Your physician spends Tuesday at three nursing facilities and comes back with fourteen encounters scribbled on the margins of a facility census printout. Your biller has to turn that into clean claims by Friday. Your privacy officer has to explain why a resident face sheet spent the afternoon on the passenger seat of a Subaru. And someone has to decide which of those visits the documentation supports — which is where the 99309 cpt code description starts to matter. This guide covers both halves of that day: how the subsequent nursing facility care family works administratively, and what mobile rounding does to your PHI footprint, records requests, and vendor list.

Quick Answer: The 99309 CPT Code Description in One Paragraph

CPT 99309 is a subsequent nursing facility care code, reported per day, for the evaluation and management of an established resident. In the code family 99307–99310, it sits at the third level: the descriptor is built around a moderate level of medical decision making, or a defined total time spent on the date of the encounter (30 minutes in the descriptor as revised for 2023). Like the rest of the office and other outpatient E/M families, level selection rests on medical decision making or total time — history and exam are performed as clinically appropriate but no longer drive the level. Always confirm descriptor language and time thresholds against your current-year CPT codebook, because the AMA revises this family periodically.

Where 99309 Sits in the 99307–99310 Family

Four codes cover subsequent nursing facility care, escalating from straightforward to high medical decision making, each with a paired total-time threshold. 99307 is the lowest level; 99310 is the highest. 99309 is the second-highest.

Separate families cover the other encounter types your rounding physicians generate: initial nursing facility care (99304–99306) and nursing facility discharge day management (99315–99316). The standalone annual nursing facility assessment code that older cheat sheets still reference was deleted in the 2023 CPT cycle. If your superbill or EHR favorites list still shows it, that is a housekeeping item for your practice manager this quarter.

Place of service is not a detail

POS 31 is a skilled nursing facility; POS 32 is a nursing facility. The E/M code family is the same, but coverage rules, delegation rules, and payer edits are not. Building POS selection into your charge-entry workflow — rather than letting it default from the last claim — prevents a predictable denial pattern.

How practices actually decide the level

Nobody in your billing office should be picking between 99308 and 99309 from a census line. The workflow that holds up looks like this: the rendering practitioner selects the level in the note, documents either the elements supporting medical decision making or an explicit total-time statement for that calendar date, signs and dates the note, and your coder audits a sample rather than re-deciding every encounter. When documentation is ambiguous, the coder queries the practitioner. The coder does not upgrade or downgrade unilaterally. Put that rule in writing in your coding policy, because it is the first thing an auditor asks about.

Who May Perform the Visit — and Why Your Credentialing File Matters

Medicare treats certain nursing facility visits as federally mandated visits, and it restricts delegation of those visits. The rules differ between SNFs and NFs, depend on state scope-of-practice law, and turn on whether the nurse practitioner, physician assistant, or clinical nurse specialist is employed by the facility. Read the source before you build the rounding schedule: CMS lays this out in the Medicare Benefit Policy Manual, Chapter 15.

Two operational consequences follow. First, "incident to" billing does not apply in institutional settings, so an NPP encounter in a SNF or NF is billed under the NPP's own NPI unless split/shared rules are met and documented. Second, your credentialing file has to be current for every practitioner who rounds — including locums and per-diem NPPs — because a claim for a visit performed by someone who was not eligible to perform it is a repayment exposure, not a coding disagreement.

Assign one person to reconcile the rounding roster against the credentialing spreadsheet monthly. Fifteen minutes. It is the cheapest audit defense you own.

The Tuesday Census Sheet Is PHI Before It Reaches Your Biller

Here is where the 99309 cpt code description stops being a billing question and becomes a privacy question. To round efficiently, your practitioner needs a list: resident names, room numbers, dates of birth, sometimes diagnoses. That list is protected health information from the moment the facility prints it. It travels in a car, sits in a bag, gets photographed, and eventually lands in a scanner or a shredder — or neither.

Map that path and write it down. Specifically:

  • How the census reaches your practitioner. Facility fax, secure portal, encrypted email, or paper pickup — pick one and prohibit the others. Personal text messages of resident lists are a recurring finding in internal audits.
  • What happens to paper during the day. Nothing left in a vehicle overnight. Nothing left on a facility nurses' station counter with your practitioner's handwritten notes on it.
  • Where notes are drafted. If a practitioner dictates or types notes into a mobile device, that device needs encryption at rest, screen lock, remote wipe, and inclusion in your device inventory. HHS's Security Rule guidance is the baseline; your risk analysis is where you prove you applied it to the rounding fleet specifically.
  • Disposition of the paper. Cross-cut shredding at the practice, logged. Not a facility trash can.

Also apply the minimum necessary standard in the other direction. If the facility sends a 40-resident census when your practitioner is seeing nine, ask for a filtered list. It is a reasonable request, and it shrinks the blast radius of a lost page.

Facility EHR Access, Shared Logins, and the Audit Trail You Don't Control

Your practitioners almost certainly document in the facility's system, in your own system, or in both. Three things to settle before the next credentialing cycle:

1. Named accounts only

If the facility hands your NP a shared "visiting provider" login, you have lost attribution. When an access complaint arrives, you cannot show who viewed what. Insist on individually named accounts and treat any refusal as a documented risk with a compensating control.

2. Offboarding runs both ways

When a practitioner leaves your practice, someone must notify every facility to deactivate access. Keep a per-practitioner list of facility system credentials in your termination checklist. Orphaned access at a nursing facility is invisible to your own IT team, which is exactly why it lingers.

3. The facility is a covered entity, not your business associate

Sharing records with the facility for the resident's treatment is a permitted disclosure. You do not need a BAA for that, and asking for one confuses everybody. But the relationship changes if you also perform a non-treatment function for the facility — medical direction, quality review, utilization work. Read those service agreements carefully and decide which hat you are wearing. When you do need an agreement in place, generating a signature-ready business associate agreement is a same-day task, not a legal project.

Vendor Inventory for a Rounding Practice

Nursing facility work quietly expands your vendor list. Walk your own workflow and confirm a signed BAA and a current security review for each of these, where applicable:

  1. The billing company or clearinghouse that submits your 99307–99310 claims.
  2. Any transcription or ambient documentation service used on rounds.
  3. The secure messaging or mobile documentation app on practitioner phones.
  4. Remote-access or VPN tooling used to reach your EHR from a facility.
  5. Cloud storage where dictations or photos land, including anything that syncs by default.
  6. The document shredding vendor, if paper leaves the building.
  7. Your answering service, which routinely takes resident names from facility nurses.
  8. Coding audit consultants who receive charts for review.

That list is also the input to your risk analysis, which is the document OCR asks for first in almost every investigation. If yours is a spreadsheet someone built three years ago and nobody has touched since the rounding program expanded, fix that before you need it. Tools that automate the HIPAA risk analysis and the supporting policy set make the mobile-rounding scenario — devices off-site, third-party systems, paper in transit — an entry in a maintained record rather than a memory.

Documentation That Survives a Records Request or Audit

Payer reviews of subsequent nursing facility care focus on a short list: was the practitioner eligible to perform the visit, was the visit medically necessary, does the note support the level selected, and is the note signed and dated by the rendering practitioner. Time-based level selection invites one extra question — where is the total-time statement for that calendar date? A generic template phrase that appears identically on every note is worse than nothing.

Producing records for an audit is a permitted disclosure for payment or health oversight purposes, so you do not need resident authorization. You do need a disclosure log entry, a minimum-necessary review of what you send, and a secure transmission method. Assign one staff member as the records custodian for audit responses so requests do not get answered ad hoc by whoever opens the mail.

When the Resident's Daughter Calls for the Chart

This is the most common privacy event in nursing facility practices, and it is usually mishandled at the front desk. A family member calls, says she has power of attorney, and asks for her father's visit notes.

Your obligations: honor a valid right-of-access request from the resident or their personal representative, generally within 30 days, in the form and format requested if readily producible, at a cost-based fee only. Verify representative status against your state's rules before releasing anything — and remember that a personal representative's authority may be limited in scope. HHS's right of access guidance is the reference to keep on the front-desk shelf.

One clarification your staff needs scripted: you hold your practitioner's notes; the facility holds the facility record. Callers routinely ask you for nursing notes, MAR entries, or therapy documentation you do not maintain. The correct response is to produce what you have and redirect the rest, not to forward the request into a void.

A 30-Day Cleanup Plan for Your Rounding Program

Week 1 — Practice manager. Pull the current-year CPT codebook and update the nursing facility section of your superbill and EHR favorites. Delete retired codes. Confirm POS 31/32 logic in charge entry.

Week 2 — Compliance lead. Reconcile the rounding roster against credentialing and against facility system access. Document delegation rules per facility type against Chapter 15 and file the memo.

Week 3 — Privacy officer. Map the census sheet from facility to shredder. Inventory every device that touches resident data off-site. Close BAA gaps against the eight-item vendor list above.

Week 4 — Coder plus one practitioner. Audit ten subsequent nursing facility encounters. Check level support, time statements, signature and date, and whether the documentation was created by the person who billed it. Report findings to the practitioner group, not just to the file.

Do that once and the 99309 cpt code description becomes what it should be — a descriptor your practitioners apply and your coders verify, rather than a monthly argument between billing and the schedule.

Next Step

Rounding programs create exposure your office-based risk analysis never contemplated: devices off-site, records in transit, credentials in systems you do not administer. If your current documentation cannot show how you assessed those specific risks, build the risk analysis and policy set that covers your mobile workflow before an access complaint or a lost bag forces the question. It is far cheaper as a February project than as a June investigation response.