A payer sends your practice a records request for 25 encounters from the last 18 months. Every one of them was leveled on total time. The request asks for the chart note, the billing record, and — this is the part that catches administrators off guard — "any system-generated evidence supporting the time reported."

That last line is why billing by time is a practice-operations problem before it is a coding problem. It changes what your clinicians write, what your EHR logs, which vendors touch protected health information, and what you have to hand over when a patient or a payer asks. This guide walks the workflow, then makes the privacy and vendor implications explicit.

What Billing by Time Means in the Current E/M Framework

Since the 2021 office-visit overhaul and the 2023 expansion to most other E/M categories, a practitioner selects a visit level using either medical decision making or total time on the date of the encounter. Emergency department visit codes remain the notable exception — they are not time-based.

Your job as an administrator is not to decide which method fits a given patient. Your job is to make sure that whichever method the clinician chooses, the documentation actually supports it, and that the supporting data is captured, retained, and protected.

What Counts Toward Total Time

CPT counts time the reporting practitioner personally spends on the date of the encounter, face-to-face and non-face-to-face. Typical activities include reviewing records before the visit, obtaining history, examining the patient, counseling, ordering medications and tests, referring and communicating with other professionals, documenting in the record, independently interpreting results, and coordinating care.

What Does Not Count

  • Clinical staff time — your MA rooming the patient, your nurse making the follow-up call.
  • Time on any service reported separately, including procedures with their own codes.
  • Time on a date other than the date of the encounter.
  • Travel and general administrative work not tied to that patient's care.

CMS also maintains its own prolonged-services HCPCS codes and its own counting conventions that differ from CPT's in places. Build your internal guidance around the specific payer, not around a single universal rule. CMS publishes its position on the evaluation and management visit policy and updates it with each physician fee schedule cycle.

What Documentation Does Billing by Time Require?

A defensible time-based note generally contains four elements:

  1. A total time statement — an explicit number of minutes, not a range and not a code-level attestation like "time consistent with 99214."
  2. The date the time was spent, matching the date of the encounter.
  3. A description of the qualifying activities the practitioner personally performed.
  4. An attribution making clear the time is the billing practitioner's own, excluding staff time and separately reported services.

Some payers additionally expect start and stop times, or a breakdown between face-to-face and non-face-to-face minutes. Check your top five payers' medical policies and write the strictest common denominator into your template. That is administrative guidance — the clinician still decides what was medically necessary and how to describe it.

The Workflow That Makes Time Defensible

Time-based selection fails audits for boring reasons: cloned attestations, minutes that never vary, and totals that exceed the hours in a provider's day.

Fix the Template Before You Fix the Providers

Most EHR time attestations ship as a single-click macro. A macro that always produces the same number is the fastest route to a refund demand. Configure the smart phrase to require a typed numeric entry and a free-text activity list. Assign this to your EHR analyst or superuser with a completion date.

Run a Monthly Aggregate Time Report

Have your billing lead pull total attested minutes per rendering provider per day. Flag any day where attested E/M time plus procedure time exceeds a plausible working day. This is a five-minute report that prevents a five-figure problem. Document that you ran it — a self-audit trail is part of your compliance program's evidence.

Decide Who Owns the Discrepancy Conversation

When the report flags a provider, someone has to have the conversation. Name that person in writing — usually the compliance lead or practice manager, not the biller who found it. Log the date, what was reviewed, and what changed.

Don't Forget the Other Time-Based Services

Billing by time is not only an E/M concern. Critical care, psychotherapy, care management and remote monitoring services, and therapy services under Medicare's timed-code conventions all carry their own minute thresholds and their own documentation expectations. If your practice bills any of them, they belong in the same monthly review.

Split/Shared and Teaching Settings Raise the Stakes

When a physician and an advanced practice provider both contribute to the same encounter, the substantive-portion rules determine who reports it. CMS has aligned with CPT in permitting the substantive portion to be established by more than half the total time or by performing the medical decision making. Your operational obligation is to make the choice visible in the note — which practitioner, which basis, which minutes.

Teaching settings add another layer: when payment is sought on the basis of time, the teaching physician must be present for the time being counted. Resident time alone does not carry the claim. If your practice hosts residents, your note template should force a separate teaching-physician time entry rather than inheriting the resident's.

Your Audit Log Just Became Billing Evidence — and It's Still PHI

Here is the operational collision nobody plans for. EHR access logs, telehealth session durations, and ambient documentation timestamps are increasingly the thing payers ask for to corroborate attested time. Those same logs are security records containing PHI and user identity data.

Three consequences for your practice:

  • Retention. If audit logs corroborate claims, your log retention period must at minimum cover your payers' lookback windows and your own record-retention policy. Confirm the actual retention setting in your EHR — vendors often default to something shorter than you assume.
  • Minimum necessary. Disclosures for payment purposes are subject to the minimum necessary standard. Exporting a full audit log for one date of service is defensible; exporting a provider's entire access history is not. HHS guidance on the minimum necessary requirement is worth putting in front of whoever fulfills payer requests.
  • Chain of custody. Whoever pulls the log should record who requested it, what date range was pulled, and where the file went. That record is your defense if the extract later shows up somewhere it shouldn't.

Billing by Time Adds Vendors to Your List — Every One Needs a BAA

Count the third parties a time-based workflow tends to introduce:

  • Ambient documentation tools that capture audio and generate a draft note, sometimes with a computed time estimate.
  • Transcription and dictation services.
  • Revenue cycle management firms and outsourced coders who review time attestations.
  • External coding auditors and compliance consultants retained to sample time-based claims.
  • Telehealth platforms whose session logs you rely on for duration.

Each of these creates, receives, maintains, or transmits PHI on your behalf. Each is a business associate. If you cannot produce a signed agreement for every one of them today, that gap is the finding an investigator will reach first — it requires no forensics, just a request for your vendor list.

If you're onboarding an ambient scribe or a new billing partner this quarter and don't want to wait on outside counsel for a standard agreement, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It's a one-time purchase, which matters when you're papering four vendors in one week and not standing up a subscription.

Ask Ambient Vendors These Four Questions

  1. Is the raw audio retained, and for how long? Can we set the retention period ourselves?
  2. Is audio or transcript data used to train models, and can we opt out contractually?
  3. Where is the data processed and stored, and are subcontractors flowed down under the BAA?
  4. What does your breach notification timeline look like, and does it beat our 60-day outer limit?

Separately — and this is state law, not HIPAA — confirm your recording consent obligations. Several states require all-party consent to record a conversation. Your front desk needs a script and a place to document the patient's response.

When a Patient Asks for the Chart, the Time Attestation Goes With It

The HIPAA right of access covers the designated record set, which includes billing records used to make decisions about the individual. A time attestation in a progress note is part of the note. A patient who requests their records receives it, and a patient who disputes a bill may request it specifically.

You have 30 days to respond, with one 30-day extension available if you notify the patient in writing of the reason and the new date. HHS keeps its individual right of access guidance current, and access-related enforcement has been a sustained OCR priority for years. Train your records staff that "the billing team handles that" is not a lawful response to an access request.

Ambient audio recordings are the harder call. Decide deliberately whether raw audio is part of your designated record set, write the decision down, and make retention match. A vendor holding recordings indefinitely while your policy says otherwise is an inconsistency you will have to explain.

A 30-Day Implementation Checklist

Week 1 — EHR analyst. Audit every time-attestation template. Remove macros that auto-populate minutes. Confirm audit log retention settings and document them.

Week 2 — Billing lead. Build the aggregate daily time report. Run it retroactively for the last two quarters. Escalate outliers to the compliance lead.

Week 3 — Compliance lead. Reconcile the vendor list against signed BAAs. Any vendor touching notes, audio, claims, or logs without an agreement gets one this week or gets suspended.

Week 4 — Practice manager. Train providers on what counts and what doesn't, with the payer-specific differences in writing. Train records staff that time attestations are releasable. Document attendance.

Then put the aggregate time report on a recurring monthly calendar item with a named owner. A control nobody runs is not a control.

Close the Gaps Before the Request Letter Arrives

Billing by time is legitimate, well-supported, and often the fairer reflection of the work performed. It also expands your data footprint and your vendor roster in ways that are easy to miss until an auditor or a patient forces the issue.

Start with the vendors, because that's the gap with no defense and the fastest fix — build the BAAs you're missing this week. If your broader documentation set needs the same treatment, automated risk analysis and policy generation will get you to a defensible baseline faster than rebuilding templates by hand.