Your back hallway probably has a plastic tote with a courier label on it. Between now and Friday, twenty or forty tubes and cups will pass through it, each one wearing a label with a patient name, a date of birth, and often a diagnosis code. The 99000 CPT code description is the administrative language attached to that workflow — and if your billing staff report it, your privacy officer inherits everything the workflow touches: the log, the requisition copies, the courier, and the lab interface.

This guide is for the administrator who owns that tote. It covers what the descriptor actually says, why the code usually produces no payment, what documentation supports reporting it, and which of the vendors in that chain need a Business Associate Agreement.

What the 99000 CPT Code Description Covers

CPT 99000 sits in the Special Services, Procedures and Reports family (99000–99091) of the Medicine section. Its descriptor addresses handling and/or conveyance of a specimen for transfer from the office to a laboratory — the office-side work of preparing, packaging, and moving a specimen to an outside lab, not the collection of the specimen and not the lab's analysis.

CPT descriptors are AMA-copyrighted and revised annually. Have your coding lead read the current codebook descriptor verbatim rather than relying on a cheat sheet taped inside a cabinet door. The 2020s brought editorial changes across the 99000 series, and a 2019 crib sheet is not a defensible source.

99000 vs. 99001

The companion code, 99001, addresses handling and conveyance of a specimen for transfer from the patient in a location other than the office to a laboratory. The distinction is the origin point of the specimen, not the effort involved. Practices that run home visits, occupational health draws at employer sites, or mobile services need this distinction written into their internal coding guidance, because the same clinical work can map to different administrative reporting depending on where it happened.

What 99000 is not

Two recurring mix-ups on internal audits: staff conflate the handling code with the venipuncture collection code, and staff report handling for specimens processed in-house rather than transferred out. Both are documentation problems before they are coding problems. If your superbill or EHR charge template lists a "lab handling" button with no accompanying prompt about destination, expect drift.

Why the Code Rarely Produces a Payment

Under the Medicare Physician Fee Schedule, 99000 carries a bundled payment status — meaning Medicare makes no separate payment for it; the work is considered part of the associated covered service. Your billing staff can report it, and it will consistently return no allowed amount. That is expected behavior, not a claim error.

Commercial and workers' compensation payers set their own policies. Some pay a small handling fee, some bundle it, and some deny it with a patient-responsibility indicator that your front desk then has to explain. Pull the actual policy language for your top five payers and store it where the billing team works, not in a shared drive nobody opens. CMS publishes the fee schedule status indicators and payment policy files through its Physician Fee Schedule resources; your commercial policies come from the payer portal or your contract.

Practices sometimes report a bundled code deliberately for internal volume tracking. That is a legitimate operational choice if it is documented as a policy decision, applied consistently, and never used to shift cost to a patient in a way the payer contract prohibits. Write down the rationale. "We've always done it" is not a rationale.

How Practices Determine and Document Code Selection

Code selection for specimen handling is an administrative determination built on three inputs: the current CPT descriptor, the payer's published policy, and the operational facts recorded at the time of service. Nobody on your staff should be deciding this from memory at 4:50 p.m.

  • Descriptor match. Does the documented work correspond to the descriptor language, including origin and destination?
  • Payer policy. Is the code payable, bundled, or excluded under the specific plan on the claim?
  • Contemporaneous record. Is there a log entry, requisition copy, or EHR note showing the specimen, the collection date, the destination lab, and who released it to the courier?

Assign ownership explicitly. In most practices of ten providers or fewer, the clinical staff member who packages the specimen creates the log entry, the billing lead maps it to a charge, and the compliance lead audits a sample monthly. If one person does all three, build a second-set-of-eyes check into the monthly close.

Your Specimen Log Is a PHI System of Record

Here is where the 99000 CPT code description stops being a billing topic. The documentation that supports it — the log, the requisition carbon copies, the courier manifest — is protected health information in your custody, subject to the same safeguards as your chart notes.

Look at yours honestly. A spiral notebook on a counter in a hallway that patients walk past, listing forty names and tests, is an access-control failure that no policy binder fixes. Common findings from internal walkthroughs:

  • Logs stored in an unlocked area accessible to delivery personnel, cleaning crews, and patients waiting for a restroom.
  • Requisition copies stacked next to the fax machine for days, then discarded in regular trash instead of a secured shred container.
  • Specimen totes left unlocked overnight because the courier arrives before staff.
  • Labels printed in batch, with mismatched sheets ending up in the wrong patient's packet.

Fix the physical layer first: move the log behind a locked or badge-controlled door, use a lockbox for after-hours pickups, and route every paper requisition copy to shredding on a defined schedule. Then set a retention period for handling logs and stick to it. Indefinite retention of a hallway notebook full of names is pure downside risk.

When a lost specimen becomes a reportable event

If a courier loses a bag, the tube is a clinical problem and the label is a privacy problem. An impermissible disclosure of PHI triggers the four-factor risk assessment under the Breach Notification Rule: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and the extent to which risk has been mitigated. Document that assessment even when you conclude notification is not required. HHS publishes the framework and reporting mechanics in its breach notification guidance.

Which Specimen-Handling Vendors Need a BAA

This is the question that gets answered wrong most often, in both directions. Walk the chain and classify each party:

  • The reference laboratory. Generally a covered entity in its own right, receiving PHI for treatment purposes. A disclosure for treatment does not require a BAA. Many labs still send you an agreement bundled into their service contract; read what you are signing rather than assuming a BAA is required.
  • A courier that only transports sealed specimens. HHS's conduit exception is narrow — it covers transmission-only services such as the postal service, private couriers, and their electronic equivalents, where any access to PHI is random or infrequent. Pure transport can fall inside it.
  • A courier that does more than transport. Holds after-hours keys, stages specimens in its own facility, enters requisition data, prints labels, or reconciles manifests on your behalf. That is business associate territory, and you need an executed agreement.
  • Specimen-tracking or lab-interface software. Business associate. It creates, receives, maintains, or transmits PHI on your behalf.
  • Your billing company or outsourced coder. Business associate, including for the handling charges they touch.
  • Document shredding vendor. Business associate.

HHS's business associate guidance is the reference to keep open while you sort the list. Do the sorting in writing, with a date and a decision-maker's name, because "we thought they were a conduit" is a much weaker position than a documented analysis.

When the sorting turns up a courier or tracking vendor with no agreement on file — and it usually does — you need a signature-ready document, not a three-week legal cycle. You can generate a Business Associate Agreement through a six-step wizard and export it as PDF or DOCX for signature the same afternoon. One-time purchase, no subscription, which matters when you are papering four small vendors at once rather than one enterprise contract.

Requisitions, Minimum Necessary, and the Diagnosis Field

Requisition forms are where minimum necessary quietly breaks. Staff copy an entire problem list into the diagnosis field because it is faster than picking the relevant one, or attach a chart summary "so the lab has context." The lab needs what it needs to perform and bill for the test. Train to that standard and audit ten requisitions a quarter against it.

Check the form itself too. Some legacy requisitions include fields for insurance details, employer, and full Social Security number. If your lab's form asks for an SSN and the lab does not need it, ask whether the field can be suppressed. Every element you write down becomes an element you have to safeguard, log, and potentially report on.

The 99000 CPT code description refers to handling and/or conveyance of a specimen for transfer from the office to a laboratory. It is an administrative code, not a clinical procedure code. Medicare treats it as bundled and pays nothing separately; commercial and workers' compensation payers apply their own policies, so some reimburse a nominal handling amount and others deny it. Practices determine whether to report it based on the current CPT descriptor, the specific payer's policy, and contemporaneous documentation — typically a specimen log entry naming the destination lab, the collection date, and the staff member who released the specimen. That log is PHI and must be safeguarded accordingly.

When Results Come Back: The Access Clock

Specimen handling ends at the courier, but records handling does not. Once results land in your chart, they are part of the designated record set, and a patient request for them starts the 30-day response clock under the individual right of access, with one 30-day extension available if you notify the patient in writing. Review the HHS right of access guidance with whoever answers your records line.

Two practical points. First, patients can also request results directly from the CLIA-regulated laboratory, and they often do — your front desk should be able to say so without sounding like a brush-off. Second, a pending or abnormal result is not a lawful reason to delay an access response. "The provider hasn't reviewed it yet" is not one of the Privacy Rule's grounds for denial.

A Monday-Morning Checklist for the Handling Workflow

  1. Pull the current CPT descriptor for 99000 and 99001 and confirm your charge templates match the language.
  2. Retrieve written handling-fee policy from your top five payers; file it where billing works.
  3. Walk the specimen path physically, from exam room to courier pickup, and note every point where PHI sits unattended.
  4. Move the log to a controlled location; add a lockbox if pickups happen before staff arrive.
  5. List every vendor in the chain, classify each as covered entity, conduit, or business associate, and record the reasoning.
  6. Execute BAAs for the ones that need them and calendar an annual review.
  7. Audit ten requisitions against minimum necessary and fix the form fields that overcollect.
  8. Confirm requisition copies and expired logs go to secured destruction on a schedule.

None of this is glamorous. All of it shows up in the first ten minutes of an audit or a records dispute, because the specimen chain is the one workflow where paper, people, and outside vendors all touch PHI in the same afternoon.

Close the Vendor Gap This Week

If your vendor classification exercise turned up a courier, a tracking platform, or a billing contractor operating without a signed agreement, handle it before the next pickup. Start with the BAA generator to produce a signature-ready agreement, and if the same walkthrough exposed gaps in your risk analysis or written policies, the broader HIPAA compliance document set covers that layer. Documented decisions beat good intentions every time someone asks how the specimen got from your hallway to the lab.