Your hospitalist group saw 14 new admissions last Tuesday. Nine of those encounters went out the door coded at the highest initial inpatient level. Six weeks later a Targeted Probe and Educate letter lands asking for 30 charts — and you discover that the physician's notes live in the hospital's system, the time attestations live in a dictation vendor's archive, and your billing company holds the only complete claim history. That is why the 99223 CPT code definition matters to you as an administrator: not because you pick the level, but because you own the paper trail, the disclosures, and every vendor contract in between.

This guide covers what the code describes, who touches the record on its way to a claim, and where the privacy and vendor obligations sit. Coding decisions belong to your physicians and certified coders. Everything downstream belongs to you.

The 99223 CPT Code Definition, Stated Plainly

CPT 99223 is the highest of the three initial hospital inpatient or observation care codes (99221, 99222, 99223). It describes an initial encounter, per day, for evaluation and management of a patient, reported when the documented work reaches either a high level of medical decision making or 75 minutes or more of total time spent on the date of the encounter.

Three operational facts sit inside that sentence:

  • Initial means initial. One clinician or group reports an initial service per admission; subsequent days move to the 99231–99233 family.
  • Observation and inpatient are one family now. The 2023 CPT revisions deleted the separate observation care codes, so site-of-service arguments that used to drive code selection no longer work the same way.
  • Two independent paths. Medical decision making or total time. The word between them is "or," which means your documentation templates have to support both without forcing physicians into one.

The 99221 threshold is 40 minutes of total time, 99222 is 55, and 99223 is 75. Your coders compare the documented record against those criteria. You do not tell them what the answer should be, and neither does your revenue cycle dashboard.

What administrators should never do with the 99223 CPT code definition

Do not build a productivity target that names a code. "We expect 99223 on complex admissions" is a sentence that shows up in audit findings and in whistleblower complaints. Build targets around documentation completeness instead: was total time recorded, was the decision making narrative present, was the note signed within the group's stated window.

Who Touches the Record Between the Bedside and the Claim

Map this once and keep the map current. For a typical hospitalist or consulting specialist group, an initial inpatient encounter generates protected health information in at least five places.

  1. The hospital's EHR — where the note is authored and signed.
  2. Your group's charge capture app or spreadsheet — where the level and date of service are recorded.
  3. A transcription or ambient documentation vendor, if physicians dictate.
  4. Your billing company or in-house biller's practice management system — where the claim is built and the remittance lands.
  5. Any coding audit or CDI consultant reviewing samples after the fact.

Numbers two through five are almost always your responsibility. Number one usually is not, and that distinction trips up more practices than any coding rule.

Your Hospital Is Not Your Business Associate

When your physician documents an initial inpatient encounter in the hospital's EHR and your billing team pulls that note to support a claim, no business associate agreement is required for that exchange. Both organizations are covered entities, and the disclosure is for treatment and payment purposes, which HIPAA permits without an authorization. What governs the access is the hospital's medical staff agreement and its EHR access policy — not a BAA.

That has three practical consequences.

Access termination is the hospital's job, and nobody checks it. When a locum tenens physician leaves your group, their hospital EHR credentials often survive for weeks. Add a line to your offboarding checklist that requires written confirmation from the hospital's HIM or credentialing office that access is closed. Keep the email.

Downloading notes moves the risk to you. The moment your biller exports a PDF of an inpatient note to your own systems to defend a 99223-level claim, that copy is in your custody. Your safeguards, your breach obligation, your retention schedule.

Your vendors are still your vendors. The transcription service, the charge-capture app, the offshore coding team, the audit consultant, and the billing company all create, receive, maintain, or transmit PHI on your behalf. Each needs a signed agreement before the first record moves. HHS publishes sample business associate agreement provisions, but sample language still has to be turned into an executed document with the right names, dates, and breach notification timeline in it. If you have vendors operating on a handshake or on an old master services agreement with no HIPAA exhibit, you can produce a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX the same afternoon — one-time purchase, no subscription to manage.

The Audit Letter Is a Disclosure Event

Initial inpatient codes draw attention because the dollar spread between 99221 and 99223 is meaningful and the documentation requirements are narrative rather than checkbox. Expect probe reviews, RAC activity, and commercial payer level-of-service audits.

Responding to a payer audit is a permitted payment-related disclosure. It is not a blank check. The minimum necessary standard still applies, and "we sent the whole chart because it was easier" is the kind of shortcut that turns a coding dispute into a privacy incident.

Building the audit response packet

Write a standing procedure so the packet looks the same every time:

  • Scope to the dates of service requested. If the letter names 30 encounters, the packet contains 30 encounters — not the full admission history for those 30 patients.
  • Include the note, the signed attestation, the time entry if time was the basis, and the claim. Nothing about family members, unrelated admissions, or other clinicians' consults unless the requested documentation depends on it.
  • Log every disclosure. Date, requester, records included, who assembled it, transmission method.
  • Transmit through a channel you can describe under oath. The payer portal or an encrypted transfer, never an unencrypted attachment to a general email address.
  • Assign one owner. One named person assembles and reviews. Distributed assembly is how the wrong patient's note ends up in the envelope.

If a consultant helps you prepare the appeal, that consultant is a business associate. So is the copy service, if you use one.

Time-Based Documentation Creates New Records You Must Produce

When a clinician selects an initial inpatient level using total time, the record now contains a time attestation. Where does it live? In some groups it is inside the signed note. In others it sits in a charge capture app, a scheduling tool, or a physician's personal log.

Anything your practice uses to make decisions about a patient — including billing records — sits inside the designated record set and is reachable by a patient exercising the HIPAA right of access. That includes claim-level detail showing the code billed. Patients who receive a surprise inpatient bill do ask for it, and you have 30 days to respond, with a single 30-day extension available if you notify them in writing.

Two things to verify this month. First, can your billing staff retrieve the claim history and supporting time attestation for a named patient in under an hour without help from the vendor? If the answer is no, your access timeline depends on a third party's ticket queue. Second, does your BAA with the billing company obligate them to return records to you on request within a defined number of days? If the contract is silent, negotiate it before you need it.

Where Practices Actually Leak PHI Around Inpatient Billing

The failures are boring and repetitive. Browse the OCR breach portal and note how often the reporting entity is a provider group and the root cause is a vendor or an email.

The rounding list

Printed patient lists with room numbers and admission dates go home in coat pockets. Pick a destruction point — a locked shred bin at the physician workroom — and audit it.

The texted room number

"Can you pick up the new admit in 412, complex, probably a long note" is PHI in a consumer messaging app. Provide a secure alternative and put the rule in your annual training with an example this specific.

The shared spreadsheet

Charge capture on a spreadsheet in a personal cloud drive is common in small groups and indefensible in a risk analysis. If you are still reconstructing where PHI lives across your systems, work through a structured HIPAA risk analysis and policy set rather than answering the question from memory during an investigation.

The offshore coding relationship

Offshore coding is permitted. It requires a BAA, and it requires you to know where the data sits and how it is transmitted. Ask for the subcontractor list in writing and update it annually.

A 45-Day TPE Response, With Roles Assigned

Here is the timeline to rehearse before the letter arrives.

Days 1–2. Practice administrator logs the request, confirms the deadline, and identifies the 30 encounters. No records move yet.

Days 3–10. Billing lead pulls claims and remittances. Designated staff member retrieves signed notes from the hospital EHR and saves them to one access-restricted folder. Every retrieval is logged.

Days 11–20. Certified coder reviews each encounter against the documentation — comparing what is in the note to the criteria in the CPT descriptors, including the medical decision making and total time paths described above. Findings go in a memo, not in the packet.

Days 21–30. Physician leader reviews any encounter where documentation appears thin, and decides whether to self-correct. Corrections follow your written policy on refunds and rebilling.

Days 31–40. Compliance lead performs the minimum-necessary review of the assembled packet, page by page, and signs off.

Days 41–45. Transmit through the payer portal. File the disclosure log entry. Calendar a 90-day follow-up.

For Medicare-specific policy on inpatient E/M services, split or shared visits, and teaching physician documentation, work from CMS source material rather than a vendor summary — start with the Physician Fee Schedule resources and your MAC's local guidance, which sometimes differs from CPT convention.

Five Things to Fix This Quarter

  1. Confirm a signed, current BAA exists for every vendor touching inpatient charge data — transcription, charge capture, billing, coding audit, copy service.
  2. Add hospital EHR access termination to physician offboarding, with written confirmation retained.
  3. Write the audit response procedure and name one owner.
  4. Test a right-of-access request for billing records end to end and time it.
  5. Remove any productivity language that names a specific CPT level.

The 99223 CPT code definition is a coding question your clinicians and coders answer. Whether the supporting record can be found, defended, disclosed correctly, and produced on a 30-day clock is an operations question, and it is yours.

If your vendor file has gaps — and after mapping the five systems above, most groups find at least one — generate the missing business associate agreements and get them signed before your next audit letter forces the issue.