Your nurse practitioner finished six home visits last Tuesday and got back to the office at 6:40 p.m. with a laptop, a personal cell phone holding four wound photos, a printed route sheet listing six names and six addresses, and a stack of encounter notes she still needs to close. Four of those visits were new patients. Somewhere in that pile, someone will select the 99342 CPT code description — new patient, home or residence, low-level medical decision making or 30 minutes — and your billing staff will send a claim.

This guide is for the person who has to make that whole chain defensible: the practice administrator, the billing lead, the privacy officer. It covers what the code family actually says, how practices build documentation workflows that support code selection, and the privacy and vendor exposure that opens up the moment PHI starts riding around in a car.

Quick Answer: The 99342 CPT Code Description in Plain Terms

CPT 99342 is an evaluation and management code in the Home or Residence Services family, used for a new patient seen in a home or residence setting. The 99342 CPT code description specifies a medically appropriate history and/or examination, plus either low level medical decision making or 30 minutes of total time spent on the date of the encounter by the reporting clinician.

Context you need alongside it:

  • The family: 99341, 99342, 99344, 99345 for new patients; 99347–99350 for established patients. CPT deleted 99343 effective January 1, 2023, when it restructured the home visit codes around MDM or total time.
  • "Residence" is broad. The 2023 revision renamed the family from "Home Services" to "Home or Residence Services" and folded in assisted living facilities, group homes, custodial care facilities, and residential substance abuse treatment settings.
  • History and exam don't set the level. Since the E/M overhaul, the level is driven by MDM or total time — history and exam must be medically appropriate, but they aren't the scoring instrument.
  • Place of service must match reality. POS 12 (home), 13 (assisted living), 14 (group home), 16 (temporary lodging), 33 (custodial care) are distinct. CMS maintains the authoritative place of service code set.

Nothing here tells you which code fits a given patient. That determination belongs to the rendering clinician, supported by documentation. Your job is the workflow around it.

Time or MDM: The Choice Your Documentation Template Should Force

The code family gives the clinician two independent paths to a level. That flexibility is useful and it is also where audit findings come from, because clinicians frequently document neither path cleanly.

If the clinician selects by total time

Total time means time spent by the reporting clinician on the date of the encounter — travel time is not included, but chart review before the visit, the face-to-face encounter itself, care coordination calls, and documentation completed that same day generally are. Your template needs a discrete field for total time with a start and stop or a stated number of minutes, not a checkbox that says "30+ minutes" prefilled.

Practical rule for your billers: if the note says a time threshold was met but the clinician closed the encounter three days later, the time attribution needs to be explicit about what happened on the encounter date.

If the clinician selects by MDM

Then the note has to show the elements — problems addressed, data reviewed, risk — in a form an outside reviewer can follow. "Reviewed labs" without saying which labs or where they came from is thin. Build the template so data review has a named source.

Who checks what

Assign it in writing. A workable split: the clinician selects the code, a certified coder reviews a fixed percentage of home-visit claims before submission (10% is a common starting point for a new program), and the billing lead runs a quarterly retrospective on the full home-visit population comparing code distribution against the prior quarter. If 99342 suddenly becomes 70% of your new-patient home visits, that's a signal to look — not proof of a problem, but a signal.

The New-Patient Determination Your Front Desk Owns

"New patient" means the patient has not received a face-to-face professional service from the clinician, or from another clinician of the exact same specialty and subspecialty in the same group practice, within the prior three years. That determination usually happens at scheduling, before anyone has laid eyes on the chart.

Two operational failure points show up constantly in home-visit programs:

  1. Multi-site groups. The patient saw your partner at the clinic 14 months ago. Your scheduler, working from a home-visit-only worklist, never sees it. Fix: the new-patient flag pulls from the enterprise record, not the visit queue.
  2. Group homes and assisted living. Your clinician covers a 40-bed facility. Half those residents may have prior encounters under a different site of service. Run the three-year check against the whole roster before the first visit day, not patient by patient in the doorway.

The privacy wrinkle: verifying identity in a home is harder than at a front desk. Confirm identity with the patient or their personal representative before discussing anything — a caregiver, a neighbor, or a facility aide who opens the door is not automatically authorized to hear PHI. Train clinicians on a one-sentence script and document the personal representative relationship in the chart when one exists.

PHI in the Passenger Seat: What Home Visits Add to Your Risk Analysis

Every home visit moves protected health information outside your physical controls. The Security Rule doesn't stop at the parking lot, and your risk analysis has to account for the mobile workflow specifically. NIST's SP 800-66 Revision 2 is the practical reference for mapping Security Rule requirements to actual safeguards, and it's free.

Devices and media that actually leave

  • Laptops and tablets. Full-disk encryption, enforced auto-lock under five minutes, and a documented offline-cache policy. If the EHR caches encounter data locally for offline charting, know how much and for how long.
  • Phones. Wound photos taken on a personal phone are the single most common home-visit gap I see. Either issue devices with a managed camera roll that uploads and purges, or use the EHR's in-app capture. "They text it to themselves and delete it" is not a control.
  • Paper. Route sheets, printed med lists, signature forms. Count them out, count them back in, shred same-day. A locked case in the trunk, not the back seat.
  • Connectivity. Cellular hotspot or tethering only. Clinicians should not join a patient's home Wi-Fi or a facility's guest network to chart. Put that in the policy in one sentence so it's enforceable.

The scheduling data nobody classifies as PHI

A text message reading "9am Mrs. Alvarez, 1420 Fern St, wound check" is PHI, sitting unencrypted on a carrier network and a personal phone. So is the shared spreadsheet your coordinator uses to build routes. Apply minimum necessary to the daily route: the driver-facing view needs a name and an address, not a diagnosis.

Incidental disclosure in a small apartment

A spouse in the next room hears the whole visit. That's generally a permissible incidental disclosure if reasonable safeguards were applied and minimum necessary was observed — but "reasonable safeguards" means the clinician asked, stepped away, or lowered their voice. Document the practice; don't assume it.

The Vendor List a Home-Visit Program Quietly Expands

Stand up home visits and your business associate inventory grows within about 60 days, usually without anyone noticing. Walk the workflow and name every third party that touches data:

  • Route optimization / scheduling software — receives names, addresses, visit types.
  • Mobile device management vendor — has administrative access to devices holding cached PHI.
  • Transcription or virtual scribe service — hears the entire encounter.
  • Answering service or after-hours triage — takes callbacks from patients seen at home.
  • Third-party billing company — receives the claim, the POS code, and the supporting documentation on appeal.
  • Secure messaging or paging platform used to dispatch visit changes.
  • Document shredding vendor handling the route sheets, if you use an off-site service.

Each one needs a signed business associate agreement in place before PHI flows, with the required terms: permitted uses, safeguard obligations, subcontractor flow-down, breach notification timing, and return or destruction at termination. If you're standing up a program and staring at four vendors who need paper this month, you can generate a signature-ready business associate agreement through a guided six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, which matters when you're papering vendors in a batch rather than one a year.

One more thing to check: your BAA with the billing company should address who holds the source documentation during an audit or appeal, and how quickly they return it. Home-visit claims draw payer attention because the setting is harder to verify, and you don't want to discover the documentation-retrieval terms mid-audit.

The 30-Day Clock When a Home-Visit Patient Requests Their Chart

A patient seen at home asks for everything from the visit. You have 30 days to act on the request, with one possible 30-day extension if you notify the patient in writing of the delay and the reason. HHS's right of access guidance is the controlling reference, and OCR has enforced this provision repeatedly against practices of every size.

Home visits complicate the designated record set in three ways:

  1. Photos. Wound and environment photos taken during the visit are part of the record. If they live on a device and never got attached to the encounter, your response is incomplete and you don't know it.
  2. Home assessment notes. Safety observations, fall-risk assessments, and medication reconciliation done at the bedside are records, not scratch paper.
  3. Voice notes. Dictation held by a transcription vendor before it's finalized still exists. Know the vendor's retention window.

Build the access workflow to check the mobile capture path explicitly, not just the EHR chart. Assign one named person to own the 30-day clock and log the request date, the response date, and the extension notice if used.

A 45-Minute Audit You Can Run Before the End of This Quarter

  1. Pull 20 home-visit claims from the last 90 days. For each, confirm the POS code matches the documented setting — home versus assisted living versus group home.
  2. For every new-patient claim, verify the three-year check was actually run against the enterprise record.
  3. For every time-based selection, confirm total minutes are stated and tied to the encounter date.
  4. Inventory every device that left the building for a visit. Confirm encryption status and lock timeout on each.
  5. Search two clinicians' phones (with them, in the room) for patient images. If any exist outside the managed app, that's your finding.
  6. List every vendor touching the home-visit workflow. Match each against your signed BAA file. Note gaps with a due date.
  7. Confirm the lost-device reporting procedure names a person, a phone number, and a same-day deadline. Post it in the vehicle kit.

Document the audit, the findings, and the remediation dates. That record is what turns a bad day into a defensible one.

Where This Leaves You

The 99342 CPT code description is straightforward on paper: new patient, home or residence, low-level MDM or 30 minutes. The operational weight sits everywhere else — the new-patient determination at scheduling, the total-time field in your template, the POS code on the claim, the photo on someone's phone, the routing vendor nobody papered.

If you're launching or expanding home-based visits this year, close the vendor gap first, because it's the fastest one to fix and the most expensive one to ignore. Start by drafting the business associate agreements your new vendors need, then work outward to your risk analysis and mobile device policies — automated risk analysis and policy generation will get the rest of the document set built while your clinicians are still on the road.