Your billing lead hands you a month-end report: 214 patients enrolled in chronic care management, 189 claims submitted, and 26 of those with a time log that reads exactly 20 minutes. Nothing on that report is automatically wrong. But if a payer asks you to substantiate a single one of those claims, you will need a consent record, a care plan, an identified billing practitioner, and a minute-by-minute log that someone other than the person who wrote it can defend. The 99490 CPT code description is where that documentation burden originates, and it is why this article is written for administrators rather than clinicians.

This guide covers what the code requires operationally, who in your practice owns each piece, and the privacy exposure that opens the moment you hand chronic care management to an outside vendor. Coding decisions belong to your providers and coders working from current payer guidance. Building the workflow that supports those decisions belongs to you.

What the 99490 CPT Code Description Actually Requires

CPT 99490 covers chronic care management (CCM) services billed per calendar month. The descriptor elements, paraphrased: the patient has two or more chronic conditions expected to last at least 12 months or until death; those conditions place the patient at significant risk of death, acute exacerbation or decompensation, or functional decline; a comprehensive care plan is established, implemented, revised, or monitored; and at least 20 minutes of clinical staff time is spent, directed by a physician or other qualified health care professional.

Read that last element twice, because it drives everything administrative. The unit of service is time, the time is clinical staff time, and the reporting period is the calendar month rather than a rolling 30 days. A patient enrolled on January 28 does not carry unused minutes into February.

Related codes in the family matter for your fee schedule build and your claim edits. There is an add-on code for each additional 20 minutes of clinical staff time in the same month, separate codes for CCM delivered personally by the physician or other qualified professional, and separate complex CCM codes with higher time thresholds and a medical decision-making component. Your coders determine which code the documentation supports. Your job is to make sure the documentation exists, is attributable, and is retrievable.

The Service Elements That Live Outside the Time Log

Time is necessary but not sufficient. Medicare's CCM requirements, laid out in CMS's Chronic Care Management Services MLN booklet, add operational obligations that your workflow has to produce evidence for:

  • Documented patient consent before the service begins, including that only one practitioner may furnish and bill CCM in a given calendar month, that cost sharing applies, and that the patient may stop at any time.
  • An initiating visit when the patient is new to the practice or has not been seen within the required lookback window.
  • An electronic comprehensive care plan, available to the care team and shareable with the patient and other treating providers.
  • 24/7 access to a care team member who can address urgent needs, plus continuity with a designated member of the care team.
  • Management of care transitions and coordination with home- and community-based providers.
  • Use of certified EHR technology for specified elements of the service.

Every one of those bullets is a record. Every record is discoverable in an audit and potentially responsive to a patient access request.

The 99490 CPT Code Description in One Paragraph

CPT 99490 is the base chronic care management code: at least 20 minutes of clinical staff time per calendar month, directed by a physician or other qualified health care professional, for a patient with two or more chronic conditions expected to last at least 12 months or until death that place the patient at significant risk of death, acute exacerbation, or functional decline, with a comprehensive care plan established, implemented, revised, or monitored. It is a non-face-to-face, time-based, once-per-month, one-practitioner code. Whether a given patient and month meet the descriptor is a determination your clinicians and coders make from the record, not something a billing template can decide.

The Time Log Is a Compliance Artifact, Not a Billing Convenience

Time-based services delivered without a face-to-face encounter are structurally attractive to auditors. There is no visit note, no vitals, no rooming timestamp. The log is the service.

Build the log so it stands on its own. At minimum, each entry should capture the date, the staff member's identity and role, the start and stop time or elapsed minutes, the specific activity, and the patient it applies to. Free-text entries reading "care coordination, 22 min" do not survive review.

Three rules to enforce with your care management team:

  1. Contemporaneous entry. Minutes logged three weeks later, in a batch, from memory, are the single easiest thing for a reviewer to dismantle. Require same-day documentation.
  2. No double-counting. Time counted toward CCM cannot also be counted toward a separately reported service in the same month. Your coders need a rule set, and your care managers need to know which activities are excluded.
  3. No rounding up to threshold. A month that lands at 17 minutes is a month you do not bill. If your report shows an implausible cluster at exactly 20 minutes, fix that before someone outside your practice notices it.

Assign a monthly reconciliation to someone who is not the person generating the minutes. Billing lead reviews the log against the claim file; compliance lead spot-checks five charts a month and documents the review.

Staff conflate these constantly. The CCM consent is a Medicare program and financial-liability consent. It tells the patient about cost sharing, the one-practitioner-per-month rule, and the right to discontinue. It is not a HIPAA authorization, and it does not expand what you may disclose.

Care coordination with other treating providers is treatment activity and generally permitted under the Privacy Rule without a separate authorization. What that permission does not cover is disclosure to entities outside treatment, payment, and health care operations, or disclosure of records with heightened protection under other law. If your care managers are routinely faxing care plans to community organizations, social service agencies, or vendor-operated call centers, someone in your practice needs to have mapped which of those disclosures rests on which legal basis.

Practical build: store the CCM consent as a discrete, dated document in the chart, not as a checkbox buried in an enrollment script. Record verbal consent with the date, the staff member who obtained it, and confirmation that the required elements were explained. When a patient revokes, timestamp the revocation and stop billing effective the end of that month.

Outsourcing CCM Adds a Business Associate to Your Vendor List

Most practices that scale CCM buy help. A care management company staffs the outreach, logs the minutes, drafts care plan updates, and often works directly inside your EHR under credentials you issue. That vendor creates, receives, maintains, and transmits protected health information on your behalf. It is a business associate, full stop, and HHS's business associate guidance does not carve out an exception for clinical staffing arrangements.

Two failure patterns show up repeatedly. First, the practice signs the vendor's services agreement, assumes a BAA came with it, and discovers eighteen months later that no executed agreement exists. Second, the BAA exists but predates the current arrangement — signed for a pilot with 40 patients, never updated when the vendor added offshore staffing, SMS outreach, and call recording.

If you are onboarding a CCM vendor this quarter and do not have a current executed agreement in hand, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX before the vendor's staff touch a single chart. One-time purchase, no subscription. Get it signed before access provisioning, not after.

What to Pin Down in the CCM Vendor Contract

  • Named subcontractors. Ask specifically whether outreach staff are employees, contractors, or offshore. Get the answer in writing and require notice before it changes.
  • Breach notification timing. Set a hard internal deadline — many practices use 5 to 10 calendar days from discovery — so you retain time to meet your own obligations.
  • EHR role scope. Vendor staff need care management modules, not full chart access across your entire panel. Minimum necessary applies to workforce and business associate access alike; HHS's minimum necessary guidance is the standard your provisioning decisions get measured against.
  • Call recordings and texts. Recordings of patient calls are PHI. Establish where they live, how long they are retained, who can pull them, and how they get produced if a patient requests them or an auditor asks.
  • Records production and return. The vendor must be able to hand you complete time logs and call documentation on request, and return or destroy PHI at termination with written confirmation.
  • Access termination SLA. When a vendor employee leaves, whose job is it to disable the credential in your system, and within how many hours?

Run a quarterly access review against the vendor's current roster. Orphaned credentials belonging to former vendor staff are one of the more common findings in practice-level audits, and they are entirely preventable.

When a CCM Patient Asks for the Records

CCM generates a category of record most front desks have never handled: monthly time logs, phone call summaries, care plan versions, and sometimes recordings held by a third party.

Treat the care plan and the clinical documentation of CCM encounters as part of the designated record set. Billing records are included as well. You have 30 days from receipt of a written request to act, with one 30-day extension available if you notify the patient in writing with a reason and a date. Review HHS's individual right of access guidance and make sure the person who fields these requests knows that "the vendor has it" is not an answer that stops the clock.

Test this before it happens live. Pick one enrolled patient, request the full CCM record internally, and time how long it takes to assemble the care plan history, the monthly logs, and any vendor-held call documentation. If the answer is measured in weeks, you have a workflow problem to fix while it is still cheap.

Role Assignments for a CCM Program That Survives Review

Front desk: confirms the initiating visit occurred within the lookback window, flags patients who need one before enrollment, and routes consent conversations to the care manager rather than improvising them at check-out.

Care management staff: obtain and document consent, log minutes same-day, maintain the care plan, and escalate when a patient asks to stop.

Billing: reconciles logs against claims monthly, maintains the edit list for services that cannot be billed alongside CCM in the same month, and monitors whether another practice has already billed CCM for a shared patient. Payer rules on overlapping care management services change; verify against the current Physician Fee Schedule materials rather than last year's cheat sheet. Federally qualified health centers and rural health clinics in particular should re-verify current care management billing instructions, which have shifted away from a single general care management code toward individual codes.

Privacy officer: owns the vendor inventory, the executed BAA file, the quarterly access review, and the disclosure log for care plans sent outside the practice.

The Audit Questions to Rehearse

Reviewers of time-based, non-face-to-face services tend to ask the same things. Show me the consent. Show me the initiating visit. Show me the care plan as it existed during the month billed. Show me who furnished the minutes and under whose direction. Show me that no other practitioner billed CCM for this patient that month.

If your answer to any of those requires a phone call to a vendor and a three-day wait, your program is not audit-ready — regardless of how clean the coding looks. The 99490 CPT code description is short. The evidentiary trail behind it is not.

Two moves this month: confirm you hold a current executed agreement for every entity touching CCM data, and run one end-to-end records test on a live enrolled patient. If the BAA is the gap, draft and export a signature-ready agreement today and get it countersigned before your next enrollment batch. If your broader documentation set — risk analysis, policies, workforce training records — is what is missing, automate the full compliance document set rather than rebuilding it by hand every time a payer or a patient asks.