A patient is discharged from the hospital on a Thursday afternoon. Your front desk finds out Monday morning, because the discharge summary landed in a shared fax inbox nobody checks on weekends. By the time anyone calls the patient, the two-business-day window has closed and the seven-day visit window is nearly gone. Whatever the clinician documents afterward, CPT 99496 is no longer on the table.

This is a practice-operations guide to Transitional Care Management, written for the administrator, billing lead, or privacy officer who has to make the workflow run. It covers the timing mechanics of CPT 99496, who owns each step, how code selection gets documented, and — the part most TCM articles skip entirely — where the protected health information moves and which vendors need agreements before that movement is lawful.

What CPT 99496 Covers, and How It Differs From 99495

CPT 99496 and CPT 99495 are the two Transitional Care Management (TCM) codes. Both describe the same bundle of work: managing a patient's transition from an inpatient or equivalent setting back to community care across a 30-day period that begins on the discharge date.

The operational differences are timing and documented medical decision making:

  • Both codes require interactive contact with the patient or caregiver within two business days of discharge; medication reconciliation and management no later than the date of the face-to-face visit; and non-face-to-face care management services during the 30-day period.
  • CPT 99495 is described with medical decision making of at least moderate complexity and a face-to-face visit within 14 days of discharge.
  • CPT 99496 is described with medical decision making of high complexity and a face-to-face visit within seven days of discharge.

Only one practitioner may report TCM for a given patient per 30-day period, and the service is reported once per discharge. The complexity determination belongs to the billing practitioner and must be supported by the clinical documentation — it is not a selection your billing staff or a coding macro should make on the clinician's behalf. Confirm current payment policy and code descriptors against the CMS Physician Fee Schedule resources and your commercial payers' published policies before you finalize any internal cheat sheet.

The Three Clocks Your Staff Are Actually Managing

Practices that lose TCM revenue rarely lose it on documentation. They lose it on calendars. There are three overlapping clocks, each owned by a different person.

Clock 1 — Two business days for interactive contact

The contact must be interactive: a live phone conversation, a real-time exchange, or an in-person encounter with the patient or caregiver. A one-way voicemail, a mailed letter, or an unanswered portal message does not satisfy it.

CMS guidance recognizes that patients do not always answer. If your staff make and document at least two separate timely attempts and still cannot reach the patient or caregiver, the service may still be reportable when the remaining requirements are met. That makes your attempt log a billing artifact, not a courtesy note. Date, time, number dialed, who called, and outcome — every time.

Owner: a named clinical staff member working under the billing practitioner's direction, with a named backup for Fridays, holidays, and PTO.

Clock 2 — Seven days for the face-to-face visit

For CPT 99496, the face-to-face visit falls within seven days of discharge. The visit is part of the TCM service and is not separately reported as an office visit by the same practitioner. That has a scheduling consequence: your template needs held slots, not hope. Practices that run TCM successfully block two to four post-discharge slots per clinician per week and release them 72 hours out if unfilled.

Owner: the scheduler, with authority to override standard booking rules for post-discharge patients. If your scheduling staff have to ask permission to open a slot, you will miss seven-day windows.

Clock 3 — The 30-day service period

The service period runs from the discharge date through the following 29 days. Non-face-to-face work across that window — communication with home health, medication management, referral coordination, education, community resource arrangements — is part of the code, and it needs to be documented as it happens rather than reconstructed at the end of the month.

Report the service using the date of the face-to-face visit, and the place of service where that visit occurred. Readmission during the 30 days, concurrent care management billing, and post-op global period interactions are payer-policy questions. Get them answered in writing by your top three payers and put the answers in your billing manual.

Who Does What: A Role Grid That Survives an Audit

Write this down and post it. Verbal understanding does not survive staff turnover.

  1. Discharge intake (front desk or designated coordinator): monitors admit/discharge/transfer notifications, hospital portal messages, faxes, and patient calls. Logs the discharge date the same business day it is received.
  2. Outreach (clinical staff): makes the interactive contact within two business days, logs attempts, screens for urgent issues per protocol, and escalates.
  3. Records retrieval (coordinator or HIM staff): obtains the discharge summary and medication list from the facility and files it in the chart.
  4. Scheduler: books the visit inside the applicable window and flags it in the schedule as a TCM visit so it is not converted to a routine slot.
  5. Billing practitioner: performs and documents medication reconciliation and the face-to-face visit, documents the complexity of medical decision making, and attests to the TCM elements.
  6. Billing lead: verifies the elements are documented before release, confirms no other practitioner has reported TCM for that discharge, and holds the claim if any element is missing.

One rule to enforce without exception: billing staff do not select the complexity level. They verify that the clinician documented one. If documentation is ambiguous, the claim goes back to the clinician — not into a queue where a coder guesses.

Where the Discharge Information Comes From — and What HIPAA Says About It

TCM only works if discharge information reaches you fast. Practically, that means one or more of these pipelines: electronic event notifications from the hospital or a health information exchange, a hospital-portal account for your clinicians, direct secure messaging, a fax line, or the patient's own phone call.

Each of those is a disclosure of PHI from the facility to your practice for treatment purposes, which HIPAA permits without patient authorization. That is the easy part. The harder part is what happens on your side of the pipe.

Three exposures show up repeatedly in practice assessments:

  • Shared inboxes. A fax-to-email or notification inbox that six people access with one shared credential defeats your access logging. When you have to answer "who saw this discharge summary," the answer is "we cannot tell."
  • Notification feeds nobody scoped. Event notification services often push alerts for patients your practice has no current relationship with. Feeds should be filtered to your panel, and staff should be trained that browsing unrelated alerts is a snooping incident, not curiosity.
  • Substance use disorder records. If the discharging facility is a Part 2 program, records you receive may carry redisclosure restrictions beyond HIPAA. Your HIM staff need a documented handling path for those, including how the restriction notice travels with the document into your chart.

The Voicemail, Text, and Answering-Service Problem

The two-business-day contact requirement pushes staff toward whatever channel gets a human on the line fastest. That is exactly where minimum-necessary discipline breaks.

Set scripts, in writing:

  • Voicemail: practice name, caller first name, callback number, and a request to call back. No diagnosis, no facility name, no medication references.
  • Text messages: if you text at all, document that the patient was told the channel is unencrypted and agreed to it, and keep the content to scheduling. Note that the outbound text still needs to reach the chart as an attempt log entry.
  • Third parties: if a caregiver answers, follow your existing personal-representative and disclosure-to-family rules. "Someone picked up" is not authorization.
  • Wrong numbers: log them as potential impermissible disclosures and route to your privacy officer for a risk assessment. Most will be de minimis. Document the determination anyway.

Your CPT 99496 Vendor List Is Longer Than You Think

Walk the TCM workflow and count the outside parties touching PHI. A typical mid-sized practice finds five to nine:

  • The event-notification service or HIE intermediary delivering discharge alerts
  • The cloud fax or fax-to-email provider receiving discharge summaries
  • The patient-outreach or automated-calling platform used for follow-up attempts
  • The answering service or after-hours nurse line fielding return calls
  • A care-management or population-health module sitting alongside the EHR
  • Transcription or documentation-assistance services touching the visit note
  • The billing company or RCM vendor submitting the claim
  • Any remote coding contractor reviewing TCM documentation
  • Interpreter services used during the interactive contact

Every one of those is a business associate. Each needs a signed agreement in force before the first discharge record moves, and each needs to appear on a list you can produce on demand. HHS publishes sample business associate agreement provisions that show the required elements, but sample text is a starting point, not an executed contract.

If launching a TCM program just added three vendors to your list and you do not have papered agreements for them, generate them before go-live rather than after. A six-step BAA generator that exports a signature-ready agreement in PDF and DOCX handles this in an afternoon — one-time purchase, no subscription — which is faster than waiting on a vendor's legal team to send back a redlined template you then have to review anyway.

Two vendor-diligence questions specific to TCM: does the outreach platform retain call recordings or transcripts, and for how long? And does the notification service log which of your users viewed which alert? If either answer is "we don't know," you have a gap in both your breach-response capability and your access-audit story.

The Tracking Spreadsheet That Becomes a Records Request

Nearly every practice running TCM builds a tracker: patient name, discharge date, contact attempts, visit date, claim status. It usually lives in a spreadsheet on a shared drive because the EHR's workflow tools are clumsy.

Understand what you have created. That spreadsheet contains PHI used to make care and billing decisions, which means it is likely part of your designated record set and reachable by a patient's right of access. Under the HIPAA right of access, you generally have 30 days to respond to a request, and OCR has enforced access failures aggressively for years.

Three fixes, in order of effort:

  1. Move the tracker inside the EHR if the platform supports a care-management worklist. Native tools inherit your access controls and audit logs.
  2. If it must stay a spreadsheet, restrict it to named users, store it only in your managed cloud tenant, disable local downloads, and add it to your inventory of systems containing PHI.
  3. Kill the personal copies. The version on a coordinator's desktop, the emailed weekly snapshot to the billing company, the printout at the nurses' station — each is an unlogged copy you will have to account for after an incident.

The same applies to the attempt log. If the record proving your two-business-day contact lives only in a spreadsheet cell, you have a documentation risk on the billing side and a records-handling risk on the privacy side, from the same artifact.

A 30-Day TCM Audit You Can Run This Quarter

Pull ten TCM claims from the last 90 days — mix 99495 and CPT 99496 — and check each against this list:

  • Is the discharge date in the chart, sourced from a facility document rather than staff recollection?
  • Is the interactive contact documented with date, time, staff member, and who was spoken to — or are two timely attempts documented?
  • Did the face-to-face visit fall within the window for the code reported?
  • Is medication reconciliation documented no later than the visit date?
  • Did the billing practitioner document the complexity of medical decision making in their own words?
  • Is the reported date of service the visit date, and the place of service where the visit occurred?
  • Did you confirm no other practitioner reported TCM for that discharge?
  • Are the systems that touched this record — fax, notification feed, outreach platform, billing vendor — all on your PHI system inventory with current BAAs?

Any item failing on more than two of ten charts is a workflow defect, not a staff performance issue. Fix the template, the role assignment, or the vendor configuration.

Close the Loop Before the Next Discharge

TCM is one of the few services where the privacy exposure and the billing exposure are created by the same three or four steps. The same rushed phone call, shared inbox, and side spreadsheet that jeopardize your CPT 99496 claim also generate your access-log gaps and your unpapered vendors.

Start with the vendor list, because it is the piece you can finish this week: inventory every outside party in the TCM workflow, then generate the agreements you are missing. If your risk analysis and written policies also predate this program, automating the risk analysis and policy set keeps the documentation in step with a workflow you just changed. Either way, do it before the next Thursday discharge lands in an inbox nobody reads until Monday.