Three specimen containers leave your treatment room at 4:40 p.m. on a Friday. Each carries a patient label, a lesion site, and a working diagnosis. By Monday, those specimens have passed through a courier, a dermatopathology lab, a lab information system, a results interface, and your billing clearinghouse — and your practice has to answer for every one of those handoffs.

This guide is for the administrator, biller, or privacy officer who owns that chain. It covers how practices determine and document the CPT code for skin biopsy services, what the record has to carry to survive a payer audit, and the vendor and records-handling obligations that ride along with every specimen you send out. It is administrative guidance, not clinical guidance. Nobody here is telling a clinician what to do with a lesion.

The Code Family Your Billers Are Working From

The CPT skin biopsy code set was restructured effective January 1, 2019, replacing the old single-code approach with three technique-based families. That structure is still what your team works from:

  • Tangential biopsy — 11102 for the first lesion, 11103 as an add-on for each separate additional lesion.
  • Punch biopsy — 11104 for the first lesion, 11105 as an add-on for each separate additional lesion.
  • Incisional biopsy — 11106 for the first lesion, 11107 as an add-on for each separate additional lesion.

Every family follows the same primary-plus-add-on architecture. The add-on codes never stand alone; they attach to a primary code from the same or another family in the set. Your coders are matching documented technique to a code, not guessing from a lesion description.

What the Note Has to Say Before a Coder Can Do Anything

Build your template so the clinician's note captures four things without the coder having to interpret:

  1. Technique actually performed — the specific method used, stated in the operative or procedure note in the clinician's own words.
  2. Anatomic site of each lesion — distinct, specific, and consistent with the specimen label and the requisition.
  3. Number of separate lesions sampled — counted individually, not summarized as "multiple lesions biopsied."
  4. Intent of the procedure — sampling for diagnosis versus removal of the lesion. CPT guidelines treat these differently, and the note is where that distinction lives.

When your template forces a free-text blob, coders start inferring. Inference is what gets recouped. Make technique and lesion count discrete fields.

Which CPT Code for Skin Biopsy Applies When Multiple Lesions Are Sampled?

When more than one lesion is biopsied at the same encounter, CPT instructs that you report one primary code for the biopsy of the highest-complexity technique performed, then report the appropriate add-on code once for each separate additional lesion sampled — using the add-on that matches the technique used on that lesion. The hierarchy runs incisional, then punch, then tangential. Documentation must identify each lesion by distinct anatomic site.

Where This Goes Wrong in Practice

Two failure modes account for most of the denials we see practices chase:

Stacking primaries. A biller reports the primary code twice with a quantity of two instead of using the add-on. The claim edits out, the appeal takes three weeks, and the AR ages.

Biopsy billed alongside a removal at the same site. CPT guidelines address when a biopsy is separately reportable versus included in a more extensive procedure on the same lesion. Your coders should be applying those guidelines against the documented note, and checking the Medicare National Correct Coding Initiative edits before the claim goes out. CMS publishes the current edit files and policy manual at cms.gov. Modifier use to override an edit needs a documented reason in the chart, not a habit in the billing module.

The Requisition Is a Disclosure, Not Paperwork

Here is the part most billing-focused guides skip. Every skin biopsy you send out generates a disclosure of protected health information to an outside entity, and that disclosure is governed by the same rules as any other.

A typical dermatopathology requisition carries patient name, date of birth, medical record number, insurance identifiers, anatomic site, clinical impression, and sometimes a photograph. That is a rich PHI packet leaving your building in a courier bag. Treatment, payment, and health care operations permit the disclosure — but the minimum necessary standard still shapes how much clinical history you attach, and your business associate obligations still apply to everyone who touches it.

Count the Entities That Touch One Specimen

Walk one biopsy end to end and list every organization involved. A representative chain:

  • Your EHR or practice management vendor (creates the order and requisition)
  • The label printer or specimen-tracking software, if separate
  • The courier or shipping service that transports the container
  • The dermatopathology laboratory
  • Any reference lab the pathology lab sends specialized stains to
  • The interface engine or HIE that returns the result
  • Your billing company, if coding is outsourced
  • Your clearinghouse
  • Any document imaging or fax-to-email service that receives the printed report

That is nine vendors for one lesion. Pull your executed business associate agreements and see how many of the nine you can produce a signed BAA for in under ten minutes. In most practices the answer is five or six. The courier and the fax-to-email service are the two that go missing most often.

The BAA Gaps a Biopsy Workflow Exposes

Couriers are the classic blind spot. Practices treat transport as a logistics expense rather than a PHI handoff, and the contract that gets signed is a service agreement with no HIPAA language in it. If the courier's driver leaves a bag in an unlocked vehicle, you are explaining an unsecured disclosure with no agreement in place to allocate anything.

The second gap is the pathology lab relationship itself. Many labs are covered entities in their own right and will argue that a provider-to-provider treatment disclosure needs no BAA. That is often correct for the treatment relationship — and irrelevant to the arrangement where the same lab handles your billing data, hosts a results portal you use, or provides you a courier under its own contract. Read what the lab actually does for you, not what its category label suggests.

The third gap is the photograph. If your clinician documents lesion sites with a phone camera and the image lands anywhere other than the EHR, you have created an uncontrolled PHI repository. Written policy, enrolled devices, and no personal cloud backup. Verify it — do not assume it.

When you find a gap, close it with a real agreement rather than an email promise. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX for the courier, the imaging service, or the billing partner you just discovered has no paper. One-time purchase, no subscription — which matters when you are papering six small vendors at once and not one large one.

Pathology Results and the Access Clock

The pathology report is part of the designated record set. When a patient asks for it, the HIPAA right of access applies: you must act on the request within 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the expected date. HHS guidance on the scope, format, and fee limits of that right is at hhs.gov.

Two operational traps here.

"The lab has it, not us." If the report is in your chart, it is yours to produce. Routing the patient back to the laboratory is a delay you own.

Holding results pending a call-back. Under the information blocking rules, delaying a patient's electronic access to results so a clinician can call first requires an applicable exception — a generalized practice policy of holding all pathology results is not one. Review the exceptions framework at healthit.gov and decide, in writing, what your release timing is and which exception supports it. Then train the front desk on the answer, because they field the call.

The Appeal Trail Is a Second PHI Trail

When a claim for a biopsy code denies, someone in your office pulls the note and sends it to the payer. That is a payment disclosure — permitted, and still subject to minimum necessary.

Send the procedure note and the pathology report the payer requested. Do not send the entire chart because it was easier to export. "We sent everything to be safe" is not a defensible position; it is an over-disclosure you documented yourself.

Assign this explicitly. In most practices the appeals writer is a biller with broad EHR permissions and no training on scope limits. Give that role a one-page rule: pull the specific encounter, redact unrelated encounters, log the disclosure, and use the secure payer portal rather than fax when a portal exists.

A One-Hour Audit You Can Run This Quarter

Pick ten skin biopsy claims from the last 90 days and check:

  1. Does the note name the technique in the clinician's words, or did a coder infer it from a template default?
  2. Is each lesion identified by a distinct anatomic site in the note, the specimen label, and the requisition — and do all three match?
  3. When more than one lesion was sampled, did the claim use add-on codes rather than repeated primaries?
  4. Where a modifier overrode an edit, is the supporting documentation in the chart or only in the billing note?
  5. Which vendors touched the specimen and the claim, and is there a signed BAA for each?
  6. How long did each pathology result sit before the patient could see it, and under what written policy?
  7. Did anyone photograph a lesion, and where did that image come to rest?
  8. Who at the practice sent records to a payer on these claims, and what did they send?
  9. Are lab portal accounts still active for staff who left?
  10. Is the courier's contract a service agreement or a business associate agreement?

Ten claims will surface your systemic problems. If the same failure shows up three times, it is a workflow defect, not a person.

Where Coding Discipline and Privacy Discipline Meet

Selecting the right CPT code for skin biopsy work and controlling the PHI that biopsy generates are the same discipline applied at two points in the same workflow. Both depend on the note being specific, the sites being matched across three systems, and every downstream party being under a written agreement.

If your vendor inventory turned up gaps during that audit, fix the paper first — a business associate agreement you can generate, review, and send for signature the same afternoon costs less than the first hour of a breach investigation. Then work outward to the rest of the file: risk analysis, written policies, and the workforce training log. Practices that want that documentation set assembled rather than drafted from scratch can build it through automated HIPAA risk analysis and policy generation.

Start with ten claims and nine vendors. That is a real afternoon's work, and it tells you exactly where your biopsy workflow leaks.