Your physician rounds at three nursing facilities every Tuesday. Fourteen patients. By Thursday afternoon your biller has nine notes, two of which arrived as photographs texted from a personal phone, and one facility's medical records clerk is asking your front desk to email a copy of last month's progress note "for the care plan meeting." Somewhere in that pile are the encounters your coders will process as CPT 99308 and its neighbors in the subsequent nursing facility care family.

This guide is for the administrator, biller, or privacy officer who owns that pile. It covers how the code family works operationally, what documentation your coders need before they can assign a level, and — the part most practices skip — where the protected health information travels once a provider steps outside your four walls. It is administrative guidance, not clinical or coding advice for any specific patient encounter.

What CPT 99308 Is, in One Paragraph

CPT 99308 is a subsequent nursing facility care code — one of four evaluation and management codes (99307, 99308, 99309, 99310) used to report a per-day E/M service for an established patient in a nursing facility. Since the 2023 E/M revisions, level selection within that family is driven by either the level of medical decision making or the total time the billing practitioner spends on the date of the encounter, and 99308 sits at the second of the four levels. The place of service reported reflects where the patient was seen — commonly 31 for a skilled nursing facility or 32 for a nursing facility. Your practice, not this article, determines which level fits a given documented encounter.

Why the 2023 restructuring still shows up in your denials

Two things changed that continue to generate rework three years later. First, the old distinction between separate SNF and NF code sets collapsed into one subsequent-care family. Second, history and exam stopped functioning as level-setters; they are performed and documented as medically appropriate, but they no longer drive the code.

If your note templates still lead with bulleted history elements and bury the assessment, your coders are hunting for the decision-making narrative in the wrong place. That hunting is where phone calls to providers, chart re-opens, and late claims come from.

The Documentation Trail Your Coders Need Before They Touch CPT 99308

Build the intake checklist around what a coder must see, not what the template collects. For subsequent nursing facility visits, your billing staff should be able to locate, without asking:

  • The date of service and the facility, matched to a place-of-service code.
  • The identity and credentials of the practitioner who performed the visit — and whether the visit was one a physician must personally perform under the facility's regulatory schedule versus one delegable to a qualified nonphysician practitioner.
  • An assessment and plan that shows what was evaluated, what was changed, and why.
  • If time is the basis for level selection: total time on the date of the encounter, stated as a number, attributed to the billing practitioner.
  • Signature and date, legible and attributable.

Assign one person to run that checklist before the claim goes out. In most practices that is a lead biller, not the provider. Document the assignment in writing so coverage exists when that person is on vacation.

Time statements are an operational problem, not a clinical one

"Approximately 20 minutes" and "20 minutes" are not the same artifact for an auditor. Neither is a time figure that appears identically in every note for a given day. Your job is to give providers a field that requires a specific number and a workflow that captures it at the bedside, on the same day, rather than reconstructed on Thursday from memory.

Cloned notes are the other recurring finding. If ten CPT 99308 encounters from one rounding day share identical assessment text, your coding review should flag the batch before submission. Set a threshold — say, any day where more than three notes exceed a similarity check — and route those to a second reviewer.

Where the PHI Actually Goes When Your Provider Rounds Off-Site

Here is the part that never appears in coding webinars. A single nursing facility visit can generate PHI in six locations before the claim is filed: the facility's own chart, the provider's mobile device, whatever app or dictation tool produced the note, your EHR, your clearinghouse, and the fax or portal used to send documentation back to the facility.

Every one of those hops is a place where your practice either has a defensible arrangement or does not. Walk the path physically. Sit with the rounding provider for one afternoon and write down each tool touched. Most privacy officers find at least one surprise.

The nursing facility is usually not your business associate

This trips up practices constantly. When your provider treats a resident and shares information with the facility's nursing staff for that resident's treatment, that is typically a disclosure between two covered entities for treatment purposes — not a business associate relationship, and it does not require a BAA. HHS explains the boundary of the business associate definition directly.

What that does not do is excuse the transmission method. A treatment disclosure sent by unencrypted email, or a note photographed on a personal phone and texted through a consumer messaging app, is still an unsecured transmission of PHI sitting outside your control. Your policy should name the approved channels for sending nursing facility documentation and prohibit the rest by name.

Apply minimum necessary to facility requests

When a facility's records clerk asks for "the whole chart" to prepare a care plan meeting, your staff should send what the request actually needs. Treatment disclosures get more latitude, but your internal habit should still be scoped release, and HHS's guidance on the minimum necessary standard is the reference to hand your front desk during training.

Write a two-line script for this exact call. "Which dates of service and which documents do you need?" resolves ninety percent of over-disclosure risk before it happens.

The Vendor List Behind a Single Nursing Facility Claim

Now count the vendors. A practice billing subsequent nursing facility visits typically involves some combination of: a transcription or ambient documentation service, a mobile charting app used for rounding, a billing or revenue cycle management company, a clearinghouse, a fax-to-email service, a coding audit consultant, and cloud storage or backup. Each of these creates, receives, maintains, or transmits PHI on your behalf. Each needs a signed business associate agreement on file before it touches data.

Two failure patterns dominate. First, the mobile app the provider found and started using without telling anyone — no agreement, no security review, PHI on a consumer platform. Second, the outsourced coding reviewer engaged for a one-time chart audit on a handshake, who now has copies of forty CPT 99308 notes on a laptop your practice has never seen.

If your inventory has gaps, close them with paper before the next rounding day. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — which is faster than waiting three weeks for a vendor's legal department to send their template. Log the executed agreement, the date, and the renewal review date in a single spreadsheet or your compliance system.

Questions to ask a rounding-documentation vendor before you sign

  • Where is data stored, and is it encrypted at rest and in transit?
  • Do they use subcontractors, and are those subcontractors bound by equivalent terms?
  • What is their notification timeline to you after they discover a security incident?
  • Can you export your data and delete your account, and what happens to backups?
  • Who at their organization is the named contact when your privacy officer needs an answer in an hour?

Put the answers in the vendor file. When your own risk analysis comes due, that file is the evidence. Practices that maintain their risk analysis and policy set as living documents rather than annual fire drills spend far less time reconstructing vendor history under pressure.

The 30-Day Clock When a Family Requests Nursing Facility Notes

An adult child calls your office asking for every progress note your physician wrote for their mother at the facility over the past year. Your obligation depends on whether the requester is the patient or a personal representative with authority, and your front desk needs to verify that before releasing anything.

Once a valid request arrives, the HIPAA right of access requires you to act within 30 days, with one 30-day extension available if you notify the requester in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount. HHS's individual right of access guidance is the document to keep printed at the records desk.

The operational wrinkle for nursing facility encounters: your practice holds your provider's notes, and the facility holds the facility record. Those are different designated record sets. Tell the requester plainly which records you hold and refer them to the facility for the rest, in writing, and log the date you sent it. Silence looks like refusal, and refusal is the most commonly resolved category of access complaint.

Log every request the same way

One spreadsheet. Columns: date received, requester, relationship and verification method, records requested, date fulfilled or extended, fee charged, staff member who handled it. Six columns and a habit will carry your practice through an inquiry that would otherwise take weeks to reconstruct.

A Two-Week Cleanup Plan You Can Actually Finish

  1. Days 1–2: Shadow one rounding day. List every device, app, and transmission method touched.
  2. Days 3–5: Compare that list to your BAA file. Flag every vendor with no agreement or an agreement older than your last EHR change.
  3. Days 6–8: Execute missing agreements. Suspend use of any tool you cannot get an agreement for.
  4. Days 9–10: Rewrite the note template so the assessment, the time statement, and the practitioner attribution appear in fixed, findable locations.
  5. Days 11–12: Train the front desk on the facility-request script and the records-request log.
  6. Days 13–14: Pull ten recent subsequent nursing facility claims and run them against your coder checklist. Fix what fails, then repeat quarterly.

For payment policy specifics — federally required visit schedules, delegation rules, and place-of-service instructions — work from CMS source material rather than vendor summaries. The Medicare Physician Fee Schedule resources and your Medicare Administrative Contractor's published local guidance are the authorities your auditors will cite back to you.

Start With the Paperwork You Can Control Today

Coding accuracy for subsequent nursing facility visits is a documentation-design problem. Privacy exposure on those same visits is a vendor-paperwork problem. The second one is faster to fix and carries the sharper penalty when it goes wrong.

Pull your vendor list this week. For every gap you find, build and export a signature-ready BAA and file it with a review date. Then go back to fixing the templates.