Your care coordinator logged 47 minutes on a Medicare patient last month: two phone calls, a medication reconciliation, a specialist records chase, and a care plan revision after a hospital discharge summary landed. The first 20 minutes bill under 99490. The next 20 bill under the 99439 cpt code. The final 7 minutes bill under nothing at all, and your biller needs to know why before she keys the claim.

This is an operations guide for the people who own that workflow — practice administrators, billing leads, and privacy officers. It covers how 99439 is structured, what documentation has to exist before the claim goes out, and the vendor and records-handling obligations that come attached the moment you outsource chronic care management to a third party.

What the 99439 CPT Code Covers, and Why It Never Stands Alone

99439 is an add-on code for chronic care management (CCM). It describes each additional 20 minutes of clinical staff time directed by a physician or other qualified health care professional, per calendar month, and it is reported in addition to the base CCM code 99490.

Three operational rules follow from that description:

  • It requires a primary code. 99439 is never submitted by itself. It attaches to 99490 on the same claim, for the same patient, in the same calendar month.
  • Medicare recognizes a maximum of two units per patient per month. That caps the billable CCM clinical staff time at 60 minutes under the 99490/99439 family. Minutes beyond that are documented but not separately payable under these codes.
  • It does not pair with the complex CCM codes or the practitioner-time codes. 99439 belongs to the 99490 family. Practices using complex CCM codes, or the codes describing the physician's own personal time, follow a different add-on structure entirely.

Your job is not to decide clinically which family fits a given patient. Your job is to make sure the documentation your clinicians produce is specific enough that the code selection is defensible, and that whoever assigns the code has the time log, the care plan, and the consent record in front of them.

The Calendar Month Is a Hard Boundary

CCM time does not roll forward. A patient who accumulates 18 minutes in March and 25 minutes in April did not earn a 99439 unit in either month. Build the calendar-month cutoff into your care management report so coordinators see a running total and a month-end close date, not an open-ended tally.

One practitioner bills CCM for a given patient in a given month. If your patient also sees a cardiologist who runs a CCM program, someone has to lose. Decide who bills before the month starts, document the decision, and put a field in your registry for it. Duplicate CCM claims across two practices are the fastest way to invite a payer review.

Your Time Log Is the Claim

When a Medicare Administrative Contractor requests documentation for a CCM claim, it is not asking for your progress note. It is asking who spent the minutes, on what date, doing what, and under whose direction. If the answer lives in a spreadsheet on a coordinator's desktop, you have a records problem and an audit problem at the same time.

A defensible time entry contains five elements:

  1. Date of the activity
  2. Name and role of the staff member
  3. Start and stop time, or elapsed minutes
  4. A concrete description of the activity — "called patient to confirm titration schedule after discharge," not "care coordination"
  5. The supervising practitioner

Clinical staff may furnish CCM under general supervision, which means the billing practitioner does not have to be in the building. That flexibility is exactly why the supervising-practitioner field matters. Without it, nothing in the record connects the coordinator's minutes to the physician who directed them.

Minutes That Do Not Count

Train your coordinators on exclusions before they start logging, not after an audit. Time already counted toward another billed service does not count again toward CCM. Neither does administrative work with no patient-specific care component — filing, scheduling for its own sake, or eligibility checks.

The clearest way to enforce this is a short exclusion list posted in the care management workflow itself, plus a monthly spot check by your billing lead on five random patients. Compare the logged minutes to the note, the claim, and the care plan revision history. Five charts a month costs an hour and catches drift early.

CCM requires patient consent before the service starts, and the consent has to be documented in the medical record. Medicare permits verbal consent, but "permits verbal" does not mean "permits vague." The conversation has to cover the nature of the service, the fact that only one practitioner may furnish and bill it per month, the patient's right to stop at any time effective at the end of the month, and that cost sharing may apply.

That last item generates most of your inbound calls. CCM is subject to Medicare deductible and coinsurance. A patient who receives an unexpected bill for a service delivered entirely by telephone will call your front desk, and your front desk needs a scripted, accurate answer that does not turn into a coverage promise.

Write the script. Put the consent elements in a template that stamps date, staff member, and consent method into the chart. Audit it quarterly. A missing consent record invalidates the 99490 claim, and when the base code falls, every 99439 cpt code unit attached to it falls with it.

Outsourced CCM Hands a Vendor Your Entire Chart

Many practices contract CCM delivery to third-party care management companies. The economics are appealing: the vendor supplies nurses, a dialer, a care plan platform, and monthly time reports formatted for billing. The privacy exposure is substantial and frequently underestimated.

To do the work, that vendor typically needs problem lists, medication lists, allergies, discharge summaries, specialist notes, and phone numbers. Its staff calls your patients using your practice's name. It stores care plans and time logs in its own system. Under HIPAA, it is a business associate, and you need a signed business associate agreement in place before the first record moves. HHS explains the scope of that relationship in its guidance on business associates.

Ask these questions during procurement, and get the answers in writing:

  • Where does the care plan live? If it lives only in the vendor's platform, your certified EHR requirements and your records-request obligations both get harder.
  • Does the vendor record outreach calls? Recorded calls containing patient information are PHI. They also trigger state call-recording consent laws that vary by the patient's location, not yours.
  • Does the vendor subcontract? Offshore or subcontracted nursing staff require downstream subcontractor agreements. Ask for the list.
  • How is access limited? Minimum necessary applies. A coordinator managing hypertension does not need the behavioral health notes.
  • What is the breach notification clock in the contract? HIPAA gives you 60 days from discovery for most notifications. If your vendor has 60 days to tell you, you have zero. Negotiate for something short and specific.

If you are onboarding a care management vendor this quarter and the contract package came back without an executable BAA, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase, not a subscription, which makes it practical for the one-off vendor that shows up mid-year without paperwork.

The Termination Clause Nobody Reads Until They Need It

Two years into a CCM contract, your vendor holds thousands of time logs and care plans. If you switch vendors or bring the program in house, you still owe documentation for every claim in the payer lookback period.

Your agreement needs an explicit data-return provision: exportable format, defined timeline, and a certificate of destruction for what remains. Also negotiate post-termination audit cooperation. A payer request that arrives eight months after you fired the vendor is still your problem.

Patients Can Request the Care Plan — and the Time Log

The comprehensive care plan is part of the medical record. So is the documentation your practice relied on for billing. Under the HIPAA right of access, patients can request the records your practice maintains, and you generally have 30 days to respond, with one 30-day extension available. HHS's right of access guidance spells out the format and fee limits.

Now connect that to your vendor arrangement. If the care plan and the call notes sit in the vendor's platform, your medical records clerk cannot fulfill a request without vendor cooperation. Test this before it happens. Send a mock request, time the turnaround, and document the process in your access procedure. If the vendor's response time is two weeks, your 30-day clock just became a 16-day clock.

What a Payer Actually Asks For

Documentation requests for CCM claims tend to follow a predictable pattern: the consent record, the care plan in effect during the billed month, the time log with activity detail, evidence of 24/7 access to a care team member who can reach the patient's records, and the identity of the supervising practitioner. CMS maintains payment policy detail for these services through the Physician Fee Schedule.

Producing those records for a payer is a disclosure for payment purposes, permitted without patient authorization. That does not make it unlimited. Send the months and patients requested, not the full chart. Log the disclosure. If your vendor responds to payer requests on your behalf, define in the contract exactly what it may release and require it to notify you of every request it receives.

APCM Changed the Decision, Not the Documentation Discipline

The advanced primary care management codes CMS introduced for 2025 gave practices a non-time-based alternative for managing this population. They cannot be billed concurrently with time-based CCM for the same patient in the same month, so your program has to pick a lane per patient and track which one applies.

Whichever structure your clinicians choose, the operational obligations barely move. You still need documented consent, a real care plan, a vendor inventory with signed agreements, and a records process that can produce the file in 30 days. The 99439 cpt code family simply makes the time log the load-bearing document.

A 30-Day Rollout, by Role

Days 1–7 — Privacy officer. Inventory every entity touching CCM data: the care management vendor, its subcontractors, the dialer or texting platform, and any analytics tool receiving patient lists. Confirm a current signed BAA for each. Flag gaps in writing.

Days 8–14 — Billing lead. Rebuild the monthly CCM report so it shows running minutes, calendar-month close date, supervising practitioner, consent date, and a one-practitioner-per-month conflict flag. Confirm the report supports a two-unit cap on 99439.

Days 15–21 — Practice administrator. Script the consent conversation and the cost-sharing answer. Train front desk and coordinators. Document the training date and attendees; that record is what you show when a payer or regulator asks how staff were prepared.

Days 22–30 — Medical records. Run the mock access request through the vendor. Measure turnaround. Update your access procedure with the real number and escalate contractually if it does not fit inside 30 days.

Run the five-chart spot check every month after that. It is the cheapest control you own.

Close the Vendor Gap Before the Claims Go Out

Billing 99439 correctly is a documentation problem before it is a coding problem, and outsourcing the work multiplies the number of places that documentation lives. Start with the paperwork that makes the vendor relationship lawful: get a signature-ready BAA drafted and exported for every care management partner, then handle the broader policy and risk analysis set through automated HIPAA documentation so your CCM program and your privacy program tell the same story when someone asks.