It's 7:40 a.m. and your hospitalist group's census list just landed in a shared inbox — eleven names, eleven room numbers, eleven admit dates. By 6 p.m. those encounters have to become charges, and the person assigning the CPT code for inpatient admission is a coder who never set foot in the building. That handoff — clinician to census list to coder to clearinghouse — is where both your revenue and your breach exposure live.

This guide is for the administrator, billing manager, or privacy officer who owns that handoff. It covers which code family applies to hospital admissions, how practices document and defend level selection, and — the part most billing guides skip — which vendors touch that data and what has to be signed before they do.

Which CPT Code for Inpatient Admission Applies: The Four Families

Hospital-based evaluation and management services live in a small, stable block of codes. Your staff should be able to recite the four families without looking them up.

  • Initial hospital inpatient or observation care — 99221, 99222, 99223. Reported for the first encounter by a given physician or qualified health professional during the stay.
  • Subsequent hospital inpatient or observation care — 99231, 99232, 99233. Daily rounding after the initial encounter.
  • Same-day admission and discharge — 99234, 99235, 99236. Used when admission and discharge occur on the same calendar date and stay-duration requirements are met.
  • Hospital discharge day management — 99238, 99239. Time-based, split at 30 minutes.

Since the 2023 CPT E/M restructuring, observation care no longer has its own code set. Observation and inpatient status now share the same code families, which removed a long-standing source of rework in billing departments — but it did not remove the need to capture patient status accurately, because status still drives hospital-side payment and the two-midnight expectation on the facility claim.

The Distinction Your Billing Staff Gets Wrong Most Often

"Initial" is per-physician-per-stay, not per-admission-event. If a patient is admitted, transferred to your service, and seen for the first time by your physician on day three, that is still the first encounter for your group. Conversely, if your partner rounded yesterday and you round today, that is a subsequent encounter for the group under same-specialty, same-group rules.

Build this as a hard rule in your charge-entry checklist: before assigning an initial-care code, the coder confirms no prior charge exists from the same group and specialty for the same stay. A one-minute lookup prevents a duplicate-service denial and, worse, an overpayment refund letter eighteen months later.

For the CPT code for inpatient admission (99221–99223), level selection is driven by either the level of medical decision making or the total time the practitioner spends on the encounter on the date of service — the practitioner's choice, documented in the note. History and exam are performed and documented as clinically appropriate but no longer determine the level. Total time includes both face-to-face and non-face-to-face work on that calendar date: chart review, ordering, documentation, and care coordination. Practices do not assign a level administratively; the coder validates that the note supports the level the practitioner selected and queries when it does not.

Who Does What: A Role-Assigned Workflow for Hospital Charges

Loose hospital charge capture is the most common revenue leak in a multi-provider practice. Assign owners explicitly.

  1. Practitioner (same day). Signs the note, indicates whether level selection is time-based or MDM-based, and records total time if time-based. If the encounter is shared with an advanced practice provider, both practitioners' contributions are documented per your split/shared policy.
  2. Charge capture lead (next business day, 9 a.m.). Reconciles the census list against submitted charges. Any name on the census without a charge becomes a same-day query.
  3. Coder (within 48 hours). Validates code family — initial, subsequent, same-day admit/discharge, or discharge management — against admit and discharge dates on the facility record. Confirms no duplicate initial charge for the group.
  4. Billing manager (weekly). Reviews level distribution by provider. Not to enforce a target distribution — that is a compliance risk in itself — but to spot providers whose documentation habits have drifted from their coding.
  5. Compliance lead (quarterly). Pulls a sample of ten hospital encounters per provider for a documentation-to-code review, with results memorialized in writing.

CMS publishes its billing requirements through the Internet-Only Manuals, and your coding policy should cite the specific chapter your staff relies on rather than a third-party summary. Start at the CMS Internet-Only Manuals library and pin the relevant claims-processing chapter to your intranet with a review date.

What Coding Policy Should Never Say

Your written policy tells staff how to determine and document a code. It never tells a practitioner which code fits a clinical picture. Language like "admissions with two or more chronic conditions are billed at 99223" turns a coding manual into a clinical directive and hands a payer auditor a gift. Write process, not conclusions.

The Census List Is PHI, and Your Practice Treats It Like a Sticky Note

Here is where the operations guide turns into a privacy problem. A hospital census list for your group contains patient names, admission dates, room numbers, and often a working diagnosis. That is protected health information in one of its densest forms — dozens of patients in a single file, frequently distributed by the least controlled channel available.

Audit how yours actually moves. In most practices, at least one of these is happening:

  • A rounding physician photographs the printed list on a personal phone.
  • The list is emailed unencrypted to a personal address so it can be opened at home.
  • The list is texted through a consumer messaging app to coordinate coverage.
  • Paper copies leave the hospital in a coat pocket and are discarded at home.
  • The billing company receives the full census by email attachment, including patients whose charges are not theirs to process.

That last one is a minimum necessary failure, and it is the one an auditor finds fastest. Your billing vendor needs the encounters they bill — not your entire service census. HHS guidance on the minimum necessary standard expects you to define role-based limits on routine disclosures, and "routine daily census transmission" is exactly the kind of recurring disclosure that requires a defined limit rather than case-by-case judgment.

Fix it with three controls: transmit census data only through your secure channel, filter the file to the providers the recipient supports, and set a retention rule so old lists are purged rather than accumulating in a shared drive nobody has audited since 2021.

Every Hand That Touches an Admission Charge Needs a Signed Agreement

Map the chain for a single inpatient admission charge. It usually runs longer than administrators expect:

  • Hospital EHR access for your practitioners (governed by your participation and access agreements with the facility)
  • Dictation or ambient documentation tooling
  • Your practice EHR or charge-capture app
  • Outsourced coding or coding-audit firm
  • Billing company or revenue cycle vendor
  • Clearinghouse
  • Denial management or A/R follow-up subcontractor
  • Document storage and backup provider

Each of those is a business associate, and each needs an executed business associate agreement before the first record moves. The coding-audit firm is the one practices most often miss, because it feels like a consultant rather than a data processor — but it receives full clinical notes to do its job.

If you're standing up a new billing vendor or coding auditor this quarter and the agreement is the thing holding up go-live, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It's a one-time purchase with no subscription, which suits a practice that signs two or three vendor agreements a year rather than twenty. Review HHS's sample business associate agreement provisions alongside it so your team knows which clauses are regulatory floor and which are negotiated.

Keep the executed agreements in one indexed location with renewal dates and subcontractor disclosures. When OCR or a payer asks, "who processes your hospital charges," the answer should take four minutes to produce, not four days.

Records Requests After a Hospital Stay: Whose Chart Is It?

A patient discharged from an inpatient stay calls your office in June asking for "my hospital records." Your front desk needs a scripted answer, because the wrong one creates a right-of-access complaint.

Your designated record set includes the notes your practitioners authored and the records you maintain to make decisions about that patient — not the facility's full inpatient chart. If your physician's admission and progress notes live in your system, you produce those on request. Nursing flowsheets, facility imaging, and the hospital's own documentation come from the hospital's release-of-information office.

The 30-day clock under the access right applies to what you hold. Train the front desk to (1) confirm identity, (2) explain the split between your records and the facility's, (3) log the request with a date stamp, and (4) route it to the records owner the same day. Do not let "we'll ask the doctor" become a two-week delay — right-of-access enforcement has been one of OCR's most consistent activities, and the fact patterns are almost always about delay rather than refusal.

One more operational detail: if a patient requests the record to check the codes billed, that is a billing inquiry and an access request. Handle both, and document that you did.

A Worked Administrative Example

Your group admits a patient Tuesday evening. Dr. A performs the initial encounter and selects a level based on total time, documenting 65 minutes on the date of service. Dr. B rounds Wednesday and Thursday. The patient discharges Friday, with Dr. B performing discharge day management and documenting 40 minutes.

What your billing staff verifies — none of it clinical:

  • Only one initial-care charge exists for the group across the stay.
  • Tuesday's note states the basis for level selection and, if time-based, records total time on that calendar date.
  • Wednesday and Thursday are subsequent-care charges tied to distinct dates of service.
  • Friday's discharge documentation supports the time threshold that separates the two discharge codes.
  • Admit and discharge dates on the charges match the facility record — a mismatch here triggers a denial that is expensive to unwind.
  • If any encounter was shared with an APP, the split/shared documentation policy was followed and the substantive portion is identifiable in the note.

Every one of those checks is a documentation question, not a medical one. That line is what keeps your billing team on the right side of both payer audits and scope-of-role complaints.

Fold Hospital Charge Capture Into Your Risk Analysis

Most practices scope their security risk analysis around the office EHR and forget the hospital workflow entirely. But rounding involves mobile devices, personal phones, off-network access, and file transfers to outside billers — a different threat profile than the front desk.

Add these to your next assessment: mobile device management on phones used for rounding, encryption on any device that stores a census file, access review for practitioners who leave the group but retain hospital credentials, and transmission security for the census handoff to billing. The ONC privacy and security resources are a reasonable starting framework, and if you'd rather not rebuild the whole document set by hand, automated risk analysis and policy generation will get you a defensible baseline faster than a spreadsheet will.

Your Next Two Hours

Pull your last 30 days of hospital charges and check three things: duplicate initial-care codes within the same group and stay, charges whose dates don't match the facility record, and any census file sitting in a shared drive older than 90 days.

Then pull your vendor list and confirm an executed agreement exists for every party that touches those charges — coder, biller, clearinghouse, auditor, backup provider. If one is missing, draft and export the agreement today rather than adding it to a queue. The CPT code for inpatient admission is the easy part of this workflow. The paper trail behind it is what holds up under scrutiny.