Three punch biopsies came off one patient on Tuesday afternoon. Your provider dictated a note, your medical assistant labeled three specimen containers, a courier picked them up at 4:15, and eleven days later a payer denied two of the three line items. Somewhere in that chain, the cpt code for punch biopsy of skin got reported in a way the payer's edits rejected — and separately, a requisition form left your building carrying more patient data than the lab needed.

This guide is for the people who own both problems: practice administrators, billing leads, and privacy officers. It covers how the biopsy code family is structured, what documentation fields your staff must capture, and the vendor and records obligations that attach to every specimen you send out.

What Is the CPT Code for Punch Biopsy of Skin?

CPT organizes skin biopsy reporting by technique, not by body area. Since the 2019 code set, three technique families exist: tangential biopsy (11102, with add-on 11103), punch biopsy (11104, with add-on 11105), and incisional biopsy (11106, with add-on 11107). The primary code covers the first lesion sampled by that technique; the add-on code is reported per additional lesion.

So the cpt code for punch biopsy of skin is 11104 for a single lesion, with 11105 appended for each separate additional lesion sampled by punch. CPT also sets a hierarchy for encounters involving more than one technique, and includes parenthetical instructions on when biopsy codes are not separately reportable. Your coders should work from the current CPT book and payer policy — not from memory or a laminated cheat sheet printed four years ago.

Who decides which code goes on the claim

The provider documents technique, anatomic site, lesion count, and instrument details. Your coder or biller reads that documentation and selects codes that match it. That order matters and it is not negotiable: billing staff do not choose the technique, and they do not upgrade a note to fit a better-paying code.

Build the rule into your policy manual in one sentence: if the note does not say it, the claim cannot claim it. When documentation is ambiguous, your process should be a query back to the provider, logged, with a turnaround expectation — not a coder's best guess.

The Six Documentation Fields That Decide Whether a Claim Holds

Audit your last twenty biopsy encounters against this list. Most practices find at least one field missing in a quarter of charts.

  • Technique — stated explicitly in the provider's own words, not implied by the tray setup.
  • Instrument detail — punch size, when the provider records it, distinguishes the note from a template.
  • Anatomic site — specific enough to match the specimen label and the pathology report.
  • Lesion count and separateness — two samples from one lesion is not the same documentation event as samples from two lesions.
  • Intent — diagnostic sampling versus complete removal changes which code family the encounter falls into.
  • Closure and post-procedure care — documented because CPT's instructions address what is and is not bundled.

If your EHR template auto-populates any of these fields with a default value, turn that default off. Auto-populated technique language is the single fastest way to fail a payer records request, because the note will read identically across patients whose specimens differed.

Your Specimen Leaves the Building — Now It Is a Vendor Problem

The moment that container goes into a courier bag, three business associate relationships are usually in play, and most practices have paperwork for only one of them.

The dermatopathology or reference lab

An independent lab performing the diagnostic read is generally a covered entity in its own right, and disclosures to it for treatment purposes are permitted without authorization. But if that lab also stores your reports, provides you a results portal, or handles billing on your behalf, review whether a business associate agreement is required for those functions. Do not assume the lab's own compliance posture covers your obligations.

The courier

Couriers carrying labeled specimens are handling protected health information. A signed BAA with your courier, with a subcontractor clause, is table stakes. If your practice uses a general delivery service rather than a medical courier, check whether their standard terms even permit PHI transport.

The billing company, clearinghouse, and coding contractor

Anyone who touches the claim touches PHI. That includes offshore coding vendors, denial-management consultants, and the clearinghouse in between. HHS publishes sample business associate agreement provisions that establish the floor — breach notification timelines, subcontractor flow-down, and return or destruction of PHI at termination.

If you found a gap while reading those three subsections — and most practices do — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, which matters when you need three agreements this month and none next quarter.

Requisition Forms Carry More PHI Than the Lab Needs

Pull a blank requisition from your lab's pad and read every field. Many include full Social Security number, complete insurance card data, prior diagnoses, and a free-text clinical history box that staff fill with whatever the chart happens to say.

The minimum necessary standard applies to what you send. OCR's guidance on the minimum necessary requirement is the reference point for the policy you write around it. For biopsy requisitions, the practical rule is that clinical history should be limited to what the pathologist needs to interpret the specimen.

Assign one person to review requisition workflow annually. Have them confirm which fields are required by the lab, which are optional, and which your staff have been filling out by habit. Then instruct staff to leave the optional ones blank and document that instruction in your training log.

The fax and the front desk

Pathology results still arrive by fax at a large number of practices. If your fax number reaches a shared multifunction printer in a hallway, that is a documented finding waiting to happen. Route results to a dedicated line or secure inbox, restrict access by role, and log who retrieves them.

The Pathology Report Becomes Part of Your Designated Record Set

Once the report lands in your chart, it is yours to produce. When the patient asks for their records — including the biopsy result — the response clock is 30 days, with one possible 30-day extension if you notify the patient in writing of the reason and the new date. HHS's individuals' right of access guidance is the operative reference for your policy.

Three failure modes show up repeatedly in biopsy-related access requests:

  1. Deflection to the lab. Front desk tells the patient to call the pathology lab. If the report is in your chart, you must produce it. Deflection does not stop your clock.
  2. Withholding pending a follow-up visit. A provider's preference to deliver results in person does not extend the response deadline.
  3. Fee creep. Charges must be limited to a reasonable, cost-based fee. Per-page schedules copied from a state statute years ago frequently exceed what HIPAA permits for electronic copies.

Write the biopsy-specific version into your access procedure so front-desk staff do not improvise. One line is enough: pathology reports in the chart are released on the same timeline and terms as any other record.

Denials, Modifiers, and the Two Documents Your Payers Will Ask For

Multi-lesion biopsy claims are a routine denial category. When the payer wants to know why two lesions were sampled and reported separately, they ask for the operative note and the pathology report. Both must independently support the site and count on the claim.

Distinct-procedural-service modifiers exist for these situations, but they are documentation-dependent, not defaults. Attaching a modifier because the edit fires is how practices end up in extrapolated overpayment findings. CMS publishes the National Correct Coding Initiative edits and the associated policy manual, and your coding lead should be checking the current quarter's files rather than relying on a clearinghouse scrubber's suggestions.

For payment amounts, use the Medicare Physician Fee Schedule lookup with your specific locality. Do not quote national averages to your providers as expected reimbursement.

A Ten-Day Cycle, Assigned by Role

Here is the operational sequence for a single multi-lesion biopsy encounter, with owners named. Adapt the roles to your staffing, but assign every step to a person.

  • Day 0, clinical staff: specimen containers labeled with two patient identifiers and site; requisition completed with minimum necessary fields only; courier pickup logged with time and initials.
  • Day 0, provider: note completed same day, with all six documentation fields present.
  • Day 1, coder: reads the note, selects codes against current CPT instruction, queries the provider if technique or lesion count is unclear. Holds the claim rather than guessing.
  • Days 3–7, results staff: pathology report received through a monitored channel, matched to the specimen log, attached to the chart. Any specimen without a returned report within your defined window gets escalated.
  • Day 7, biller: claim submitted with documentation attached where the payer requires it.
  • Day 10, administrator: reconcile the specimen log against claims submitted and reports received. Gaps in that three-way match are your early warning for both revenue loss and lost specimens.

That reconciliation step is the one practices skip, and it is the one that catches a specimen never delivered, a report never filed, and a biopsy never billed.

What to Add to Your Next Risk Analysis

Biopsy workflow touches paper, courier hand-offs, fax, portals, and at least three vendors. Your risk analysis should reflect all of it, not just your EHR.

Add these items specifically: the specimen log and where it is stored; the requisition form and its data fields; every courier and lab relationship with the BAA status noted; the results-delivery channel and its access controls; and any coding or billing contractor, including their subcontractors. HHS's proposed Security Rule overhaul, published for comment in January 2025, would tighten asset inventory and vendor verification expectations if finalized — practices that already maintain a current vendor inventory will have far less work ahead of them.

If your documentation set is stale or was assembled ad hoc, tools that automate risk analysis reports and the supporting policy set will get you to a defensible baseline faster than rebuilding from templates. And if the specific gap you identified today is a missing agreement with a courier, lab, or billing vendor, produce the BAA and get it signed this week rather than adding it to a list you will revisit in July.

The coding side of the cpt code for punch biopsy of skin is a documentation discipline. The privacy side is a vendor discipline. Both fail quietly, and both get expensive at exactly the moment someone outside your practice asks to see the file.