Your nurse practitioner finishes a first-time visit at an assisted living facility at 4:40 p.m., taps a note into a tablet in the parking lot, and drives home with that tablet in the passenger seat. Three days later your biller opens the encounter and has to decide whether it supports a CPT 99344 claim, what place of service to attach, and whether the time entry is defensible. Two separate problems, one visit.

This guide is for the administrator or compliance lead standing up — or cleaning up — a home-based visit program. It covers what the 99344 descriptor family requires operationally, how your practice documents code selection without your coders guessing, and the privacy exposure that shows up the moment protected health information starts riding in cars and living rooms.

What CPT 99344 Covers, in One Paragraph

CPT 99344 sits in the home or residence evaluation and management family for new patients. That family — 99341, 99342, 99344, and 99345 — applies when a qualified clinician evaluates a patient in a private residence, an assisted living facility, a group home, a custodial care facility, or a residential substance use treatment setting. The AMA restructured this section effective January 1, 2023, folding the old domiciliary and rest home codes into the home or residence codes and deleting 99343. Within the surviving new-patient codes, 99344 is the higher-intensity option below 99345, selected either on medical decision making or on total time on the date of the encounter. Your practice must select the level from the current CPT descriptors and your payer's policy — not from a cheat sheet a former biller taped to a monitor in 2021.

That paragraph is the operational summary. Everything that follows is what your staff actually has to do with it.

The Documentation Your Coders Need Before a 99344 Claim Goes Out

Coding staff cannot invent facts. If your home visit template does not capture the elements the descriptor turns on, your coders will either downcode defensively or query the clinician for every encounter. Both cost you money and cycle time.

New versus established: the three-year rule

The 99344 code only applies to new patients. Under standard E/M convention, a patient is new if no physician or qualified health professional of the exact same specialty and subspecialty in the same group practice has provided a face-to-face professional service within the prior three years. That is a registration question, not a clinical one.

Build the check into intake. Your scheduler should run the patient against the practice management system before the visit is confirmed, flag any encounter in the last 36 months, and record which clinician and which specialty designation it was under. When a patient moves from your office panel to your home-visit panel, that history follows them — the setting changed, the patient status usually did not.

Time versus medical decision making

Home and residence E/M codes can be selected on either MDM or total time on the date of the encounter. Decide, as a practice, how clinicians will signal which basis they used, and make that signal visible to your coders.

The cleanest approach is a required field: basis for level selection — MDM or time. If time, the note needs start and stop or a total-minutes figure, plus enough narrative that the minutes are attributable to countable activities. If MDM, the note needs the problems addressed, the data reviewed, and the risk considered, stated plainly rather than implied.

Travel time is not visit time. Say that in the training deck, put it in the template help text, and audit for it. A clinician who logs door-to-door minutes will eventually produce a claim your practice cannot defend.

Place of service is a separate decision

The code describes the service. The place of service code describes where it happened, and the two are set independently on the claim. Private residence, assisted living facility, group home, and custodial care facility each carry their own POS value, and payers reimburse and audit against them. CMS maintains the authoritative list in its place of service code set.

Assign one person to own POS mapping. In practice, the failure mode is a clinician who describes a facility in narrative terms and a biller who guesses. Require the address type to be captured at scheduling, not reconstructed at billing.

What your coders should be able to answer without calling anyone

  • Is this patient new or established under the three-year rule, and what evidence supports it?
  • Was the level selected on time or MDM, and where in the note is that supported?
  • What was the physical setting, and what POS does it map to?
  • Was any part of the encounter delivered by someone other than the billing clinician, and how is that reflected?
  • Does the payer for this patient have a home-visit policy that differs from the general rule?

If any of those five questions routinely requires a query, your template is the problem, not your coders.

The Privacy Exposure Starts When the Clinician Leaves the Parking Lot

An office visit happens inside a perimeter you control. A CPT 99344 encounter happens inside someone else's living room, and every safeguard you rely on at the practice either travels with the clinician or does not exist.

Who else is in the room

Home visits almost always involve third parties: an adult child, a paid caregiver, a facility aide, a roommate. HIPAA permits disclosure to family or others involved in care when the patient agrees, does not object after being given the opportunity, or when the clinician reasonably infers from the circumstances that the patient does not object — but the clinician has to actually make that judgment and record it.

Give clinicians a one-line documentation field: persons present during encounter, and patient's response to their presence. That single field resolves most of the complaints your privacy officer will otherwise field six months later. It also matters when a family member later requests records and you have to determine what they were already party to versus what requires authorization.

The car, the tablet, and the hotspot

Lost and stolen unencrypted devices remain one of the most durable causes of reportable breaches in the record, and you can see the pattern for yourself in the HHS breach portal. A home-visit program multiplies the number of devices that spend their day outside a locked building.

Minimum controls before your first visit:

  • Full-disk encryption on every tablet and laptop, verified by report, not by assertion.
  • Remote wipe capability and a documented trigger — who calls it, within how many hours.
  • Screen lock under two minutes and no shared device passcodes.
  • No visit data cached on the device beyond the current day, if your system supports it.
  • A written prohibition on connecting to patient or facility Wi-Fi; issue cellular hotspots instead.
  • Photos of wounds, medication bottles, or home conditions captured only in the clinical application, never the device camera roll.

That last one is the rule staff break most often, and the one that quietly moves PHI into a personal cloud photo backup. HHS keeps its Security Rule guidance and risk analysis material in one place at the Office for Civil Rights security guidance library; your mobile controls should trace back to a documented risk analysis, not to a vendor's marketing checklist.

Your Vendor List Gets Longer the Day You Start Home Visits

Count the vendors a single 99344 encounter touches. A mobile EHR client or remote-access layer. A route optimization or scheduling tool that holds patient names and home addresses. A mobile device management platform. An ambient documentation or dictation service. A telephonic interpreter. An answering service that fields after-hours calls from caregivers. Possibly a staffing agency supplying the clinician, and a courier or lab handling specimens collected in the home.

Most administrators have a business associate agreement with the EHR vendor and nothing else on that list. Route optimization is the common miss — a scheduling tool holding names paired with home addresses is handling PHI, full stop, and it needs an executed BAA before the first route runs.

Do the inventory now, while the program is small. For each vendor: does it create, receive, maintain, or transmit PHI on your behalf; is there a signed BAA on file; when was it last reviewed; and does it address subcontractors, breach notification timelines, and return or destruction of data at termination? If you find gaps and need paper quickly, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription, which is the right shape for a practice that needs four agreements this quarter and not a platform.

Do not let a vendor tell you a BAA is unnecessary because data is "encrypted" or "only metadata." Addresses attached to patient names are identifiers. The conduit exception is narrow and does not cover a scheduling platform that stores your route.

Records Requests From a Home-Based Program Are Harder Than You Expect

A patient — or more often an adult child holding a power of attorney — requests the chart. Your 30-day clock under the right of access runs the same as it does for an office visit. What is different is where the record lives.

Home visit programs scatter documentation: the EHR note, photos in an imaging module, a dictation transcript sitting in a vendor's system, text messages between the clinician and a caregiver, and route notes in the scheduling tool. Your designated record set definition has to account for all of it, and your response process has to reach every location.

Two operational fixes. First, write the designated record set definition down and list the systems by name, including vendor-hosted ones. Second, prohibit clinician-to-caregiver texting on personal devices outright, because those messages are discoverable, unretrievable, and unencrypted, and no amount of policy language fixes a phone you do not control.

Apply minimum necessary discipline when responding. A caregiver with authorization for medication management does not automatically receive the full behavioral health history captured during the same home encounter.

Six Checks Before Your Next Billing Cycle

  1. Pull ten recent home or residence E/M claims and verify the new-versus-established determination against the three-year rule.
  2. Confirm every one of those notes states whether the level was selected on time or MDM.
  3. Reconcile POS codes on the claims against the actual setting recorded at scheduling.
  4. Run an encryption report on every device that leaves the building this week.
  5. List every vendor touching home visit data and match it against your executed BAA file.
  6. Confirm your designated record set definition names the vendor-hosted systems, not just the EHR.

Each of those takes under an hour. The alternative is discovering the gap during an audit or after a tablet disappears from a car in a facility parking lot.

Where to Start

Pick the vendor inventory first, because it is the item most likely to be entirely missing and the one that takes the longest to remediate once you find gaps. Close them with a properly scoped business associate agreement you can execute this week, then work backward through your risk analysis and mobile device policy. If your broader documentation set — risk analysis, policies, workforce training records — has not kept pace with the program you actually run, automating the compliance document set is a faster path than rebuilding it in a word processor.

The coding side of a CPT 99344 encounter is a template problem you can solve in a morning. The privacy side is an inventory problem, and it only gets more expensive the longer the program runs without one.