Your care manager logs 23 minutes for a patient in April. The claim goes out on May 2. Six months later a payer asks you to prove those 23 minutes happened, that the patient agreed to the service and understood the cost sharing, and that no other practice billed the same patient for the same calendar month. If the minutes live in a third-party platform your practice does not control, you have a records problem and a vendor problem at the same time.

CCM billing — reporting chronic care management services to Medicare — is one of the few revenue streams where the documentation, the privacy exposure, and the vendor relationship are the same object. This guide covers the operational mechanics for administrators and billing staff, then makes the records-handling and business associate implications explicit.

What CCM Billing Requires Before a Single Minute Counts

Medicare conditions payment for chronic care management on a set of structural requirements that must be in place before you accrue billable time. In short form:

  • Two or more chronic conditions expected to last at least 12 months (or until death) that place the patient at significant risk of death, acute exacerbation or decompensation, or functional decline.
  • Patient consent, documented in the medical record, covering the nature of the service, that only one practitioner may furnish and bill it per calendar month, applicable cost sharing, and the patient's right to stop at any time.
  • A comprehensive, electronic care plan that is available to the care team and can be shared with the patient or caregiver.
  • 24/7 access to a care team member for urgent needs, plus continuity with a designated member of the care team for successive routine appointments.
  • Management of care transitions, including timely exchange of clinical summaries.
  • Time tracked per calendar month, attributable to identified clinical staff or the billing practitioner, under the required level of supervision.

Miss the consent documentation and the minutes are unbillable no matter how good the care was. That single fact drives most of the workflow below. CMS publishes the governing payment policy through the Physician Fee Schedule, and your billing lead should be reading the annual final rule summary rather than a vendor's marketing sheet.

The Monthly Cycle: Who Does What, and When

CCM is a calendar-month service, which means your close process is not the same as your ordinary claim cycle. Build it as three phases with named owners.

Days 1–25: Enrollment, Outreach, and Time Capture

Enrollment is a front-office and clinical hand-off. A practitioner identifies eligibility during a visit, the consent conversation happens, and someone records it — verbatim scripted language, date, and the name of the person who obtained it. Assign this to a specific role, not "whoever is available."

Time capture happens continuously. Every phone call, medication reconciliation, chart review, coordination call to a specialist's office, and care plan update gets a timestamped entry with the staff member's name and a one-line description of the activity. Round numbers repeated across dozens of patients — 20 minutes exactly, every month, every patient — are the pattern auditors look for first.

Days 26–31: Threshold Review

Your care management lead reviews the panel against time thresholds and flags patients sitting just under a threshold. This is a legitimate operational review: an outreach call that was already clinically indicated can be completed before month end. It is not a license to manufacture minutes. Write the distinction into your policy so staff know where the line sits.

First week of the following month: Reconciliation and Claim Release

Billing pulls the time log, confirms consent is on file, confirms the care plan exists and was accessible, and confirms no conflicting monthly care management service was reported for the same patient. Only then does the claim release. One person signs off — and that sign-off is itself a record you keep.

If a vendor supplies the time log, reconciliation means checking a sample against something independent: call detail, EHR access logs, secure message threads. Attesting to minutes you cannot verify is a False Claims Act problem wearing a billing costume.

How Practices Determine Which CCM Code to Report

Code selection turns on three variables: whose time it was, how much time accrued in the calendar month, and whether the case meets the payer's definition of complex care management. The CPT family separates clinical staff time from billing practitioner time, and separates base codes from add-on codes for additional increments. There are also separate codes for the initiating comprehensive assessment and care planning work.

Your job as an administrator is to build a decision path, not to decide clinical complexity. That means:

  1. The time log distinguishes practitioner time from clinical staff time by default, not by later reconstruction.
  2. The billing practitioner — not the billing department — attests to complexity determinations in the record, in their own documentation.
  3. Your coding policy names the payer source for each definition, and someone reviews it every January when the fee schedule changes.
  4. Add-on increments are reported only when the underlying time log supports the full increment.

CMS also introduced advanced primary care management codes in 2025 — bundled monthly payments stratified by patient risk, without a time threshold. Practices evaluating them should note that concurrent reporting rules apply: you cannot stack these against CCM for the same patient in the same month. Whichever path you pick, the consent, care plan, and 24/7 access obligations do not disappear.

Staff conflate these constantly, and the confusion produces two failure modes. First, practices collect a HIPAA authorization form and think it satisfies the CCM consent requirement — it does not, because it says nothing about cost sharing, the single-biller rule, or the right to discontinue. Second, practices treat CCM consent as broad permission to share the patient's chart with any vendor in the workflow.

Treatment, payment, and health care operations disclosures to a business associate performing care management on your behalf do not require patient authorization. They do require a signed business associate agreement and a minimum-necessary decision about how much of the chart the vendor actually sees. Those are separate documents serving separate purposes. Keep them separate in your files and in your training.

Your CCM Vendor Is a Business Associate — Settle These Before PHI Moves

Outsourced CCM is common because staffing a nurse call panel is expensive. The vendor makes outbound calls to your patients, drafts and stores care plans, records time, and often texts or emails patients. Every one of those functions creates or holds protected health information on your behalf.

Before the first roster upload, get written answers to these:

  • Scope of access. Full EHR credentials, a limited interface, or an exported roster? Which fields?
  • Subcontractors. Who else touches the data — offshore call centers, transcription, SMS gateways, analytics? Are downstream BAAs in place?
  • Call recording. Are calls recorded, where are recordings stored, how long, and who can replay them? Recordings are PHI and they are discoverable.
  • Care plan ownership. On termination, do you get a complete, usable export — and in what format, by what deadline?
  • Time log integrity. Is the log append-only with an audit trail, or can entries be edited after the fact without a record?
  • Breach notification. How many days to notify you? "Without unreasonable delay" leaves you holding a 60-day clock you can't meet.
  • Identity of the caller. Do vendor staff identify themselves as calling on behalf of your practice? Patients who feel cold-called complain to you, and to OCR.
  • Secondary use. Does the contract prohibit using your patient data for the vendor's own product development, marketing, or de-identified data sales?

If the vendor's paper is thin or you are onboarding a new care management partner without an executed agreement, generate a clean one before the roster moves. A signature-ready business associate agreement built through a guided six-step wizard gets you a defensible document in PDF and DOCX for a one-time cost — faster than routing a redline through counsel while the pilot sits idle. HHS also publishes sample business associate agreement provisions worth reading alongside whatever you sign.

Where the Care Plan Lives Determines How You Answer a Records Request

A patient enrolled in your CCM program asks for "everything the care manager wrote." The care plan, the call notes, and the time log entries with clinical content are part of your designated record set — even if they physically sit in a vendor's platform. You have 30 days, with one possible 30-day extension. The vendor's response time is your problem.

Two operational fixes. First, write a records-retrieval service level into the BAA: vendor produces a complete patient-level export within a set number of business days on request. Second, test it. Pull one record per quarter as a fire drill and time it. OCR's right of access work has been persistent for years, and the enforcement pattern in the public breach portal and access-related resolutions makes clear that "our vendor was slow" is not a defense.

De-Enrollment Is a Privacy Control, Not Just a Billing Step

A patient revokes CCM consent. Billing stops at the end of that month. But if nobody tells the vendor, the outbound calls continue — and a patient who asked you to stop and kept getting called from a number they do not recognize will file a complaint.

Build a single de-enrollment trigger that does four things: stops the billing flag, notifies the vendor in writing, suspends automated outreach, and documents the date and requester. Same workflow for patients who move, die, or transfer to another practice's CCM program. Stale rosters are the most common source of unnecessary disclosure in outsourced care management.

Audit Exposure: Time Logs Are Both Billing Documentation and PHI

Hold your CCM documentation to the longer of your state medical-record retention requirement and your payer's audit lookback. HIPAA separately requires six years of retention for the compliance documentation itself — policies, BAAs, risk analyses, training records — measured from creation or last effective date.

Practical consequence: when you terminate a CCM vendor, you cannot simply let their instance go dark. Get the export, verify it is complete and readable, store it inside your own retention scheme, and document the vendor's certification of destruction. Practices that skip this discover the gap during an audit, three years later, when the vendor no longer exists.

Your risk analysis should also name the CCM platform explicitly as a system holding ePHI, with the roster size and data types recorded. If your current analysis predates the program, it is out of date. Tools that automate risk analysis and the supporting policy set shorten that update considerably, but the system inventory still has to reflect what you actually run.

A 30-Day Punch List

  1. Pull five CCM claims from last quarter. Confirm consent documentation, care plan existence, and time log detail for each. Note what is missing.
  2. Confirm an executed BAA exists for every vendor touching the CCM roster, including SMS and call-recording tools.
  3. Name the person who releases CCM claims and the person who reconciles the time log. They should not be the same person.
  4. Run one records-request fire drill against the vendor platform and record the turnaround.
  5. Test your de-enrollment trigger end to end with a real revoked patient.
  6. Add the CCM platform to your system inventory and update the risk analysis.

CCM billing rewards practices that treat documentation as the product. The revenue follows the record, not the other way around.

If a care management vendor is waiting on paperwork before your program can start, generate the business associate agreement now and get the roster moving under a signed contract rather than a handshake.