Your billing lead forwards a batch of 38 denials and a one-line question: "What's the CPT code for hypertension?" It's the third time this quarter someone has asked, and the answer is the same each time — there isn't one. Hypertension is a diagnosis, and diagnoses travel on the claim as ICD-10-CM codes. CPT codes describe what your clinicians did.

This guide is for the person who runs the practice: the administrator, the billing manager, the privacy officer wearing three hats. It walks through which service codes typically show up on a blood-pressure-related encounter, how practices document code selection defensibly, and — the part most billing articles skip — the vendor agreements and records obligations that a hypertension program quietly creates. If your practice is standing up remote monitoring or self-measured BP, the compliance surface grew before the revenue did.

Is There a CPT Code for Hypertension? The Short Answer

No. There is no CPT code for hypertension because CPT describes procedures and services, not conditions. Hypertension is reported as a diagnosis using ICD-10-CM — the I10–I16 range covers essential hypertension, hypertensive heart and chronic kidney disease, secondary hypertension, and hypertensive crisis.

On a claim, the diagnosis code justifies the service code. So a hypertension encounter carries an ICD-10-CM diagnosis plus one or more CPT/HCPCS codes describing the visit, the monitoring, the device supply, or the care-management time. When staff ask for "the CPT code for hypertension," what they usually need is the service code for the specific work performed and documented.

What Actually Goes on the Claim

Below is the administrative landscape — the families of codes that commonly appear on hypertension-related encounters. This is not clinical guidance and it is not a determination that any code fits any particular patient. Code selection belongs to the rendering clinician, supported by documentation your practice can produce on audit.

Office and outpatient E/M

Most hypertension encounters bill through the office/outpatient evaluation and management family (99202–99215). Since the 2021 E/M revisions, level selection rests on either medical decision making or total time on the date of the encounter. Your job as administrator is making sure the note supports whichever basis the clinician used, and that your template doesn't auto-populate time that nobody actually spent.

Self-measured blood pressure monitoring

CPT includes codes for self-measured blood pressure monitoring — one describing patient training and device calibration, another describing collection of readings taken over a 30-day period with a reported average and communication of a plan back to the patient. These codes carry explicit frequency and content requirements written into the code descriptors themselves. Read the descriptor before you let anyone add it to a superbill.

Remote physiologic monitoring

RPM is where hypertension programs generate the most revenue and the most exposure. The family covers initial setup and patient education, the supply of a device transmitting daily recordings, and monthly treatment-management time in 20-minute increments. Payer rules layer on top of CPT — Medicare has long conditioned the device-supply code on a minimum number of transmitting days within a 30-day period, and CMS has revisited that structure in recent rulemaking.

Verify the current requirements against the CMS Physician Fee Schedule each January rather than trusting last year's cheat sheet. Commercial payers frequently diverge.

Care management

Chronic care management, principal care management, and the newer bundled advanced primary care management arrangements CMS has introduced all touch hypertension panels. Each has its own consent, documentation, and time-tracking requirements. Time logs are the audit target — if your platform can't export per-patient, per-month time with the identity of the staff member who performed it, you have a problem you haven't discovered yet.

How Practices Determine and Document Code Selection

Build the process, not the answer. A defensible workflow looks like this:

  1. The clinician selects the code based on the documented service. Billing staff query; they do not upgrade.
  2. Documentation precedes the claim. The note supports the level or the monitoring interval before anything drops.
  3. A written policy names the authority your practice follows — current-year CPT, payer policy manuals, and the fee schedule — and names who reconciles conflicts between them.
  4. Someone owns the annual update. Assign a date in December for reviewing code changes and reissuing internal guidance.
  5. Sampled internal audits. Ten charts a month per clinician, documented, with corrections tracked to closure.

Write down who does each step. "The biller handles it" is not a control; it's a name you'll be reading back to an auditor.

The Vendor List Your Hypertension Program Just Grew

Here's what nobody tells you when you launch an RPM or self-measured BP program: you did not add one vendor. You probably added four.

Trace the data. A cuff sends a reading over cellular or Bluetooth. A connectivity provider carries it. A monitoring platform stores and displays it. A managed services firm may staff the monthly outreach calls. Your billing company pulls the time logs. Your clearinghouse transmits the claim. Every one of those entities creates, receives, maintains, or transmits protected health information on your behalf — which makes each one a business associate under 45 CFR 160.103.

The device manufacturer sometimes argues it's a conduit or a mere product supplier. If it holds readings tied to an identifiable patient, that argument fails. HHS publishes sample business associate agreement provisions, and the required elements are not optional.

Before your first RPM claim goes out, you need executed agreements covering the full chain — including subcontractors the platform uses for storage or analytics. If your BAA process today is emailing a 2016 template and hoping, tighten it. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX, one-time purchase, which is faster than routing a redline through counsel for a $40-a-month device vendor.

Contract terms worth fighting for

  • Breach notification timing. Push for notice within a fixed number of calendar days of discovery — not "promptly."
  • Data return or destruction at termination, with a certificate. RPM platforms accumulate years of readings.
  • Subcontractor disclosure. You should be able to name every downstream entity holding your patients' readings.
  • Audit and export rights. If you can't extract the full record on demand, you can't satisfy a records request.
  • No secondary use. Explicitly bar de-identification for the vendor's product development unless you've decided to permit it in writing.

Home Blood Pressure Readings Are Part of the Designated Record Set

If your clinicians use transmitted readings to make decisions about a patient, those readings sit in the designated record set. That means a patient's right-of-access request reaches them — the readings, the trend reports, the monthly summaries — not just the office note.

The HHS right of access guidance is the operative reference, and the 30-day clock does not pause because the data lives on a vendor's server. OCR has pursued right-of-access enforcement consistently for years; "our monitoring vendor can't export that" is not a defense anyone has successfully raised.

Test it. Pick a live RPM patient this week and have your front desk run a full access request end to end. Time it. If the vendor portal only exports a 90-day PDF and the patient has 14 months of data, you've just found the gap before a patient did.

Retention and the billing file

Monitoring data supporting a claim is also documentation supporting a claim. Your record retention schedule needs to name it explicitly, alongside the time logs and consents. Set retention to the longer of your state medical record requirement and your payer audit lookback, and confirm the vendor's contractual retention matches — some platforms purge on subscription lapse.

The Consumer BP App Your Patient Mentions at Checkout

A patient walks in and says she's been tracking readings in a free app on her phone. That app is almost certainly not a business associate, and HIPAA does not follow the data there. The FTC's Health Breach Notification Rule covers many of these consumer health apps instead.

Two operational consequences. First, if your staff instruct patients to use a specific app, you have arguably brought it into your workflow — get it under agreement or stop recommending it. Second, once a patient hands you a screenshot or export and your clinician relies on it, that copy is in your record and subject to your safeguards.

Train the front desk on the distinction in one sentence: anything we ask a patient to use is our vendor problem; anything they bring us becomes our record.

A 30-Day Cleanup for Hypertension Program Operations

Week 1 — Inventory. List every vendor touching BP data: devices, connectivity, platform, staffing partner, billing company, clearinghouse. Note who signed a BAA and when.

Week 2 — Close the gaps. Execute missing agreements. Re-paper anything signed before 2020 that lacks breach-notification timing or subcontractor terms.

Week 3 — Documentation audit. Pull 20 charts with hypertension-related monitoring or care-management codes. Confirm consent, time logs, transmitting-day counts, and that the note supports what was billed. Log every finding.

Week 4 — Records drill and risk analysis. Run the access-request test above. Then update your security risk analysis to reflect the new data flows — new devices, new remote access, new staff roles. If your risk analysis hasn't changed since you added remote monitoring, it's out of date, and tooling that automates HIPAA risk analysis reports and the supporting policy set beats a spreadsheet you'll never open again.

What to Tell Staff When They Ask Again

Post one line by the billing desk: there is no CPT code for hypertension — I10-series ICD-10-CM carries the diagnosis, and the CPT code describes the service the clinician documented. That single correction prevents a surprising share of denials, because the underlying error is usually a claim built around a condition instead of around work performed.

Then handle the half nobody searches for. Every hypertension program built on connected devices adds vendors, adds records, and adds a 30-day clock you'll be held to. Start with the vendor inventory this week, and get the business associate agreements executed before the next claim cycle rather than after the next audit letter.