A cardiology group's front desk takes a call Monday morning: a family medicine office is sending a patient over and wants "a consult, not a transfer." By Thursday the visit is done, the note is signed, and your biller is staring at a claim that says 99244. Two weeks later the commercial payer denies it, and the requesting physician's office calls asking why they never got a report. The 99244 cpt code definition matters here for two reasons that live in different parts of your building — one billing, one privacy.

This guide is written for the people who own both: practice administrators, billing leads, and privacy officers. It covers what the descriptor requires, how practices document code selection, which payers recognize the code, and — the part usually skipped — how the consultation report travels and which vendors need a Business Associate Agreement before it does.

The 99244 CPT Code Definition, in the Terms Your Coders Actually Use

CPT 99244 sits in the office or other outpatient consultation family: 99242, 99243, 99244, and 99245. The family was restructured for 2023 alongside the rest of the E/M code set. Code 99241 was deleted, the history and exam bullet-counting went away, and level selection now rests on either the level of medical decision making or total time spent on the date of the encounter.

For 99244, the AMA descriptor pairs a moderate level of medical decision making with a total-time threshold of 40 minutes that must be met or exceeded on the date of the encounter. The code applies to a new or established patient — unlike the office visit codes, the consultation family does not split on that axis.

Two guardrails your coding staff already know, but that administrators should be able to state out loud:

  • Time counts qualifying activities on the encounter date only. Review of records, the face-to-face portion, ordering, counseling, and documentation performed that day roll into total time. Time spent on a different calendar day does not.
  • Prolonged-service add-ons attach to the top of the family, not to 99244. If the encounter runs long enough that someone reaches for a prolonged code, that is a signal to re-check level selection rather than stack an add-on.

Beyond time and MDM, the consultation family carries structural requirements the office visit codes do not. CPT guidance for consultations expects a request from another physician or other appropriate source, the request and reason documented in the patient's record, and the consultant's opinion communicated back in a written report. Miss the report and you have a documentation gap regardless of how clean the time math is.

What Determines the Level Is Documentation, Not Habit

Your practice does not decide in advance that referrals from a given group are "usually 99244." The clinician documents the medical decision making and, where relevant, the total time; the coder selects the level from what is documented. Your job as administrator is to make sure the template captures both inputs so the selection is defensible — and to make sure nobody is auto-populating a time statement.

Practices that get burned in audits usually get burned on time attestations that appear identically on every note. If your EHR template pre-fills "40 minutes," fix the template this quarter.

The 99244 cpt code definition is the AMA CPT descriptor for a level-four office or other outpatient consultation for a new or established patient, requested by another physician or appropriate source, supported by either a moderate level of medical decision making or 40 or more minutes of total practitioner time on the date of the encounter. A written report back to the requesting source is part of the consultation requirement. Medicare does not pay consultation codes; recognition varies by commercial and Medicaid payer.

Medicare Stopped Paying Consultation Codes — Your Payer Grid Must Say So

Since 2010, Medicare has not recognized the office and inpatient consultation code families for payment. Claims for Medicare patients get reported using the appropriate office visit or other applicable E/M codes instead. That policy has not changed, and it is the single most common source of consult-code denials in a mixed-payer practice.

Commercial payers and state Medicaid programs are a patchwork. Some recognize 99242–99245 fully, some pay them at office-visit rates, some require the requesting provider's NPI in a specific loop on the claim, and some do not accept them at all. CMS maintains general E/M guidance and fee schedule material at cms.gov, but payer-specific recognition comes from your contracts and payer policy bulletins.

Operational fix, and it is boring on purpose:

  1. Build a one-page payer grid listing every payer you contract with and whether it recognizes the consultation family.
  2. Assign an owner — usually the billing lead — to refresh it each January and whenever a payer policy bulletin lands.
  3. Put the grid where the coding staff sees it, not in a shared drive folder three levels deep.
  4. Track consult-code denials as their own denial reason so you can see drift within a quarter instead of at year-end.

The Written Report Back Is a Coding Requirement and a Disclosure

Here is where the two halves of this article meet. The consultation report you send to the requesting physician is required by the coding rules and is simultaneously a disclosure of protected health information.

Good news first: that disclosure is a treatment disclosure, permitted under the Privacy Rule without patient authorization, and it does not require an accounting of disclosures. You do not need a signed form before faxing the consult note back to the referring office.

The exposure is not permission — it is delivery and scope. Two failure modes show up repeatedly in practice:

Misdirected Reports

Wrong fax number, stale directory entry, a secure-message thread that includes a departed staffer, or a report attached to the wrong patient's chart. Misdirected consultation reports are ordinary, unglamorous impermissible disclosures, and they are exactly the kind of small incident that becomes a breach determination after you run the four-factor risk assessment. Browse the public HHS breach portal and you will see how many reported incidents trace back to routine document transmission rather than to hacking.

Control: verify the destination against a directory your practice maintains, not against whatever number appeared on the referral slip. Require a second-person check on any consult report leaving the building for a new referral source.

Sending the Whole Chart Instead of the Report

Staff under time pressure will attach a full chart export because it is one click instead of five. Treatment disclosures get more latitude, but your internal policy should still define what a consultation report contains. HHS guidance on the minimum necessary requirement is a reasonable anchor for writing that policy, and reviewers ask to see it.

Every Vendor That Touches a Consult Report Needs a BAA on File

Map the path a single 99244 encounter takes and count the third parties. A typical specialty practice hands that record to more than most administrators expect:

  • The e-fax or secure document delivery service carrying the report to the requesting provider
  • The transcription or ambient documentation service that produced the note
  • The outsourced coding or coding-audit firm reviewing level selection
  • The billing company or clearinghouse submitting the claim with the requesting provider's identifiers
  • The release-of-information vendor handling records requests that later include the consult
  • The offsite storage or shredding company handling paper referral packets
  • The IT support firm with remote administrative access to the EHR

Each of those is a business associate. Each needs a signed agreement in place before PHI moves, with the required content — permitted uses, safeguards, subcontractor flow-down, breach reporting timelines, and return or destruction at termination. HHS publishes sample business associate agreement provisions if you want to see the baseline language.

The realistic problem is not disagreement about whether BAAs are required. It is that a practice adds a transcription vendor in March, an outsourced coding reviewer in June, and a new fax platform in September, and nobody generates paper for any of them. If your vendor list has grown faster than your contract file, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — which is usually faster than waiting for a vendor to send their own template and then arguing about the subcontractor clause.

Assign one person to own the vendor inventory. Review it at the same meeting where you review the payer grid. Two lists, one hour, twice a year.

When the Patient Asks for the Consult Report

Patients request consultation notes constantly — for a second opinion, for disability paperwork, for their own files. The consult report is part of the designated record set, and the right of access applies.

Your clock is 30 days from the request, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Fees must be limited to the reasonable, cost-based amounts permitted under the rule. HHS's right of access guidance is the reference to keep bookmarked; OCR has pursued a long series of enforcement actions on access delays, and they are among the least defensible findings a practice can collect.

One nuance worth training the front desk on: a patient who asks you to send the consult report to another provider is exercising a right of access with a directed disclosure. That is not a subpoena and not an authorization puzzle. Log it, verify the destination, meet the clock.

Payer Records Requests After a Consult-Code Denial

When a payer denies or audits a 99244 claim and requests documentation, that release is a payment disclosure — permitted, no authorization needed, no accounting required. Send the encounter documentation supporting level selection: the request and reason from the referring source, the MDM or time documentation, and the report. Not the patient's entire history.

Route those requests through one queue with one owner. Payer audit responses that get handled ad hoc by whoever opened the envelope are how full charts leave the building.

A Worked Example, Roles Assigned

A gastroenterology practice receives a written request for opinion from an internal medicine group for an established patient.

  • Front desk scans the request into the chart and flags the encounter as a consultation, capturing the requesting provider's name and NPI.
  • Clinician documents the reason for the request, the medical decision making, and total time on the date of service.
  • Coder selects the level from documentation and checks the payer grid. Payer recognizes the consultation family, so the claim goes out with the requesting provider identified.
  • Clinical staff sends the report back through the practice's secure delivery vendor — the one with a current BAA — to a number verified against the practice directory.
  • Privacy officer sees the transmission log in the monthly review, spots one report sent to an unverified number, runs the four-factor assessment, and documents the outcome.

Five roles, one encounter. Every one of them has a way to create a billing problem or a privacy problem, which is why the 99244 cpt code definition belongs in your operations manual rather than only in the coding staff's heads.

Your Next Two Hours

Pull your consult-code denial report for the last two quarters and see whether the pattern is Medicare patients, missing requesting-provider data, or level documentation. Then pull your vendor list and mark every entry without a signed agreement in the file.

If the second list is longer than the first, start there — draft the missing Business Associate Agreements and get them signed, or work through the broader risk analysis and policy set if the gaps run deeper than contracts. Coding errors cost you a claim. Undocumented vendor relationships cost you the enforcement conversation.