A provider removes a lesion from a patient's forearm at 9:40 on a Tuesday. The operative note says "1.5 cm lesion excised, closed with 4-0 nylon." Your biller opens the encounter Thursday, needs to decide whether the 11402 CPT code family applies, and finds no excised diameter, no margin measurement, and no pathology result yet. That single gap sets off three days of chart chasing, a delayed claim, and — the part administrators forget — a document trail that now includes a specimen label, a courier manifest, a path report, and two clinical photographs sitting in someone's phone camera roll.

This guide is for the people who fix that: practice managers, billing leads, and privacy officers. It covers how practices document and determine code selection in this family, then makes the records-handling and vendor obligations explicit.

What the 11402 CPT Code Describes, and What Your Chart Has to Prove

The 11402 CPT code sits in the CPT series for excision of benign lesions, with the descriptor keyed to lesions of the trunk, arms, or legs and an excised diameter in the 1.1 to 2.0 cm range. Three documented facts drive selection within this family: anatomic site, whether the lesion is benign or malignant, and the excised diameter — the lesion's greatest clinical diameter plus the narrowest margin on each side.

Your coders do not decide any of those. The record does. If the note lacks a measurement, the coder cannot manufacture one, and a note that says "1.5 cm lesion" is describing the lesion, not the excision. Those are different numbers and payers know it.

The measurement has to be taken before the cut

CPT guidance ties the excised diameter to measurement prior to excision, because tissue shrinks in fixative. Practices that measure off the pathology report end up with a smaller number than the one they documented in the room, and the two versions sitting in the same chart is exactly what an auditor circles in red.

Build the prompt into the template. A structured field — lesion diameter, narrowest margin, calculated excised diameter, site — costs the provider six seconds and eliminates the most common query your billing staff sends.

Closure is documented separately

Excision codes in this family include simple closure. Intermediate and complex repairs are documented and evaluated separately, and whether separate reporting is appropriate depends on CPT instructions, payer policy, and edits published through the CMS National Correct Coding Initiative. Your job as an administrator is to make sure the repair type, layers, and length are in the note so the determination can be made on evidence rather than assumption.

Benign versus malignant is a pathology-dependent hold

Many practices hold these claims until pathology returns, because the benign/malignant determination changes which code family applies. Decide your policy in writing: hold and bill once, or bill and correct. Either is defensible. What is not defensible is an undocumented practice where some claims get held and others get corrected depending on who is working that day.

Every Artifact an 11402-Range Encounter Generates Is PHI

Walk the encounter as a records officer instead of a biller. One lesion excision produces, at minimum:

  • The operative or procedure note in the EHR
  • A specimen container label with patient identifiers
  • A pathology requisition, usually including diagnosis and history
  • A courier pickup log or specimen tracking record
  • The pathology report returned by fax, portal, or interface
  • Pre- and post-procedure clinical photographs, if taken
  • The claim, the clearinghouse transmission, and the remittance advice
  • Any coding query or external coder worklist entry

Eight artifacts, at least four systems, and typically three or more outside organizations. The billing side of your practice tracks one of these — the claim. The privacy side is accountable for all eight.

Photos taken on a personal phone and texted to the provider's own account are PHI in an uncontrolled location. If your practice photographs lesions, the images belong in the EHR through a sanctioned capture path, and the device policy has to say so. Audit this quarterly by asking three clinical staff to show you where the last lesion photo lives. The answers will tell you whether your policy is real.

Which of Your Lesion-Excision Vendors Actually Need a BAA

This is where administrators get tangled, so be precise.

The pathology laboratory is usually not your business associate. When you send a specimen for diagnostic interpretation, the lab is a covered entity performing treatment, and disclosures for treatment do not require a business associate agreement. Labs sometimes send one anyway. Signing an unnecessary BAA is not a violation, but it does create obligations you then have to honor, so read it before your director of operations signs it out of reflex.

The specimen courier is a business associate if it is handling identifiable specimens and paperwork on your behalf as a service, rather than acting as a conduit. Most courier contracts in this space include a BAA. Confirm yours does.

These almost always require a signed agreement:

  • Outsourced coding and billing companies
  • Your clearinghouse
  • Transcription or ambient documentation vendors capturing the procedure note
  • Clinical photography or image-storage platforms outside the EHR
  • Any dermatopathology results portal operated by a third-party technology vendor rather than the lab itself
  • Document scanning and release-of-information contractors
  • Coding audit consultants reviewing charts on your behalf

That last one catches practices during payer audits. You hire an outside consultant to review fifty excision charts before responding to a payer request, and no one thinks of the consultant as a vendor. They are, and they need an agreement before the first chart moves. HHS publishes sample business associate agreement provisions that show the required elements, though sample language is a starting point rather than a finished contract.

If you are staring at an audit consultant who starts Monday and you have no agreement template, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon. One-time purchase, no subscription — which matters when the need is a single vendor and not a program.

Offshore coding deserves a separate conversation

HIPAA does not prohibit offshore business associates. Some state laws, some Medicaid contracts, and many commercial payer agreements do restrict where claims data may be processed. Ask your coding vendor, in writing, where the work is performed and where the data rests. Put the answer in your vendor file next to the BAA.

Minimum Necessary Applied to a Coding Worklist

Your outsourced coder needs the procedure note, the pathology report, and the demographic and insurance fields required to build the claim. They do not need the patient's behavioral health notes, the substance use history, or the imaging from an unrelated 2023 encounter.

Most EHRs support role-based views. Fewer practices configure them. Pull a report of what your billing role can actually see, compare it to what claim production requires, and close the gap. The minimum necessary standard applies to uses and disclosures for payment, and a coder with full-chart access across every patient is a finding waiting for an auditor.

Do the same exercise for the audit trail. If your system logs access, run a sample: pick five patients who had lesion excisions last month and review who opened the chart. Unexpected names in that list are the whole point of the exercise.

When the Patient Calls About the Charge

A patient sees a line item for a lesion excision, does not recognize the amount, and asks for everything you have. Billing records are part of the designated record set. That request is a right-of-access request whether or not the patient uses those words.

The clock is 30 days from receipt, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount covering labor for copying, supplies, and postage — not search or retrieval time. HHS maintains detailed guidance on individuals' right of access, and the enforcement record on access requests is long enough that no practice should be improvising here.

The operational trap: billing lives in one system, the path report in another, and the photos in a third. Train your front desk to route the request to a single owner who assembles all three. A response that omits the pathology report because "that's the lab's document" is incomplete — it is in your record, so it is in the designated record set.

Payer Audits and the Retention Clock

Excision codes draw post-payment review because the code selection turns on a measurement that lives in narrative text. When the request arrives, you will disclose the note, the path report, and often the photos. That disclosure is for payment and does not require authorization, but it does require the same care as any other transmission: verified fax number, encrypted portal upload, or secure file transfer.

Two retention clocks run in parallel. HIPAA requires six years for policies, BAAs, risk analyses, and required documentation. Medical record retention itself is governed by state law and payer contract, frequently longer. Your excision documentation sits under the second clock; your BAA with the coding vendor sits under the first. Track them separately or you will destroy the wrong thing.

A Workflow You Can Assign This Week

  1. Clinical staff: measure and record lesion diameter, narrowest margin, and calculated excised diameter in a structured template field before the excision. Site documented by specific anatomic location, not "arm."
  2. Provider: document closure type, layers, and repair length in the same note. Sign within 24 hours.
  3. Clinical staff: capture photographs only through the sanctioned EHR path. No personal devices.
  4. Specimen handler: log the courier pickup with specimen ID and time. Reconcile against results received weekly; unreconciled specimens are both a patient safety issue and a potential loss of PHI.
  5. Billing lead: hold or release the claim per your written pathology policy. Route coder queries through the EHR, never through email.
  6. Privacy officer: confirm every vendor touching this chain appears on the vendor inventory with an executed, current agreement.

Assign names, not departments. "Billing" does not reconcile a specimen log; a person does.

The Short Answer, for the Person Who Searched This at 4 PM

The 11402 CPT code is used for excision of a benign lesion of the trunk, arms, or legs with an excised diameter of 1.1 to 2.0 cm, where excised diameter equals the lesion's greatest clinical diameter plus the narrowest margin on each side, measured before excision. Code selection within the family is determined by documented site, benign or malignant pathology, and that measurement — not by the coder's judgment. Because the supporting record spans the EHR, a pathology lab, a courier, clinical photographs, and a clearinghouse, every claim in this family creates a multi-vendor PHI trail that your business associate inventory has to account for.

Where to Start Monday

Pull ten lesion excision charts from the last quarter. Check whether each one carries an excised diameter recorded before the procedure, a site specific enough to support the code family, and a pathology report filed to the encounter. Then pull your vendor list and confirm the courier, the coding company, the clearinghouse, and the image platform each have a current signed agreement in the file.

If any of those agreements are missing, expired, or written against pre-2013 rules, build a current one through the BAA generator before the next specimen leaves your building. If the gap is broader than contracts — risk analysis, policies, the full document set — automate the compliance documentation rather than rebuilding it from templates each year. Either way, the fix takes an afternoon; the audit that finds the gap takes considerably longer.