destruction. The provider documents intent; the coder does not supply it.
  5. Closure, if performed. Simple closure is bundled into the biopsy family descriptors. Documenting it protects you when a payer asks why no separate repair was billed.

Units, add-ons, and payer edits

The base code is reported once per encounter for the first lesion regardless of technique mix; additional lesions are reported with the add-on that matches each one's technique. When techniques differ across lesions in a single visit, the ordering and modifier logic gets fussy, and payers apply their own edits on top of national correct coding rules.

Two operational habits protect you. First, have a designated coder — not the rooming staff — assign units after reading the note. Second, keep payer-specific policy PDFs in a shared, dated folder so an appeal never depends on someone's memory of a phone call. If you need to verify relative values or global periods, the CMS Physician Fee Schedule Look-Up Tool is the primary source; use it rather than a vendor's summary chart.

The Specimen Chain: Every Point Where PHI Leaves Your Building

A punch biopsy produces a container with a patient name on it and a requisition with name, date of birth, insurance information, and often a clinical history narrative. That is a PHI disclosure the moment it goes out the door.

Requisitions and labels

Apply the minimum necessary standard to the requisition. The lab needs identifiers, site, technique, and relevant history. It does not need the patient's full problem list, unrelated medication history, or a copy of the entire encounter note. HHS guidance on the minimum necessary requirement applies to routine disclosures like this, and "routine" is exactly the point — you are supposed to have standard protocols for recurring disclosure types, not case-by-case judgment.

Audit your requisition form once a year. Practices commonly discover the form auto-populates far more than the lab ever uses.

Couriers and transport

Here is the distinction your staff gets wrong. The pathology lab receiving the specimen is generally acting as a health care provider furnishing treatment, and a disclosure to it for treatment purposes does not require a business associate agreement. The courier company that picks up the labeled specimen container is a different question. If the courier is transporting sealed, labeled specimens and does nothing with the information beyond moving the package, many practices treat it as a conduit. If that courier also handles requisition paperwork, maintains chain-of-custody records containing patient identifiers, or provides a tracking portal your staff logs into, that relationship has moved past conduit and into business associate territory.

Do not resolve this by assumption. Read what the courier actually does, then apply HHS's business associate guidance and document your reasoning in writing. A one-paragraph memo in your vendor file is what turns a judgment call into a defensible one.

Your Pending Pathology Log Is a Records System, Not a Spreadsheet

Almost every practice performing biopsies maintains some tracking mechanism for outstanding results. Almost none of them treat it as a PHI system.

If your pending log lives in a spreadsheet on a shared drive, on a whiteboard in the back hallway, or in a personal task list on someone's phone, you have created an unmanaged repository of patient names, dates, sites, and diagnostic status. Ask three questions:

  • Where does it live? If the answer is a cloud file service, that service is a business associate and needs an executed agreement.
  • Who can see it? A whiteboard visible from a patient corridor is an incidental disclosure problem you can fix this afternoon with a door.
  • What happens when the owner leaves? Logs maintained by one medical assistant in a personal file disappear with that person's departure, taking your reconciliation trail with them.

Assign the pending log to a role, not a person. Set a standing weekly reconciliation — every specimen sent, every report received, every gap escalated to the ordering provider within a defined window.

The 30-Day Clock When a Patient Asks for the Biopsy Result

When a patient requests their pathology report, the report is part of your designated record set once you have received it and it informs care decisions. The fact that an outside lab generated it does not make it someone else's problem.

Under the HIPAA right of access, you generally must act on the request within 30 days, with one possible 30-day extension if you notify the patient in writing of the reason and the new date. OCR has treated access delays as an enforcement priority for years, and the HHS right of access guidance is unambiguous about scope and fee limits.

Two practical rules for your front desk:

  1. Never tell a patient to "call the lab." If the report is in your chart, you produce it.
  2. Do not condition release of a result on the patient scheduling a follow-up appointment. Clinical follow-up and records access are separate obligations, and bundling them is the exact fact pattern that draws complaints.

Photos of the Biopsy Site

Site photography before and after a punch biopsy is standard practice and a recurring privacy failure. Photos taken on a personal phone, texted to a covering provider, or stored in a camera roll that syncs to a consumer cloud account are unmanaged PHI.

Set one rule and enforce it: images are captured only on practice-controlled devices or an EHR-integrated capture tool, and they attach to the chart before the shift ends. If a staff member uses a personal device in an emergency, that is a documented exception with a defined cleanup step, not a habit.

Billing Vendors, Clearinghouses, and Appeal Packets

Now follow the money. The claim for the biopsy goes to your clearinghouse. The clearinghouse is a business associate. If your billing is outsourced, that company is a business associate. If a coding consultant reviews your biopsy documentation quarterly, that consultant is a business associate. If a denials-management vendor pulls path reports to build appeals, same answer.

Appeal packets deserve specific attention. Staff under deadline pressure often attach the full encounter note plus the complete pathology report when the payer requested documentation supporting a single line item. Define what an appeal packet contains for each common denial reason, and make that definition a template rather than a per-case decision.

If your vendor list has grown faster than your paperwork — and after a year of adding portals, scanning services, and transcription tools, it usually has — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase, no subscription, which makes it practical for the courier or the small local coding consultant who will otherwise sit unpapered for another eighteen months.

A 90-Day Cleanup Plan You Can Actually Assign

Days 1–30: inventory

Practice manager lists every entity that touches biopsy-related PHI: pathology labs, couriers, clearinghouse, billing service, coding consultant, image storage, cloud file service holding the pending log. Note for each whether a signed BAA exists and where it is filed.

Days 31–60: documentation and disclosure

Compliance lead reviews the requisition form against minimum necessary, audits ten recent biopsy notes for the five documentation elements, and walks the physical space looking for logs and specimen containers visible to patients. Front desk retrains on right-of-access scripting.

Days 61–90: close the gaps

Execute missing agreements. Move the pending log to a system with access controls and an audit trail. Set the weekly reconciliation as a recurring calendar item owned by a role. Document what you changed and when — an undated fix is worth very little when a regulator asks.

If you are rebuilding the surrounding policy set at the same time, tools that automate risk analysis reports and the full compliance document set will save you from writing eighteen policies from scratch. Note that no product, including that one, confers a government-issued HIPAA certification — HHS does not certify or endorse compliance vendors.

The Short Version

Billing the 11104 CPT code correctly is a documentation discipline. Handling everything that code generates — specimens, requisitions, courier handoffs, pending logs, photos, path reports, appeal packets — is a privacy discipline. The same reconciliation habit that catches an unbilled add-on catches the missing report that a patient has been waiting sixty days for.

Start with the vendor inventory this week. When you find the courier, the file service, or the coding consultant with no agreement on file, draft and export the BAA the same day rather than adding it to a list you will revisit next quarter.