A denial letter arrives on a Tuesday for a date of service fourteen months old. The claim is a telephone encounter, the code is 99443, and the payer wants documentation of the time spent. Your biller pulls the note, finds "discussed at length by phone," and stops. That is the moment the 99443 CPT code description stops being trivia and becomes an operational problem — because the code was deleted from CPT effective January 1, 2025, and the person who billed it no longer works there.

This guide is for practice administrators, billing leads, and privacy officers who still have to defend, appeal, correct, or produce records tied to telephone evaluation and management services. It covers what the code required, what replaced it, how your staff should document time, and — the part most billing SOPs skip entirely — which vendors sitting in your phone path need a Business Associate Agreement.

The 99443 CPT Code Description, Stated Plainly

CPT 99443 described a telephone evaluation and management service provided by a physician or other qualified health care professional who may report evaluation and management services, furnished to an established patient, parent, or guardian, involving 21–30 minutes of medical discussion.

The definition carried three qualifiers that drove most denials:

  • The service could not originate from a related E/M service provided within the previous seven days.
  • The service could not lead to an E/M service or procedure within the next 24 hours or the soonest available appointment.
  • The patient had to be established with the practice.

The three-code family

99443 sat at the top of a three-code time ladder: 99441 for 5–10 minutes of medical discussion, 99442 for 11–20 minutes, and 99443 for 21–30 minutes. Time was the sole distinguishing element, which is precisely why documentation of time is the first thing a payer asks for on audit.

Your coders determine code selection from the documented encounter, the payer's published policy, and the practice's coding guidelines. Nobody in your billing department should be assigning a level from a verbal description of the call.

The Code Was Deleted January 1, 2025 — and You Still Need the Definition

The 2025 CPT code set retired 99441, 99442, and 99443. As of today, March 21, 2026, you are more than a year past that deletion. So why keep the 99443 CPT code description in your reference materials?

Because payer look-back windows outrun code sets. Commercial recoupment periods commonly run 12 to 24 months, some state Medicaid programs and federal payers reach further, and False Claims Act exposure runs longer still. A 2024 date of service can generate a records request in 2026, and the person answering it needs to know what the code required before they decide what to send.

Practical situations where the old definition still governs:

  • Retroactive audits and recoupment demands on 2023–2024 dates of service.
  • Corrected claims and appeals that must be resubmitted with the code set in effect on the date of service.
  • Credit balance and refund analysis when a telephone claim overlapped an office visit inside the seven-day or 24-hour window.
  • Payer-specific policies that lagged the CPT deletion — some plans and state programs kept legacy or crosswalked codes active on their own timelines.

Keep a dated archive of retired code definitions and the payer policies that referenced them. If your only reference is a live coding lookup that reflects the current year, you cannot reconstruct what was correct in 2024.

What Replaced Telephone E/M, and Why Payment Doesn't Track CPT One-to-One

The 2025 CPT code set introduced a dedicated telemedicine E/M family, including audio-video services and a separate set of synchronous audio-only E/M codes, plus a brief communication technology–based service code for short virtual check-ins. The audio-only codes absorbed the clinical territory that 99441–99443 used to occupy.

Here is the trap: CPT publishing a code does not mean Medicare pays it. The Physician Fee Schedule assigns its own status indicators, and CMS has not adopted every new telemedicine E/M code for separate payment. Medicare's broader telehealth flexibilities have also moved through a series of short-term legislative extensions rather than a permanent rule.

Assign one person — usually the billing manager — to verify three things every January and every time an extension deadline approaches:

  1. The current status indicator for each telemedicine code you bill, from the fee schedule itself.
  2. The current CMS telehealth coverage guidance, including any active expiration date on flexibilities.
  3. Each commercial payer's published telehealth policy, because they diverge from Medicare freely.

Document the verification date in your coding policy. Auditors respond much better to "we checked on this date and here is the source" than to a confident assertion with no provenance.

How Your Staff Should Document an Audio-Only Encounter

Time-based codes fail on documentation, not on medical judgment. Build the template so the elements land in the note automatically rather than depending on dictation habits.

The five fields that survive an audit

  • Start and stop time, or total minutes of medical discussion, recorded by the clinician — not reconstructed later by billing from a phone log.
  • Who was on the call — patient, parent, guardian, interpreter, caregiver — and the identity verification method used.
  • Patient consent to the audio-only encounter and to any applicable cost sharing, captured at the time of service.
  • The seven-day look-back and 24-hour look-forward check, or the equivalent under whatever code set applies to the date of service.
  • Modality — audio-only versus audio-video — stated explicitly, because the code family depends on it and because your privacy analysis differs.

Who touches the record, and when

Clinician documents within 24 hours. Billing runs a scrub that flags any telephone encounter with an office visit in the surrounding window before the claim drops. Compliance samples ten telephone encounters per quarter and checks whether documented time supports the level billed. Front desk never selects a code.

That last line matters more than it sounds. When a scheduler or a medical assistant picks the level because "the doctor was on for a while," you have built an upcoding pattern that a payer's data analytics will find long before you do.

The Privacy Problem Your Billing SOP Doesn't Mention

Telephone care generates protected health information in places your risk analysis probably doesn't cover. OCR's Notification of Enforcement Discretion for telehealth expired on May 11, 2023, with a 90-day transition that closed on August 9, 2023. Since then, every telehealth modality — including plain audio — sits under the full Security Rule and Privacy Rule.

OCR has published guidance confirming that traditional landline telephone service is not electronic media for Security Rule purposes, so a call placed over a standard phone line does not by itself trigger a BAA with the carrier. Almost nothing in a modern practice is a standard phone line. Review the HHS telehealth and HIPAA guidance against your actual infrastructure before you assume you are covered.

Personal devices and call forwarding

The after-hours physician takes the call on a personal cell phone. The number forwards through the practice's VoIP system. The call log, and often a voicemail transcription, lands in a cloud account tied to that clinician's personal credentials.

Inventory this. Ask each clinician who takes calls: which device, which number, which app, and where do the voicemails go. Then write a mobile device policy that covers screen lock, remote wipe capability, and prohibition on storing patient contact lists in personal cloud backups.

Call recording and AI transcription

If any part of your phone system records or transcribes patient calls — for quality assurance, for documentation support, for an ambient scribe — those recordings are PHI. They are stored somewhere, retained for some period, and accessible to some set of people. Most practices cannot answer any of those three questions on the first ask.

Set a retention period in writing, confirm the vendor enforces it, and confirm whether the vendor uses your recordings for model training. Several states also require two-party consent to record, which is a state-law obligation layered on top of HIPAA, not a substitute for it.

Every Vendor in the Call Path Needs a BAA

Walk one telephone encounter end to end and list every company that touches it. A typical list looks like this:

  • VoIP or cloud phone provider
  • Answering service or after-hours triage vendor
  • Voicemail-to-text transcription service
  • Ambient documentation or AI scribe tool
  • Telehealth platform, if audio-only calls route through it
  • Appointment reminder and patient messaging vendor
  • Billing company or clearinghouse that receives the resulting claim
  • EHR host and any backup provider

Cross that list against your executed agreements. If you find a vendor handling call audio, call metadata, or transcripts without a signed BAA, that is a gap you can close this week — you can generate a signature-ready Business Associate Agreement and get it in front of the vendor before the next audit cycle.

Then update the risk analysis. Adding a new telephone or transcription vendor is a change to your environment, and the Security Rule requires the analysis to reflect your actual systems, not the ones you had two years ago. If maintaining that documentation set by hand is why it keeps slipping, automated HIPAA risk analysis and policy generation will produce the report, the policies, and the supporting documents in a form you can hand to an auditor.

Audio-Only Encounter Notes Sit in the Designated Record Set

A patient calls in March 2026 and asks for everything from a 2024 telephone visit. The note is in the designated record set. So is the billing record. So, arguably, is a call recording your practice retained and used to make decisions about that patient's care.

You have 30 days to respond, with one possible 30-day extension and written notice of the reason. Fees must be limited to the reasonable, cost-based amounts described in the HHS right of access guidance. Right of access has been one of OCR's most consistently enforced areas, and telephone-visit records are a common blind spot because staff think of them as "just a phone call."

Fix the intake side: your records request form should ask about telehealth and telephone encounters by name so the person fulfilling the request knows to look beyond the office-visit notes.

A 30-Day Cleanup Plan

Week 1. Archive the retired code definitions, including the full 99443 CPT code description, with the effective dates. Pull a report of all telephone E/M claims from the past 24 months and note which remain inside any payer's recoupment window.

Week 2. Sample ten of those encounters. Check whether documented minutes support the level billed and whether the seven-day and 24-hour conditions were verified. Escalate any pattern to counsel before you self-disclose anything.

Week 3. Build the vendor list from the phone path walkthrough. Match to executed BAAs. Send agreements where they are missing.

Week 4. Update the risk analysis to reflect telephone and transcription systems. Update the records request form. Retrain the front desk on identity verification for inbound clinical calls, and confirm nobody outside coding is selecting levels.

Retired codes do not retire your obligations. If your compliance documentation still describes a practice that only sees patients in exam rooms, bring the risk analysis and policy set current before a payer audit or a records request forces the issue on someone else's timeline.