Your nurse practitioner finished nine home visits on Tuesday. She carried a tablet with your full patient panel on it, a printed route sheet with nine addresses and nine names, and a phone she used to call the office from a driveway. Two of those charts still weren't closed by Friday. That is the operational reality behind the 99349 cpt code description — an established-patient home or residence E/M service — and it is why this article is aimed at you, not at your clinicians.

Below: what the code family actually covers, how level selection gets documented and audited, which place-of-service code goes on the claim, and the privacy and vendor exposure that follows every device and piece of paper out your front door.

The 99349 CPT Code Description in One Paragraph

CPT 99349 is a home or residence visit for the evaluation and management of an established patient. Since the 2023 CPT revision, the home or residence family absorbed the old domiciliary/rest home codes, so it covers private residences, assisted living facilities, group homes, custodial care facilities, and residential substance abuse treatment facilities. Level selection is driven either by medical decision making or by total time on the date of the encounter. Within the established-patient set — 99347, 99348, 99349, 99350 — 99349 sits at the moderate MDM tier, with a time threshold of 40 minutes or more on the date of the encounter. The rendering clinician selects the level; your job is making sure the documentation supports whichever basis was used.

The Four Established-Patient Codes and Where 99349 Sits

Your billing staff should be able to recite the ladder without opening a book. For established patients seen in a home or residence:

  • 99347 — straightforward MDM, or 20 minutes or more of total time
  • 99348 — low MDM, or 30 minutes or more
  • 99349 — moderate MDM, or 40 minutes or more
  • 99350 — high MDM, or 60 minutes or more

New-patient home visits use a separate range (99341, 99342, 99344, 99345). If your intake process is sloppy about the three-year rule for established status, you will mis-map the whole encounter before anyone gets to level selection. Front desk owns that determination, not the clinician in the car.

Time counting has a rule your clinicians will get wrong

Total time means time personally spent by the reporting clinician on the date of the encounter — reviewing the chart beforehand, the visit itself, ordering, documenting, coordinating care. Travel time does not count. Neither does time spent by clinical staff who are not the reporting provider.

Home visit programs generate more travel than any other service line in a practice, and the temptation to fold windshield time into total time is real. Build the exclusion into your template: a start/stop field labeled "clinical time (excludes travel)" prevents a whole category of audit findings. When a payer asks how the encounter reached the 40-minute threshold associated with the 99349 cpt code description, you want a time entry with a definition attached to it, not a round number.

MDM-based selection needs the elements visible

If the clinician selects on medical decision making instead of time, the note has to show the problems addressed, the data reviewed, and the risk considered. Home visits are especially prone to thin data columns — no in-office labs, no imaging on site — so the note often leans on external records review and independent historian. Those count, but only if they are documented as such.

Coders do not assign the level for the clinician. Coders check whether the documentation supports the level the clinician assigned, and route it back when it does not. Write that distinction into your coding policy so nobody in your billing office is making clinical judgments they aren't licensed to make.

Place of Service Is Where Billing and Privacy Meet

The claim carries a place-of-service code, and for home and residence visits it is not always POS 12. Assisted living is POS 13. Group home is POS 14. Custodial care facility is POS 33. The CMS place of service code set is the authoritative list, and mismatches between the POS on the claim and the setting in the note are a routine denial driver.

Here is why the privacy officer cares: the POS field on a claim is a de facto disclosure of where a patient lives, at a level of specificity that matters. A claim tagged POS 33 says something about that person. A claim tagged POS 14 says something else. This is exactly why the minimum necessary standard applies to your internal reporting too. Your route sheets, census exports, and "home visit patients" dashboards should not be circulating to staff who have no role in the program.

Also check payer policy on documenting why the service happened in the residence. Medicare does not apply the home health homebound standard to physician home visits, but payers commonly expect a note element explaining the setting. Standardize the phrasing your clinicians use so it is consistent across the panel.

The PHI That Leaves Your Building Every Morning

A home visit program moves protected health information off your network and into vehicles, private homes, and cellular connections you do not control. Treat it as a distinct risk domain in your risk analysis, not a footnote under "mobile devices."

Devices

Every tablet or laptop that goes on a route needs full-disk encryption, a screen lock timeout measured in single-digit minutes, remote wipe, and a documented inventory entry with a serial number and an assigned custodian. Encryption is your safe harbor: a lost encrypted device that meets the HHS specification is generally not a reportable breach, while a lost unencrypted one starts a breach notification analysis on the spot.

Decide deliberately whether field devices sync the full panel offline or pull records on demand. Offline sync is operationally convenient in dead zones and catastrophic in a car break-in. If you allow it, scope the sync to today's route only and set it to purge on a schedule.

Paper

Printed route sheets are the most under-managed PHI in most home visit programs. They contain names, addresses, times, and often a chief complaint. Rules to write down: no route sheets left in vehicles overnight, no personal-vehicle glovebox storage, return-and-shred at end of shift with a log, and no photos of paperwork on personal phones.

Other people in the room

A home visit happens in a space full of family members, aides, roommates, and sometimes facility staff. Incidental disclosures are permitted when you have reasonable safeguards and are following minimum necessary — but "reasonable safeguards" in a living room means something specific. Train clinicians to ask who is present, to ask the patient whether they want the conversation to continue with those people in the room, and to document the answer. In assisted living and group home settings, confirm what the facility is authorized to receive before handing anything to staff at the desk.

Your Vendor List Gets Longer the Day You Start Home Visits

Run this list against your business associate agreement register before your next visit cycle. Each of these typically touches PHI in a home visit program:

  1. Route optimization or scheduling software — holds patient names and home addresses. Almost always a business associate. Frequently missed.
  2. Mobile device management platform — has access to devices holding PHI.
  3. Mobile dictation or ambient documentation tools — recording audio in a patient's home is PHI capture, and the retention terms matter.
  4. Cellular hotspot or connectivity provider — usually conduit, but confirm rather than assume.
  5. Billing company or coding vendor handling the claims.
  6. Answering service taking after-hours calls from home visit patients.
  7. Document shredding vendor for the route sheets.

Two categories that are not business associates: a partnering home health agency or hospice, which is a covered entity in its own right and receives PHI from you for treatment purposes; and the patient's family, who receive information under the personal representative or involvement-in-care provisions. Both still require documented policy, just not a BAA.

If a vendor comes back with a redlined agreement or nothing at all, don't let the route start without paper. You can produce a signature-ready business associate agreement in an afternoon rather than waiting three weeks on a vendor's legal team.

Documentation Workflow: Assign These Four Roles

Home visit charting fails on timing more than on content. Build the workflow with named owners:

  • Scheduler — confirms established vs. new patient status and the correct residence type before the route is built. Errors here propagate to POS and code family.
  • Clinician — closes the note the same day where possible, since time-based selection depends on time on the date of the encounter. A note closed four days later invites questions about how total time was reconstructed.
  • Coder — verifies documentation supports the assigned level, checks POS against the setting documented, and returns queries without suggesting a level.
  • Privacy officer — audits device inventory, route sheet destruction logs, and access reports monthly. This is a fifteen-minute task that catches the leak before OCR does.

The 30-Day Clock Follows the Chart Home

Home visit patients request records like anyone else, and the individual right of access clock is the same: 30 days, with one 30-day extension if you notify the patient in writing with a reason. What changes is the intake path. Requests come verbally, at the door, to a clinician who is not trained to process them.

Give every field clinician a one-page script and a form. The clinician's job is to capture the request, verify identity per your policy, and hand it to the release-of-information owner the same day — not to hand over records from a tablet in a hallway. Log the date of receipt as the date the clinician received it, not the date it reached your office. That distinction has cost practices their extension window.

Your Risk Analysis Probably Doesn't Mention Home Visits

Pull yours up and search for "vehicle," "route," or "residence." If nothing comes back, your analysis does not reflect how your organization actually handles PHI — and an incomplete risk analysis is among the most consistently cited findings in OCR enforcement. NIST SP 800-66 Revision 2 is the practical reference for scoping one that covers off-premises operations.

HHS also published a proposed overhaul of the Security Rule in January 2025 that would tighten expectations around asset inventories, encryption, and documented technical controls. It is not final as of this writing, but the direction is clear: written, current, specific. Track it.

If your policy set still describes a practice that never leaves the building, you can generate a current risk analysis and the full HIPAA policy document set that names field devices, route data, and mobile access as in-scope systems — instead of retyping a template from 2019.

What to Do This Week

Three items, in order. First, confirm your coding staff can distinguish the new-patient and established-patient home code ranges and knows the time thresholds attached to each, including the 40-minute figure tied to the 99349 cpt code description. Second, reconcile your BAA register against the seven vendor categories above. Third, walk out to a clinician's vehicle at end of shift and look at what is sitting on the passenger seat.

The billing side of the 99349 cpt code description is a documentation discipline problem. The privacy side is an inventory problem. Both are solvable this quarter — and if your risk analysis and policies are the piece that's stale, build the current document set before your next payer audit or patient complaint decides the timeline for you.