A patient is discharged from the hospital at 4:40 p.m. on a Friday. Your practice now has until close of business Tuesday to complete interactive contact, and — if the encounter is going to be documented and reported under the higher-complexity transitional care management code — seven calendar days to get that patient in front of a billing practitioner. The 99496 CPT code description is short. The operational machinery required to satisfy it is not.

This guide is for the administrator, billing lead, or privacy officer who has to build that machinery: who watches the discharge feed, who makes the call, what gets documented, and which of your vendors ends up holding protected health information when the workflow goes live. It is administrative guidance on how practices determine and document code selection — not clinical direction on which code fits a given patient.

99496 CPT Code Description in One Paragraph

CPT 99496 describes transitional care management (TCM) services for a patient discharged from an inpatient, observation, or skilled nursing setting to a community setting, requiring: interactive contact with the patient or caregiver within two business days of discharge; medical decision making of high complexity during the service period; and a face-to-face visit within seven calendar days of discharge. Its companion code, 99495, describes the same service framework with moderate-complexity medical decision making and a face-to-face visit within 14 calendar days. Both carry a 30-day service period that begins on the date of discharge, and payer rules generally allow only one practitioner to report TCM per patient per 30-day period.

The three elements your documentation has to prove

  • Interactive contact within two business days — telephone, secure message, or face-to-face — with the patient or caregiver, including attempts if contact fails.
  • A face-to-face visit inside the applicable window, performed by the billing practitioner (or, where payer rules permit, qualified staff under the applicable supervision rules).
  • Medical decision making complexity documented by the practitioner. Staff do not assign this. Complexity is a clinical determination recorded in the note; your role is making sure the note actually records it.

Everything else — reviewing the discharge summary, reconciling medications, arranging community services, scheduling follow-up diagnostics, educating the caregiver — is the non-face-to-face component that fills the 30 days between discharge and the end of the service period.

Why the Difference Between 99495 and 99496 Is an Operations Problem

The two codes are separated by dates and by documented complexity. Dates are something your practice controls. Complexity is not.

That means your scheduling design determines whether the seven-day window is even reachable. If your soonest post-hospital slot is 11 days out, the seven-day element is unavailable no matter what the practitioner documents. Practices that report the higher-complexity code with any regularity hold protected same-week slots, name a staff member who owns them, and track fill rate weekly.

Build a one-page internal rule that says, in plain language: discharge date is day zero; interactive contact is due by end of the second business day; the seven-day visit target and the 14-day outer limit are calculated from the discharge date, not the notification date. Notification often lags. Your clock does not.

What administrators should never decide

Do not let anyone on the billing side upgrade a code because the visit happened to land on day five. Complexity is documented by the clinician or it is not documented at all. Write that into your coding policy, and have your compliance lead spot-check ten TCM claims a quarter against the notes.

The Discharge-to-Contact Workflow, With Roles Attached

Here is a workflow structure that survives audit. Adapt the titles to your staffing.

  1. Day 0 — discharge notification arrives. A named role (front-desk supervisor or care coordinator) checks the discharge queue every business morning and at mid-afternoon. Log the notification source and timestamp.
  2. Day 0–2 — interactive contact. Clinical staff attempt contact. Record date, time, method, who was reached, and what was discussed. Record failed attempts with the same detail.
  3. Day 0–3 — records retrieval. Request the discharge summary and medication list from the facility. This is a treatment disclosure under the Privacy Rule and does not require authorization, but it does need to be requested through a documented channel, not a personal cell phone.
  4. Day 1–7 — schedule and hold the visit. Schedulers work from the discharge date, not the referral date.
  5. Day 7–30 — ongoing non-face-to-face work. Medication reconciliation must be completed no later than the date of the face-to-face visit. Referrals, home health coordination, and follow-up labs continue through the service period.
  6. Billing. Confirm the date-of-service convention your payers require and whether any other care management service was reported in the same period. Check the current Medicare Physician Fee Schedule guidance before you change a longstanding billing practice — the rules on concurrent care management reporting have shifted more than once.

One more discipline: assign a backup for every role. TCM windows do not pause for vacation, and a missed two-business-day contact is not recoverable.

The ADT Feed Is a PHI Pipeline, Not an IT Convenience

You cannot run this workflow without knowing when patients are discharged. Most practices get that through hospital admit-discharge-transfer notifications, a health information exchange, or a third-party notification service.

Every one of those arrangements moves identifiable patient data to or through an entity that is not your practice. Sort them before go-live:

  • Hospital to your practice, for treatment — a permitted disclosure between covered entities. No business associate agreement required, though the hospital may want a participation or data-use agreement.
  • An HIE or notification vendor handling the data on your behalf — that is a business associate. You need an executed BAA before the first message flows.
  • A subcontracted care-management or nurse-triage company making your two-business-day calls — business associate, and their subcontractors need agreements too.

HHS's business associate guidance is the reference to hand your practice manager. If your TCM build has surfaced two or three vendors with no paper in the file, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription, which is usually faster than routing a request to outside counsel for a routine notification vendor.

Ask these four questions before you sign

  • Which specific data elements does the vendor receive, and can the feed be narrowed?
  • Where is the data stored, and for how long after termination?
  • Which subcontractors touch it?
  • What is their breach notification timeline to you, in days, and is it in the contract?

What Your Two-Business-Day Call Can Actually Say

The interactive contact requirement pushes staff to leave voicemails, send texts, and call whoever answers. That is where minimum necessary gets tested.

Write a call script and a voicemail script. The voicemail script should identify the practice and request a callback — not the admitting diagnosis, not the facility name, not the medication being reconciled. HHS's minimum necessary guidance supports limiting the content of routine communications to what the purpose requires, and the purpose of that voicemail is a callback.

Then handle the caregiver question in advance. Staff will reach spouses, adult children, and group home managers. Document what the patient has confirmed about who may receive information, and give staff a written rule for what to do when an unlisted person answers: confirm identity, disclose nothing clinical, request a callback.

If you use SMS or a patient portal for interactive contact, confirm the platform is covered by a BAA and that message content is captured in the record. A contact you cannot evidence did not happen, as far as an auditor is concerned.

The Spreadsheet Problem: TCM Trackers Living Outside the EHR

Nearly every practice that launches TCM builds a tracker. Discharge date, contact attempt, visit date, complexity, billed or not. It usually starts life as a shared spreadsheet on someone's desktop or a personal cloud drive.

That file is a designated record set component and a breach waiting for a lost laptop. Bring it inside systems you already control and have assessed: your EHR's care management module, or at minimum a mapped, access-controlled network location with audit logging. Add it to your asset inventory and your risk analysis. If your risk analysis has not been refreshed since your workflows changed, that is the gap to close — automated risk analysis and policy generation will at least get the inventory and documentation current.

Then set a retention rule. Trackers accumulate for years because no one owns deleting them.

Documentation a Payer Audit Will Ask For

When a records request arrives for TCM claims, the reviewer is looking for a dated trail. Assemble it as a standard packet so staff are not reconstructing it under deadline:

  • Discharge date and discharging facility, from the discharge summary in the chart
  • Date, time, method, and participants of the interactive contact — including unsuccessful attempts
  • Date of the face-to-face visit and the practitioner who performed it
  • The practitioner's documentation of medical decision making complexity
  • Medication reconciliation, dated no later than the face-to-face visit
  • Non-face-to-face services performed during the 30-day period, with dates and the staff role performing them

Producing this to a payer for payment purposes is a permitted disclosure. Producing it to anyone else is not automatically permitted. Route unusual requests — attorneys, employers, a hospital's quality department asking for outcome data — through your privacy officer before anything leaves the building. Log the ones that require an accounting.

The Other 30-Day Clock: Patient Access

The 30-day TCM service period is not the only 30-day window in play. When a patient requests a copy of records that include TCM documentation, the Privacy Rule's right of access generally requires you to act within 30 days, with one 30-day extension available if you notify the patient in writing.

TCM records are scattered by design — call logs, outside discharge summaries, coordination notes, medication reconciliation. Decide now, in writing, what your designated record set includes for a TCM episode, so the person fulfilling a request is not making that judgment alone at day 27.

Also remember that withholding or unreasonably delaying electronic health information can raise information blocking exposure separate from HIPAA. The information blocking rules apply to actors including health care providers, and "we were not sure which system it lived in" is not an exception.

A Short Pre-Launch Checklist

  1. Written internal rule defining day zero, the two-business-day contact deadline, and the seven- and 14-day visit windows.
  2. Named owner and named backup for the discharge queue.
  3. Protected same-week appointment capacity, monitored monthly.
  4. Call and voicemail scripts approved by your privacy officer.
  5. Every discharge-data, telephony, texting, and outsourced-coordination vendor on your BAA list, with executed agreements on file.
  6. Tracker inside a system covered by your risk analysis, with a retention rule.
  7. Quarterly audit of ten TCM claims against the underlying documentation.
  8. Designated record set definition for a TCM episode, written down.

The 99496 CPT code description rewards practices that can prove dates. The privacy risk in TCM comes from the same place as the billing risk: hurried contact attempts, records moving through channels nobody papered, and trackers living where nobody looks. Fix the paper before you fix the throughput.

If your discharge-notification or outsourced-calling vendors are operating without executed agreements, close that gap first — generate the business associate agreement, get it signed, and file it with the vendor record before your next TCM cycle starts.