A commercial payer sends your practice a records request covering 14 dates of service. It does not ask for clinical justification. It asks for one thing: the start and stop times supporting each prolonged non-face-to-face service line, and the name of the person who recorded them. Your biller finds the encounter notes in the EHR and the time entries in a shared spreadsheet on someone's desktop.

That is the CPT 99358 problem in one sentence. This guide is for practice administrators, billing leads, and privacy officers who need to know how prolonged service coding gets verified, documented, stored, and defended — and what those time logs mean for your records-request workflow and your vendor list. It is administrative guidance about process, not advice on which code fits a given patient encounter.

What CPT 99358 Describes, and Why the Descriptor Matters More Than Your Payer Policy

CPT 99358 is defined as prolonged evaluation and management service before and/or after direct patient care, first hour. Its add-on companion, 99359, covers each additional 30 minutes. The service is non-face-to-face by definition: record review, extended chart analysis, coordination work that occurs outside the encounter itself but relates to a companion E/M service.

Two structural facts drive most of the operational risk. First, the code has historically been tied to a companion E/M service, which means the audit reviewer will pull two documents, not one. Second, the AMA's 2021 office and outpatient E/M revisions carved these codes away from the 99202–99215 family, which is where most independent practices live. Practices that never updated their charge-capture rules after 2021 kept generating claim lines that no longer belonged there.

Read the descriptor in your current CPT code set before you read anyone's payer policy. The policy tells you whether you get paid. The descriptor and the time thresholds tell you whether the documentation you are holding matches what you billed — and that is the question an auditor asks.

Is CPT 99358 still separately payable in 2026?

The honest answer your coding lead should give leadership: verify it, in writing, every January. The status of prolonged non-face-to-face service codes has moved more than once — through the 2021 E/M overhaul, the 2023 prolonged-services restructuring, and subsequent annual CPT and Physician Fee Schedule cycles. Medicare and commercial payers have not moved in step.

Verification takes three lookups:

  1. Confirm the code's presence and exact descriptor in the current-year CPT code set your practice licenses.
  2. Check the status indicator and RVU treatment in the current CMS Physician Fee Schedule Look-Up Tool, plus any MAC-published article addressing prolonged services.
  3. Pull the prolonged-services policy from each of your top five commercial payers by volume and note the effective date and retrieval date.

Write the results into a dated one-page code-status memo, sign it, and store it with your coding policies. When a payer opens a look-back review three years from now, that memo is the evidence that your practice exercised diligence at the time — which is a materially different posture than "we always billed it that way."

The January Verification Workflow, With Names Attached

Assign this, do not distribute it. Diffuse responsibility is why stale codes survive in charge sheets.

Roles and dates

  • Coding lead, by January 15: runs the three lookups above for every time-based and add-on code in your charge master, including CPT 99358 and 99359. Produces the code-status memo.
  • Practice administrator, by January 31: reconciles the memo against the EHR charge-capture templates, superbills, and any favorites lists clinicians built themselves. Retired or restricted codes get pulled from the pick lists, not just flagged.
  • Billing manager, by February 15: reruns the prior 12 months of claims for the affected codes and reports volume, denial rate, and payer mix to the administrator.
  • Privacy officer, ongoing: confirms that any documentation artifact the coding change creates — new time-log fields, new templates, new exports — lives inside systems already covered by policy and, where a vendor touches it, by an executed business associate agreement.

That last role is the one practices skip, and it is the one this blog exists to press. Coding changes create records. Records create disclosure obligations.

Your Time Log Is PHI, and Probably Part of the Designated Record Set

Prolonged service billing rests on contemporaneous time documentation: date, start time, stop time, the activity performed, and the identity of the person performing it, tied to a specific patient and a companion encounter. Practices routinely capture this in a place that is not the chart — a spreadsheet, a task-tracker, a notes app, a billing portal comment field.

Once that log identifies a patient and relates to their treatment or payment, it is protected health information wherever it sits. If your practice uses it to make decisions about that patient's care or billing, treat it as part of the designated record set under 45 CFR 164.501. That has a concrete operational consequence: when a patient exercises their right of access, the log may be responsive.

The HHS Office for Civil Rights has been consistent that the access right is broad and that the clock is short. Review the current OCR guidance on the individual right of access with your records custodian, and make sure your response procedure accounts for records held outside the EHR. A 30-day deadline is not the problem. A 30-day deadline you discover on day 26, for a file nobody catalogued, is the problem.

Three fixes that take a week

  • Move time capture into a structured EHR field or an EHR-attached template. If the EHR cannot hold it, document why and pick one controlled location.
  • Kill the desktop spreadsheet. Export it, import it, delete the local copy, and confirm deletion from backups per your retention policy.
  • Add "prolonged service and time logs" as a named line item in your records-request checklist so the person assembling a chart production does not have to remember it.

Where the Vendor Exposure Actually Sits

Non-face-to-face work is, by nature, work performed away from the patient — which means it tends to travel across more systems than a routine visit does. Map the path before an auditor does it for you.

The usual participants: your outsourced billing company, which sees the time entries and the companion E/M note. Any scribe or documentation service that drafts the log. A time-tracking or task-management tool, if clinicians use one. Secure messaging or fax services used to obtain outside records that the prolonged review consumed. Release-of-information vendors handling the eventual audit production. Your clearinghouse. Occasionally a coding consultant brought in to review the very charts under scrutiny.

Every one of those is a business associate if it creates, receives, maintains, or transmits PHI on your behalf. The consultant you hire to audit your prolonged-service documentation needs a signed agreement before they open the first chart, not after they send the findings. If you are staring at a vendor you cannot produce a current agreement for, generate a signature-ready business associate agreement through a six-step wizard and get it executed this week — it exports to PDF and DOCX, it is a one-time purchase, and it removes the excuse that legal review takes a month. HHS also publishes sample business associate agreement provisions if you want to compare required elements clause by clause.

Minimum necessary and the audit response packet

When a payer requests documentation for prolonged services, send what was requested for the dates requested. Practices lose control here by exporting a full longitudinal chart because it is one click, when the request covered six encounters.

Payment-related disclosures to a health plan fall within permitted uses, so you generally do not need an authorization — but minimum necessary still governs the volume. Build a standing production template: companion E/M note, time log, any referenced outside records the reviewer specifically asked for, and a cover index. Have one person assemble it and a second person review it before transmission. Log the disclosure.

If the request arrives from an attorney, a records-retrieval firm, or a subrogation vendor rather than the plan itself, stop and route it to your privacy officer. Those requests usually require a valid authorization, and the person at your front desk should not be the one making that call under time pressure.

A Worked Internal Review: 30 Charts, Six Checks

Before an external reviewer picks your sample, pick your own. Pull the 30 most recent claims containing prolonged non-face-to-face service lines and run six checks per chart. Score them yes/no. Do not editorialize.

  1. Companion service present? The related E/M service is documented and identifiable on the claim history.
  2. Time documented contemporaneously? Start and stop times or total minutes with an entry timestamp, not a figure reconstructed at month-end.
  3. Activity described? The log states what was done, specifically enough that a stranger can read it.
  4. Performer identified? Named individual with credentials, and their role permits the work under your payer contracts.
  5. Threshold met? Documented time reaches the threshold in the descriptor for the code billed, including any add-on units.
  6. Code status current? The code billed appears on the current-year code-status memo as payable by that specific payer on that date of service.

Any chart failing check five or six goes to your compliance lead the same day. If the review surfaces a pattern of overpayment, remember that identified Medicare and Medicaid overpayments carry a 60-day report-and-return obligation under Section 6402 of the Affordable Care Act. That clock runs on identification, not on convenience, and "we were still investigating" is a defensible answer only if your investigation is documented and moving.

What to Tell Your Clinicians, in Two Sentences

Clinicians do not need a lecture on code status. They need to know that time entered later is worth less than time entered contemporaneously, and that time entered in a personal note app is a privacy incident waiting to happen.

Put both sentences in your annual training deck. Then make the compliant path the easy path — a template field in the chart that takes eleven seconds — because workflow beats policy every time.

The Short Version

CPT 99358 and its add-on live at the intersection of three things practices manage badly: annual code-status drift, documentation that lives outside the chart, and vendors handling records nobody catalogued. Fix the verification calendar, fix where the time log lives, and fix the BAA gaps in that order.

If your prolonged-service review turned up vendors without executed agreements, close that gap first — build and export the agreements you need before the next records request forces the question. If the same review exposed thornier problems in your policies or risk analysis, automated risk analysis and compliance documentation will get the underlying document set current. Neither is a certification, because no such government credential exists — they are the paperwork that makes an audit response boring.