Your MAC sends an additional documentation request for twenty inpatient encounters. Nineteen were billed at the highest initial hospital care level, the letter gives you 45 days, and the notes live in a hospital EHR your group accesses under a participation agreement rather than owns. That is the moment most administrators go looking for the 99223 cpt code description — not because they need to code, but because they need to know what the payer expects the record to show, who else in the vendor chain has a copy, and how the response leaves the building without becoming a breach.

This guide is written for practice administrators, billing managers, and privacy officers. It covers the operational mechanics of the code, then makes the records-handling and vendor obligations explicit. It does not tell you which code fits which patient — that determination belongs to the treating clinician and your certified coders.

What the 99223 CPT Code Description Covers

The 99223 cpt code description defines the highest level in the initial hospital inpatient or observation care family: a per-day service that requires a medically appropriate history and/or examination and a high level of medical decision making. When total time on the date of the encounter is used for code selection instead of MDM, the descriptor sets a threshold of 75 minutes that must be met or exceeded.

Three structural points your billing staff should know cold:

  • It is a per-day code. Only one initial service is reported per admission by the same physician or same-specialty group, regardless of how many times they see the patient that calendar day.
  • Observation and inpatient merged. The separate observation code families were deleted effective January 1, 2023. Initial observation encounters now report from the 99221–99223 range, subsequent care from 99231–99233.
  • Site and admission status still drive place of service. Your biller confirms POS against the hospital's admission status and the payer's policy, not against where the physician happened to stand.

The Codes Sitting Next to It

99221, 99222, and 99223 differ by MDM level or time threshold. Subsequent care is 99231–99233. Admission and discharge on the same calendar date has its own family (99234–99236) with its own payer-specific stay-duration expectations. Discharge day management is 99238 or 99239.

Under Medicare, the principal physician of record appends modifier AI to the initial service so the MAC can distinguish the attending from consultants who also report an initial hospital care code. Get that wrong across a hospitalist group and you generate duplicate-service denials that look like fraud patterns in aggregate.

CPT descriptors are copyrighted by the AMA. Paraphrasing the 99223 cpt code description in an internal cheat sheet is one thing; pasting full official descriptors into a public-facing fee schedule, a patient handout, or a vendor RFP is a licensing exposure. Keep the licensed codebook or licensed encoder as the single source of truth and reference it rather than replicating it.

How Practices Document Code Selection Without Guessing

Since the 2021–2023 E/M revisions, history and exam no longer drive level selection. Two paths remain: medical decision making, or total time on the date of the encounter.

The MDM Path

MDM has three elements — the number and complexity of problems addressed, the amount and/or complexity of data reviewed and analyzed, and the risk of complications or morbidity from patient management. Two of the three must meet or exceed the level being reported. Your job as an administrator is not to judge whether an encounter reached the high level; it is to ensure the note contains enough narrative for a coder and an auditor to see the clinician's reasoning.

Practices that survive audits build a documentation prompt into the note template that asks the clinician to state what was considered, what data was independently interpreted, and what risk the management plan carried. Templates that auto-populate that language for every patient are worse than no template, because they make every chart look identical to a reviewer.

The Time Path

When time is used, it is total time on the date of the encounter by the reporting physician or qualified health professional — face-to-face and non-face-to-face — excluding clinical staff time and time spent on separately reported services. The note should state the total time and the date. "Greater than 75 minutes" without a date attached is the single most common defect billing managers find on internal review.

Prolonged services beyond the highest-level code carry different reporting rules by payer, including Medicare's own HCPCS alternative. Your billing lead should maintain a payer-by-payer grid rather than assuming CPT rules apply universally. CMS publishes its current instructions on the agency's evaluation and management billing page.

Late Entries, Addenda, and Record Integrity

A physician who signs Wednesday for a Monday encounter creates a legitimate late entry — as long as it is labeled as one, timestamped, and attributable. An entry that silently backfills MDM detail after a denial is an altered record, and an auditor who spots it will question every chart in the sample. Set a hold rule: claims do not drop until the note is signed, and any post-signature change routes through an addendum with its own author and timestamp.

This matters beyond billing. When a patient exercises the amendment right under 45 CFR 164.526, your record system has to distinguish what the clinician originally wrote from what was added later. If your addendum workflow overwrites content, you cannot answer an amendment request honestly.

Everyone Who Touches the Note Between the Bedside and the 837

Map this once and keep it current. For a typical hospitalist or specialty group billing inpatient encounters, the chain usually runs:

  1. The hospital EHR, accessed under a participation or access agreement. The hospital is a separate covered entity; your clinicians access it for treatment.
  2. A charge-capture app on physician phones, holding patient names, MRNs, room numbers, and diagnosis shorthand.
  3. A scribe or transcription service, if used.
  4. A coding vendor — frequently offshore or remote — reviewing notes to assign levels.
  5. Your billing company or RCM platform, generating the 837 professional claim.
  6. A clearinghouse, routing to payers.
  7. Denial analytics and audit-defense consultants, receiving chart extracts.

Every one of those except the hospital treatment relationship is a business associate relationship. And there is an eighth item nobody puts on the list: the rounding sheet. Printed census lists with patient names carried in a lab coat and discarded in a car are a routine source of small reportable incidents. Count them in your workflow or you will meet them in an incident report.

The BAA Gaps That Show Up in Hospital-Based Billing

Groups that bill inpatient services almost always have at least one of these holes:

  • The charge-capture app was adopted by a physician, not procured by administration. No BAA, no risk analysis entry, no offboarding process when that physician leaves.
  • The coding vendor has a BAA but no subcontractor flow-down documented, and the actual coders sit with a subcontracted staffing firm.
  • The audit consultant was engaged by outside counsel, and everyone assumed privilege substituted for a BAA. It does not.
  • The BAA predates the current HIPAA Security Rule expectations and never mentions breach notification timelines, return or destruction of PHI at termination, or permitted subcontractor use.

HHS publishes sample business associate agreement provisions that establish the required elements, but sample text is not a finished contract. If you need a signature-ready document for a coding vendor or billing partner this week, you can generate a complete Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, which matters when you are papering three vendors at once and do not want another recurring line item.

Log every executed BAA with the effective date, the services covered, the subcontractor provision, and a renewal review date. When OCR asks, the register is the evidence.

When a Payer Requests Records to Support the Claim

Disclosure to a health plan or its contractor for payment purposes is permitted without patient authorization. That is settled. The operational risks are transmission and scope.

Transmission. Use the payer portal, secure file transfer, or Medicare's electronic submission channel for medical documentation. Unencrypted email attachments and consumer fax apps without a BAA are where routine ADR responses turn into incidents.

Scope. The minimum necessary standard applies to payment disclosures. A request supporting an initial hospital care claim needs the encounter note, relevant orders and results the clinician documented reviewing, and the demographic and coverage data — not the patient's full longitudinal chart. HHS guidance on the minimum necessary requirement is short enough to hand to your billing team.

Assign one named owner for audit responses. Two people pulling charts for the same ADR is how a wrong patient's note ends up in the packet — and misdirected disclosures make up a meaningful share of the incidents visible on the OCR breach reporting portal.

The Patient Request That Includes Your Billing Data

A patient who asks what your group billed for their hospital stay is exercising the right of access. The designated record set includes billing and payment records, not just clinical notes. You have 30 days, with one 30-day extension that requires written notice of the reason and the new date.

Practical failure mode for hospital-based groups: the patient calls the hospital, the hospital sends its facility record, and the professional-fee record from your group is never produced because nobody owns the request. Write the routing rule down. Front desk and answering service both need it.

Note that payment and treatment disclosures are excluded from the accounting of disclosures — so an ADR response does not go in the accounting log. That exclusion does not remove the obligation to log the disclosure internally for your own audit trail.

A 90-Day Cleanup Sequence

Days 1–30: Inventory

Privacy officer lists every system and vendor that holds inpatient encounter data, including physician-adopted apps. Billing manager confirms which vendors have current, executed BAAs. Flag anything unsigned or older than three years.

Days 31–60: Paper and Policy

Execute missing agreements. Update the ADR response procedure with a named owner, an approved transmission method, and a minimum-necessary scope rule. Reconcile your risk analysis against the vendor inventory — if the tooling for that is thin, automating the risk analysis and policy set is faster than rebuilding spreadsheets each year.

Days 61–90: Test It

Run a mock ADR with ten charts. Time it. Check whether every note was signed before the claim dropped, whether time statements carry dates, whether addenda are distinguishable, and whether the packet left the building through an approved channel. Then run a mock right-of-access request that includes the professional-fee billing record.

Where This Leaves You

The 99223 cpt code description is a coding fact your certified coders own. The chain of custody around the note that supports it is yours. Vendor agreements, transmission methods, addendum integrity, and a named owner for every records request are what turn a routine audit into a non-event.

If your vendor register has blanks next to the coding company, the charge-capture app, or the audit consultant, close those first — build the signature-ready agreements before the next documentation request arrives, not while you are answering it.