Your nurse practitioner leaves the office at 8:15 on a Tuesday with a laptop, a phone, a printed route for six addresses, and a folder of paper intake forms for two patients whose portal accounts were never activated. By 4:00 she has documented six encounters, several of which your billing team will review for CPT code 99348 or one of its siblings. That laptop and that folder held protected health information for six households, in four vehicles-worth of parking lots, for eight hours, outside every physical safeguard you built into your building.

This guide is for the person who owns both halves of that problem: the administrator who has to get the home visit claim right and the privacy officer who has to explain what happened if the bag walks off. Coding and billing guidance here is administrative. Clinical decisions belong to your clinicians.

What CPT Code 99348 Describes, in Plain Administrative Terms

CPT code 99348 is an evaluation and management code in the Home or Residence Services, Established Patient family. Per the CPT descriptor, it applies to an established-patient encounter in a home or residence that includes a medically appropriate history and/or examination and a low level of medical decision making, or 30 minutes of total time spent on the date of the encounter.

The established-patient home and residence range runs 99347 through 99350, distinguished by level of medical decision making or total time. New-patient encounters in the same settings use a separate range. Since the 2023 CPT revision folded the old domiciliary, rest home, and custodial care codes into the home or residence family, one set of codes now covers private homes, assisted living, group homes, and similar residential settings.

Your practice does not "pick" 99348 because a visit felt like a 30-minute visit. The clinician documents the encounter; your coding staff selects the level from what the documentation supports; your compliance lead spot-checks that the two agree. Verify descriptors and any payer-specific edits against your current CPT reference and your MAC's published articles before you set internal policy.

The Codes That Sit Next To It

  • 99347–99350 — established patient, home or residence, ascending by medical decision making or total time.
  • Prolonged services add-on — applied only when time thresholds beyond the base code are documented and the payer recognizes the code.
  • Place of service 12 (home), 13 (assisted living), 14 (group home), 33 (custodial care) — the POS on the claim has to match where the clinician actually stood.

Note that CMS home visit E/M policy is not the same thing as the home health benefit. A patient does not have to be certified homebound for a physician or NP home visit to be payable, but payers do expect documentation supporting the medical necessity of the encounter. Payment rates and any locality adjustments live in the CMS Physician Fee Schedule, which your billing lead should be checking annually, not assuming.

How Your Practice Decides Which Home Visit Level Gets Submitted

Build the decision into workflow instead of leaving it to end-of-day recall. Three operational rules do most of the work.

Pick One Basis Per Encounter and Say So

Level selection rests on either medical decision making or total time on the date of the encounter. Mixing them inside a single note is where audits go badly. Your template should force the clinician to state the basis. If time is the basis, the note needs a total time figure and a description of the qualifying activities — chart review, the face-to-face encounter, care coordination, documentation — all performed on that calendar date.

Capture Travel Separately and Never Inside Total Time

Travel between residences is not a billable E/M activity. Your mileage log and your time-based documentation should live in different fields, in different systems if possible. When a coder sees 30 minutes of documented time on a visit that a route app shows lasted 12 minutes on-site, you have a problem that started with a badly built template.

Reconcile the Route Against the Claims Weekly

Assign one person — usually the billing supervisor — to compare the scheduled route, the documented encounters, and the submitted claims once a week. Missing notes, duplicate encounters, and POS mismatches surface within days instead of at a payer audit two years later. Log the reconciliation. A dated log is the difference between "we monitor" and "we can show we monitor."

The Privacy Problem CPT Code 99348 Creates That Office Visits Do Not

An office encounter happens inside your Security Rule perimeter. A home visit does not. Every home or residence encounter your practice bills moves PHI through at least four uncontrolled environments: the vehicle, the residence, whatever network the clinician connects to, and the clinician's own household if the bag goes home at night.

Four exposures show up repeatedly in practices running home visit programs:

  1. The device. A laptop or tablet with a cached patient panel, left in a car. If full-disk encryption is enabled and you can prove it, this is a lost asset. If it is not, it is a reportable breach affecting every patient whose data was cached.
  2. The paper. Printed schedules with names, addresses, and chief complaints. A single day's route sheet is a compact directory of who is sick and where they live.
  3. The network. Clinicians joining the patient's home Wi-Fi to sync a note. Use cellular data or a hotspot you control, and write that into policy.
  4. The audience. Family members, aides, and roommates are present in ways they are not in your exam rooms. Verbal disclosures in a shared living space need the same discretion your front desk uses at the check-in window.

The HHS Security Rule guidance library is the right starting point for the technical safeguard side, and NIST SP 800-66 Revision 2 maps Security Rule requirements to concrete controls in a format your IT vendor will actually recognize.

Write the Home Visit Addendum to Your Device Policy

Your general mobile device policy is probably written for a phone that checks email. It needs a home-visit section covering: encryption verification before each route, screen lock timeout under two minutes, no local storage of patient lists beyond the current day, remote wipe capability tested quarterly, a rule against printing route sheets that include diagnosis information, and a same-day reporting requirement for any lost device or document. Have every field clinician sign it annually.

Every Vendor on a Home Visit Route Needs a BAA — Including the Ones You Forgot

Here is the vendor list a typical home visit program actually touches, and the one most practices have never fully inventoried:

  • The EHR or mobile charting platform — usually covered.
  • The answering service or triage line taking calls from the field — sometimes covered.
  • The route optimization or scheduling app receiving patient names and addresses — frequently not covered.
  • Transcription or ambient documentation tools running on the clinician's phone — frequently not covered.
  • The billing company or clearinghouse submitting the home visit claims — usually covered.
  • Mobile device management and remote wipe providers — often overlooked.
  • Interpreter services dialed in from a residence — often overlooked.
  • Secure messaging or paging vendors used to coordinate the route.

A route optimization tool that ingests patient names and street addresses is handling PHI. So is a transcription app that captures a recorded encounter. Both are business associates, both require an executed agreement before they touch data, and both are the sort of small operational tool a clinician adopts on their own without telling anyone.

If you find gaps — and a first inventory of a home visit program almost always does — you need signature-ready agreements faster than outside counsel can turn them around. A six-step wizard that generates a signature-ready Business Associate Agreement with PDF and DOCX export closes those gaps in an afternoon, as a one-time purchase rather than another subscription line item. Send the DOCX to the vendor, keep the PDF in your vendor file, and record the execution date in your inventory.

Run the Inventory Against the Route, Not the Invoice List

Accounts payable will not show you the free app a clinician installed. Interview each field clinician directly: what is on your phone, what do you open between visits, where do the notes go if the EHR is down. Do this once a year and after any staffing change on the home visit team.

Records Requests for Home Visit Encounters Run on the Same 30-Day Clock

A patient or their personal representative asking for records from a home or residence encounter gets the same right of access as anyone else: generally 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Home visit programs miss this deadline more often than office-based ones for a predictable reason — documentation lives in more places.

Before your next request lands, answer these: where do field-generated paper forms get scanned, and how quickly? Does a photo taken on a clinician's phone for wound tracking end up in the designated record set? Is your route or care-coordination note discoverable, or is it sitting in a scheduling tool nobody thinks of as a records system? Anything used to make decisions about the patient belongs in the designated record set regardless of which application stores it.

HHS maintains detailed right of access guidance covering formats, fees, and timelines. Read it against your actual home visit data flow, not against your office workflow.

A 60-Minute Audit You Can Run This Week

Block an hour. Pull five home or residence encounters billed in the last quarter, mixing levels including any billed as CPT code 99348. For each one, confirm:

  1. The note states whether level selection rested on medical decision making or total time.
  2. The place of service on the claim matches the setting described in the note.
  3. No travel time is folded into documented encounter time.
  4. Every application that touched the encounter appears in your vendor inventory with an executed BAA.
  5. The full record — including any field-captured images or paper — is retrievable within your access-request workflow.
  6. The clinician's device carried encryption you can independently verify, on the date of the encounter.

Any failure in items one through three is a billing integrity issue. Any failure in four through six is a Security or Privacy Rule issue. Both belong in the same corrective action log, reviewed by the same person, because in a home visit program they are produced by the same workflow.

If your risk analysis has never explicitly addressed off-site encounters, that gap is worth closing before your next audit cycle — automated risk analysis and policy generation will at least give you a documented baseline to work from. Then start on the BAA inventory. The vendors serving your home visit route are the ones most likely to be missing an agreement, and the easiest to fix today.