At 8:40 a.m. your front desk takes a call from a claims adjuster who wants a disability evaluation scheduled for Thursday and the report faxed to her the same day. She gives you a claim number, an employer name, and an email address at a third-party review company you have never heard of. Nobody has asked the patient anything yet.

That call is the operational reality behind the 99455 CPT code. This guide is for the administrator, biller, or privacy officer who has to make that encounter happen correctly: how the service is structured, how coders document their selection, who is legally entitled to the resulting report, and which of the parties in that phone call needs a signed agreement before they touch anything.

What the 99455 CPT Code Covers, in Plain Administrative Terms

CPT 99455 sits in the Special Evaluation and Management Services family alongside 99450 (basic life and disability evaluation) and 99456. It describes a work-related or medical disability examination performed by the treating physician.

Per CPT, the service description includes completion of a medical history commensurate with the patient's condition, performance of an examination commensurate with the patient's condition, formulation of a diagnosis with assessment of capabilities and stability and calculation of impairment, development of a future medical treatment plan, and completion of the required documentation, certificates, and report.

99456 describes the same service performed by a physician other than the treating physician — the independent medical examiner scenario. The distinction is a relationship question, not a complexity question, and your intake form should capture it before the visit rather than after.

Who is expected to pay

These are third-party-driven services. Payment typically comes from a workers' compensation carrier, an employer, a disability insurer, or an attorney — not from a health plan. Medicare does not generally pay for examinations performed for the benefit of a third party rather than for the beneficiary's treatment; your billing lead should confirm current policy against the CMS Physician Fee Schedule resources and the applicable Medicare manuals before assuming otherwise.

Many states publish workers' compensation fee schedules that address these codes specifically, sometimes with their own modifiers, report-format requirements, or state-assigned codes that replace the CPT entirely. Your billing manager should keep a one-page reference per state you operate in. Do not let that live only in someone's head.

How your coders determine and document selection

Code selection here is a documentation-matching exercise, not a judgment call your front office should make. The physician's report either contains the elements the code description requires, or it does not. Coders compare the dictated report against the current-year CPT descriptor, confirm whether the physician meets the treating-relationship definition, and note the payer's own policy language in the encounter.

Build a short internal checklist your coding staff initials: treating relationship confirmed, history documented, examination documented, impairment assessment present, treatment plan present, required forms and report completed. When a payer audits, that checklist is the fastest way to show your process. Never let a scheduler pre-assign the code on the calendar.

The Records Problem: Three Requesters, Three Different Rule Sets

Here is where the 99455 CPT code workflow stops being a billing question. The exam generates a report that at least three parties will want, and HIPAA treats each of them differently.

The workers' compensation carrier

The Privacy Rule permits disclosure of protected health information as authorized by, and to the extent necessary to comply with, laws relating to workers' compensation or similar programs. HHS maintains dedicated guidance on disclosures for workers' compensation purposes, and your privacy officer should read it against your state statute rather than assuming the federal permission is self-executing.

Two practical constraints follow. First, the permission is bounded by state law — if your state comp statute limits what an adjuster can obtain, HIPAA does not expand it. Second, minimum necessary still applies to these disclosures unless the release is required by law or made under a patient authorization. Sending the full longitudinal chart when the carrier asked for the disability report is the most common error we see.

The employer

An employer is not a business associate and is not automatically entitled to the report. There is a narrow permission covering employers: when your provider furnishes care to an individual at the employer's request to conduct medical surveillance of the workplace or to evaluate whether the individual has a work-related illness or injury, you may disclose findings concerning that work-related illness, injury, or surveillance — where the employer needs those findings to comply with OSHA, MSHA, or a comparable state law, and where you give the individual written notice that the information will be disclosed.

Read that carefully. It covers findings, not the chart. It requires written notice to the patient. And it applies only where the employer arranged the evaluation for those purposes. If your clinic hands an employer a narrative that includes unrelated diagnoses, medication lists, or family history, you have exceeded the permission — and you have handed the employer a headache under the ADA and GINA that will eventually land back on your desk.

Operationally: keep a standing employer-report template that outputs work status, restrictions, and the specific findings requested. Nothing else. Have the physician sign the template, not a free-text letter.

The attorney and the patient

Defense and plaintiff attorneys route requests through subpoenas, authorizations, or state comp procedures, and each path has its own verification steps. The patient's own right of access is separate and unaffected — they can request the exam record, and your standard access timeline applies.

Train your records staff to sort inbound requests by requester type first, before looking at what is being asked for. The sorting decision determines the rule set; the content decision comes second.

Where the 99455 Workflow Creates Vendor Exposure

Trace the report from dictation to delivery and count the outside parties. In most practices doing volume disability work, the list looks like this:

  • The transcription service that types the narrative
  • The scheduling or exam-coordination platform the carrier's network uses
  • The records-retrieval company pulling prior treatment records to attach
  • The fax-to-email or secure-messaging service that transmits the finished report
  • The billing company that submits to a comp carrier's clearinghouse
  • Any independent contractor physician performing 99456-type exams under your tax ID

Every one of those creates, receives, maintains, or transmits PHI on your behalf. Every one needs a business associate agreement before the first record moves. The carrier and the employer, by contrast, are receiving disclosures as end recipients — they are not business associates and a BAA with them is the wrong instrument. HHS lays out the boundary in its business associate guidance, and getting the classification backwards is a real finding in an OCR investigation.

The coordination platform is the one practices miss. A third-party administrator that schedules the exam, collects intake forms, and hosts the finished report is doing PHI work on your behalf even though the carrier introduced you. If they push back with "we're the payer's vendor, not yours," that answer is not sufficient — determine whose behalf they act on for the function they perform for you, and paper it.

If you are adding disability exams as a new service line this quarter, you can generate a signature-ready business associate agreement through a six-step wizard and have PDF and DOCX copies in your vendor file the same afternoon. It is a one-time purchase rather than another subscription line, which matters when you are papering six vendors at once for a service line that has not billed a dollar yet.

A Working Intake Script and Role Assignment

Assign these steps by name, not by department. Ambiguity at intake is what produces the wrong-recipient fax three weeks later.

  1. Scheduler: captures requester type (carrier, employer, attorney, patient), claim number, employer name, referring entity, and the exact delivery destination. Flags whether the examining physician has an existing treating relationship.
  2. Scheduler: confirms a BAA exists for any intermediary platform before entering patient data into it. If none exists, the encounter goes on hold and the privacy officer is notified.
  3. Front desk, day of exam: delivers the written notice of disclosure where an employer-requested evaluation is involved, and documents delivery in the chart.
  4. Physician: dictates against the report template; separates work-related findings from unrelated clinical content.
  5. Coder: completes the element checklist, selects the code, records payer policy citation.
  6. Records staff: releases only the report and only to the destination captured at intake. Logs the disclosure.
  7. Billing: submits under the applicable state comp or third-party rules, not the general commercial workflow.

What to Retain, and For How Long

Keep the exam record under your standard state medical-record retention period. Keep the disclosure documentation — authorizations, written notices to individuals, subpoena verification, accounting entries — for at least the six years HIPAA requires for documentation, running from the later of creation or last effective date.

Keep BAAs for the same six years past termination. When a records-retrieval vendor you used in 2023 turns up in a 2027 breach notice, the question you will be asked is what agreement governed them at the time. "We switched vendors" is not an answer.

Also keep the payer correspondence. Disability and comp payers change report-format requirements more often than health plans change policy, and a denial trail is your evidence that you followed the rules in effect on the date of service.

Five Fixes Worth Doing This Quarter

  • Sort your inbound disability requests by requester type for one month and see how many were routed under the wrong rule set.
  • Pull your employer-report template and delete every field that is not a work-related finding or restriction.
  • Confirm a written notice is actually being handed to patients in employer-requested evaluations, and that someone is documenting it.
  • Reconcile the vendor list above against your signed BAA file. Expect at least one gap.
  • Give your coders the current-year CPT descriptor and the applicable state comp fee schedule, on paper, at their desk.

Disability exam work is profitable precisely because it is administratively annoying — the practices that do it well are the ones that treat the report as a controlled document from the moment the adjuster calls. If your broader policy set, risk analysis, and workforce training have not been refreshed since you added this service line, automating the compliance document set is a faster path than rebuilding it in a spreadsheet. Start with the BAAs, though. Those are the ones that fail first.