A four-provider dermatology group runs roughly 45 specimens a week. Each one generates a requisition, a courier handoff, a pathology report, a claim line, and — eventually — at least one patient or payer asking for a copy of something. Every biopsy CPT code your practice reports sits at the center of that chain, and the chain crosses three or four organizations before the money lands.

This guide is for the administrator, biller, or privacy officer who owns that chain. It covers how practices structure biopsy coding workflows, where the documentation has to live, and — the part most coding articles skip entirely — which of those handoffs create disclosure obligations, which require a signed Business Associate Agreement, and which do not.

None of what follows is clinical guidance. Code selection belongs to the provider who performed and documented the procedure. Your job is to build the workflow that captures the documentation, applies the rules consistently, and keeps the protected health information from leaking out the sides.

Which Biopsy CPT Code Families Your Coders Work From

There is no single biopsy CPT code. CPT organizes biopsies by anatomic site and technique, and your coding staff needs to know which family a given specimen belongs to before anything else happens:

  • Integumentary (skin): 11102–11107, split by technique — tangential, punch, and incisional — each with a primary code and an add-on code for additional lesions.
  • Fine needle aspiration: 10004–10012 and 10021, differentiated by imaging guidance and lesion count.
  • Breast: 19081–19086 for percutaneous biopsy with imaging guidance and device placement; 19100 for percutaneous needle core without imaging guidance.
  • Bone marrow: 38220 (aspiration), 38221 (biopsy), 38222 (both).
  • Lymph node: 38500–38525, split by open versus needle and by depth.
  • Endoscopic: biopsy is built into the endoscopy code itself — 43239, 45380 and similar — rather than reported separately.
  • Organ-specific: liver (47000), kidney (50200), prostate (55700), muscle (20200, 20205), bone (20220–20251).

Surgical pathology codes — the 88300 series, plus special stains and immunohistochemistry — are a separate conversation, and in most practices a separate biller entirely. More on that below.

How Your Practice Determines and Documents Code Selection

The distinguishing facts for most biopsy families are technique, lesion count, and imaging guidance. All three have to appear in the operative or procedure note before your coder can do anything defensible.

Build a specimen log, not a memory

Practices that report multiple lesions on one date need a per-encounter specimen log that records: lesion number, anatomic site with laterality, technique used, container ID, and the requisition number sent to the lab. That log reconciles three separate things — the chart note, the claim, and the pathology report that comes back days later.

Assign the log to a named role. In most small practices it is the medical assistant who labels containers; in larger ones, a designated specimen coordinator. Do not leave it to "whoever is in the room." When a payer audits a multi-lesion claim two years later, the log is what tells you which pathology report corresponds to which line item.

Modifiers and edit pairs

Add-on codes, distinct-service modifiers, and site-specific modifiers all show up in biopsy billing. Your coding staff should be checking claims against the current National Correct Coding Initiative edits before submission rather than after denial. CMS publishes the edit files and the accompanying policy manual at cms.gov, and they change quarterly.

Set a standing calendar item: someone reviews the quarterly NCCI update and the annual CPT changes and confirms your charge master, EHR order sets, and encounter form still match. Practices that skip this are still billing deleted codes eighteen months later.

Who signs off

Write down the escalation path. If the note does not state technique or lesion count clearly enough for the coder to pick a biopsy CPT code, the claim goes to a query queue — not to a guess. Track query turnaround time. If your average is over three business days, your A/R is paying for it.

The Requisition Is a Disclosure, Not Just Paperwork

Every lab requisition your practice sends out contains patient identifiers, a clinical indication, and often an insurance ID. That is a disclosure of protected health information, and it travels through a courier, a lab's intake department, and back through a results interface.

Three failure points show up repeatedly in practice audits:

  1. Requisitions left in an unsecured pickup bin near a back door where the courier collects them.
  2. Results faxed to a stale number after a referring provider's office moves — misdirected faxes and mailings remain a persistent category in the incident reports practices file with OCR.
  3. Pathology reports printed to a shared tray and left overnight.

Fix these with physical controls, not policy language. Locked pickup box, annual fax directory verification with a documented date, and a print-release requirement on any device that receives pathology results.

Which Biopsy-Chain Partners Need a BAA — and Which Don't

This is where practices get it backwards, in both directions.

Generally not a business associate

An independent reference laboratory that receives your specimen and requisition is typically acting as a covered entity in its own right, receiving PHI for treatment purposes. A disclosure from one covered entity to another for treatment does not require a Business Associate Agreement. The same reasoning applies to a consulting pathologist who bills independently for the professional component.

That does not mean you skip diligence. You still confirm the lab's results delivery method is encrypted, you still verify who at the lab can access your patient list, and you still document that verification.

Almost always a business associate

  • Your billing company or outsourced coding vendor. They handle PHI on your behalf to perform a covered function. BAA required.
  • Transcription services producing procedure notes.
  • Specimen couriers that also handle requisitions or paperwork — if they are doing more than moving a sealed container, get the agreement.
  • Your EHR and practice management host, along with any results-interface middleware sitting between you and the lab.
  • Document scanning and records-release vendors that fulfill pathology report requests on your behalf.
  • Cloud storage or backup providers holding scanned path reports.

Pull your vendor list and mark each row against that split. If you find a billing vendor or courier with no executed agreement — and most practices find at least one — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase, not a subscription, which matters when you are papering over a gap discovered on a Tuesday afternoon. HHS also publishes sample BAA provisions if you want to compare required elements line by line.

Anti-Markup, TC/PC Splits, and Who Actually Bills the Pathology

If your practice sends specimens out and the lab bills the patient's insurer directly, your billing scope ends at the biopsy CPT code for the collection procedure. Clean and simple.

If your practice bills globally for surgical pathology performed by an outside lab or a contracted pathologist, you are in anti-markup territory under 42 CFR 414.50. The payment limitation restricts what you may bill Medicare for the technical or professional component of a diagnostic test performed by someone outside your practice. There are also Stark and anti-kickback implications in how those arrangements are structured.

Operationally: know which model you are in, write it down, and make sure the person entering charges knows it too. The most expensive coding errors in this space are structural, not clerical.

The in-office lab wrinkle

Practices with in-house histology add a CLIA obligation and a second records custodian inside their own walls. Under the 2014 CLIA amendments, laboratories must provide patients direct access to their completed test reports on request. If your practice operates the lab, you own that duty in addition to the HIPAA right of access.

The 30-Day Clock When a Patient Asks for a Pathology Report

A patient calls two weeks after a procedure and wants the full pathology report, not the summary the provider gave them by phone. Your obligation under 45 CFR 164.524 is to provide access to PHI in the designated record set within 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the new date.

Practical rules for your front desk:

  • The pathology report is part of the designated record set once your practice maintains it. "Ask the lab" is not a compliant answer if you have the report.
  • Fees must be reasonable and cost-based. Per-page charges pulled from an old state schedule are a common source of complaints.
  • If the patient asks for electronic delivery to an unencrypted personal email address, you may honor that after warning them of the risk. Document the warning and the request.
  • Log every request with a received date. That timestamp is your defense.

OCR's Right of Access Initiative has produced a long series of enforcement resolutions since 2019, and the pattern is consistent: small practices that ignored or slow-walked a records request. HHS maintains detailed guidance on individuals' right of access — put a printed copy in your records-release binder.

Payer Records Requests and the Minimum Necessary Standard

When a payer requests documentation supporting a biopsy claim, send what supports that claim. Minimum necessary applies to payment disclosures — it does not apply to treatment disclosures, which is why the requisition to the lab and the response to the payer are governed differently.

Build a records-release template keyed to the request type. A payer asking about a multi-lesion date of service needs the procedure note, the specimen log, and the corresponding pathology reports for those lesions. It does not need the patient's entire longitudinal chart, and sending the whole chart because it is faster to hit "export all" is an over-disclosure your privacy officer will have to explain.

A 30-Day Tightening Plan

Week 1. Inventory every organization that touches a specimen, requisition, or pathology report. Reference labs, couriers, billing vendor, transcription, interface vendor, scanning service, backup provider.

Week 2. Sort that inventory into treatment-disclosure relationships and business associate relationships. Confirm an executed, current agreement for every business associate. Note the execution date and the renewal owner.

Week 3. Audit ten recent multi-lesion encounters. Can you reconcile the chart note, the specimen log, the pathology report, and the claim lines without asking anyone? If not, the log is the problem.

Week 4. Time-test your records release. Have someone submit a test request and measure the actual turnaround. Verify the fee schedule. Verify the fax directory.

Reconciling a biopsy CPT code against a pathology report is a billing task. Knowing who received that report, under what agreement, and how fast you can produce it for the patient is a compliance task. The same specimen generates both.

Next Step

If your vendor inventory turned up a billing company, courier, or transcription service without a current agreement on file, close that gap this week — build the Business Associate Agreement and get it countersigned before your next audit. If the broader document set is what's thin — risk analysis, policies, workforce training records — automated HIPAA documentation tooling will get you further than another folder of templates nobody has opened since 2022.