A payer audit letter arrives asking for twelve months of time logs on forty-one patients. Your billing lead pulls the report and finds that eleven of those months show exactly 60 minutes — not 58, not 63, exactly 60 — and that the entries were created by a contracted care management company you signed with eighteen months ago. Nobody in your office can produce the underlying activity detail, and nobody can find the business associate agreement. That is the practical risk buried inside the 99487 CPT code description, and it is why administrators, not clinicians, need to own this workflow.

This guide walks through what the code requires operationally, who on your staff does what, how the documentation gets built, and where the privacy and vendor exposure sits. It is administrative guidance on process and documentation. It does not tell you which code fits a given patient — that determination belongs to the treating clinician and your coding policy.

What the 99487 CPT Code Description Actually Says

CPT 99487 describes complex chronic care management services furnished during a calendar month, with all of the following elements: multiple (two or more) chronic conditions expected to last at least 12 months or until the death of the patient; conditions that place the patient at significant risk of death, acute exacerbation or decompensation, or functional decline; establishment or substantial revision of a comprehensive care plan; moderate or high complexity medical decision making; and at least 60 minutes of clinical staff time directed by a physician or other qualified health care professional.

CPT 99489 is the add-on for each additional 30 minutes of clinical staff time in the same calendar month. The time is cumulative across the month and is non-face-to-face — phone calls, medication reconciliation, chart review, coordination with home health, follow-up on referrals.

How 99487 sits next to the other care management codes

Your staff will hear these codes used interchangeably. They are not.

  • 99490 — non-complex chronic care management, at least 20 minutes of clinical staff time per calendar month, with 99439 as the add-on.
  • 99491 — care management time personally performed by the physician or other qualified health professional, with 99437 as the add-on.
  • 99424–99427 — principal care management, built around a single high-risk condition rather than two or more.
  • 99487/99489 — the complex tier, distinguished by the care plan work and the complexity of decision making, not merely by minutes.

The operational consequence: minutes alone never justify the complex tier. A month with 64 logged minutes and no substantive care plan revision does not become a 99487 month because the clock crossed 60. Build that rule into your internal edit checks so billing staff are not left guessing.

Medicare also restricts billing multiple care management services for the same patient in the same calendar month, and only one practitioner may bill care management for a patient in a given month. Confirm current pairings and payment rules against the CMS Physician Fee Schedule and your commercial payer policies before you turn on a new workflow. If your organization is an RHC or FQHC, verify the current care management billing structure directly — CMS has moved these settings away from the older general care management G-code toward the individual CPT codes, and internal cheat sheets go stale fast.

The Calendar-Month Time Log Your Biller Will Have to Defend

Complex CCM is a time-based service, which means your defense in an audit is a log, not a narrative. Decide now what a defensible entry looks like and hold every entry to it.

At minimum, each entry should capture: date, start and stop time or duration, the name and role of the person performing the work, a specific description of the activity, and the patient it applies to. "Care coordination — 15 min" is not an activity description. "Called cardiology scheduling to move echo from 4/12 to 3/29 after patient reported new dyspnea; notified Dr. Reyes" is.

Assign the roles explicitly:

  1. Clinical staff (RN, LPN, MA, care coordinator) log time contemporaneously — same shift, not month-end reconstruction.
  2. The supervising clinician reviews the month's activity and documents the care plan establishment or substantial revision and the complexity of decision making in their own note.
  3. Billing runs a month-end report and holds any patient whose log lacks the clinician attestation or whose entries look templated.
  4. Compliance samples five to ten patient-months per quarter and reads the entries the way an auditor would.

Watch for the two patterns that draw scrutiny: identical durations repeating across patients, and time logged for activities that are not separately billable care management work. Round numbers are not fraud, but a report where 90% of patient-months land on 60 minutes flat invites a records request.

Before the first month of service, the patient must be informed about the service and consent to it, and the consent must be documented in the medical record. Medicare permits verbal consent so long as it is documented. Your documentation should reflect that the patient was told:

  • what the service includes;
  • that cost sharing may apply;
  • that only one practitioner may furnish and bill the service per month;
  • that the patient may stop the service at any time, effective at the end of the month.

Also confirm your initiating-visit policy. For patients not seen recently, Medicare expects a qualifying visit before care management begins, during which the clinician discusses the service. Put the consent script and the initiating-visit rule in the same one-page job aid so nobody has to remember which applies.

Then prepare the front desk. Patients who see a coinsurance amount for a month in which they never came to the office will call, and the person answering deserves a scripted, accurate answer. Log those calls — a spike in "I never agreed to this" calls is an early warning that your consent workflow is broken.

The Comprehensive Care Plan Is a Records Request Waiting to Happen

The care plan is the clinical center of the service and, from a privacy standpoint, a document you will hand out repeatedly. Medicare expects the patient to receive a copy, expects it to be available electronically to the care team, and expects it to be shared as appropriate with other treating providers.

That means the care plan sits squarely in your designated record set. When a patient asks for their chart, the care plan goes with it, and the standard 30-day clock applies. If your care plan lives in a third-party care management platform rather than your EHR, ask a hard question: can your records staff pull it, in a readable format, without opening a support ticket with the vendor? If the answer is no, you have a right-of-access problem that predates any audit. Review the OCR individuals' right of access guidance against your actual retrieval steps.

Two more habits worth building. First, care plans routinely name family caregivers and their phone numbers — apply minimum necessary before you fax a plan to a specialist's office. Second, when the plan is shared electronically with outside providers, your information-blocking posture matters; the ONC information blocking materials are the reference your policy should cite.

Every Vendor in the 99487 Workflow Touches PHI

Complex CCM is one of the most vendor-dense services a small practice runs. Count the outside parties in a typical build:

  • the care management platform holding condition lists, time logs, and care plans;
  • the contracted clinical staffing company whose nurses log the minutes;
  • the after-hours answering service providing 24/7 access;
  • the SMS or automated outreach tool sending appointment and medication reminders;
  • your billing company, which now sees monthly care management claims tied to chronic condition diagnoses.

Each of those is a business associate. Each needs an executed BAA before PHI moves, and each subcontractor arrangement needs to flow the obligations downstream. If you are standing up a program this quarter and one of those agreements does not exist yet, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — rather than waiting three weeks for a vendor's legal team to send a template you will have to redline anyway. Compare whatever you produce against the HHS sample business associate agreement provisions so you know which clauses are required and which are negotiated.

Contracted care managers working from home

General supervision means the nurse logging your minutes may be sitting in a spare bedroom two states away. Your risk analysis has to account for that. Ask the staffing vendor, in writing: device ownership and encryption, whether screen recording or keystroke tools are in use, household member access, whether calls are recorded and where recordings live, and how access is terminated within 24 hours of a staffing change.

The 24/7 access line

The after-hours requirement is easy to satisfy and easy to get wrong. An answering service that takes clinical messages is handling PHI. Confirm the BAA, confirm message retention and transmission method, and confirm that overnight messages actually land in a queue somebody works at 8 a.m. An unread message queue is both a care problem and a documentation problem.

When One of the Two Chronic Conditions Is a Substance Use Disorder

This is the trap most CCM programs miss. If a patient's qualifying conditions include a substance use disorder and any part of that record originates from a Part 2 program, the disclosure rules under 42 CFR Part 2 layer on top of HIPAA. Pushing a care plan that names SUD treatment to an outside specialist, or into a vendor platform, may require patient consent that your standard CCM consent does not cover.

Have your privacy officer decide in advance how those care plans are segmented and who approves outbound sharing. Do not leave it to a care coordinator at 4:45 p.m.

A Readiness Checklist Before You Bill the First Month

  1. Written coding policy distinguishing the complex tier from the 20-minute tier, with the concurrency restrictions listed.
  2. Time-log field standards and a rule against month-end reconstruction.
  3. Consent script, cost-sharing disclosure, and initiating-visit rule on one job aid.
  4. Care plan retrievable by records staff in under an hour, in a portable format.
  5. Executed BAAs for every vendor in the list above, with subcontractor flow-down.
  6. Risk analysis updated to include remote care management staff and the after-hours service. If your documentation set needs rebuilding, automated HIPAA risk analysis and policy generation will get you a defensible baseline faster than a blank template.
  7. Quarterly internal audit of five to ten patient-months, results documented.
  8. Breach response plan that accounts for a vendor-side incident — most reported breaches involving third parties show up on the OCR breach portal under the covered entity's name.

The 99487 CPT code description is short. The operational footprint behind it is not: a monthly time log you must defend, a care plan you must produce on request, and a vendor chain you must paper. Practices that treat this as a billing project fail the audit. Practices that treat it as a records-and-vendor project pass both.

If your program is live and you cannot name every business associate touching those care plans, start there this week — build the missing agreements, log them in your vendor register, and put a renewal date on each one.