A three-provider dermatology practice ran a self-audit last fall and found 214 skin biopsy claims over six months where the operative note said "biopsy performed" and nothing else — no technique, no lesion count, no site. Every one of those claims had been coded, submitted, and paid. Every one of them was indefensible on review.

If your practice bills the CPT code for punch biopsy, this guide is for the person who owns that process: the administrator who signs the billing vendor contract, the coder who queries the provider, the privacy officer who answers when a patient asks why their pathology report went to an outside lab. It covers the coding mechanics as administrative workflow, then the records and vendor obligations that attach to every specimen that leaves your building.

What the CPT Code for Punch Biopsy Sits Inside

Before 2019, skin biopsies were coded with a single-lesion code and an add-on, without regard to technique. The AMA restructured that family, and the current code set separates biopsies by the method the provider used. Your coders work inside six codes:

  • 11102 — biopsy of skin, subcutaneous tissue and/or mucous membrane; tangential (shave, scoop, saucerize, curette), single lesion
  • +11103 — each separate/additional lesion, tangential (add-on)
  • 11104 — punch biopsy, single lesion
  • +11105 — each separate/additional lesion, punch (add-on)
  • 11106 — incisional biopsy, single lesion
  • +11107 — each separate/additional lesion, incisional (add-on)

The CPT code for punch biopsy is therefore technique-specific by design. Your coding staff cannot pick it from a chief complaint or a diagnosis — they need the technique documented in the note. That is a documentation workflow problem, not a coding problem, and it belongs to you.

The Add-On Codes and How Units Get Counted

The add-on codes are reported per additional lesion, not per additional specimen jar and not per additional pass on the same lesion. When multiple lesions are biopsied by different techniques in the same session, CPT instructs that the most complex biopsy is reported as the primary code and the remaining lesions are reported with the corresponding add-on codes.

That hierarchy rule is where practices lose money and where they create audit exposure in equal measure. Build it into your encounter form or charge-capture template so the provider records technique plus lesion count plus anatomic site for each lesion. If your template collects only "biopsy x3," your coder is guessing, and guessing is what shows up in a payer extrapolation.

Which CPT Code Is Used for a Punch Biopsy?

CPT designates 11104 for a punch biopsy of a single lesion and add-on code 11105 for each separate additional lesion biopsied by punch technique in the same encounter. Code selection is driven by the documented technique and the documented number of distinct lesions, not by the diagnosis or the number of specimen containers sent to pathology. Practices determine the code by reading the procedure note for three elements: the instrument and method used, the anatomic site of each lesion, and the count of separate lesions sampled. When the documentation does not state technique, the standard operational response is a provider query before the claim goes out — not a default to the most-billed code in your history.

Modifiers and Edits Your Billing Lead Should Own by Name

Two operational issues generate most of the denials on this code family.

Bundling with a same-session removal. National Correct Coding Initiative edits govern whether a biopsy reported alongside an excision or destruction at the same site survives adjudication. Your billing lead should be pulling the quarterly edit files directly rather than relying on a vendor's summary. CMS publishes the NCCI edit files and policy manual at no charge, and the policy manual chapter on integumentary procedures is the reference your coders should have open.

Modifier discipline. Separate-site and separate-encounter modifiers get applied by habit in a lot of practices. Habit is not documentation. If your billing vendor appends a modifier that your note does not support, the liability lands on your practice, not theirs — the claim carries your NPI. Ask your vendor, in writing, for a monthly report of every modifier they added that was not on your submitted charge.

One more administrative point that surprises people: CPT is copyrighted by the AMA. Your practice needs current licensed codebooks or a licensed electronic code set for every coder. Photocopied crosswalks circulating on a shared drive are both a licensing problem and a version-control problem.

Where the Specimen Goes — and What Goes With It

A punch biopsy generates more than a claim. It generates a labeled container, a requisition form, a courier handoff, a pathology report, a result notification to the patient, and often a clinical photograph. Each of those is a PHI touchpoint with a different owner.

Walk your own workflow and write down who handles the specimen label. In most practices it is a medical assistant standing at a counter that patients can see. Requisition forms stacked face-up in a pass-through window are a routine, unglamorous disclosure risk that no risk analysis template will catch for you — only a walkthrough will.

The Pathology Lab Is Not Automatically a Business Associate

This trips up new privacy officers constantly. When you send a specimen to a pathology group for interpretation, that group is a covered entity providing treatment. Disclosures between covered entities for treatment purposes do not require a business associate agreement. HHS is explicit that a BAA is not required for disclosures to a healthcare provider concerning the treatment of an individual — see the OCR guidance on business associates.

What you do owe there is a minimum-necessary review of your requisition form. If your form transmits the patient's full chart summary, insurance card image, and unrelated history because that is what the interface exports by default, tighten it.

The Vendors Around the Biopsy That Do Need a BAA

Here is the list most practices are missing at least two entries from:

  • The specimen courier, if the driver handles labeled containers and requisitions rather than a sealed opaque package they never open. Conduit status is narrow — narrower than couriers usually claim.
  • Your billing company or outsourced coding vendor, including any offshore subcontractor they use. Ask for the subcontractor list and confirm downstream agreements exist.
  • Clinical photography and dermoscopy apps that store lesion images outside your EHR. If the image sits in a third-party cloud, that vendor is a business associate.
  • Transcription or ambient documentation services that capture the procedure note where technique and lesion count are dictated.
  • Result-notification and patient-messaging platforms that deliver "your biopsy results are ready."
  • Shredding and e-waste vendors handling requisition copies and label printer waste.

If you find a gap while reading that list, close it before the week ends rather than adding it to a compliance backlog. You can generate a signature-ready business associate agreement through a six-step wizard with PDF and DOCX export, one-time purchase, no subscription — which is faster than routing a redline through counsel for a courier contract you need signed Friday.

The Pathology Report Is in the Designated Record Set

A patient who had a punch biopsy last month calls and asks for "everything." Your obligation is concrete: the pathology report, the procedure note, the images if they are used to make decisions about that patient, and the billing record are all part of the designated record set. You have 30 days to act on the request, with one 30-day extension available if you notify the patient in writing of the reason and the new date. OCR's right of access guidance is the operative reference, and right-of-access enforcement has been one of OCR's most consistent activity areas for years.

Two practical failure modes on biopsy records specifically:

The report lives in two systems. The pathology group's portal has the signed report; your EHR has a scanned or interfaced copy. If your release-of-information staff only pulls from one, the patient gets an incomplete record. Document which system is authoritative and train to it.

Images get skipped. Clinical photos taken at the biopsy site are records. If they inform treatment decisions, they belong in the response. Decide your policy now, in writing, rather than at the counter with a frustrated patient.

When the Dispute Is About the Code, Not the Chart

Patients increasingly request records specifically to challenge a bill — "they charged me for three biopsies and I only had two." Route that as both an access request and a coding review. Your coder pulls the note, counts documented lesions, and either supports the claim or corrects it. If the patient asks you to change the note itself, that is an amendment request under 45 CFR 164.526, with its own 60-day clock and its own written-denial requirements. Do not let a billing supervisor informally resolve an amendment request; it needs the documented process.

A Ten-Line Audit You Can Run This Quarter

  1. Pull 25 skin biopsy claims from the last 90 days.
  2. Confirm each note states the technique in words the coder can use.
  3. Confirm each note states anatomic site per lesion.
  4. Confirm add-on units match documented distinct lesions.
  5. Confirm every modifier on the claim traces to something in the note.
  6. Confirm the pathology report is filed in the EHR and linked to the encounter.
  7. Confirm the requisition form transmits only minimum-necessary data.
  8. Confirm a signed BAA exists for the courier, the billing vendor, and any image platform.
  9. Walk the specimen counter during clinic hours and note what a waiting patient can see or hear.
  10. Log findings with owner names and 30-day due dates.

Ten lines. Two hours of an administrator's time. It will surface more than a purchased checklist will, because it follows your actual specimen through your actual building.

What Ties the Coding and the Privacy Work Together

The same note that supports the CPT code for punch biopsy is the note a patient can request, a payer can audit, and a plaintiff's counsel can subpoena. Thin documentation is simultaneously a revenue risk and a records risk. Practices that fix the template fix both at once.

And the same vendor ecosystem that moves your specimen moves your PHI. Every courier, every billing subcontractor, every image app sitting between the exam room and the pathology report is a potential entry on a breach report. The OCR breach portal is full of incidents that originated at a vendor the covered entity had not formally papered.

Start with the BAA gap you identified while reading the vendor list above — draft and export a signed-ready agreement in a single sitting, then move on to the documentation template. If your broader policy set and risk analysis are also overdue, automated HIPAA risk analysis and policy generation will get the paperwork current faster than rebuilding it in a word processor. Neither replaces the walkthrough. Do the walkthrough anyway.