Your Tuesday afternoon allergy clinic has 14 patients on the board, three of them scheduled back-to-back at 3:15. Each one gets injections, each one sits in a waiting area for an observation period, and each one generates a claim line for CPT code 95117 plus separate lines for the extract. If your medical assistant charts the encounter in a paper flow sheet that lives in a binder next to the vial refrigerator, you have a billing workflow and a privacy problem in the same three square feet.

This guide is for the administrator, biller, or privacy officer who owns that room. It covers what the code describes, how practices build documentation that survives a payer audit, and the specific PHI exposures and vendor agreements that an allergy injection program creates. It is administrative guidance, not clinical guidance — code selection belongs to the rendering provider and your coding policy.

What CPT Code 95117 Describes

CPT code 95117 is the professional-services code for allergen immunotherapy injections when two or more injections are administered, and it explicitly excludes the provision of the allergenic extract itself. Its companion, 95115, describes a single injection. Both are administration-only codes: they pay for the professional service of giving the injection and the associated observation, not for the antigen in the vial.

The extract is billed separately under the antigen preparation and provision codes (the 95144–95170 family), which are reported based on the number of doses prepared. So a single allergy visit commonly produces two kinds of line items: one administration code and one or more extract codes, unless the extract was supplied by another practice — a common arrangement when a specialist prepares vials and a primary care office administers them.

Where practices get the distinction wrong

The most frequent internal error is treating the administration code as a per-injection unit. The descriptor already accounts for multiple injections in one encounter, which is why quantity fields on the claim need a documented rule in your billing policy rather than staff judgment at the keyboard.

Your coding policy should state who determines which descriptor matches the documented service, what source document that determination comes from (the signed injection record, not the appointment type), and how the biller confirms the extract source before adding or omitting antigen lines. Publish the current Medically Unlikely Edit values and NCCI pairings for these codes from the CMS National Correct Coding Initiative and refresh them on a calendar reminder each quarter.

The Shot-Room Workflow That Produces a Clean Claim

A defensible claim for CPT code 95117 rests on four facts captured at the point of service: who was injected, what was injected and from which vial, how many injections were given, and who was on site supervising. Miss any one and you are reconstructing the encounter from memory six months later during a records request.

Role assignments that hold up

  • Front desk: verifies identity with two identifiers, confirms the patient is on the active immunotherapy roster, and marks arrival. Nothing about diagnosis or dose belongs in this step.
  • Clinical staff administering: pulls the patient-specific vial, records site, volume, vial identifier, lot, and time of administration, and signs the entry.
  • Observation monitor: records the start and end of the observation period and the disposition. This is the entry that most often goes missing.
  • Supervising provider: attests presence per payer policy and state scope-of-practice rules. Your policy should name how on-site supervision is recorded — a schedule alone is thin evidence.
  • Biller: codes from the signed injection record, reconciles antigen units against the preparation log, and holds anything incomplete rather than guessing.

Build the reconciliation as a daily task, not a monthly one. Twelve unmatched injection records are a morning of work; two hundred are a project.

Documentation an Auditor Will Actually Ask For

Payer reviews of allergen immunotherapy tend to focus on three things: proof that the injection occurred, proof of supervision arrangements, and proof that antigen units billed match antigen units prepared. Assemble a sample packet now, before anyone asks.

  1. The signed injection record for the date of service, showing count of injections.
  2. The antigen preparation log or the outside practice's vial transfer documentation.
  3. The observation entry with times.
  4. Your written supervision policy and the staffing record for that session.
  5. The patient's current treatment schedule as maintained in the record.

If any of those five live in a vendor's separate portal rather than your chart, you have both an audit-retrieval problem and a designated record set problem. Solve them together.

Worked Example: One Encounter, Two Kinds of Line Items

A patient arrives for a scheduled immunotherapy visit. Clinical staff administer injections and document each one; the observation period is recorded and closed; the extract was prepared in-house from vials your practice mixed and logged.

Your biller opens the signed record and confirms the injection count, then selects the administration descriptor that matches what was documented — single injection versus two or more — per your coding policy. She then checks the antigen preparation log to determine the number of doses provided, codes the extract lines accordingly, and documents in the claim note which log entry she relied on.

If the patient's vials came from an allergist across town, the extract lines drop off entirely and the note records the outside source. If an evaluation and management service was also performed and separately documented, whether it is separately reportable depends on payer policy and the documentation — your policy should route that decision to the provider and require an explicit note, not a front-desk checkbox.

Where an Allergy Injection Program Leaks PHI

Allergy shot clinics run on visible logistics, and visible logistics leak. Every workaround that makes a busy shot room faster tends to expose names.

The clipboard, the whiteboard, and the timer

The observation period creates a queue, and queues create rosters. A whiteboard listing "Rodriguez 3:20 / Chen 3:25 / Patel 3:31" in a public waiting area is a disclosure. So is a shared sign-in clipboard where each patient reads the six names above theirs, and so is a paper flow-sheet binder left open on the counter.

Fix these with the minimum necessary standard as your test: does the person who can see this information need it to do their job? Number-based timers, single-patient sign-in slips, and a binder that stays closed and out of sightlines cost nothing and remove three findings from your next walkthrough.

The vial refrigerator

Patient-specific vials are labeled with patient names by necessity. If that refrigerator sits in a corridor patients walk through, or if unrelated staff and delivery personnel pass it unsupervised, those labels are an unsecured disclosure of treatment information. Locate the unit in a controlled area, log access, and include it in your annual walkthrough alongside your servers.

Reminder texts and no-show calls

Immunotherapy schedules generate a high volume of reminders. "Your allergy shot appointment" in an SMS reveals a treatment relationship. Get documented patient consent for the channel, keep message content thin, and confirm your messaging vendor's agreement covers PHI in transit and at rest.

The Vendor List Behind CPT Code 95117

Run the list of everyone who touches an allergy injection encounter. Most practices find more names than they expected.

  • Turnkey allergy program vendors. Companies that place a technician in your office, supply their own testing and treatment-tracking software, and support billing are handling PHI on your behalf. That is a business associate relationship, full stop.
  • Compounding or mixing services. A supplier that ships you generic bulk antigen is selling a product. A service that receives patient-specific prescriptions and returns patient-labeled vials is handling PHI.
  • Billing companies and clearinghouses. Obvious, and usually papered — but check that the agreement on file matches the entity actually submitting your claims.
  • Practice management and EHR hosting. Includes any separate immunotherapy scheduling module bolted onto your main system.
  • Patient messaging, answering services, and interpreters.
  • Record storage and shredding vendors handling paper flow sheets.

Refrigerator temperature monitoring is the edge case worth thinking through: a sensor reporting degrees Celsius handles no PHI, but a platform that ties alerts to patient vial identifiers does. Document the reasoning either way so your file shows a decision rather than an omission.

HHS guidance on business associates is the reference to cite in your own policy. If your walkthrough turns up a vendor operating without a signed agreement — which is the usual outcome for turnkey allergy programs added mid-year — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon. One-time purchase, no subscription, and no reason to leave the gap open another quarter.

When a Patient Asks for Their Shot Record

Immunotherapy patients move, switch primary care, or transfer to another allergist, and they ask for their schedules and injection history. Your response clock is 30 days from the request, with one 30-day extension available if you notify the patient in writing.

The shot record is part of the designated record set. That includes flow sheets, treatment schedules, and vial documentation maintained for your practice — even when the source system belongs to a vendor. Two operational consequences:

  • Extraction has to be tested. Ask your vendor today for a complete single-patient export and time it. If the answer is a support ticket and four business days, your 30-day clock has a dependency you did not know about.
  • Termination terms matter. Your business associate agreement should specify what happens to injection histories when the contract ends, in what format, and how the vendor documents destruction of its copy.

A 60-Minute Audit for Your Allergy Program

Block an hour this week and work through it with the lead clinical staffer in the shot room.

  1. Walk the patient path from front door to observation chair. Note every place a name is visible to someone who does not need it.
  2. Pull five recent encounters billed under CPT code 95117 and confirm each has a signed injection record, an observation entry, and a matching antigen log or transfer document.
  3. List every vendor touching the program. Match each against your signed agreement file.
  4. Request a single-patient export from the vendor holding your immunotherapy schedules. Record how long it takes.
  5. Confirm who receives the alert if a records request arrives while the privacy officer is on vacation.

Anything you cannot close in that hour becomes a dated task with a named owner. Undated findings do not get fixed.

The Short Version

CPT code 95117 looks like a small line item, and it is — a few dollars, repeated hundreds of times a month. The exposure is not in the code. It is in the paper binder, the labeled vials in a hallway refrigerator, the whiteboard of waiting patients, and the turnkey vendor whose technician has been charting in your office for eight months without a signed agreement.

Start with the vendor list, because it is the fastest thing to fix and the easiest thing for a regulator to check. Close the gaps with a purpose-built BAA generator, then work outward to the policies and risk analysis that document why your allergy program is run the way it is — automated HIPAA risk analysis and policy generation handles the rest of the document set. Your shot room will still be busy on Tuesday. It will just be defensible.