On a Tuesday morning your hospitalist group rounds on 41 patients across two facilities. By 6 p.m., 38 notes are closed, three are open, and your billing coordinator is staring at a census reconciliation report that does not match the hospital's ADT feed. Most of those encounters will be coded as subsequent inpatient visits, and a large share of them will land on the 99231 CPT code.

This guide is for the people who run that pipeline — practice administrators, billing leads, and privacy officers. It covers how subsequent-visit charges get captured, routed, and defended, and then makes the records-handling and vendor obligations explicit, because a single rounding note touches the hospital's EHR, your billing company, a transcription or ambient documentation vendor, a clearinghouse, and sometimes a remote coder in another state.

What the 99231 CPT Code Is, in Plain Administrative Terms

99231 is the lowest-level code in the subsequent hospital inpatient or observation care family (99231–99233). It applies to follow-up visits by a clinician after the initial inpatient encounter. Under the E/M framework that took effect in 2023, code selection in this family is driven by either the level of medical decision making or total time spent on the date of the encounter. The CPT descriptor for 99231 references straightforward or low-level medical decision making, or 25 minutes of total time.

Your practice does not decide which code "fits" a clinical picture from the front desk. The rendering clinician documents; your coders and auditors verify that the documentation supports the level selected. That distinction matters operationally and it matters in an audit.

Who touches a subsequent-visit charge, in order

  1. Rounding clinician — documents the encounter and selects a level based on MDM or time.
  2. Charge capture — mobile app, hospital EHR charge module, or a daily census spreadsheet.
  3. Coder or coding auditor — reviews documentation against the level selected, queries when unclear.
  4. Biller/scrubber — checks payer edits, place of service, NPI, admitting relationship.
  5. Clearinghouse — transmits the 837 claim.
  6. Denials analyst — works rejections and medical-necessity denials, often by resending the note.

Six handoffs. Every one of them is a place where PHI moves and where a contract, an access control, or an audit log needs to exist.

The Capture-to-Claim Workflow That Keeps 99231 Charges From Aging Out

Morning census reconciliation

Assign one person per facility to reconcile the hospital census against your group's rounding list before noon. Discrepancies fall into three buckets: patient discharged overnight, patient transferred to a service you do not cover, and patient rounded on but never added to your list. That third bucket is where revenue disappears and where duplicate documentation shows up two weeks later with no charge attached.

The note-closure deadline you actually enforce

Set an internal rule — 48 or 72 hours from the date of service — and report on it weekly by clinician. Late notes create three problems at once: charge lag pushes claims past timely-filing windows, memory-based documentation is thinner and harder to defend, and late-signed entries invite auditor questions about whether the note was written contemporaneously.

Track two numbers monthly: median days from date of service to note closure, and median days from note closure to claim submission. If either exceeds five days, you have a workflow problem, not a clinician problem.

Time documentation versus MDM documentation

When a clinician selects a level based on total time, your documentation policy should require an explicit time statement tied to the date of the encounter, not a range and not a template default. When the level is based on medical decision making, your coders look for the elements that support the MDM level — problems addressed, data reviewed, and risk.

Your job as an administrator is to make sure the template does not pre-populate either. Auto-filled time attestations and copy-forward MDM language are the two findings that show up most often in internal audits of subsequent-visit coding.

Split and shared visits

If an advanced practice clinician and a physician both perform part of a subsequent visit in a facility setting, Medicare's split (or shared) visit policy determines who bills. That policy has been revised more than once through successive Physician Fee Schedule rulemakings, so verify the current definition of the substantive portion against the CMS Physician Fee Schedule and your MAC's local guidance before you write it into a documentation policy. Build the attestation language into your template once the rule is confirmed, and re-verify it every January.

Your Clinicians Are Documenting in Someone Else's System

Here is the structural fact that most rounding-heavy practices under-manage: the note supporting a 99231 CPT code charge usually lives in the hospital's EHR, under the hospital's access policies, with the hospital's audit logging. The hospital is a separate covered entity. Your group is another. Neither is the other's business associate simply because your physicians are credentialed there.

That arrangement has four operational consequences you should have written down.

Access is granted and revoked by the facility, not by you

When a clinician leaves your group, your offboarding checklist has to include a written termination request to every facility's medical staff office and health information management department. Do not assume credentialing lapse automatically kills EHR access. Ask for written confirmation and keep it. Set a 24-hour target for the request and a 5-business-day target for confirmation.

Snooping investigations run on the hospital's logs

If a facility privacy officer calls because one of your clinicians accessed a chart outside a treatment relationship, the evidence is the hospital's audit trail. Your practice still has to investigate, discipline if warranted, and participate in the breach risk assessment. Name in your policies who at your practice receives that call and who documents the outcome.

Copy-forward and minimum necessary

Pulling forward yesterday's assessment is a documentation-integrity problem for coding. It is also a privacy problem when clinicians copy blocks containing information about other encounters, other providers, or sensitive categories into a note that will be sent to payers, auditors, and attorneys. Audit copy-forward volume the same way you audit level distribution.

Your practice keeps a copy anyway

Most groups download or receive a copy of the rounding note for coding, denials, and internal audit. The moment that copy exists in your systems, it is part of your records inventory — subject to your retention schedule, your access controls, and your response to patient records requests. Inventory where those copies live: billing system attachments, shared drives, coder inboxes, denial-appeal folders.

The Vendor List Behind One Rounding Charge

Take a single subsequent-visit encounter and trace every outside party that touches it. A typical hospitalist or specialty consult group produces this list:

  • Billing company or outsourced RCM firm
  • Independent coding contractor or coding-audit vendor
  • Transcription service or ambient documentation vendor
  • Charge-capture mobile app vendor
  • Clearinghouse
  • Cloud storage or file-transfer platform used to move notes for appeals
  • Document-shredding and offsite-storage vendors
  • IT managed service provider with administrative access to your systems

Every one of them creates, receives, maintains, or transmits PHI on your behalf. Every one needs a signed business associate agreement in place before data flows, not after go-live. HHS publishes sample business associate agreement provisions that set the floor for required terms — permitted uses, safeguards, subcontractor flow-down, breach notification timing, and return or destruction at termination.

The gap most practices find during a vendor audit is not a missing contract with the billing company. It is the small stuff: the per-diem coder working from home under a handshake, the file-transfer tool a denials analyst signed up for with a company card, the transcription vendor whose BAA was signed in 2016 and never updated when they moved to a new subcontracted platform.

If your vendor list has holes, close them before your next audit cycle. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription — which is usually faster than routing a redline through counsel for a single-coder engagement.

Set breach-notification timing in the contract, not by default

The regulation requires business associates to report breaches to you "without unreasonable delay" and no later than 60 days. Sixty days is useless to you, because your own 60-day clock to notify patients runs from discovery. Negotiate a shorter internal reporting window — many practices use 5 to 10 calendar days for confirmed incidents and 24 to 72 hours for suspected ones — and record it in the BAA.

Records Requests That Land on a Rounding Note

A patient asks your practice for everything related to their hospital stay. Your obligation covers the designated record set your practice maintains — which includes your copies of the notes and the billing records supporting each charge. It does not extend to the hospital's full chart, which the patient requests from the facility.

The clock: 30 days from the request, with one 30-day extension if you give the patient written notice of the reason and the new date. Fees must be reasonable and cost-based. The HHS individual right of access guidance is the authority to keep on your intake desk, and access-related enforcement has been a consistent OCR priority for years.

Script the handoff

Train your front desk and release-of-information staff to say what your practice holds and to point the patient to the facility's HIM department for the rest — in writing, on the same day. Never respond with a bare refusal. "We do not have that" is how a routine request becomes a complaint.

The 99231 CPT code is the lowest-level subsequent hospital inpatient or observation care code. Documentation must support the level the clinician selected, either through medical decision making elements or a total-time statement for the date of the encounter. Practices verify this through pre-bill coding review or retrospective audits; coders query the clinician when documentation is ambiguous rather than assigning a level themselves.

Building an Audit File Before the Payer Asks

Subsequent-visit codes draw payer attention because of volume, not because any single claim is suspect. Assume a probe review will arrive. Prepare accordingly.

  • Run a level-distribution report quarterly by clinician across 99231–99233 and compare it to your specialty's national pattern. Investigate outliers internally before a payer does.
  • Audit 10 notes per clinician per quarter against the documentation the coder used. Record findings, education delivered, and re-audit results.
  • Log every audit disclosure. Sending records to a payer for payment purposes does not require authorization, but minimum-necessary still applies. Send the encounter at issue, not the entire patient history.
  • Keep the chain of custody. If notes leave your practice on a portable drive or through a consumer file-sharing account, you have created an incident waiting to be discovered. Use an encrypted channel covered by a BAA.

Consult the CMS Evaluation and Management Services Guide when you write your internal audit criteria, and re-check it annually against the current-year fee schedule rule.

A 30-Day Punch List for Rounding-Heavy Practices

  1. Days 1–5: Inventory every facility where your clinicians round. Confirm who at each facility grants and revokes EHR access, and get the termination-request contact in writing.
  2. Days 6–10: List every vendor that touches a subsequent-visit charge. Match each to a signed, current BAA. Flag gaps.
  3. Days 11–15: Close the BAA gaps. Include the shortened breach-notification window.
  4. Days 16–20: Pull charge-lag and note-closure metrics by clinician. Set the internal deadline and publish the report.
  5. Days 21–25: Run a level-distribution report and pick 10 charts per clinician for audit.
  6. Days 26–30: Update your records-request script to separate what your practice holds from what the facility holds, and train the staff who answer the phone.

None of this is glamorous. All of it is what stands between a routine payer probe and a six-month remediation project.

Start With the Contracts

The vendor list is the fastest place to make measurable progress, because the gaps are discoverable in an afternoon and closable in a week. Put together your list, then build the agreements you are missing — six steps, PDF and DOCX export, one-time purchase. If your broader policy set and risk analysis are also overdue, the automated HIPAA document and risk analysis toolkit handles the rest of the file. Get the paperwork current now, while the only thing forcing the issue is your own calendar.