Your anticoagulation clinic runs eleven fingersticks on a Friday afternoon. Each one generates a result, a dose decision, a phone call, a portal message, and a line on a claim. That line is usually CPT 85610 — the prothrombin time code — and it is one of the highest-volume, lowest-dollar codes a primary care or cardiology practice will ever submit.

This guide is for the administrator, biller, or privacy officer who owns that workflow. It covers what the code represents, how practices document and route code selection, where claims fail, and — the part most billing articles skip — exactly which vendors, interfaces, and records requests come attached to every INR result you produce. No clinical guidance here. Operational only.

What CPT 85610 Is, in Plain Administrative Terms

CPT 85610 is the American Medical Association's Current Procedural Terminology code for a prothrombin time (PT). In practice, most PT results are reported alongside an INR value derived from the same test, and the INR is not separately coded — the single laboratory code covers the assay.

Three things your staff should be able to recite:

  • It is a laboratory code, not an evaluation and management code. It is billed by whoever performs the test, not by whoever orders it.
  • If your practice performs the test in-house, you must hold the appropriate CLIA certificate covering that test method.
  • If the specimen goes to a reference lab, the lab bills the test. Your practice may bill a specimen collection or handling code depending on payer policy — and billing 85610 yourself when you did not perform it is a false-claims problem, not a coding preference.

Code selection itself is determined by what the provider ordered and what the laboratory actually performed, documented in the order and the result report, then verified by your coder against the current CPT descriptor and the payer's policy. Your job as an administrator is to make sure that chain is documented, not to decide clinically what test was appropriate.

The QW Modifier and Your CLIA Certificate Scope

Most practices running point-of-care INR devices operate under a Certificate of Waiver. Medicare requires the QW modifier on claims for tests granted waived status when performed under that certificate, and CMS maintains the authoritative list of waived tests and the specific device systems tied to them.

Two failure modes I see repeatedly:

  1. The device changed, the list was never rechecked. Your clinic swapped analyzers eighteen months ago. Nobody confirmed the new system appears on the CMS waived-test list under the same code. Claims deny, and — worse — you may be performing testing outside your certificate scope.
  2. The CLIA number on the claim is stale. Certificates expire on a two-year cycle. When a certificate lapses, denials arrive in a batch, usually three weeks after the fact.

Assign one named person — not "the lab" — to reverify device status and certificate expiration each quarter against the CMS CLIA program pages. Put the certificate expiration date in the same tickler system that tracks your malpractice renewals.

Where CPT 85610 Claims Actually Fail

The dollar value per test is small. The volume is not, and denial patterns compound fast in a practice running two hundred INRs a month.

Frequency and medical necessity edits

Payers apply frequency screens to PT testing. When a patient is tested more often than the payer's policy anticipates, the claim edits out. Your billing staff cannot fix this by resubmitting; the fix is documentation of why the ordering provider ordered at that interval, captured at the time of the order.

Build the order template so the reason for the interval is a required field. Retroactive documentation is a compliance problem, not a workaround.

Diagnosis linkage

The diagnosis code submitted with 85610 comes from the ordering provider's documentation. Billing staff should never select or upgrade a diagnosis to clear an edit. If the linkage is wrong, the order goes back to the provider. Write that rule into your billing policy and have your coders sign it annually.

Advance Beneficiary Notices

When you have reason to believe Medicare will not cover a specific PT test, an ABN is issued before the test, signed, and retained. A stack of blank pre-signed ABNs at the front desk is an audit finding waiting to happen. So is a signed ABN that nobody can locate three years later.

Home INR self-testing programs

CMS has established separate codes and a national coverage determination framework for home prothrombin time INR monitoring, covering patient training, device and supply provision, and clinician review of self-tested results. If your practice runs such a program, those services are billed under those codes — not by appending 85610 to a phone call. Verify the applicable NCD and any local coverage articles before you build the workflow, and document the training encounter the way the policy describes.

Six Places a PT/INR Result Leaves Your Building

Here is where the compliance conversation starts, and where most practices have never actually mapped the data flow. A single INR result touches more systems than a specialist referral does.

  • The point-of-care device. Many INR meters store patient identifiers and results locally, and increasingly sync to a manufacturer or dealer cloud portal for quality control and operator tracking. That portal holds PHI. That vendor is a business associate.
  • The middleware or lab interface. The connector moving results from device to chart is frequently a third-party product, separately licensed and separately capable of storing results in transit logs.
  • The reference lab. Labs are covered entities in their own right. Disclosing a specimen and order for treatment purposes does not require a BAA — but a courier company that transports specimens does need one, and so does any lab-supplied requisition software running on your network.
  • The patient portal or messaging tool. Results and dose instructions go out through it. Confirm what it retains and for how long.
  • The billing clearinghouse. Every 85610 claim carries a patient identifier, a diagnosis, and a date of service through at least one intermediary.
  • The anticoagulation tracking spreadsheet. The one on a shared drive, maintained by a nurse who leaves in eight months. This is the item that shows up in breach investigations.

Every named vendor above belongs on your business associate inventory with a current, signed agreement and a documented date of last review. If your inventory is a list of names in a Word document with no execution dates, you do not have an inventory — you have a memory aid. Practices that need to close that gap quickly can generate a signature-ready Business Associate Agreement through a guided wizard and get the executed copies filed the same week.

The Records Request That Starts With "Send Me All My INR Results"

Anticoagulation patients accumulate long result histories, and they request them — for a new prescriber, a travel clinic, a disability file, or an attorney.

Two rules govern the response. First, HIPAA's individual right of access gives the patient the right to their records generally within 30 days, with one 30-day extension available if you notify them in writing of the delay and the reason. Second, since 2014, laboratories subject to CLIA must also provide completed test reports directly to patients on request. HHS maintains detailed guidance on the individual's right of access, including what you may and may not charge.

Operationally, three things go wrong:

  1. The results live outside the chart. If your PT/INR values sit in a device portal or a standalone spreadsheet rather than the designated record set, staff produce an incomplete response and the practice absorbs the complaint.
  2. Fees exceed the permitted cost basis. Access fees are limited to a reasonable, cost-based amount. Per-page fee schedules borrowed from a state subpoena statute are a frequent overreach.
  3. The request scope is ignored. A patient asking for twelve months of INR results should not receive a 400-page complete chart. Minimum necessary does not apply to the patient's own access request in the way it applies to disclosures, but sending far more than asked creates its own problems.

Separately, information blocking rules mean you cannot build friction into result delivery without a documented exception. Delaying release of PT results as a matter of routine policy — so a nurse can call first — is the exact practice ASTP/ONC guidance on information blocking tells you to examine.

The Risk Analysis Your PT/INR Workflow Belongs In

The Security Rule requires an accurate and thorough risk analysis covering all electronic PHI your practice creates, receives, maintains, or transmits. A benchtop INR analyzer with a USB port and a vendor cloud account is in scope. So is the nurse's spreadsheet. HHS's proposed Security Rule update, published in January 2025, would tighten expectations around asset inventories and network mapping specifically — and a device closet full of undocumented point-of-care analyzers is the clearest example of what that gap looks like.

If your last risk analysis predates your current INR device, or does not name it, that document will not hold up. Practices that need current, defensible documentation without a six-week consulting engagement can automate the risk analysis, policies, and full compliance document set and keep them updated as devices and vendors change.

One caution: no product, including any compliance platform, confers government HIPAA certification. HHS does not certify or endorse compliance tools. What documentation gets you is evidence of a reasonable, dated, and current process — which is what an investigator asks for.

A 90-Minute Audit for Your Next Staff Meeting

Pull twenty recent CPT 85610 claims and walk the chain end to end:

  • Is there a signed provider order with a documented reason for the testing interval?
  • Does the CLIA number on the claim match a currently valid certificate, and does that certificate cover the device in use?
  • Is the QW modifier applied consistently where the payer requires it, and is your device confirmed on the current CMS waived-test list?
  • Did the diagnosis come from provider documentation, unaltered by billing?
  • Where did the result physically travel? Name every system. Check each against your BAA inventory.
  • Can you retrieve those twenty results in under ten minutes for a records request?
  • If your INR spreadsheet disappeared tonight, what would you have to report under the breach notification rule?

Document the findings, assign owners with dates, and re-run the same twenty-claim sample next quarter. The reason CPT 85610 deserves this attention is not the reimbursement — it is the volume. High-frequency, low-dollar testing is where sloppy workflows hide longest and where a single unmapped vendor account touches thousands of patients.

Next step: before your next quarterly compliance meeting, confirm that every system touching your PT/INR results appears in a current risk analysis with an executed business associate agreement behind it. If either document is missing or stale, build the current version of your compliance document set and start the vendor review from an accurate baseline.