Your physician rounded on fourteen residents at a skilled nursing facility last Tuesday. She used the facility's workstation for four charts, her phone camera for two wound photos, a paper census sheet the DON printed for her, and your own EHR for the rest — from her car, on the facility's guest Wi-Fi. Six of those encounters came back to your biller flagged for the 99309 CPT code. Only three had documentation your biller could defend without a phone call.

This guide is for the person who owns that mess: the administrator, billing lead, or privacy officer who has to make nursing facility rounding produce clean claims and a clean audit trail at the same time. It covers how code selection gets determined and documented, where the PHI actually travels, and which of the parties in that Tuesday workflow needs a business associate agreement on file.

What the 99309 CPT Code Is, in One Paragraph

The 99309 CPT code is a subsequent nursing facility care code — the third of four levels in the 99307–99310 family used for follow-up visits to residents of skilled nursing facilities and nursing facilities. Initial nursing facility care uses a separate range (99304–99306). Like all office and other outpatient E/M services since the 2023 CPT revisions, the level within 99307–99310 is selected on either the level of medical decision making or the total time the billing practitioner spends on the date of the encounter. 99309 sits at the moderate MDM tier. Your practice does not choose the level; the rendering practitioner does, and your job is to make sure the record supports whatever they chose.

The two selection paths, and why your biller needs to know which one was used

Path one is medical decision making — the number and complexity of problems addressed, the data reviewed and analyzed, and the risk of the management options. Path two is total time on the date of the encounter, which includes non-face-to-face work like chart review, ordering, and documenting, performed by the billing practitioner on that calendar date.

The time thresholds for 99307 through 99310 step upward in roughly 10-, 20-, 30-, and 45-minute increments in the current code set. Do not run your workflow off a number in a blog post. Have your coding lead pull the thresholds from the current-year CPT code set each January and post them where the rounding practitioners can see them. Thresholds have moved before and will move again.

Operationally, this means your encounter template needs a single unambiguous field: level selected by MDM or level selected by time. If it's time, the note needs the total time stated. A biller who has to infer which path was used is a biller who will guess wrong under audit.

Place of service and the Part A question

Nursing facility claims carry place of service 31 (skilled nursing facility) or 32 (nursing facility), and the distinction matters for how the claim prices and for consolidated billing edits when a resident is in a covered Part A stay. Professional services from your physicians are generally billed separately to Part B rather than bundled into the facility's payment, but the edits are unforgiving about POS mismatches. Build a rule into your charge entry: no nursing facility claim leaves the practice without POS verified against the resident's status on the date of service, sourced from the facility — not from memory.

CMS publishes payment and policy detail for these services through the Physician Fee Schedule. Assign one person to check it annually rather than letting each practitioner form their own opinion.

The PHI Trail a Nursing Facility Visit Leaves Outside Your Building

Here is the part most practices never map. A single rounding day generates protected health information in at least six places your security risk analysis probably doesn't mention:

  • The facility's EHR, accessed under a login your practice does not control or revoke
  • A printed census or face sheet carried in a bag, then left in a car overnight
  • Photos and voice memos on a personal or practice-issued phone
  • Text messages between the practitioner and the charge nurse about a resident's status
  • A charge-capture or rounding app that syncs to a vendor's cloud
  • Email from the facility's admissions coordinator with a spreadsheet of new admits

Every one of those is a records-handling decision, and every one of them is a place where a claim for a 99309 CPT code encounter can be supported — or where a breach starts. When you scope your annual risk analysis, the rounding workflow is a distinct environment, not a footnote to "mobile devices."

The census list problem

Facilities routinely hand physicians a full building census when the practitioner only follows twelve residents. Minimum necessary applies to what your practice requests. Have your practice manager ask the facility, in writing, for a filtered list limited to your panel, and keep the request in your file. If the facility can only produce the full census, document that the limitation is on their side and set a retention rule — the sheet gets shredded at end of day, not stored in a rounding bag for a month.

The same discipline applies to face sheets. A face sheet contains insurance identifiers, responsible-party contacts, and often a diagnosis list. If your billing staff need it, they need the current one, scanned into the chart, not a stack of photocopies in a rounding binder.

Which Nursing Facility Relationships Need a BAA

This is where practices get it backwards in both directions. Work through it once and write the answer down.

The nursing facility itself: generally no BAA. The facility is a covered entity in its own right. When your physician and the facility exchange information to treat a shared resident, that's a disclosure for treatment purposes between two covered entities. No business associate agreement is required for that exchange. HHS's sample business associate agreement provisions page is the reference to keep on hand when someone insists otherwise.

The facility when your physician serves as medical director: read the contract. If the arrangement involves your practice performing administrative or quality functions on the facility's behalf using facility PHI, that piece may create a business associate relationship running the other direction — with your practice as the business associate. Your attorney should look at the medical director agreement specifically for this.

Your rounding and charge-capture app: yes. Any vendor that stores, transmits, or maintains PHI on your behalf is a business associate. A rounding app that holds resident names, room numbers, and diagnosis lists is squarely in scope.

Your billing company or outsourced coder: yes. They receive PHI to perform payment functions for you.

Answering service, transcription, mobile device management, secure messaging, document shredding, cloud backup: yes.

If you just discovered a vendor on that list without a signed agreement, the fix is not a six-week legal project. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX the same afternoon — one-time purchase, no subscription — then send it out and track the returns. Close the gap first; negotiate refinements later if the vendor asks.

The 30-Day Clock When a Resident's Family Asks for the Chart

A daughter with health care power of attorney calls your office asking for every note her father's physician wrote during his nursing home stay. Your practice has 30 days to respond, with one possible 30-day extension if you notify her in writing of the reason and the new date. That clock belongs to your practice for your records — the facility's records are the facility's obligation, and you should say so plainly rather than letting the request drift.

Three operational traps show up in nursing facility requests specifically:

  1. Split records. If your practitioner documented some encounters in the facility's system and some in yours, your designated record set includes only what your practice maintains. Define that boundary in writing before the first request arrives.
  2. Personal representative verification. Powers of attorney, guardianships, and health care proxies vary by state and by document. Your front desk needs a verification checklist, not a judgment call.
  3. Fees. The permitted fee is limited to a reasonable, cost-based amount. Review OCR's individual right of access guidance with whoever quotes prices at your practice.

A Documentation Workflow That Survives a Payer Audit

Subsequent nursing facility visits draw payer attention because they repeat, on the same residents, on a predictable schedule. When a request arrives asking for ten charts billed under the 99309 CPT code, you have days, not weeks. Build the workflow so the answer is already assembled.

Same day: the practitioner

Note completed and signed within 24 hours of the encounter. Level-selection basis stated explicitly. If time-based, total time on the date of the encounter documented. Any facility-system documentation cross-referenced by date and resident so your staff can find it later.

Within 48 hours: the biller

Charge entered with verified POS and verified resident status. Any encounter missing a signed note gets held, not submitted. Held charges go on a daily report that the practice manager actually reads.

Weekly: the practice manager

Reconcile the facility census against charges entered. Two failure modes surface here — visits performed but never billed, and charges entered for residents who had already discharged. Both are findings in an audit.

Quarterly: the compliance lead

Pull a sample of nursing facility encounters and check three things: level distribution by practitioner, presence of the level-selection basis in the note, and whether any PHI from those visits still lives on a device or in a bag it shouldn't. A practitioner whose subsequent-visit levels cluster tightly at one code across every resident is not necessarily wrong — but you want to see it before a payer does.

The rendering practitioner selects the level based on medical decision making or total time on the date of the encounter. The practice's obligation is documentation, routing, and protection. Administrative staff should never upgrade or downgrade a nursing facility visit level based on payment expectations. Your role is to confirm the note states the basis for selection, the place of service matches the resident's status, the record reaches your designated record set, and every vendor that touched the encounter data has a signed BAA on file.

Your 60-Day Cleanup

Days 1–14. Map every system, device, app, and paper artifact that a nursing facility encounter touches. Interview the rounding practitioners directly; they use tools you don't know about.

Days 15–30. Match that map against your business associate agreement inventory. Every third-party name on the map either has a current signed agreement or gets one issued this month.

Days 31–45. Fix the paper. Written request to each facility for a filtered census, a shredding rule for printed lists, and a prohibition on storing rounding documents in vehicles.

Days 46–60. Update your risk analysis to include the rounding environment as its own scope, and re-run the sample audit on nursing facility encounters. If your risk analysis and policy set are stale enough that this is a rewrite rather than an edit, automating the risk analysis and policy document set is faster than another quarter of good intentions.

The billing side of nursing facility rounding is a coding conversation between your practitioner and your coder. The privacy side is entirely yours. Start with the vendor list — pull it up today, mark every name that touches nursing facility data, and generate the agreements you're missing before the next audit letter tells you which ones they were.