A payer audit letter arrives on a Tuesday asking for twelve charts, all of them initial hospital visits, all billed at the same level. Your biller forwards it to you. Your hospitalists round at two facilities, document in a hospital EHR your practice does not own, and submit charges through an app on their personal phones. You now have to produce twelve complete, defensible records — and account for every vendor that touched them.

This guide covers the operational mechanics behind the 99222 cpt code — how practices determine and document level selection, who owns each handoff, and where charges break — then makes the privacy, records-handling, and vendor obligations explicit. It is administrative guidance for the people who run the practice, not clinical guidance.

What the 99222 CPT Code Is, in One Paragraph

99222 is the middle code in the initial hospital inpatient or observation care family (99221, 99222, 99223). It describes the first encounter a physician or qualified health professional has with a patient during a hospital inpatient or observation stay, per day. Since the January 2023 CPT restructuring, the separate observation codes were deleted and folded into this family, so inpatient and observation status share one set of initial-care codes. Level selection rests on either the level of medical decision making documented or the total time spent on the date of the encounter — 99222 is defined at moderate MDM or 55 minutes met or exceeded. History and exam must be medically appropriate but no longer drive the level.

The Two Selection Paths Your Documentation Has to Support

Your job is not to decide which path applies to a given patient. Your job is to make sure the record supports whichever path the clinician used, and that your staff can tell the difference when a chart comes back for review.

Path one: medical decision making

MDM is scored across three elements — the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications from management decisions. Two of three elements must meet or exceed the level being reported. For internal audits, build a worksheet that mirrors those three columns rather than a checklist of history bullets. Coders who are still auditing against 1995/1997 history-and-exam elements are auditing the wrong thing.

Path two: total time on the date of the encounter

Total time includes qualifying non-face-to-face work performed by the reporting clinician on the same calendar date — chart review, ordering, care coordination, documenting. It excludes time by other staff and excludes any activity separately reported. Practices that allow time-based selection should require a stated total in the note ("45 minutes total time on 1/14") rather than a range or a template default. A number that appears on every note in a physician's panel is the fastest way to attract a targeted probe.

For the 99221–99223 family, the time thresholds run 40, 55, and 75 minutes. Note that the 99222 cpt code threshold sits at 55 minutes met or exceeded, which means a note documenting "approximately 50 minutes" does not support it under the time path even if the MDM path might.

Five Places Hospital Initial-Visit Charges Break

1. A second "initial" service from the same group

Only one initial hospital inpatient or observation service is reported per admission per physician or per group of the same specialty. If your Monday rounder submits an initial code and your Wednesday rounder does the same for the same stay, one of those claims is wrong. Build a stay-level flag in your charge review queue keyed to admission date and facility, not to date of service alone.

2. Admissions that cross midnight

A patient seen in the ED at 11:40 p.m. and admitted at 12:20 a.m. generates two calendar dates and a predictable argument. Your policy should say who resolves the date of service, what documentation settles it, and where that resolution is recorded. Do not leave it to whichever biller opens the encounter first.

3. Split or shared visits

When a physician and an advanced practice provider from the same group both contribute to the same encounter on the same date in a facility setting, the service is billed under the clinician who performed the substantive portion. CMS has defined that substantive portion in terms of more than half the total time or a substantive part of the medical decision making, and the definition has shifted across recent Physician Fee Schedule rules. Confirm the current-year definition against the CMS Physician Fee Schedule materials before you finalize your internal policy, and require both clinicians to document their own contribution in the same note.

4. Same-day admission and discharge

When a patient is admitted and discharged on the same calendar date, a different code family may apply depending on the length of stay and payer rules. Your charge edits should catch same-date admit/discharge pairs before submission rather than after a denial. Assign one person to own that edit.

5. Who is the admitting physician

Because Medicare does not pay inpatient consultation codes, multiple specialties may report initial hospital care for the same stay, with the principal physician of record identified by modifier. Your front-end scrub needs to know which of your clinicians holds that role on each admission. If nobody in your practice can answer that question from the charge record, your denial rate will tell you eventually.

Role Map: Who Owns Each Step

  • Rounding clinician — documents in the hospital EHR, selects the level, states time if using the time path, and submits the charge within your stated window (48 hours is a common internal standard).
  • Charge entry staff — reconciles the daily census against submitted charges, flags stays with no initial service and stays with two.
  • Coding reviewer — audits a defined sample per clinician per quarter against MDM and time criteria, documents findings, routes education.
  • Billing lead — owns payer-specific edits, modifier logic, and appeal packets.
  • Privacy officer — owns the vendor list, the BAAs, device policy, and the response when a rounding list ends up somewhere it shouldn't.

Write those five rows into an actual document. When an auditor asks who reviews level selection, "the billing team" is not an answer.

The PHI Your Billing Team Carries Around All Day

Every hospital charge starts with a census. Census lists, rounding sheets, and hand-annotated patient lists are protected health information in the most portable possible form. They get printed at a nursing station, folded into a lab coat, carried to a car, and thrown away at home. Small-scale paper losses rarely make headlines, but they are exactly the kind of incident your practice has to log, assess, and potentially report.

Three controls that cost nothing and matter:

  1. Printed rounding lists return to the practice for shredding, or they don't get printed. Pick one and enforce it.
  2. No patient identifiers in SMS or consumer messaging apps. Charge capture happens in the approved application, and the approved application is on your device inventory with encryption and remote wipe enabled.
  3. Personal phones used for charge capture are covered by a written BYOD policy that the clinician has actually signed, and that policy addresses what happens on separation.

Apply the minimum necessary standard to your own internal routing too. Your coding reviewer needs the encounter note, the face sheet, and the orders — not the entire longitudinal record. HHS guidance on the minimum necessary requirement is short and worth circulating to the revenue cycle team once a year.

Coding Vendors, Offshore Reviewers, and the BAA You Actually Need

Here is where hospital charge workflows quietly outgrow their paperwork. A practice bills the 99222 cpt code and its siblings a few hundred times a month, decides internal review isn't scaling, and contracts an outside coding firm. That firm receives charts. It is a business associate, and it needs a signed agreement before the first chart moves — not after the first invoice.

The same applies to your denial-management consultant, your transcription service, your ambient documentation tool, your clearinghouse, your audit-response firm, and any analytics vendor that ingests claim-level data. HHS's overview of business associate obligations also covers subcontractors — which is the clause practices forget when a domestic coding vendor routes work to an offshore team. Ask directly, in writing, whether any part of the work is subcontracted and whether downstream agreements exist.

One nuance for hospital-based groups: the hospital is generally not your business associate, and you are generally not theirs, when clinicians access the hospital EHR to treat patients. That relationship runs through medical staff and participation agreements. But the moment a hospital-affiliated entity performs billing or coding work on your behalf, you are back in business associate territory. Map it explicitly rather than assuming.

If your vendor list has grown faster than your contract file, you can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — a one-time purchase, no subscription — and close the gaps before your next audit rather than during it.

When an Audit or a Patient Request Lands on the Same Chart

Payer audits and patient record requests draw from the same documentation, but the rules differ. Disclosures to a health plan for payment purposes are permitted without patient authorization. Patient requests are governed by the individual right of access, which carries a 30-day response clock with one 30-day extension available if you notify the patient in writing of the reason and the new date.

Two practical consequences for hospital-based groups. First, your practice must be able to produce its own designated record set even though the note lives in a hospital system — know how your clinicians retrieve and export their documentation, and test it before a request forces you to. Second, when a records vendor or release-of-information service handles those requests, the fee limits and timelines still apply to you. Your name is on the complaint if the request is late.

Incidents involving 500 or more individuals appear publicly on the OCR breach reporting portal. Spend twenty minutes reading recent entries in your state. The failure patterns are repetitive, and most of them are workflow problems, not hacking.

A Thirty-Day Cleanup You Can Actually Finish

  • Week 1: Pull a stay-level report and count duplicate initial services by group and specialty over the last 90 days.
  • Week 2: Audit ten notes per rounding clinician against MDM and time criteria. Record which path each note used.
  • Week 3: Inventory every vendor that touches charge or chart data. Match each to a signed, current BAA. Note subcontractors.
  • Week 4: Rewrite the rounding list and device policy in one page, distribute it, and collect signatures.

Practices that need the surrounding documentation set — risk analysis, policies, workforce training records — can automate the full compliance document build instead of rebuilding templates from scratch each year.

Start With the Contract File

Level selection is a documentation discipline. Vendor oversight is a paperwork discipline. The first one shows up in your denial rate; the second one shows up in an OCR data request, and it is far less forgiving. If any firm reviewing your hospital charges is operating without a current agreement, draft and export a Business Associate Agreement this week and get it signed before the next batch of charts leaves your building.