Your nurse practitioner finishes a Tuesday route: six established patients, four private residences, two assisted living apartments. She documents in a laptop from the driver's seat between stops, texts the scheduler a change for Thursday, and drops a folder of printed face sheets in the back seat. By Friday your biller is asking whether visit four supports the level she selected. That single day touches coding, device security, incidental disclosure, and at least three vendor relationships.

This guide covers the 99348 CPT code description from the administrator's chair: what the descriptor actually says, what your billing staff needs in the record before a claim leaves the building, and the privacy exposure that home-based care creates and office-based care does not. It is operations guidance, not clinical guidance — your clinicians select codes, and you build the workflow that documents how.

Quick answer: what is the 99348 CPT code description?

CPT 99348 is an evaluation and management code for a home or residence visit for an established patient, requiring a medically appropriate history and/or examination and a low level of medical decision making. When total time on the date of the encounter is used for code selection, 30 minutes must be met or exceeded.

  • Patient type: established (seen by the same clinician or a same-specialty partner in the same group within three years)
  • Setting: private residence, assisted living, group home, custodial care facility, temporary lodging — not a hospital, SNF, or office
  • Selection basis: medical decision making or total time on the date of the encounter
  • Family context: 99347 (straightforward), 99348 (low), 99349 (moderate), 99350 (high)

Descriptors change. CPT restructured this family in 2023 when the old domiciliary codes were folded into the home and residence set, and the new-patient side changed again with the 2025 deletion of 99343. Have someone on staff reconcile your fee schedule and encounter form against the current CPT book every January.

Where 99348 sits in your charge capture workflow

Established versus new is a scheduling decision, not a coding one

Your front desk decides new-versus-established before the clinician ever opens the chart. The three-year rule and the same-specialty, same-group test live in your scheduling system, not in the clinician's head at the bedside.

Build the check into intake: search by name, date of birth, and prior address before creating a new record. Home-visit populations move — from a house to a daughter's house to assisted living — and duplicate charts are how a genuinely established patient gets billed as new. Duplicates also break your release-of-information process later.

Time or medical decision making — pick one and document it

Under the current E/M framework, the clinician selects the level using either MDM or total time on the date of the encounter. Total time includes non-face-to-face work performed that day: reviewing records, coordinating with a home health agency, documenting the encounter. It does not include travel.

That travel exclusion is the single most common correction our readers report in home-visit programs. If your template auto-populates a time range, make sure it captures start and stop of the work, not the windshield time between addresses. Your compliance lead should sample five charts a month for this specific field.

Place of service and the homebound myth

Place of service drives payment for this family: 12 for home, 13 for assisted living, 14 for group home, 16 for temporary lodging, 33 for custodial care. A residence-based encounter billed with POS 11 is a denial waiting to happen, and a pattern of it is an audit flag.

Also retire the belief that a patient must be homebound for a physician or NP home visit. Homebound status belongs to the Medicare home health benefit, a different program with different documentation. The physician visit needs medical necessity supported in the note. CMS lays out the E/M framework in its Medicare Learning Network Evaluation and Management Services Guide; keep the current version in your billing shared drive and date-stamp it.

What your biller needs in the record before the claim goes out

Write a one-page charge-capture standard for home visits and hand it to every clinician on the route. At minimum, the note should make these elements findable without a phone call:

  1. Address type of the encounter location, mapped to a place-of-service code
  2. Established-patient basis — prior visit date and rendering clinician
  3. Whether the level was selected by MDM or by total time, stated explicitly
  4. If by time: start and stop, with travel excluded
  5. Who else was present and in what role — caregiver, aide, interpreter, agency nurse
  6. Any coordination performed that day with an outside agency, and with whom

Items 5 and 6 are where coding operations and privacy operations converge. The same line that supports a time-based level also documents a disclosure to a third party, which is why home-visit notes get read twice — once by your biller, once by whoever answers your next accounting-of-disclosures request.

Every home visit moves PHI outside your perimeter

The office has a locked door, a badge reader, and a shredder. A 2007 Buick has none of those. When you launched a home-visit line of service, you extended your covered entity's boundary to every vehicle, kitchen table, and parking lot on the route — and your Security Rule risk analysis is supposed to reflect that.

The device inventory nobody updated

Pull your asset inventory and count the laptops, tablets, and phones assigned to field staff. Then count what field staff actually carry. The gap is your exposure. Lost and stolen unencrypted portable devices remain a recurring category on the HHS Office for Civil Rights breach portal, and they are entirely preventable.

Full-disk encryption on every field device is the control that turns a stolen laptop into a lost asset instead of a reportable breach, because encrypted PHI meeting HHS specifications falls under the safe harbor. Verify it is actually enabled — not merely purchased — and keep the attestation. HHS collects its technical guidance on the Security Rule guidance page, and NIST's SP 800-66 Revision 2 maps HIPAA safeguards to concrete implementation steps.

Add remote wipe, screen-lock timeouts under two minutes, and a rule that field devices never hold the only copy of anything. Sync before the route, sync after.

Paper in the passenger seat

Route sheets, printed face sheets, and signed consent forms travel in bags that get left in cars. Set a hard rule: PHI on paper is carried on the person or locked in the trunk, never visible, never overnight. Give each field clinician a locking pouch and a scheduled shred day. Document the rule in your policy set, because an undocumented rule is a rule that did not exist when OCR asks.

Texting the scheduler

Field staff text. They text about running late, about a door code, about a patient who fell. Standard SMS is not an appropriate channel for PHI, and "we told them not to" is not a safeguard. Give them a secure messaging channel that you control and can audit, then monitor whether it is used.

If your risk analysis has not been touched since before the home-visit program launched, it is stale by definition. Practices that need to rebuild the analysis and the supporting policy set without a six-month consulting engagement can generate a documented HIPAA risk analysis and policy package that reflects mobile workforce realities, then hand the output to the clinician-owner for review and sign-off.

Who else is in the room

A home visit is a family event. A spouse hovers, a home health aide charts in the corner, a neighbor lets you in. Some of what they overhear is a permitted incidental disclosure — but only if you applied reasonable safeguards and the minimum necessary standard first.

Train to a simple field script: ask the patient, before discussing anything substantive, whether they want the other person present. Document the answer. When a caregiver is routinely involved, capture that once in the chart rather than re-litigating it every visit. HHS explains the boundaries in its guidance on the minimum necessary requirement.

Assisted living adds a wrinkle: facility staff are not automatically part of your workforce or your treatment team. Sharing a visit summary with the wellness director because it is convenient is a disclosure that needs a basis — treatment coordination, an authorization, or a written arrangement. Decide which, in advance, per facility.

The vendor list a home-visit program creates

Home-based care generates business associate relationships that office-based care does not. Walk your route and count:

  • Routing and scheduling software that holds patient names and addresses — addresses are PHI in this context
  • Electronic visit verification vendors, if you bill Medicaid personal care or home health lines subject to the Cures Act EVV mandate; these systems capture time and geolocation tied to a patient
  • Mobile device management platforms with access to device contents
  • Transcription or virtual scribe services listening to encounters in a living room
  • Answering services fielding after-hours calls from caregivers
  • Document shredding for the paper that comes back from the field
  • Staffing agencies supplying field clinicians who are not on your payroll

Each needs an executed business associate agreement before PHI flows, not after the first invoice. Practices closing gaps on a short list can produce a signature-ready BAA and get it out the same week. Keep a single register — vendor, service, BAA date, renewal, termination contact — and review it quarterly against your accounts payable list. AP always knows about vendors compliance has never heard of.

The 30-day clock when a home-visit patient asks for records

Right of access applies identically whether the encounter happened in your suite or in a mobile home. Thirty days from the request, one 30-day extension with written notice, and fees limited to a reasonable cost-based amount.

Home-visit programs miss this deadline more often for a structural reason: the request arrives verbally, at the bedside, from the patient's daughter, and never enters your intake queue. Fix it with a paper request form in every field bag and a rule that the clinician photographs it and sends it to release-of-information the same day. Log the receipt date, not the date it reached your desk.

Also settle personal representative status in advance. Adult children managing a parent's care are frequently the ones asking, and your field staff need a documented way to verify authority rather than deciding in a hallway.

A 60-minute audit you can run this week

  1. Pull ten home-visit encounters from the last quarter. Confirm place of service matches the documented location.
  2. On time-selected visits, confirm travel is excluded and start/stop times appear.
  3. Confirm each rendering clinician had an established-patient basis in the record.
  4. Inventory field devices; verify encryption is enabled on each, and screenshot the confirmation.
  5. Match your vendor register against last month's AP report; flag anything without a BAA.
  6. Ask two field clinicians how they would handle a records request at the bedside. If the answers differ, your process is not written down.

The 99348 CPT code description is a two-sentence descriptor that generates a week of operational obligations. Get the coding workflow, the device controls, and the vendor register moving in the same direction, and the audit becomes routine instead of alarming.

If your risk analysis predates your home-visit program — or you cannot produce it on demand — start by building the current-state risk analysis and policy set, then attach the device inventory and vendor register to it. That package is the first thing anyone asks for, and the last thing most practices have ready.