Your specialty practice saw 41 referred patients last month. Your billers submitted 23 of those encounters with office consultation codes, and by the middle of February, six had come back denied — every one of them a Medicare beneficiary. Another three were downcoded by a commercial plan that asked for records and didn't find a documented request from the referring physician. If your revenue cycle keeps tripping over the 99243 CPT code and its siblings, the problem is almost never clinical. It's documentation routing, payer rules, and who has access to the chart.

This guide is for the administrator, biller, and privacy officer who own that workflow. It covers what the code family requires operationally, why payer behavior splits so sharply, and — the part most coding articles skip — what happens to protected health information when a consultation report leaves your building.

What the 99243 CPT Code Is, in Plain Administrative Terms

The 99243 CPT code is one of the office or other outpatient consultation codes (99242–99245). A consultation, in CPT's framing, is an encounter where another physician or appropriate source requests your clinician's opinion or advice about a specific problem. It is distinct from a transfer of care, and distinct from a standard office visit code (99202–99215).

Since the 2023 CPT revisions, the consultation family is leveled by either the level of medical decision making or the total time the billing clinician spends on the date of the encounter. 99243 sits at the low-complexity rung of that four-code ladder. Code 99241 was deleted effective January 1, 2023, so any internal cheat sheet, superbill, or charge-capture template still listing it is out of date and should be pulled today.

Verify the exact time threshold and decision-making descriptor against your current-year CPT book or your coding vendor's reference, not against a blog post. Descriptors get revised, and your compliance file should show that your practice relied on the authoritative source. Your job as an administrator is to make sure the documentation your clinicians produce supports whatever level gets billed — not to pick the level for them.

The 99243 CPT code reports a low-complexity office or outpatient consultation, requested by another physician or appropriate source, and selected based on either the level of medical decision making or the clinician's total time on the date of the encounter. It applies to new or established patients. Medicare does not reimburse consultation codes; many commercial and workers' compensation payers do. Practices must document the request, the evaluation, and a written report back to the requesting provider.

The Three Documents Every Consultation Claim Rests On

Billers have long called these the three Rs: request, render, report. Auditors look for all three, and two of them create privacy obligations.

1. The request, captured before the visit

Someone has to document who asked for the opinion and why. A referral form, a note in the intake screen, an inbound fax, a Direct message — the medium doesn't matter, the retrievability does. Assign this to a named role. In most practices it's the referral coordinator, and the standard should be that the request is attached to the encounter before the patient is roomed.

When your billers get an audit letter eighteen months later, they will need to produce that artifact. If the request lived only in a shared fax inbox that purges every 90 days, you have a records-retention problem masquerading as a coding problem.

2. The rendered evaluation

This is the clinician's note. Administratively, your only concern is whether the note contains the elements that substantiate the level selected — documented decision making, or a total-time attestation that names the date and the minutes. If your practice uses time-based selection, your template needs a discrete field for it. Free-text "spent significant time" language does not survive review.

3. The report back to the requesting source

The written opinion must go back to whoever asked. This is a disclosure of PHI, and it is the step where practices most often leak.

Why Medicare Denies the 99243 CPT Code and Commercial Plans Sometimes Don't

Medicare stopped recognizing office and inpatient consultation codes for payment effective January 1, 2010. Since then, Medicare instructs physicians to report the appropriate new or established patient office visit code instead, based on the site of service and the patient's status. That policy has not been reversed. If a Medicare claim goes out with 99243, expect a denial.

Commercial payers went their own directions. Many still recognize the consultation family. Some recognize it with additional documentation conditions. Some follow Medicare. Workers' compensation programs, auto liability carriers, and certain state Medicaid programs frequently do reimburse consultations, sometimes at fee schedules materially different from your commercial contracts. Check the CMS Internet-Only Manuals for current Medicare instruction, and each payer's own provider manual for the rest.

Build the payer grid your billers actually use

Create one table, maintained by one person, reviewed quarterly. Columns: payer, product line, consultation codes recognized (yes/no/conditional), documentation conditions, effective date of the policy, link or PDF of the source, date last verified. Store the source PDFs — payers change policies and rarely announce it in a way your inbox catches.

Then wire the grid into your charge-capture rules so a Medicare-primary encounter cannot be submitted with a consultation code without a hard stop. Preventing the denial costs less than working it.

The Consultation Report Is a Disclosure — Route It Like One

Sending your specialist's opinion back to the referring physician is a disclosure for treatment purposes, permitted under the Privacy Rule without patient authorization. Two practical consequences follow.

First, the minimum necessary standard does not apply to disclosures to another provider for treatment. HHS is explicit on this in its minimum necessary guidance. You are not obligated to redact the consultation report down to a summary before returning it to the requesting clinician.

Second — and this is where practices get burned — "permitted" says nothing about whether you sent it to the right place. Nearly every misdirected-report incident I have investigated traces to one of four causes:

  • A stale fax number in the referring-provider directory, never reconciled after the group moved offices
  • A fax cover sheet with the patient's name and diagnosis visible above the confidentiality notice
  • A staff member selecting the wrong "Dr. Patel" from an autocomplete list of three
  • A batch report run that attached the wrong PDF to the wrong recipient

Assign directory maintenance to a named owner with a quarterly verification date. Require a second-field confirmation — NPI or practice ZIP — before any outbound report transmits. And log every transmission in a form your privacy officer can pull during an incident review, because a misdirected report to a non-covered recipient is a potential breach requiring risk assessment under the Breach Notification Rule.

Inbound Records, the Designated Record Set, and the 30-Day Clock

When the referring practice sends you labs, imaging reports, and prior notes to support the consultation, those documents don't sit in limbo. Once your clinician uses them to make decisions about the patient, they are part of your designated record set. That means they are subject to the patient's right of access.

So when a consultation patient calls in March asking for "everything you have," your release-of-information staff cannot default to "we only send our own notes." You have 30 days from the request, with one 30-day extension available if you notify the patient in writing of the reason and the new date. HHS's individual right of access guidance is the reference to keep in your ROI binder.

Train your ROI staff on one specific decision: which inbound documents belong in the designated record set, and which are excluded. Then document the standard so two different staff members produce the same output. Inconsistency between staff is what turns an access request into a complaint.

The Vendor Layer Nobody Inventories

Count the outside parties that touch a single consultation encounter in a typical specialty practice:

  1. The referral management or e-referral platform that received the request
  2. The cloud fax or Direct messaging service that transmits the report
  3. The transcription or ambient documentation tool that produced the note
  4. The outsourced coding or auditing firm that assigns and reviews the level
  5. The clearinghouse that scrubs and submits the claim
  6. The denial-management or RCM vendor that works the rejected Medicare claims
  7. The offsite storage or scanning vendor holding the paper referral forms

Every one of those is a business associate. The outsourced coder is the one practices most often miss — a coding vendor reviewing charts to determine whether 99243 or 99244 is supportable has full access to the clinical record, and needs a signed agreement with breach-notification timelines, subcontractor flow-down, and return-or-destruction terms at the end of the engagement.

Pull your vendor list against your billing workflow this week. If you find a party handling PHI without a current signed agreement — and most practices find at least one — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon. It's a one-time purchase, not a subscription, which matters when you need three agreements this quarter and none next quarter.

What to ask a coding vendor before you sign

  • Do your reviewers access our EHR directly, or do we export records to you? Either answer is workable; the controls differ.
  • Where do exported records live, for how long, and how are they destroyed?
  • Do you use offshore reviewers or subcontractors? Name them.
  • Will you notify us of a security incident within a defined number of days, and does that number appear in the agreement?
  • Can you produce an access log for our records on request?

Responding to Payer Record Requests Without Overdisclosing

When a commercial plan requests records to substantiate a consultation claim, that's a disclosure for payment purposes — permitted, and here the minimum necessary standard does apply. Send the encounter documentation relevant to the claim under review. Do not send the entire chart because it's easier to export.

Give your billers a written standard for what a payment-purpose production includes: the encounter note, the documented request, the report, and the relevant orders and results. Track what was sent and when. If a plan later escalates to an extrapolated audit, that log is your first line of defense.

A 30-Day Sequence for Cleaning This Up

Week 1. Pull every claim submitted with a consultation code in the last 12 months. Sort by payer. Identify your denial pattern and dollar exposure. Remove 99241 from every template, superbill, and fee schedule where it still appears.

Week 2. Build the payer grid. Assign an owner and a quarterly review date. Configure the charge-capture hard stop for Medicare-primary encounters.

Week 3. Audit the referring-provider directory. Verify fax numbers and Direct addresses for your top 25 referral sources. Add second-field confirmation to outbound report transmission.

Week 4. Map the vendors touching the consultation workflow against your signed agreements. Close the gaps. Then have your privacy officer confirm that consultation-related disclosures — outbound reports, payer productions, access-request fulfillments — are all logged somewhere retrievable.

If that fourth week surfaces broader gaps — an out-of-date risk analysis, policies that don't match how your practice actually operates — the same underlying documentation set can be generated and maintained alongside your agreements rather than rebuilt from scratch every audit cycle.

The Short Version

The 99243 CPT code is only as billable as the paperwork behind it, and only as safe as the vendors and fax numbers that carry it. Get the request documented before the visit, get the report to the right recipient, know which payers recognize the code family, and know exactly who outside your walls is reading those charts.

Start with the vendor gap, because it's the one with regulatory teeth. Inventory the parties handling your consultation records, then put a signed Business Associate Agreement in place for each one before your next records request forces the question.