Your nurse practitioner spent 80 minutes on Tuesday afternoon in a patient's living room — a first encounter, three unstable chronic conditions, two family members present, and a stack of discharge paperwork from a hospitalization she had to reconcile on the spot. She got back to her car, opened a tablet on the passenger seat, and started charting on a public cellular connection. Your billing lead now has to decide what gets submitted. Your privacy officer, if she's paying attention, has a second problem entirely.

This guide covers the 99345 CPT code description from an administrative angle: what the descriptor actually requires, how practices build documentation that supports it, which place-of-service codes travel with it, and — the part most billing guides skip — what happens to protected health information when the encounter takes place somewhere your access controls don't reach.

The 99345 CPT Code Description, Stated Plainly

CPT 99345 is the highest-level code in the new patient home or residence services family (99341, 99342, 99344, 99345). The descriptor requires a medically appropriate history and/or examination and a high level of medical decision making. When the clinician selects the code by time instead of MDM, the descriptor sets a threshold of 75 minutes of total time on the date of the encounter.

Three operational facts fall out of that:

  • Two independent paths. Either high MDM or total time meets the threshold. Your documentation template needs to make clear which path the clinician used.
  • History and exam are no longer the selector. Since the 2021 and 2023 E/M revisions, history and exam must be medically appropriate but do not drive level selection. Auditors still expect to see them.
  • It's an in-person service. Home and residence visit codes describe a clinician physically present at the patient's residence. Do not let a scheduler treat these as interchangeable with telehealth codes.

Note that CPT deleted 99343 in the 2023 revision, when the old domiciliary and rest home codes (the 99324–99337 series) were folded into the home or residence services family. If your charge master, superbill, or claim-scrubber rules still reference the retired codes, that is a cleanup task, not a coding question.

What "Residence" Covers

The home or residence family is not limited to a single-family house. It reaches private residences, assisted living facilities, group homes, custodial care facilities, and similar non-facility living settings. Your registration workflow should capture the setting type at intake, because it drives the place-of-service code on the claim — and because it changes who else is standing in the room.

New Patient Means New to the Practice, Not New to the Address

The 99345 CPT code description applies only to new patients. CPT's definition: someone who has not received professional services from the physician or qualified health professional, or from another clinician of the exact same specialty and subspecialty in the same group practice, within the prior three years.

This trips up home-visit programs constantly. A patient seen in your clinic 14 months ago is not new because the encounter moved to their kitchen. A patient seen by your cardiology partner is potentially still new to your internal medicine clinician. Build the three-year lookup into the pre-visit checklist rather than leaving it to the coder after the fact.

Assign the lookup to a named role. In most practices that's the intake coordinator who schedules the visit, not the clinician in the field — the clinician has no reliable way to check three years of practice history from a driveway.

Place of Service Codes That Ride Along

Home and residence visits fail on the claim more often for place-of-service mismatches than for level selection. The POS code has to match the setting your documentation describes.

  • POS 12 — Home
  • POS 13 — Assisted Living Facility
  • POS 14 — Group Home
  • POS 33 — Custodial Care Facility
  • POS 04 — Homeless Shelter

CMS maintains the current place-of-service code set; check it against your billing system's dropdown annually. If your scheduling software only offers "Home" as an option, your assisted-living encounters are being submitted with the wrong POS and you have a systematic denial pattern waiting to surface.

Documenting Time When Time Drives the Code

If your clinician selects by time, the note has to support it. That means a total time figure and enough narrative to make the figure credible. "75 minutes" alone is a bare assertion; auditors read it as one.

What Counts Toward Total Time

Total time on the date of the encounter includes both face-to-face and non-face-to-face work performed by the reporting clinician: chart review before the visit, the visit itself, ordering medications and tests, counseling the patient and caregivers, care coordination, and documentation completed that same calendar day.

What Does Not Count

Time performed by clinical staff who are not the reporting clinician. Travel time to and from the residence. Time spent on a different calendar day. Time already counted toward a separately reported service.

Travel is the one that generates the most internal argument. A clinician who drove 40 minutes each way and spent 45 minutes in the home has not documented 125 minutes of E/M time. Put that rule in writing in your home-visit documentation policy and reference it during onboarding.

Medical Necessity of the Setting Is a Separate Question

Medicare does not require a patient to be homebound to receive a physician home visit — that requirement belongs to the home health benefit, which is a different program. What CMS does expect is that the record documents why the visit occurred at the residence rather than in the office.

Practically: a sentence or two in the note explaining the barrier. Mobility limitation, cognitive status, lack of caregiver transport, infection risk, post-discharge instability. Your template should prompt for it, because clinicians who visit homes every day stop thinking of it as remarkable and stop writing it down. Payment rules and RVUs for the family live in the Medicare Physician Fee Schedule; check the current year's values rather than carrying forward last year's estimates.

Prolonged Services Beyond the Threshold

When documented time substantially exceeds the 75-minute threshold, prolonged services may be reportable. Medicare uses its own HCPCS G-code for prolonged home or residence services rather than the CPT prolonged-services add-on, and commercial payers vary. Have your billing lead maintain a one-page payer grid on this rather than letting each coder guess.

PHI Leaves the Building: The Privacy Half of Home Visits

Everything above is billing mechanics. Here's the part that shows up on the OCR breach portal as "Theft — Laptop" or "Loss — Other Portable Electronic Device."

A home-visit program takes your PHI outside every physical safeguard you've built. The badge reader, the locked file room, the network your firewall covers, the shredder bin — none of it applies to a clinician's car. Your Security Rule risk analysis has to account for that explicitly, and if it was written for a single office location, it doesn't.

Device and Paper Controls to Verify This Quarter

  • Full-disk encryption on every device that leaves the building, verified by report and not by attestation. Encryption is what makes the breach-notification safe harbor available to you.
  • Remote wipe capability enrolled and tested. Test it on one device per quarter and log the result.
  • Screen lock timeouts short enough to matter — a tablet left unlocked on a passenger seat is the scenario.
  • Printed route sheets. A day's schedule listing patient names, addresses, and reasons for visit is a PHI document. Decide whether they're allowed at all, and if so, where they get destroyed.
  • Personal hotspots versus open Wi-Fi. Write the rule down. Clinicians charting from a coffee shop parking lot need to know which network they're supposed to use.

NIST's guidance on managing the security of mobile devices in the enterprise is a reasonable framework for the technical side, and it maps cleanly onto the Security Rule's addressable specifications.

Third Parties in the Room

Home visits are crowded. Adult children, home health aides, facility staff, roommates in a group home. Your clinicians are making minimum-necessary judgments in real time with no privacy officer to consult.

Train to a simple default: discuss what the patient consents to have discussed, and document who was present. HHS guidance on the minimum necessary standard and on disclosures to family and friends involved in care gives you the language for a short field reference card. Print it, laminate it, put it in the bag.

The Vendor List a Home-Visit Program Quietly Creates

Stand up home visits and you will add vendors within six months. Route optimization software that receives patient addresses. A mobile documentation or ambient scribe tool. Transcription. An answering service that fields after-hours calls from the field. Cloud storage for photos of wounds or medication bottles. Mobile device management. Possibly a remote monitoring vendor whose data lands in the same chart.

Every one of those that creates, receives, maintains, or transmits PHI on your behalf is a business associate and needs an executed agreement before it touches live data. The failure mode is predictable: a clinician finds a scheduling app that works well, expenses it, and eleven months later nobody can produce a contract. That gap is exactly what an OCR investigation asks about first after a lost-device incident.

If your home-visit vendor list has grown faster than your paperwork, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — rather than routing every small vendor through outside counsel. Get the routing app and the transcription service papered this month; they're the two that always turn out to be missing.

One caution on assisted living and group homes: a facility where you see patients is not automatically your business associate. It becomes one only if it performs a function involving PHI on your behalf — holding records for you, scheduling for you, billing for you. Document the analysis for each facility relationship instead of issuing agreements reflexively or skipping them reflexively.

A Monthly Review Loop That Catches Problems Before the Payer Does

Pick a fixed date. Pull every home and residence claim from the prior month and run four checks:

  1. New versus established. Did anyone billed as new have a qualifying encounter in the prior three years?
  2. POS match. Does the place-of-service code match the setting described in the note?
  3. Level support. Does the note state whether MDM or time drove selection, and does the supporting detail exist either way?
  4. Setting rationale. Is there a documented reason the encounter happened at the residence?

Sample ten charts, not all of them. Log findings, assign corrections to a named person, and keep the log — a documented internal audit program is worth more in an investigation than a clean claim history you can't explain.

Denials Generate Records Requests, and Records Requests Have Clocks

High-level new patient codes attract payer review. Review generates records requests. Records requests pull your staff into producing charts under deadline, often by fax to a number someone read off a letter, often including more of the chart than the request actually covered.

Set the rule now: payer records requests go through one person, get logged, and get scoped to what the request specifies. A payer auditing a 99345 claim needs that encounter and its supporting documentation — not the patient's full ten-year history. Over-disclosure in response to a legitimate request is still an impermissible disclosure.

The same discipline applies when the patient asks for their own record. Home-visit patients and their caregivers request charts frequently, and the access clock does not pause because your clinician is in the field four days a week.

Where to Start

If your practice is launching or expanding home visits this year, do three things before the first claim goes out: update your risk analysis to cover off-site encounters and mobile devices, inventory the vendors the program touches and confirm each has a signed agreement, and write a one-page home-visit documentation standard that names who checks the three-year rule and who verifies the POS code.

You can put the vendor agreements in place today and handle the risk analysis and policy set through automated HIPAA documentation for healthcare organizations. Neither is glamorous work. Both are what an investigator asks for first.