It's Monday, 8:05 a.m. An electronic patient event notification lands in your inbox: an established patient was discharged from the hospital Friday evening at 6:40 p.m. Your two-business-day contact window is already burning, and if your billing team plans to report the higher-complexity transitional care management code, the face-to-face visit has to happen inside seven days of that discharge date.

This guide is for the person who owns that workflow — practice administrator, billing lead, compliance officer. It covers what the CPT hospital follow-up within 7 days requirement actually means administratively, who owns each step, and the records-handling and vendor obligations that come with pulling discharge data into your practice fast.

Which CPT Codes Cover Hospital Follow-Up Within 7 Days?

Transitional care management (TCM) is reported with two CPT codes, 99495 and 99496. Both cover a 30-day service period that begins on the date of discharge. The two codes are distinguished by the level of medical decision making documented by the billing practitioner and by how soon the face-to-face visit occurs:

  • 99495 — moderate complexity medical decision making; face-to-face visit within 14 days of discharge.
  • 99496 — high complexity medical decision making; face-to-face visit within 7 days of discharge.

Both codes also require interactive contact with the patient or caregiver within two business days of discharge, and medication reconciliation on or before the date of the face-to-face visit. The visit timing alone does not select the code — complexity is a clinical determination the treating practitioner documents. Your job on the administrative side is to make sure the calendar math, the contact attempts, and the documentation are all captured so the code the practitioner selects is supportable. CMS publishes the current requirements in its MLN fact sheet on Transitional Care Management Services; check it each year, because concurrent-billing rules and eligible discharge settings have shifted over time.

The Two Clocks, and Who Owns Each One

TCM fails operationally for one reason more than any other: nobody owns the clock. Assign each segment to a named role, not a department.

Day 0 — The Discharge Notification Arrives

Someone has to see the notification the same day it lands, including weekends when your practice is closed. Most practices learn about discharges through one of three channels: an electronic patient event notification feed from the hospital, a health information exchange query, or a phone call from the patient or a family member.

Hospitals subject to the Medicare Conditions of Participation are required to send electronic patient event notifications for admission, discharge, and transfer to established primary care practitioners and other identified recipients — see the CMS Interoperability and Patient Access fact sheet. If your practice is not receiving those notifications for your panel, that is a fixable intake problem, not a billing problem. Confirm the hospital has your correct routing endpoint and that your inbox is monitored by a role, not one person's login.

Owner: front-desk supervisor or care coordinator, with a named weekend backup. Document the date and time of receipt, because the two-business-day clock runs from discharge, not from when you noticed.

Days 1–2 — Interactive Contact

Interactive contact means a two-way exchange — telephone, secure message, or video — with the patient or caregiver. Unsuccessful attempts count toward your documentation only if you record them and keep trying until contact succeeds.

Build the log inside the chart, not on a spreadsheet. For each attempt, capture the date, time, staff member, method, and outcome. Two attempts to a disconnected number with no follow-up is the pattern that collapses under audit.

Days 1–7 — The Face-to-Face Visit

This is where the CPT hospital follow-up within 7 days timing gets operational. If your schedule has no same-week capacity, the seven-day option is theoretical. Practices that report the shorter-interval code reliably hold protected slots — typically two per day per practitioner — released to routine scheduling at 4 p.m. the prior business day.

Owner: scheduling lead. The instruction is specific: post-discharge patients go into a hold slot, and the slot is not backfilled by a routine physical.

Days 8–29 — Non-Face-to-Face Services and Close-Out

The 30-day period includes non-face-to-face work: reviewing the discharge summary and diagnostic results, coordinating with home health or community services, education, and follow-up with other treating clinicians. Assign a coordinator to close out the record on day 30 with a summary of services rendered.

One more scheduling rule your billers need to enforce: only one practitioner may report TCM for a patient per 30-day period. If your specialty group and the patient's primary care practice both start a TCM episode, one claim is going to be denied and both charts will look thin. Reconcile at intake, not after the denial.

Getting the Discharge Summary Without Over-Collecting

To do this work you need the discharge summary, the medication list at discharge, and pending results. You do not need the full inpatient record — every progress note, every imaging study, the behavioral health consult from a prior admission.

HIPAA permits disclosures between covered entities for treatment purposes without patient authorization, so the hospital can send you what you need. But the minimum necessary standard applies to what your practice requests. A standing request for "the complete record" on every discharge is a request your privacy officer should not sign off on.

Write a standing request template that names the documents: discharge summary, discharge medication list, pending labs and imaging, and consult notes relevant to the discharge diagnosis. Keep it in your policy binder with a date and a reviewer name.

What Lands in Your EHR vs. What Lands in Someone's Downloads Folder

Audit this. Hospital portals push PDFs; staff download them to a workstation to attach them to the chart. If those PDFs are still sitting in a local downloads folder or a shared network drive three months later, you have created an undocumented repository of inpatient records outside your EHR's audit controls.

Fix it with a written rule and a quarterly spot check: attach, then delete locally. Two workstations, five minutes, documented in your compliance log.

The Vendor List Behind a 7-Day Follow-Up Program

Most practices running TCM have more business associates in the loop than their BAA file reflects. Walk the workflow and name every entity that touches PHI:

  • Notification or HIE intermediary routing discharge events to you
  • Answering service or after-hours call center making or receiving contact attempts
  • Appointment reminder / SMS platform used for post-discharge outreach
  • Care management platform tracking the 30-day period, if it sits outside your EHR
  • Outsourced coding or billing company reviewing TCM documentation
  • Remote scribe or transcription service documenting the follow-up visit
  • Home health or community service partners — some are covered entities in their own right; others are contractors that need an agreement

Each business associate needs an executed agreement before PHI moves. If your file is missing one — the answering service is the usual culprit — you can produce a signature-ready Business Associate Agreement in an afternoon rather than waiting on a vendor's legal team to send their template back.

The Risk Analysis Question Nobody Asks Until an Audit

Adding a care management platform or a notification feed changes where your ePHI lives. That is a change to the scope of your security risk analysis, and the analysis is supposed to be updated when your environment changes — not annually by tradition. NIST's guidance on implementing the Security Rule, SP 800-66 Revision 2, is the practical reference for how to structure that work.

If your last risk analysis predates your TCM program, it does not describe your practice. Tools that generate an updated HIPAA risk analysis and the supporting policy set save you from rebuilding the document from scratch every time you add a vendor — which, in a follow-up program, is every few months.

Documentation That Survives Both an Audit and a Records Request

TCM documentation gets reviewed by two very different readers, and practices usually prepare for only one.

The payer reviewer wants the discharge date, evidence of interactive contact within two business days, the date of the face-to-face visit, medication reconciliation on or before that date, and documentation supporting the complexity level the practitioner selected.

The patient — or the patient's attorney — can request the same chart under the HIPAA right of access, and your practice generally has 30 days to respond. Review the HHS right of access guidance if you have not recently. Everything your coordinator wrote in the contact log is part of that record, including the note that reads "family difficult, would not stop talking."

Train coordinators to write contact logs the way they would write a chart note: factual, dated, no editorializing. That single habit reduces the friction in records requests more than any policy revision.

Five Failure Points I See in TCM Programs

  1. Voicemail content. Staff leave messages naming the hospital and the reason for the call on a number the practice has not verified. Limit voicemail to name of practice, callback number, and a request to call back.
  2. Texting from personal phones. A coordinator's cell used for a Saturday contact attempt puts PHI on an unmanaged device with no retention control. Route all outreach through practice systems.
  3. Shadow spreadsheets. The 30-day tracker in a shared cloud folder with link-sharing turned on. Move it into the EHR or into a system covered by a BAA and access controls.
  4. Notification feeds pointed at a departed employee. Discharge alerts routing to a deactivated mailbox means missed clocks and, worse, PHI sitting in an unmonitored account.
  5. Coding by calendar alone. Billing staff selecting the shorter-interval code because the visit happened on day six. Timing is a threshold, not a justification. The practitioner documents complexity; billing verifies the timing and the required elements.

A Worked Timeline

Composite example, details changed. Patient discharged Friday at 6:40 p.m. following an inpatient stay. Notification arrives in the shared care-coordination inbox at 6:52 p.m.

  • Monday 8:05 a.m. — Coordinator opens the notification, logs receipt, requests the discharge summary using the standing minimum-necessary template.
  • Monday 9:20 a.m. — First contact attempt, no answer. Logged with time and method.
  • Monday 2:10 p.m. — Contact made with the patient's daughter, who is the documented caregiver. Interactive contact requirement satisfied inside two business days.
  • Tuesday — Discharge summary and medication list received, attached to chart, local copy deleted. Visit scheduled into a protected slot for Wednesday.
  • Wednesday (day 5 from discharge) — Face-to-face visit. Medication reconciliation documented that day. Practitioner documents medical decision making and selects the code.
  • Days 6–30 — Coordination with home health, one lab follow-up, close-out note on day 30. Claim submitted after the 30-day period per current CMS guidance.

Every step in that timeline is a documentation artifact. Every artifact is also a record subject to access requests, retention rules, and your breach-response obligations if the system holding it is compromised.

What to Do This Week

Pull your last ten TCM claims. Check three things: was the discharge date captured from a source document, is there a timestamped contact log, and is every vendor in that workflow on your BAA list. If any answer is no, you have a documentation problem before you have a billing problem.

Then confirm your risk analysis and policy set actually describe the systems your follow-up program uses. If they don't, generate a current risk analysis and the matching policy documentation and put the review date in your compliance calendar. A well-run program that bills the CPT hospital follow-up within 7 days interval consistently touches more PHI, more vendors, and more records requests than the practice did a year ago — your paperwork should say so.