A patient leaves the hospital at 4:40 p.m. on a Friday. The admit-discharge-transfer notification lands in your inbox at 4:52 p.m. Your two-business-day interactive contact window now closes at end of business Tuesday, and nobody on your staff has looked at that inbox since Friday lunch.

That is the operational reality behind transitional care management. If your practice bills it, the 99495 CPT code description is not a coding trivia question — it is a staffing schedule, a call log, a data feed from a hospital you do not control, and a short list of vendors who touch protected health information on your behalf. This guide covers the mechanics, then makes the privacy and vendor consequences explicit.

The 99495 CPT Code Description in Plain Operational Terms

CPT 99495 is Transitional Care Management Services with three published components: interactive contact with the patient or caregiver within two business days of discharge; medical decision making of at least moderate complexity during the service period; and a face-to-face visit within 14 calendar days of discharge. The service period runs 30 days beginning on the date of discharge.

Its companion code, 99496, carries the same contact requirement but specifies high-complexity medical decision making and a face-to-face visit within seven calendar days. Both apply when a patient transitions from an inpatient setting — acute care hospital, inpatient rehabilitation facility, long-term care hospital, skilled nursing facility, partial hospitalization, or hospital outpatient observation — back to a community setting such as home, assisted living, or a domiciliary.

Three more operational facts your billing staff should have memorized:

  • Medication reconciliation and management must occur no later than the date of the face-to-face visit.
  • The face-to-face visit is bundled into the TCM code and is not reported separately.
  • Only one practitioner may report TCM for a given patient per 30-day period.

Confirm current Medicare payment policy against the physician fee schedule materials published by CMS before you finalize internal policy, and check commercial payer rules separately — they diverge.

The Two-Business-Day Clock and Who Owns It

The contact requirement fails more TCM claims than the complexity requirement does. It fails because of weekends, holidays, staff PTO, and unmonitored inboxes — not because anyone forgot how care coordination works.

Assign the clock to a named role, not a department. In most practices that is a care coordinator or an RN care manager, with a designated backup. Write the coverage into your holiday schedule the same way you write in phone coverage.

What the contact log must show

Interactive contact means a real two-way exchange with the patient or caregiver by telephone, email, or in person. A voicemail is an attempt, not contact. Published guidance permits reporting the service when two or more separate attempts are documented in a timely manner and remain unsuccessful, provided the other requirements are met.

So your log needs timestamps, the identity of the staff member, the modality, the outcome, and the substance of the exchange. Free-text notes buried in a telephone encounter are hard to retrieve under audit. Use a structured template.

The 14-day visit window

Front desk staff need a scheduling rule that treats discharge-driven appointments differently from routine follow-ups. If your scheduling template has no protected slots, the 14-day window quietly becomes 19 days and the encounter gets billed as an ordinary office visit instead.

Practices that run this well hold two or three same-week slots per provider per day and release them 48 hours out if unused. That is a scheduling policy, not a clinical decision, and your administrator can write it.

Where the Discharge Data Comes From — and What It Drags In

You cannot start the clock without knowing the patient was discharged. Most practices learn this through one or more of: electronic patient event notifications from hospitals, a health information exchange feed, a fax from a discharge planner, or the patient's own phone call.

Each channel carries a different privacy profile, and your privacy officer should be able to draw the map on a whiteboard.

ADT feeds and the minimum necessary problem

Event notification feeds are useful precisely because they are broad. They are also easy to over-scope. If your feed delivers full discharge summaries for every patient on a hospital's panel rather than event notices for your attributed patients, you are receiving PHI you have no operational need for.

Treatment activities enjoy latitude under HIPAA, but the minimum necessary standard still shapes how you configure downstream access. Ask two questions at every feed review: who inside the practice can see this data, and how long does it persist in the intermediary's systems?

Behavioral health and substance use discharges

A discharge from a facility subject to 42 CFR Part 2 does not travel under the same rules as a discharge from a general medical floor. Part 2 records carry consent and redisclosure restrictions that your intake and care coordination staff will not intuit on their own.

Build a flag into your TCM intake worksheet. If the discharging facility is a Part 2 program, the coordinator escalates to the privacy officer before pulling records or leaving any message that identifies the source of care.

Information blocking cuts both ways

When the hospital is slow to send a discharge summary, your staff will start calling records departments. When another practice asks you for TCM documentation, the same pressure lands on you. The information blocking rules govern both directions, and "we were busy" is not a recognized exception. Document your release turnaround times.

The Contact Attempt Log Is a Billing Record and a Privacy Record

Here is where operations and privacy collide. Your coordinator needs to reach the patient fast, so she leaves a voicemail, sends a text, and emails the daughter listed as caregiver. Each of those is a disclosure decision.

Voicemail. Leave a callback name and number. Do not name the discharging facility, the diagnosis, or the reason for the transition. Script it once and post the script at every workstation.

Text messages. If you text patients, confirm the number in the chart against a documented patient preference, keep content minimal, and understand where the message content is stored by the carrier or platform. A texting platform that retains message bodies is a business associate.

Caregiver contact. The code contemplates contact with a caregiver. That is permissible under HIPAA when the caregiver is involved in the patient's care and the patient has not objected — but your staff needs a documented basis, not an assumption based on who answered the phone last time.

Vendors in the TCM Chain That Need a Business Associate Agreement

Walk the 30-day service period end to end and list every outside party that touches PHI. For a typical practice running TCM, that list includes more names than the administrator expects:

  • The care management or population health platform holding your discharge worklist
  • The health information exchange or notification intermediary delivering ADT events
  • Your after-hours answering service, which may take the patient's return call
  • Any outsourced or remote care coordination staffing vendor
  • The texting or patient-messaging platform
  • Your billing company or revenue cycle vendor, which sees the encounter and the documentation supporting it
  • Transcription or ambient documentation tools used during the face-to-face visit

Every one of those is a business associate if it creates, receives, maintains, or transmits PHI for you. The agreement has to be executed before data flows, not after the first incident. If your vendor list has grown faster than your contract file — and with TCM programs it usually has — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, which matters when you are papering six vendors at once rather than running a standing program.

The subcontractor question nobody asks

Your care management platform almost certainly runs on a cloud host and may use an offshore support team. Both are subcontractors, and both must be bound by agreements at least as protective as yours. Ask for the list in writing during vendor review. Note where support personnel are located, and note it in your risk analysis.

How Practices Determine and Document Code Selection

Administrative staff do not choose between 99495 and 99496. The billing provider does, based on the complexity of medical decision making during the service period, and the documentation has to support that determination independently of what the claim says.

What your staff owns is the evidentiary scaffolding around that decision:

  1. Discharge date, sourced and documented — not the date you heard about it.
  2. Contact timestamp and modality, with attempts logged separately from successful contact.
  3. Date of the face-to-face visit, and its position within the 7- or 14-day window.
  4. Medication reconciliation date, on or before the visit date.
  5. Non-face-to-face services performed by clinical staff during the 30 days, with who did what and when.

Your compliance lead should run a quarterly sample of TCM claims and check those five elements against the record. When an element is missing, the fix is almost always a workflow fix — a template field, a scheduling rule, a coverage assignment — not a coding correction.

A worked timeline

Discharge Wednesday the 7th. Coordinator calls Thursday the 8th, reaches voicemail, logs attempt one at 10:14 a.m. Calls again Friday the 9th at 2:30 p.m., speaks with the patient for eleven minutes, documents symptoms review and appointment scheduling. Face-to-face visit occurs Tuesday the 13th, six days post-discharge. Medication reconciliation completed at that visit. Service period runs through the 6th of the following month.

Every one of those entries is retrievable in under two minutes because the coordinator used a structured template. That is the whole difference between a defensible chart and a painful audit.

What Happens When a Patient Requests the TCM Record

Patients discharged from the hospital request records more often than average — they are dealing with disability paperwork, second opinions, and insurance appeals. Under the HIPAA right of access, you generally have 30 days to respond, with one 30-day extension available if you notify the patient in writing.

The TCM record includes the contact log, the care plan, and the non-face-to-face documentation — not just the office visit note. If that material lives in a third-party care management platform rather than your primary chart, your records staff needs a documented procedure for pulling it. Discovering that gap while the clock runs is a bad way to learn it exists.

Same principle applies to payer audits and to breach response. If you cannot enumerate every system holding TCM documentation, you cannot scope an incident. That enumeration belongs in your risk analysis and policy set, refreshed whenever you add a vendor — and the Security Rule update proposed in early 2025 pushes hard in the direction of complete, current asset inventories.

Your Next Step This Week

Pull your TCM vendor list and your executed BAA file. Put them side by side. If the vendor list is longer, close the gap before the next discharge notification arrives — draft and export the missing agreements in an afternoon rather than letting them sit as an open finding.

The 99495 CPT code description defines a 30-day service period. Your obligations around the data that supports it do not expire on day 31.