A payer requests records on eleven spirometry claims from last quarter. Your biller pulls the notes and finds the interpretation for nine of them. For the other two, the chart has a printed number — FEV1, FVC, a ratio — and no graphic tracing anywhere, because the front-desk MA printed the summary page and the device software purged the session after 90 days. Those two claims are indefensible, and you now have a records-retention problem that is bigger than the money.

The 94010 CPT code is one of the most commonly performed in-office diagnostic tests in primary care, pulmonology, allergy, and occupational medicine. It is also one of the easiest to bill sloppily, because the equipment does the work and the paperwork feels optional. This guide is for the administrator who owns the workflow: what the code actually describes, what your documentation packet has to contain, and where the spirometry data creates privacy and vendor obligations your compliance binder probably does not cover.

What the 94010 CPT Code Covers — and What It Doesn't

CPT 94010 describes spirometry, including a graphic record, total and timed vital capacity, expiratory flow rate measurement(s), with or without maximal voluntary ventilation. Three operational points follow from that descriptor:

  • The graphic record is part of the code. A numeric summary alone does not match what you billed. The flow-volume and volume-time tracings belong in the record.
  • It is a single test, not a per-effort charge. Multiple acceptable maneuvers within one session are one unit of service.
  • It does not include bronchodilator administration or post-bronchodilator repeat testing. Those scenarios map to different codes in the pulmonary function family, and the code family carries bundling edits.

Code selection is a clinical-documentation decision made by the ordering and interpreting provider, informed by the actual test performed. Your job as an administrator is not to pick the code — it is to make sure the record supports whatever code was picked, and that the same code appears on the claim, the encounter note, and the device output.

The Documentation Packet Your Biller Needs Before the Claim Goes Out

Build a single checklist and attach it to the spirometry workflow in your EHR. Every 94010 encounter should produce all of the following before the claim drops:

  1. An order from a qualified provider, with the reason for testing documented in the note.
  2. Date, time, and the identity of the technician who performed the maneuvers.
  3. Device identification and calibration status for that day. Calibration logs are their own retention item — decide who keeps them and for how long.
  4. The graphic tracings and the numeric results, including the reference set used to calculate predicted values.
  5. An interpretation, signed and dated by the provider who is billing for it.
  6. Effort quality notation — how many maneuvers, whether they met acceptability and repeatability criteria, and any noted limitations.

Assign the Roles in Writing

The most common failure is not a missing element; it is an unassigned one. Write down who owns each step:

  • Clinical staff perform the test and push results into the chart the same day.
  • The interpreting provider signs within a defined internal turnaround — many practices use 72 hours — and the front desk does not release results before that signature.
  • Billing holds the claim until the signed interpretation exists. Build the hold as a work queue, not a habit.
  • The compliance lead audits ten spirometry charts per quarter against the six-item list above and logs the results.

Ten charts a quarter takes about an hour. It is the cheapest insurance you will buy this year.

Where the 94010 CPT Code Collides With Other Pulmonary Codes

Spirometry sits in a code family with heavy procedure-to-procedure editing. Codes for bronchodilator responsiveness testing, bronchospasm provocation, flow-volume loops, and standalone vital capacity measurement all overlap with 94010 in ways that generate denials when both are reported for the same session.

Do not manage this from memory or from a vendor cheat sheet that someone downloaded in 2022. Pull the current quarterly edit files directly from the CMS National Correct Coding Initiative edit tables and load the relevant pairs into your practice management system's scrubber. Reload every quarter. Put it on the same calendar entry as your fee-schedule update.

Separately, if an evaluation and management service is reported on the same day as spirometry, your documentation has to show that the E/M was significant and separately identifiable from the test. That determination belongs to the provider and must be visible in the note — not asserted by a modifier your biller appends by default.

Professional and Technical Components: Who Owns the Interpretation

Pulmonary function codes can split into technical and professional components. If your practice owns the spirometer and your provider interprets the study, you generally report the global service. If an outside physician reads the study, or if the test is performed at a facility your practice does not own, the components separate.

Verify the component indicators and supervision requirements for the current year in the Medicare Physician Fee Schedule Look-Up Tool rather than relying on a payer rep's verbal answer. Print the result and keep it with your fee schedule documentation, because the person who asks about it in eighteen months will not be the person who is asking now.

The privacy consequence of a split arrangement is immediate: if an outside reader interprets your tracings, PHI leaves your building. That reader is either a treatment relationship or a business associate, and you need to know which before the first study is transmitted.

The Spirometry Tracing Is PHI — and It's in Your Designated Record Set

Here is the part that gets skipped. Spirometry output is individually identifiable health information created and maintained by your practice, used to make decisions about the patient. That places it squarely in the designated record set under the Privacy Rule, alongside the note and the interpretation.

Practical consequences:

  • Right of access applies to the tracing. When a patient requests their records, "we sent the visit note" is not a complete response if the spirometry graphics live only in the device software. You have 30 days, with one permitted 30-day extension and written notice. HHS's right of access guidance is the authoritative reference; keep a copy in your policy binder.
  • Format matters. If a patient asks for an electronic copy and you can readily produce one, produce it. A proprietary device file that only the manufacturer's software can open is not a usable electronic copy — export to PDF.
  • Retention is yours to set. If the device software auto-purges sessions after a set interval and nobody exported them, you have destroyed part of the record. Change the export step from optional to mandatory in the workflow, and confirm the export lands in the chart, not on a workstation desktop.
  • Amendment requests reach it too. Patients can request amendment of records in the designated record set. Your policy needs a path for a disputed spirometry interpretation, including how a denial and the patient's statement of disagreement get filed.

Responding to a Payer Audit Without Overdisclosing

When a payer requests records to adjudicate a 94010 claim, the disclosure is permitted for payment purposes — and minimum necessary still applies. Send the order, the tracing, the results, and the signed interpretation for that date of service. Do not send the entire longitudinal chart because it was easier to export. Log the disclosure, note what was sent, and keep the request letter.

Your Spirometer Is a Vendor Relationship, Not Just a Device

Modern spirometers do not stay on the cart. They sync to a manufacturer cloud portal, push results through a middleware bridge into the EHR, receive firmware updates over your network, and sometimes route studies to a remote over-read service. Every one of those paths moves PHI.

Walk the actual data flow with your IT contact and answer four questions for each spirometry unit:

  1. Where does the raw study data live — on the device, on a local PC, in a vendor cloud, or all three?
  2. Who at the vendor can view identified patient data during support sessions, and is remote access logged?
  3. Does the interface engine or middleware provider store PHI in transit, even briefly?
  4. Is the device on the same network segment as workstations, and does it still run an operating system the manufacturer supports?

Any vendor that creates, receives, maintains, or transmits PHI on your behalf needs a signed business associate agreement before the first study moves. That includes cloud spirometry portals, remote over-read services, interface vendors, and the RCM company submitting the claim. If you found a vendor on that list without an executed agreement, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — rather than waiting on a redline cycle with the vendor's legal department.

Add each spirometer to the asset inventory that feeds your Security Rule risk analysis. HHS proposed substantial updates to the Security Rule in January 2025, with a comment period that closed that March; the direction of travel is toward more explicit asset inventory, network mapping, and encryption expectations. A device you cannot name is a device you cannot risk-assess. If your inventory and risk analysis documentation are out of date, refresh them before your next annual review rather than after an incident.

Occupational Spirometry: The Employer Disclosure Trap

If your practice performs spirometry for employers — respirator clearance, surveillance under a workplace exposure standard, pre-placement screening — the data flow is different and the mistakes are expensive.

The Privacy Rule permits disclosure of workplace medical surveillance findings to an employer in narrow circumstances: you provided the service at the employer's request, the findings relate to a work-related illness or to medical surveillance of the workplace, the employer needs the findings to comply with occupational safety requirements, and you give the individual written notice that the information will be disclosed. That notice requirement is not optional and not satisfied by your general Notice of Privacy Practices.

Operationally: keep occupational testing records segregated from treatment charts, script exactly what goes back to the employer (typically a clearance determination, not raw values), and train your front desk on the answer when an HR manager calls asking for a copy of the tracing. The answer is a documented process, not a judgment call at the counter.

A Quarterly Review That Takes Ninety Minutes

Put these on a recurring calendar entry with a named owner:

  • Reload NCCI edit pairs for the pulmonary function family into your claim scrubber.
  • Audit ten 94010 charts against the six-element documentation checklist; log findings and retraining.
  • Confirm every spirometry study from the prior quarter exported into the chart, tracing included.
  • Reconcile the spirometry data flow against your business associate list; chase any gap the same week.
  • Verify device calibration logs exist and are retained per your written policy.
  • Check firmware and OS support status on each unit.

The 94010 CPT code will keep generating revenue quietly for years. It will also keep generating records — tracings, exports, cloud copies, vendor support sessions — that your compliance program has to account for. Handle the documentation packet and the vendor inventory together, because a payer audit and a records request will eventually arrive on the same week, and they will both point at the same folder.

Start with the vendor list. Pull every system that touches spirometry data, mark the ones without an executed agreement, and draft the missing business associate agreements this week. It is the shortest path from a known gap to a closed one.