On a Tuesday your women's health pod collects fourteen liquid-based cytology specimens. The courier picks up at 3:15. By Friday, twelve results are back in the portal, one specimen was rejected for a labeling discrepancy, and one patient calls the front desk asking why she got a bill from a lab she has never heard of. Somewhere in that chain, the reference lab submitted a claim using CPT code 88175 — and your practice's name is on the requisition that made it possible.

This guide is for the administrator, billing lead, or privacy officer who owns that chain. It covers what 88175 describes, who submits it, the handoffs your staff actually control, and the records and vendor obligations that attach at each step. It is administrative guidance, not clinical or coding advice for any specific patient encounter.

What CPT Code 88175 Describes — and Who Submits the Claim

CPT code 88175 is a cytopathology code in the pathology and laboratory section of the CPT code set. It describes cervical or vaginal cytology using an automated thin-layer preparation, with screening performed by an automated system and manual rescreening or review, under physician supervision.

The entity that performs that work bills it. In the overwhelming majority of practices, that entity is an outside CLIA-certified laboratory — not you. Your practice's role is specimen collection, requisition accuracy, and, depending on payer, a separate collection or handling code. If your practice operates its own CLIA-certified cytology lab, the picture changes entirely and your compliance program needs a CLIA workstream to match.

The 88174 / 88175 Distinction Belongs to the Lab

Nearby codes in the same family describe manual screening of a thin-layer preparation, automated screening alone, and automated screening with manual rescreening or review. The difference between them is a description of laboratory work product and supervision — facts your practice does not observe and cannot document.

Practical consequence: your billing staff should never "correct" a lab's cytopathology code, and your coding policy should say so in writing. If a payer denies and points at the cytology code, the resolution path runs through the performing lab's billing department, not through your claim scrubber.

The Nine-Step Handoff Your Practice Actually Owns

Write this down with names attached. Ambiguity about ownership is where specimens and PHI both get lost.

  1. Order entry — clinician documents the order and the reason for the test in the chart. Owner: clinician.
  2. Requisition generation — demographics, insurance, ordering provider NPI, collection date, and the diagnosis narrative move from your system to the lab's requisition. Owner: clinical support staff.
  3. Specimen labeling — two identifiers on the vial, matched to the requisition at the point of collection. Owner: collecting staff, verified before the patient leaves the room.
  4. Specimen log entry — a running log with patient identifier, collection date/time, test ordered, and courier pickup. Owner: designated lab liaison per site.
  5. Courier transfer — signature or scan confirming custody change. Owner: front-office lead.
  6. Pending-results tracking — an open worklist reconciled against the specimen log. Owner: lab liaison, reviewed weekly.
  7. Result receipt and filing — inbound result matched to the correct chart, with the interface or manual entry documented. Owner: clinical support.
  8. Patient notification — per your practice policy on normal versus abnormal results, with the notification method logged. Owner: clinician's care team.
  9. Rejected or unsatisfactory specimens — a named escalation path with a recollection deadline. Owner: lab liaison plus clinician.

Step 6 is the one that fails silently. A specimen that never generates a result generates no alert either. Reconcile the log against received results on a fixed weekly cadence and document who did it.

Where PHI Leaves Your Building on a Single Pap Order

Count the disclosures in the workflow above. The requisition carries name, date of birth, address, insurance identifiers, ordering provider, and clinical narrative. The specimen label carries identifiers. The courier manifest carries a patient list. The lab portal carries results. Your billing system carries the encounter.

Disclosure to the performing laboratory for treatment purposes is permitted under the Privacy Rule without patient authorization, and the minimum necessary standard does not restrict treatment disclosures the way it restricts others. That does not make the surrounding handling risk-free.

Requisitions, Labels, and the Printer Nobody Owns

Three recurring findings from walkthroughs of women's health suites:

  • Pre-printed requisitions with demographics sitting in a stack at a shared workstation, visible to anyone who walks behind the desk.
  • Label sheets for patients who did not show, discarded in a regular trash bin instead of a shred container.
  • Fax confirmations and rejection notices from the lab printing to a device in a hallway with patient names on the cover sheet.

Fix these with placement and destruction rules, not memos. Move the printer, add a locked shred bin within arm's reach of the collection rooms, and add both to your quarterly walkthrough checklist. NIST's SP 800-66r2 guidance on implementing the HIPAA Security Rule is a useful frame for tying these physical safeguards back to a documented risk analysis.

The Reference Lab Is Not Your Business Associate — Four Other Vendors Are

This trips up more practices than any other point in the cytology workflow. A CLIA-certified reference laboratory performing a test you ordered is acting as a covered entity providing treatment. You do not need a business associate agreement with it for that relationship, and asking for one signals to the lab's compliance team that your program is fuzzy.

These, however, generally do require executed BAAs:

  • Courier and specimen transport companies that are not employees of the performing lab and that handle identifiable specimens and manifests on your behalf.
  • Revenue cycle and billing companies that touch the encounter, the collection code, or the appeal.
  • Coding consultants and external auditors reviewing charts and claims.
  • Interface, integration, and results-routing vendors that move lab results into your record system or into a patient messaging tool.

Also on the list: document scanning services digitizing paper cytology reports, answering services relaying result callbacks, and any texting or reminder platform that includes "your Pap result is ready" in a message. If a third party creates, receives, maintains, or transmits PHI to perform a function for you, the agreement requirement attaches regardless of how small the touch is.

If your vendor inventory has gaps — and after mapping a cytology workflow, most do — you can produce a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, one-time purchase, no subscription. Fill the gap this week rather than adding it to a list you will revisit next quarter.

Results, the Designated Record Set, and the 30-Day Clock

Once a cytology report lands in your chart, it is part of your designated record set. A patient request for records that includes it starts a 30-day response clock, with one 30-day extension available if you notify the patient in writing of the reason and the new date. HHS's right of access guidance is the operative reference, and it is worth re-reading with your records clerk annually.

Two additional points your front desk should know cold:

  • Patients also have a direct right of access to completed test reports from the performing laboratory itself. "Call the lab" is a legitimate parallel path, not a brush-off — but it does not relieve your practice of its own obligation for the copy in your chart.
  • A pending result is not an excuse to stop the clock on the rest of the record. Send what you have within the deadline and document what remained outstanding.

When a Patient Says the Lab Report Is Wrong

Amendment requests on cytology reports arrive in two flavors. Demographic mismatches — wrong date of birth, wrong collection date, name variant — you can correct in your record and should flag to the lab so its record matches. Disagreement with the cytologic interpretation is different: you did not author that finding and cannot amend it.

The correct response is a written denial that explains the practice did not create the record, identifies the entity that did, and preserves the patient's right to submit a statement of disagreement that travels with the record. Have that letter template in your records binder before you need it.

Billing Questions Your Staff Will Ask About CPT Code 88175

"The lab wants us to bill the test and they'll invoice us."

Client-bill arrangements exist, but Medicare places specific conditions on who may bill for a test performed by another entity, and commercial payer contracts frequently prohibit the practice outright. Route any such proposal to counsel and to your payer contracting file before signing. Arrangements bundling free supplies, courier service, or in-office staffing alongside a billing concession also draw federal anti-kickback scrutiny — that is a legal review, not a billing decision.

"Can we bill for collecting the specimen?"

Medicare recognizes a separate HCPCS code for collection of a screening Pap specimen, and some commercial payers handle specimen handling differently again. Verify current payer-specific rules rather than relying on a habit that predates a contract renewal. The CMS Medicare Coverage Database is where your billing lead should check for applicable national and local coverage policy, including frequency limitations on screening cytology.

"Screening or diagnostic?"

That determination follows from the clinician's documentation of the reason for the test, not from a billing preference. Your job is to build a workflow where the documented indication reaches the requisition and the claim consistently. When it does not, the fix is a documentation prompt at order entry — not a downstream code change.

"The patient got a surprise bill from the lab."

Frequency limits, deductibles, and out-of-network reference labs generate these calls. Two operational controls reduce them: verify which lab your patient's plan actually contracts with before the specimen ships, and give patients a plain-language handout naming the lab you use and explaining they may receive a separate statement. Route the balance question to the lab; keep the network question with your staff.

A 90-Minute Quarterly Audit

Pull twelve cytology encounters from the last quarter and confirm, for each: an order in the chart with a documented indication; a specimen log entry with courier confirmation; a result filed to the correct chart; documented patient notification; and, where a specimen was rejected, a recollection or a documented decision not to recollect.

Then pull your vendor list and confirm an executed, current BAA for every courier, billing company, interface vendor, and messaging platform in the workflow — with the signature date and renewal owner recorded. Finish by confirming that lab portal accounts map one-to-one to current employees, that no shared logins exist, and that every departure in the last quarter triggered a portal deactivation. Terminated-staff access to a lab portal is one of the quieter ways a small practice ends up self-reporting a breach.

Document all of it. An audit you performed but did not record is, to a regulator, an audit you did not perform. If you are building out the surrounding documentation — risk analysis, policies, the full document set — automating the compliance document workstream keeps the paperwork current between quarterly reviews.

Start With the Agreements

Mapping a single cytology workflow usually surfaces two or three vendors touching PHI without a signed agreement on file. That is the fastest gap to close and the one an investigator asks about first. Generate the Business Associate Agreements your specimen and results workflow requires, get them signed, and log the dates before your next audit cycle.