Seventy minutes, one calendar month, one registry entry, and a weekly consultation call. That is the operational skeleton behind the 99492 CPT code description, and every one of those elements has to be documented by someone on your staff before your biller touches a claim. If your practice is standing up a collaborative care program this quarter, the coding question is the easy part. The hard part is that you have just added a behavioral health care manager, a psychiatric consultant, and a tracking registry to your protected health information footprint — and at least one of those three probably needs a signed agreement you don't have yet.

This guide is written for the administrator or compliance lead who owns the workflow, not the clinician who documents the visit. It covers what the code requires operationally, who counts the minutes, where the records-handling traps sit, and which relationships trigger a Business Associate Agreement.

What the 99492 CPT Code Description Actually Requires

CPT 99492 describes initial psychiatric collaborative care management — the first 70 minutes, in the first calendar month, of behavioral health care manager activities furnished in consultation with a psychiatric consultant and directed by the treating physician or other qualified health care professional. The code is a time-based, month-based service, not a visit.

The required elements built into the 99492 CPT code description are:

  • Outreach and engagement of the patient in treatment, directed by the treating practitioner.
  • Initial assessment, including administration of validated rating scales, with development of an individualized treatment plan.
  • Review by the psychiatric consultant, with modification of the plan if recommended.
  • Registry entry and tracking of follow-up and progress, with appropriate documentation, plus participation in weekly caseload consultation with the psychiatric consultant.
  • Brief interventions using evidence-based techniques.

Related codes in the same family: 99493 covers subsequent months (first 60 minutes), 99494 covers each additional 30 minutes in a given calendar month and is reported alongside 99492 or 99493, and HCPCS G2214 covers a shorter initial or subsequent increment. Code 99484 describes general behavioral health integration, which does not require a psychiatric consultant or a registry. Which code fits a given month depends on the documented time and the documented elements — your clinical and coding staff determine that together, and your job is to make sure the documentation exists to support whatever they select.

Who Counts the Minutes, and Where

Time counted is the behavioral health care manager's time on qualifying activities during the calendar month, including time spent on the weekly caseload review and time coordinating with the treating practitioner. CMS guidance has described minimum time thresholds keyed to the midpoint of each code's described range, so a month that falls short of the threshold does not support the code even if every other element happened. Have your billing lead pull the current CMS MLN booklet on behavioral health integration services at the start of each year and re-verify the thresholds rather than relying on a cheat sheet someone laminated in 2023.

Two operational rules that generate the most rework:

  1. Minutes reset with the calendar month, not the enrollment date. A patient enrolled on the 27th has four days to accumulate time before the clock restarts.
  2. The same minute cannot support two services. If care manager time is counted toward collaborative care, it is not also available for chronic care management or a separately billed therapy encounter. Your time log needs a field that identifies which program each entry belongs to.

The Registry Is a Records Problem Before It's a Billing Problem

The registry requirement is what separates collaborative care from general behavioral health integration, and it is where most practices accidentally create a second, unmanaged patient record.

Many programs run the registry in a spreadsheet, a standalone tracking tool, or a population-health module that sits outside the chart. Whatever holds it, that registry contains names, diagnoses, symptom scores, and treatment notes. It is protected health information. Answer these questions in writing before your first enrollment:

  • Is the registry part of your designated record set? If it is used to make decisions about the patient — and a treatment-plan tracker is — treat it as in scope for access and amendment requests. Your records clerk needs to know it exists.
  • Where does it live? A spreadsheet on a care manager's desktop or in a personal cloud folder is a breach waiting for a lost laptop. The OCR breach portal is full of incidents that began as one clinician's convenient side file.
  • Who has access, and is it scoped? A registry naturally aggregates the most sensitive population in your panel. Apply the minimum necessary standard deliberately: front-desk staff scheduling follow-ups do not need symptom scores.
  • Is it backed up and retained on the same schedule as the chart? If a payer audits a 99492 claim two years out, the registry documentation has to still be retrievable.

The Three Relationships That Decide Whether You Need a New BAA

Collaborative care introduces up to three outside parties in a single workflow. Each requires a separate analysis.

The Registry or Tracking Software Vendor

Straightforward: a vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and you need an executed agreement before data flows. That includes the analytics tool your consultant recommended, the survey platform administering rating scales, and the secure messaging service the care manager uses for outreach. HHS maintains plain guidance on who qualifies as a business associate — read it alongside your vendor list, not instead of it.

The Behavioral Health Care Manager

If the care manager is your employee, they are workforce: no BAA, but they belong in your training roster, your access reviews, and your sanction policy. If the care manager is supplied by an outside organization under contract, you are looking at either a business associate relationship or a leased-staff arrangement — the answer depends on the contract's structure and who controls the work. Document your determination and the reasoning. "We assumed" is not a defense during an audit.

The Psychiatric Consultant

This one gets skipped most often. When a psychiatric consultant advises your treating practitioner about panel management rather than establishing an independent treatment relationship with the patient, many practices conclude the consultant is performing a service on the practice's behalf and paper the relationship with a BAA. When the consultant is a separate covered entity furnishing treatment, disclosures for treatment purposes stand on their own footing. Contracted consultants frequently sit in a gray zone, and the low-cost move is to make the analysis explicit in your files and to have an agreement in place where the service is administrative in character.

If that inventory just produced two or three relationships without signed paperwork, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — rather than waiting on outside counsel to redline a template you'll reuse forty times.

Collaborative care carries a patient consent requirement that your front desk, not your clinicians, will usually execute. Consent may be obtained verbally, but it must be documented in the medical record before the service begins, and it must cover specific ground:

  • The patient may be responsible for cost sharing, including applicable deductible and coinsurance amounts, for monthly services.
  • Only one practitioner may furnish and bell these services in a given calendar month — so if the patient is enrolled elsewhere, you have a conflict to resolve.
  • The patient may stop the services at any time, effective at the end of the calendar month.

Build this as a scripted intake step with a discrete field in the chart — a checkbox plus a free-text note naming who obtained consent and when. Free-text-only consent buried in a progress note is invisible to your auditor and to the next person who covers the desk.

Correct that typo in your own materials, incidentally: only one practitioner may furnish and bill these services per month. Cross-practice duplication is a real denial driver when a health system and an independent primary care office both enroll the same patient.

Two Carve-Outs That Break Your Default Release Workflow

Behavioral health records do not follow your standard records-release path, and a collaborative care program pushes sensitive data into places your release-of-information clerk has never had to think about.

42 CFR Part 2

If any part of your program meets the definition of a Part 2 program, or if you receive records from one, substance use disorder treatment records carry their own consent and redisclosure rules. The federal rule aligning Part 2 more closely with HIPAA — including breach notification and enforcement changes — reached its compliance date in February 2026, so this is current operating reality, not a future project. Practically: your release workflow needs a decision point that asks whether the requested records include Part 2 material, and your registry needs a way to flag it.

Psychotherapy Notes

HIPAA treats psychotherapy notes — a clinician's private session notes, kept separate from the chart — differently from the rest of the record, including for patient access. If your care manager keeps separate process notes, decide explicitly whether they meet that definition and whether they are stored separately. Ambiguity here produces the worst possible outcome: notes that are treated as private internally but produced in full when a subpoena arrives.

A 30-Day Standup Checklist With Names Attached

Assign each item to a person, not a department.

  1. Days 1–5 — Practice administrator: map the data flow. Who touches PHI, in what system, under what agreement. One page, one diagram.
  2. Days 1–5 — Privacy officer: classify the registry (designated record set or not), document the psychiatric consultant analysis, and identify missing BAAs.
  3. Days 5–10 — Privacy officer: execute outstanding agreements. Nothing goes live before signatures.
  4. Days 10–15 — Billing lead: build the time log with fields for date, activity, minutes, program attribution, and staff initials. Verify current CMS time thresholds.
  5. Days 10–15 — Front desk supervisor: write the consent script and add the discrete chart field.
  6. Days 15–20 — Security officer: update the risk analysis to include the registry and any new vendor. New systems mean new risks; the assessment is not a one-time document.
  7. Days 20–25 — Records clerk: add the registry to release-of-information procedures and add the Part 2 decision point.
  8. Days 25–30 — All: run three test patients end to end, then audit the documentation as if you were the payer.

The Audit File You'll Wish You Built

For each enrolled patient and each billed month, be able to produce, in under ten minutes: documented consent with date and obtainer; the initial assessment including rating scale results; the treatment plan and any consultant-recommended modification; registry entries showing follow-up; evidence of weekly caseload consultation; and the time log totaling minutes for that calendar month with program attribution.

Practices that can produce that file survive audits. Practices that reconstruct it from memory after a records request negotiate refunds. The same discipline pays off on the privacy side, because the artifacts a payer wants are largely the artifacts that prove your access controls and vendor oversight were real.

Next Step

Pull your vendor list and your collaborative care data map side by side this week. Anywhere a name appears on the map but not on a signed agreement, close the gap — you can produce a signature-ready BAA in a single sitting, and if the standup also exposed a stale risk analysis or missing policies, automated HIPAA risk analysis and policy generation will get that documentation set current before your first 99492 claim goes out the door.