A nurse practitioner finishes eight home visits on a Tuesday, drives back to the clinic, and leaves the bag in the trunk overnight — tablet, a printed route sheet with fourteen names and street addresses, and two paper encounter forms she meant to hand to billing. That bag is a reportable breach waiting on a broken window. It is also the operational reality behind every claim your practice submits for a home or residence visit, which is why the 99347 CPT code description is a privacy topic as much as a billing one.

This guide is for the administrator, biller, or privacy officer supporting a house-call program. It covers what the code family requires, how practices build a defensible code-selection and documentation workflow, and the specific vendors, devices, and disclosure risks that show up the moment charting happens in someone else's living room.

What Is CPT 99347? The Short Answer

CPT 99347 is a home or residence visit for the evaluation and management of an established patient. Per the CPT descriptor, it requires straightforward medical decision making, or 20 minutes of total time spent on the date of the encounter. It sits at the lowest level of the established-patient home visit series (99347–99350).

Two things the code does not do: it does not authorize a specific clinical decision, and it does not tell your biller which level to submit. Level selection is documented by the rendering clinician based on the work performed. Your job is making sure the documentation supports whatever gets billed, and that the record of the visit is protected once it leaves your building.

The 99347 CPT Code Description in Context: The Full Home Visit Family

The 2023 CPT overhaul consolidated the old domiciliary and rest-home codes into the home-or-residence series, which changed a lot of practices' cheat sheets. If your internal fee schedule or superbill still lists 99334–99337 or 99343, it is out of date and someone should own fixing it this week.

Established patient — 99347 through 99350

  • 99347 — straightforward medical decision making, or 20 minutes total time on the date of the encounter
  • 99348 — low level of medical decision making, or 30 minutes
  • 99349 — moderate level of medical decision making, or 40 minutes
  • 99350 — high level of medical decision making, or 60 minutes

New patient — 99341, 99342, 99344, 99345

The new-patient side runs 99341 (straightforward, 15 minutes) through 99345 (high, 75 minutes), with 99343 deleted in the 2023 revision. Because the AMA owns and periodically revises these descriptors, verify your reference against the current CPT codebook and the current Medicare Physician Fee Schedule before you print anything staff will rely on for a year.

Prolonged services

When a visit runs well past the highest-level code, CPT and Medicare handle prolonged time differently — Medicare uses its own HCPCS G-code for prolonged home or residence visits rather than the CPT add-on. Confirm which applies per payer instead of assuming. Mixed instructions here are a common source of quiet underbilling.

Where "Residence" Ends and a Facility Begins

The home-or-residence family covers a private residence, assisted living, a group home, a custodial care facility, and residential substance use treatment settings. It does not cover settings that provide round-the-clock skilled nursing services — those map to the nursing facility codes.

That distinction drives your place-of-service code, and POS mismatches are one of the most preventable denial patterns in a house-call program. Build the POS decision into scheduling, not billing. Whoever books the visit records the setting type; the biller inherits it rather than guessing from an address.

Practically, that means your intake form needs a field for setting type with defined options, and your front desk needs a rule for what to do when a patient moves. A patient who transitions from a private home to assisted living mid-year changes your POS, your travel logistics, and potentially who else is in the room during the encounter.

How Practices Determine and Document Code Selection

Administrators do not select codes. What you own is the workflow that makes selection reviewable. A defensible one looks like this:

  1. Scheduling captures setting and patient status. Established versus new patient, and residence type. Assigned to the scheduler.
  2. The clinician documents the basis for the level. Either the elements of medical decision making, or total time on the date of the encounter with a start and stop or a stated total. Not both loosely — one basis, stated clearly.
  3. The clinician documents why the encounter occurred in the residence. CMS materials, including the MLN Evaluation and Management Services Guide, emphasize that the record should support the medical necessity of the service as furnished. For house calls, the setting itself invites a payer question. Answer it in the note.
  4. Notes close within a fixed window. Pick 48 hours and enforce it. Time-based documentation written from memory a week later is the weakest chart you will ever hand to an auditor.
  5. Billing scrubs for pattern risk before submission. Not level accuracy — pattern. If one clinician's home visits are 90% a single code, that is a training conversation, and it is better to have it internally than in response to a payer letter.

The worked example your billers should have on the wall

A clinician sees an established patient at home, documents 22 minutes of total time on the date of the encounter, and separately documents the medical decision making performed. Your reviewer's questions are narrow: is the patient established with this practice, is the setting a residence rather than a skilled facility, is the time or MDM basis stated unambiguously, does the POS on the claim match the documented setting, and did the note close inside the window? Nobody in billing is second-guessing the clinical content. They are verifying the record supports what left the building on a claim form.

The PHI That Leaves Your Building on a Home Visit Day

A house-call program takes the tidiest part of your security posture — a controlled office with a locked door and a wired network — and replaces it with a car, a cellular connection, and someone else's kitchen table. Your risk analysis has to account for that explicitly, and "our EHR is encrypted" is not an analysis.

Inventory what actually travels:

  • Route sheets and day lists. The single highest-density PHI artifact in the program — a dozen names paired with home addresses on one page. If they print, they get shredded on return, logged the same day.
  • Tablets and laptops with offline caching. Many mobile charting tools cache locally so clinicians can work without signal. That cache is PHI at rest on a device that lives in a vehicle. Full-disk encryption, screen lock under two minutes, remote wipe enrolled before the device ever leaves.
  • Personal phones used for wound photos or a quick call to the office. Either you provide a sanctioned pathway or clinicians will invent one. Camera rolls sync to personal cloud accounts you do not control.
  • Paper encounter forms and signed consents. Chain of custody from the residence to the scanner. Name the person who confirms every form came back.
  • Mileage, expense, and time-tracking entries. If they contain patient names or addresses, that app is handling PHI.

NIST's SP 800-66r2 resource guide for the HIPAA Security Rule is a useful structure for documenting these mobile-workforce controls in language an OCR investigator recognizes. And a scan of the OCR breach portal is a bracing reminder of how many incidents begin with a device that was in a vehicle rather than an intrusion into a server.

Vendors Your BAA List Probably Misses

Home visit programs generate a specific set of vendor relationships that never appear on the BAA list built for an office-based practice. Walk your program and check each one:

  • Route optimization and dispatch tools. You are uploading patient names and home addresses. That vendor creates, receives, maintains, or transmits PHI on your behalf. Business associate.
  • Mobile documentation or dictation apps not part of your core EHR contract, including AI scribe or transcription services. Business associate.
  • Answering services and after-hours triage lines that field calls from patients and family caregivers. Business associate.
  • Mobile device management platforms with access to device contents. Evaluate and document the determination either way.
  • Cellular carriers and internet providers. Generally the conduit exception — transmission only, no maintenance. Document the reasoning so it is not relitigated every year.
  • Contracted clinicians and staffing agencies. Depending on the arrangement, this may be a workforce question or a business associate question. Get it in writing before the first visit, not after.

If that walkthrough turned up two or three vendors already handling PHI without a signed agreement, close the gap now rather than at renewal. HHS publishes sample business associate agreement provisions as a baseline, and you can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — a one-time purchase, no subscription — which is usually faster than routing a redline through counsel for a route-planning app. Log the executed agreement in the same place you track your other vendor paperwork so the next audit does not become an archaeology project.

Incidental Disclosures in Someone Else's Living Room

Home visits guarantee that other people are present: adult children, home health aides, roommates, a neighbor who let the clinician in. The Privacy Rule tolerates incidental disclosures when reasonable safeguards are in place, but "reasonable" has to be trained, not assumed.

Give clinicians a script. Ask the patient, on the record, who may remain in the room and who may receive information. Document the answer in the chart, because the family dynamics of a house call generate more records-access disputes than any other service line you run.

Reinforce the minimum necessary standard in the small moments: no reading the day's route sheet aloud at a doorway, no leaving a tablet unlocked while stepping into another room, no discussing the previous patient in a shared hallway of an assisted living building.

When the Home Visit Chart Gets Requested

Right-of-access requests for house-call encounters arrive with complications an office visit does not have. A daughter with a power of attorney wants the last six months. A residential facility wants the visit notes for its own file. A patient asks you to mail records to the same address where the visit happened, which may be shared housing.

Your 30-day clock runs the same regardless. What changes is verification. Build a documented step for confirming personal representative status and for confirming the delivery method the patient actually chose, in writing. A facility is not automatically entitled to your note simply because the encounter happened under its roof.

Also decide where home-visit artifacts live in the designated record set. Route sheets and mileage logs generally are not clinical records, but photos, consents, and encounter forms are. Ambiguity here is what produces incomplete productions.

A One-Week Hardening Checklist

  1. Monday. Reconcile your superbill and fee schedule against the current home-and-residence code set. Retire deleted codes.
  2. Tuesday. Add setting type as a required scheduling field and map each option to a place-of-service code.
  3. Wednesday. Inventory every device and app that touches a home visit. Name an owner for each.
  4. Thursday. Identify vendors without executed BAAs and start the paperwork.
  5. Friday. Run a 15-minute clinician huddle on route-sheet handling, device lock timing, and the who-can-stay-in-the-room script.

None of that requires new software. It requires deciding who owns each step and writing it down where a surveyor can find it.

Next Step

Pull the last twenty home visit claims and check three things: does the POS match the documented setting, does the note state its basis for the level, and is every vendor that touched that encounter under a signed agreement. If the third one fails, draft and export the missing BAAs before your next visit day, and use automated risk analysis and policy generation to get the mobile-workforce controls documented alongside them. The 99347 CPT code description tells you what to bill. Your documentation and vendor file are what let you keep it.