By 10 a.m. on a normal Tuesday, a two-provider primary care office has drawn blood on eleven patients, printed nine requisitions, labeled twenty-six tubes, and handed the whole batch to a courier who signs a clipboard and drives away. Every one of those transactions is both a billing event and a disclosure of protected health information. The CPT code for lab draw is the part your billing staff argues about; the courier, the requisition, and the results interface are the parts that show up in a breach investigation.

This guide is written for the person who owns both problems. It covers how practices determine and document specimen collection coding, who bills what when the specimen leaves the building, and which of the vendors in that workflow need a signed Business Associate Agreement before the next draw.

What the CPT Code for Lab Draw Describes

Two codes carry most of the volume in an outpatient setting:

  • 36415 — collection of venous blood by venipuncture.
  • 36416 — collection of capillary blood specimen (for example, a fingerstick or heelstick).

Code selection follows the documented collection method and the payer's published policy, not habit. Your coder reads the encounter documentation, confirms which method was performed and by whom, and checks whether the payer covers the collection separately, bundles it into another service, or treats it as incidental. Many commercial payers pay a small separate amount for venipuncture; some bundle it entirely. Capillary collection is non-covered by a number of payers. None of that is a clinical judgment — it is a documentation-and-policy question, and it belongs to the administrative side of the house.

Two adjacent codes come up constantly in practice management conversations. 99000 describes handling or conveyance of a specimen from the office to an outside laboratory and is non-covered under many contracts. HCPCS codes exist for specimen collection performed in a nursing facility or a homebound setting, and for the associated travel allowance; those have narrow eligibility criteria and payer-specific rules. Verify each against the current payer manual before you build it into a fee schedule.

The One-Draw Rule Your Coders Should Know Cold

Venipuncture is generally reported once per encounter regardless of how many tubes are filled from a single stick. Multiple units require documentation supporting genuinely separate collection events, and payers scrutinize them. If your charge capture template auto-populates a unit count from the number of tubes, that is a compliance defect waiting to become a refund request. Fix the template, not the claim.

Who Bills the Draw When the Specimen Leaves Your Building

Three arrangements are common, and each has different billing and privacy consequences.

Reference lab bills the patient's insurer directly. Your practice bills only the collection. The lab bills the analysis. This is the cleanest arrangement and the one most administrators default to.

Client billing. The reference lab bills your practice at a contracted rate, and your practice bills the payer for the testing. This arrangement is restricted or prohibited for federal program beneficiaries in most circumstances, restricted by direct-bill statutes in a number of states, and subject to CMS anti-markup provisions. Do not adopt it on a sales rep's assurance. Get it reviewed.

In-office testing. If you run analyzers on site, your CLIA certificate scope governs what you may perform, and CLIA-waived tests generally require the QW modifier where the payer specifies it. Review your certificate scope annually against your actual test menu — the mismatch is a routine survey finding.

When you bill for a test a reference lab actually performed, modifier 90 identifies the outside laboratory. Modifier 91 identifies a repeat clinical diagnostic test on the same day, which is a distinct concept from a repeat run for equipment error. Your billing lead should be able to explain the difference from memory.

Bundling questions get settled by the National Correct Coding Initiative edits, which CMS publishes and updates quarterly. Assign one person to download the current edit files and reconcile them against your charge master. The CMS NCCI edits page is the source of record; a vendor summary is not.

The Requisition Is a Disclosure, Not a Form

Here is where the operations guide turns into a privacy guide. A lab requisition typically carries the patient's name, date of birth, address, insurance identifiers, ordering provider, diagnosis codes, and the test menu. Diagnosis codes on a requisition can reveal pregnancy, HIV status, substance use disorder treatment, and mental health conditions. That form is a full-strength PHI disclosure traveling on paper through a car.

Disclosure to the reference lab for testing is a treatment disclosure and is permitted without authorization. Minimum necessary does not apply to treatment disclosures — but that is a legal safe harbor, not an operational excuse. If your EHR appends a four-page progress note to every requisition because someone checked a box in the interface configuration three years ago, you are shipping far more than the lab needs, into a system you do not control.

Three concrete fixes your front office can execute this month:

  1. Audit what actually prints. Pull ten requisitions from ten different order types and read every field. Compare against what the lab requires.
  2. Kill the shared fax cover sheet. Misdirected faxes remain one of the most reliable ways for a small practice to generate a reportable breach. Confirm every stored lab fax number annually and require a second person to verify new ones.
  3. Lock the specimen staging area. Labeled tubes sitting in an open bin in a hallway are PHI in a hallway. Move them behind a door that closes.

Which Lab-Workflow Vendors Need a BAA

Administrators consistently over-sign and under-sign here. Sort your lab workflow into three buckets.

No BAA required

The reference laboratory itself is a covered entity receiving PHI for treatment purposes. A covered-entity-to-covered-entity treatment disclosure does not create a business associate relationship. You do not need a BAA to send a specimen for testing. Labs sometimes hand you one anyway; signing it is not harmful, but it is not the control you think it is.

BAA required

Everything performing a function on your behalf:

  • Your billing company or revenue cycle vendor submitting the collection charge.
  • Your clearinghouse.
  • The lab interface or integration vendor that maps results into your chart.
  • The connected point-of-care analyzer vendor whose device pushes results to a cloud portal.
  • Your document scanning or record storage vendor holding paper requisitions and result reports.
  • A coding consultant who reviews charts to validate your specimen collection coding.

The one people argue about: couriers

HHS treats the conduit exception narrowly — it covers entities that merely transmit PHI, such as the postal service and its electronic equivalents. A courier your practice contracts with directly, who holds specimens and paper requisitions in a vehicle, maintains chain-of-custody logs, and returns printed reports, is doing more than transmitting. Get the agreement. HHS guidance on business associates and the conduit exception is worth reading before your next courier renewal.

If that audit turns up two or three vendors touching specimen and results data without a signed agreement, you need paper before your next draw, not next quarter. A six-step Business Associate Agreement generator produces a signature-ready BAA with PDF and DOCX export as a one-time purchase, which is generally faster than routing a template through outside counsel for a courier contract worth a few hundred dollars a month.

When a Patient Asks for Lab Results

Lab results in your designated record set are subject to the HIPAA right of access. You have 30 days from the request, with one 30-day extension available if you notify the patient in writing of the reason and the new date. "The lab has it, call them" is not a compliant response for results held in your chart.

Separately, CLIA regulations permit patients to obtain completed test reports directly from the laboratory. Both paths can be true at once. Your staff should know that a patient who already contacted the lab still has a right to the copy you hold.

Fee rules matter here. You may charge a reasonable, cost-based fee limited to labor for copying, supplies, and postage. You may not charge for search and retrieval time. OCR's Right of Access Initiative has produced a long run of settlements against practices of every size, and the fact pattern is almost always the same: a patient asked, nobody responded, the patient filed a complaint. Review the current HHS right of access guidance with whoever answers your records line.

The Guarantor Problem

A billing statement that itemizes venipuncture plus a specific test panel mails to the guarantor address. For an adult dependent on a parent's plan, or a patient who has requested confidential communications, that statement is a disclosure they did not expect. You are required to accommodate reasonable requests for confidential communications by alternative means or location. Build a flag in your practice management system that suppresses the standard statement address, and test it before you promise it to a patient.

Assign These Five Tasks by Name

  • Billing lead — quarterly reconciliation of specimen collection codes and modifiers against current NCCI edits and top-five payer policies. Document the review date.
  • Front office supervisor — annual verification of every stored lab fax number and portal credential; immediate removal of terminated staff from lab portals.
  • Privacy officer — vendor inventory covering courier, interface, analyzer, billing, and storage vendors, with BAA execution date and expiration for each.
  • Records custodian — logged 30-day clock on every access request, with the response date recorded even when the request is fulfilled in two days.
  • Practice administrator — annual review of the CLIA certificate scope against the in-office test menu, and of any client-billing arrangement against state direct-bill law.

What to Do This Week

Pull one week of lab encounters. For each, confirm the documented collection method supports the specimen collection code billed, confirm the requisition contained only what the lab needed, and confirm the courier who moved it is on your vendor list with a current agreement. Most practices find at least one gap in each column.

If the vendor column is where you land, close it first — an unsigned courier or interface agreement is the cheapest finding to fix and the most expensive to explain. Generate the agreement your courier and interface vendors need and get signatures this week. If your broader documentation set — risk analysis, policies, workforce training records — is equally overdue, automating the full compliance document set is a reasonable next step once the agreements are in hand.