Your nurse practitioner drove to four private residences last Tuesday. She carried a tablet, a phone with a hotspot, a printed route sheet with four names and four street addresses, and a portable pulse oximeter. Three of those encounters were new patients. Your biller now has to pick a code, and your privacy officer — possibly the same person — has to answer a harder question: where did all that PHI go?

The 99344 CPT code description sits at the center of both problems. It is one of the new-patient home or residence visit codes, and understanding what it actually requires tells you what your clinicians must document, which in turn tells you exactly how much protected health information is now living on devices and in vendor systems outside your four walls. This guide covers the operational mechanics first, then the privacy and vendor obligations that ride along with them.

What the 99344 CPT Code Description Actually Says

99344 is a home or residence visit for the evaluation and management of a new patient. Per the CPT descriptor structure adopted for the 2023 code set, it requires a medically appropriate history and/or examination plus a moderate level of medical decision making, with a total-time alternative of roughly 60 minutes spent on the date of the encounter.

Two things about that sentence matter more than the number itself. First, "new patient" carries the standard CPT definition — no face-to-face professional service from your practice, or from a same-specialty physician or qualified health professional in your group, within the prior three years. Second, the code is level-selected the same way office E/M codes have been since 2021: by medical decision making or by total time, whichever the clinician documents and supports. History and exam are performed as medically appropriate but no longer drive the level.

The 2023 restructuring your billing staff needs to remember

The old domiciliary, rest home, and custodial care codes were deleted and folded into the home or residence family. 99343 went away in the same restructuring. The surviving new-patient series runs 99341, 99342, 99344, and 99345, ascending by medical decision making and time. Established-patient home visits use 99347 through 99350.

If your fee schedule, superbill, or EHR order set still lists 99343 or a 993xx domiciliary code, you have a stale build. That is a billing accuracy problem and, less obviously, a record integrity problem — the Security Rule expects your systems to produce accurate, complete records, and a charge template that fires a deleted code produces neither.

Place of service, not the CPT code, defines the setting

The home or residence codes cover a private residence, an assisted living facility, a group home, a custodial care facility, and similar non-facility residential settings. Your place-of-service code has to match reality: 12 for home, 13 for assisted living, 14 for group home, 33 for custodial care. Skilled nursing facility encounters are a different code family entirely.

Assign responsibility for POS selection explicitly. In most practices the clinician selects the encounter type and the biller validates POS against the scheduling record. Write down who does which, because a POS mismatch is one of the easiest audit findings a payer can generate.

Quick Answer: The 99344 CPT Code Description in One Paragraph

CPT 99344 describes a home or residence visit for the evaluation and management of a new patient requiring a medically appropriate history and/or examination and a moderate level of medical decision making, with an approximate total time of 60 minutes on the encounter date. It applies to private homes, assisted living, group homes, and custodial care settings — not skilled nursing facilities. Level selection is driven by medical decision making or total time, documented by the treating clinician. Always verify descriptors and time thresholds against the current CPT code book and your payer's policy before building it into a charge template.

How Your Practice Decides and Documents the Level

Administrators do not pick codes. Clinicians do, based on the encounter they performed. What you own is the process that makes their selection defensible.

A workable process has four parts. The clinician documents the problems addressed, the data reviewed, and the risk of the management options — the three MDM elements — or documents total time with a description of the activities that consumed it. The template prompts for both paths so nothing is lost when the clinician chooses time. Your coding reviewer samples a percentage of home visits monthly and checks whether the documentation supports the level submitted. Discrepancies go back to the clinician, not to a coder who "fixes" the level unilaterally.

Total-time documentation for home visits deserves special attention. Travel time is not billable time. If a clinician records 60 minutes and the schedule shows the visit block was 25 minutes plus 35 minutes of driving, you have a problem that surfaces in the worst possible venue. Train on this once a year and put it in writing.

Medical necessity for the setting

Payers generally expect the record to reflect why the service occurred in the residence rather than the office. Documentation practice varies and requirements change, so check current guidance in the CMS Physician Fee Schedule materials and your commercial payer manuals rather than relying on a policy someone wrote in 2019.

The Paper and Pixel Trail a Home Visit Leaves Behind

Now the part billing guides skip. A single 99344-level encounter typically generates: a route sheet with names and addresses, a tablet-based note, possibly ambient or dictated audio, wound or environment photographs, a mileage log, a hotspot session, text messages between the clinician and the scheduler, and a follow-up phone call from a car.

Every one of those is a PHI touchpoint outside your physical safeguards. The route sheet alone — name plus home address plus "cardiology follow-up" — is a disclosure risk sitting in a passenger seat. Home visit notes also tend to be unusually rich: who else lives in the home, household conditions, food access, substance use, firearms, caregiver dynamics. That content is clinically appropriate and it makes the record more sensitive than a typical office note.

Every Home Visit Program Needs a Refreshed Vendor List

Sit down with your actual home-visit workflow and list every third party that touches the data. In most practices the list is longer than the compliance file suggests:

  • Mobile device management or endpoint platform — manages and can wipe the field tablets. BAA required.
  • Cloud dictation, transcription, or ambient documentation tool — processes the encounter audio. BAA required.
  • Route optimization or field scheduling software — holds names and addresses. BAA required.
  • Answering service or after-hours triage — takes calls from patients seen in the home. BAA required.
  • Billing company or coding contractor — receives the note and the claim. BAA required.
  • Secure messaging or texting platform used between clinician and scheduler. BAA required.
  • Document courier or shredding service handling printed route sheets. BAA required.
  • Patient transport, ride-share, or interpreter services — analyze each one; interpreters handling PHI in a clinical encounter generally need an agreement, while a transport vendor may or may not, depending on what you disclose.

If any name on that list lacks a signed, current agreement, close the gap before your next audit does it for you. You can produce a signature-ready document quickly with a six-step business associate agreement generator that exports to PDF and DOCX — one-time purchase, useful when you discover three unpapered vendors on a Thursday afternoon and need them countersigned by Monday.

Also confirm each vendor's subcontractor posture. A routing tool built on a cloud provider you have never heard of still owes you flow-down obligations under its BAA.

Incidental Disclosures in Someone Else's Living Room

Your clinician conducts a 60-minute new-patient evaluation at a kitchen table while an adult child, a home health aide, and a neighbor move in and out of the room. The Privacy Rule tolerates incidental disclosures that occur despite reasonable safeguards, and it permits disclosure to family involved in care when the patient does not object. It does not tolerate a clinician narrating the assessment to whoever happens to be present.

Give field staff a short, concrete script: confirm with the patient who may remain in the room, note that confirmation in the record, and move sensitive discussion to a separate space when the patient asks. Document the patient's stated preference at the first visit so it carries forward. Review the HHS guidance on sharing information with family and caregivers and turn it into a one-page field reference rather than a policy nobody reads.

Photographs

Wound and environment photos taken on a personal phone are the single most common finding in home-visit programs. Either provide managed devices with a camera that writes directly into the EHR, or prohibit photography outright. There is no workable middle position where a clinician texts an image to themselves and deletes it later.

When the Tablet Doesn't Come Back

Field devices get left in cars, restaurants, and waiting rooms. The question is whether that event is a reportable breach or a bad afternoon. Full-disk encryption meeting current NIST recommendations is the difference — encrypted PHI that meets HHS's specification is not "unsecured" PHI, and the notification obligation does not attach. Read the actual HHS guidance on rendering PHI unusable, unreadable, or indecipherable and confirm your encryption configuration matches it. Encryption enabled but with keys stored on the same device does not count.

Then verify three operational details: your MDM can remote-wipe within minutes, your inventory list is accurate to the serial number, and your staff know who to call at 7 p.m. on a Saturday. Run the drill once a year. The first time you attempt a remote wipe should not be during a real incident.

Records Requests for Home Visit Notes

Home visit documentation draws requests from adult children, facility administrators, disability insurers, and attorneys. The 30-day access clock under the individual right of access applies exactly as it does to office notes, with one 30-day extension available if you notify the requester in writing. Facility staff at an assisted living location are not automatically authorized recipients simply because the visit happened on their property.

Apply minimum necessary rigorously on disclosures that are not to the patient. A note describing household conditions and a third party's substance use may need review before release. Assign that review to a named person, not "whoever pulls the chart." HHS maintains detailed right of access guidance worth re-reading before you rewrite your release procedure.

A 30-Day Cleanup Checklist

  1. Week 1: Pull your charge master and delete every retired home visit and domiciliary code. Confirm 99341, 99342, 99344, 99345, 99347–99350 are the only entries.
  2. Week 1: Map POS codes to your scheduling location types and assign validation to a named biller.
  3. Week 2: Inventory every device that travels. Verify encryption, MDM enrollment, and screen lock timeout.
  4. Week 2: Build the home-visit vendor list above and check every BAA against it.
  5. Week 3: Update your risk analysis to include the field workflow as a distinct environment. If yours has not been touched since your last office renovation, automated risk analysis and policy generation will get you to a current document faster than a blank template.
  6. Week 4: Train field clinicians on incidental disclosures, travel-time documentation, and the photography rule. Log attendance.

The 99344 CPT code description is a billing fact your coders can look up in five minutes. The operational program behind it — devices, vendors, route sheets, and consent conversations in strangers' living rooms — is what you actually manage. Get the coding build right, then get the vendor paperwork right, because a home-visit program with clean claims and unpapered vendors is a program with one clean half.

If your vendor list came up short this week, start with the agreements. A signature-ready BAA generated in six steps closes the gap today, and you can spend the remaining time on the training that keeps PHI in the bag it left in.