A practice administrator in a three-physician internal medicine group told me she found 412 minutes of chronic care management time logged in a vendor portal for the month of January — and not one of those minutes appeared in her EHR. The vendor billed it. The practice signed the claims. Nobody could produce a time-stamped record inside the chart. That is the operational risk sitting under ccm cpt codes: the money is straightforward, the documentation is not, and the work is usually done by someone who is not your employee.

This guide is for the person who runs the practice — the administrator, the billing lead, the privacy officer. It covers what the CCM code family bills for, what documentation an auditor asks for, and where the vendor and records-handling exposure actually sits. It is administrative guidance about process, not clinical guidance about which code fits a given patient.

What CCM CPT Codes Actually Bill For

Chronic care management is a non-face-to-face service billed once per calendar month per patient, by one practitioner. The code family separates by who performed the time (clinical staff under general supervision vs. the physician or other qualified health professional) and how much time accumulated in the month.

  • 99490 — first 20 minutes of clinical staff time directed by a physician/QHP, per calendar month.
  • 99439 — each additional 20 minutes of clinical staff time; add-on to 99490.
  • 99491 — first 30 minutes of physician/QHP time personally performed, per calendar month.
  • 99437 — each additional 30 minutes of physician/QHP time; add-on to 99491.
  • 99487 — complex CCM, first 60 minutes of clinical staff time, with moderate or high complexity medical decision making.
  • 99489 — each additional 30 minutes of complex CCM clinical staff time.
  • G0506 — a one-time add-on for the comprehensive assessment and care planning performed by the billing practitioner, reported with the initiating visit.

Related but distinct: principal care management codes (99424–99427) cover a single complex chronic condition, and CMS introduced Advanced Primary Care Management HCPCS codes in the CY2025 Physician Fee Schedule as a bundled monthly alternative without a time threshold. Your billing lead should confirm current-year payment policy against the CMS Chronic Care Management Services MLN booklet before changing anything.

Who selects the code: the billing practitioner, based on documented time and documented complexity. Your job is to build the workflow that makes that documentation exist and survive an audit. Never let a vendor's dashboard be the sole basis for code selection.

The Program Requirements That Generate Your Compliance Work

CCM has structural conditions that go beyond the minutes. Each one creates an operational artifact your practice has to store, retrieve, and protect.

Eligibility and the initiating visit

The patient must have two or more chronic conditions expected to last at least 12 months or until death, placing them at significant risk. New patients — or patients not seen within the prior year — generally require an initiating visit before enrollment. Assign one person to run the eligibility list monthly. If your enrollment roster is built by a vendor's algorithm, require them to hand back the criteria used, in writing.

Consent may be verbal or written, but it must be documented in the record, and it must cover the essentials: only one practitioner can furnish and bill CCM in a calendar month, cost sharing may apply, and the patient can stop the service at the end of any month. Store the consent where a records request can find it — not in a vendor CRM your release-of-information clerk has never logged into.

The time log

This is where most practices lose an audit. You need per-encounter entries: date, staff member, minutes, and what was done. Rounded monthly totals with no underlying detail will not hold. Decide now whether the authoritative log lives in your EHR or in a vendor system, and if it lives in the vendor system, get a contractual right to export it in a readable format on demand — including after termination.

The comprehensive care plan

A typed, structured, electronic care plan covering problems, expected outcomes, medication management, planned interventions, and the responsible providers. It has to be available to the care team 24/7 and a copy has to be given to the patient. That last requirement quietly turns the care plan into a document your front desk will be asked to reproduce, and it belongs in your designated record set.

24/7 access and continuity

Patients need a means to reach care team members around the clock for urgent needs, and a designated team member for successive routine contacts. In practice this means an answering service, a nurse triage line, or a vendor call center. All three are business associates.

Why CCM CPT Codes Expand Your Vendor List Faster Than Any Other Service

Run the inventory for a single CCM program and count the entities that touch protected health information:

  1. The care management vendor whose nurses call your patients and document in your chart.
  2. The telephony or VoIP provider carrying those calls — and recording them, if you record.
  3. The SMS or automated outreach platform sending check-in messages.
  4. The care-plan software, if it sits outside your EHR.
  5. The billing company submitting the monthly claims.
  6. Any offshore or remote staffing arrangement layered under the vendor.

Every one of those needs a Business Associate Agreement in place before PHI moves. And the PHI at issue here is unusually sensitive in aggregate: a CCM roster is, by definition, a list of your patients with two or more serious chronic conditions. A breach of that file is not a mailing list. It is a diagnosis list.

Check the OCR breach portal and the pattern is consistent: business associates account for a substantial share of large reported breaches, and provider organizations are the ones whose patients get the notification letter. Your BAA is what defines breach notification timelines, subcontractor flow-down, and return-or-destruction of data at termination.

If your CCM vendor onboarding is moving faster than your paperwork, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon — one-time purchase, no subscription. That is a better outcome than the common alternative, which is starting the pilot on a handshake and backfilling the agreement in Q3.

Four contract terms to negotiate before the first enrollment call

  • Data export on demand. Time logs, consent records, and care plans in a portable format, within a defined number of days, at no additional cost.
  • Subcontractor disclosure. Names and locations of any downstream staffing or technology partners, with notice before changes.
  • Breach notice window. HIPAA allows a business associate up to 60 days; negotiate for materially less, because your own 60-day clock to patients runs concurrently.
  • Termination handling. Return or destruction of PHI, with written certification. Vendors who cannot commit to this usually have an architecture problem.

HHS publishes sample business associate agreement provisions that give you the required floor. Treat them as a floor, not a template you ship unchanged.

The Records Requests CCM Will Generate

Once a patient has a care plan and a monthly service, they will eventually ask for the file — sometimes because they are disputing the cost sharing on their statement.

Under the HIPAA right of access, you generally have 30 days to respond, with one 30-day extension available if you notify the patient in writing of the reason and the new date. The care plan is part of the designated record set. So is the clinical documentation of CCM encounters. OCR's right of access guidance is the reference to hand your ROI staff, and right-of-access failures have driven a long-running OCR enforcement initiative — these are not theoretical cases.

The operational failure mode is specific: your release-of-information clerk pulls the chart from the EHR, exports it, and never touches the vendor portal where the care plan and encounter notes actually live. Fix this by mapping your designated record set explicitly, naming every system that holds CCM documentation, and giving ROI staff credentialed access to each one — with role-appropriate permissions, not a shared login.

Minimum necessary in outreach workflows

Outbound CCM calls hit voicemail constantly. Set a scripted voicemail standard that identifies the practice and a callback number and nothing else — no condition, no medication, no reason for the call. Do the same for SMS. Confirm the patient's preferred contact method and any confidential-communication request at enrollment, and make sure that preference syncs to the vendor's dialer, not just to your EHR demographics screen.

If calls are recorded for quality review, the recordings are PHI. Document retention, access controls, and who inside the vendor can replay them.

One Practitioner Per Patient Per Month

Only one practitioner may bill CCM for a given patient in a given calendar month. When a specialist and a primary care practice both enroll the same patient, one claim gets denied and both practices have done unbilled work.

Build a check into enrollment: ask the patient directly whether another practice provides monthly care management, and document the answer with the consent. Coordination calls with the other practice are permitted for treatment and payment purposes — you do not need a separate authorization to sort out who is billing.

A Month-End Close Checklist for CCM

Assign these by name, not by department, and run them in the first five business days after month close:

  1. Billing lead: reconcile vendor-reported minutes against time-log detail in the record. Any patient with reported minutes and no corresponding entries gets held, not billed.
  2. Clinical lead: confirm the billing practitioner reviewed the month's activity before code selection, and that the review is documented.
  3. Front desk supervisor: verify every newly enrolled patient has a documented consent on file, including the one-biller and cost-sharing disclosures.
  4. Privacy officer: spot-check five outreach records for minimum-necessary compliance in voicemails and texts.
  5. Administrator: confirm every system that touched a CCM patient this month appears on the current BAA inventory with an executed, in-date agreement.

That fifth item is the one that slips. Care management programs grow by adding tools — a survey platform here, a scheduling bot there — and the vendor inventory ages out within a quarter. Reconciling it monthly is cheaper than reconstructing it during an investigation.

Where This Leaves You

The revenue mechanics of ccm cpt codes are the easy part. The durable work is the evidence trail: consent you can retrieve, time logs with per-encounter detail, a care plan that a records clerk can produce inside 30 days, and a signed agreement with every entity that touched the data. Practices that get audited on CCM rarely fail because the service was not delivered. They fail because the proof lived somewhere nobody controlled.

Before your next care management vendor goes live, put the agreement in place — build the BAA in six steps and export it for signature, then log it in your vendor inventory the same day. If your broader documentation set needs the same treatment, automated risk analysis and policy generation will get the rest of the file current.