A Tuesday morning lesion removal in your procedure room will touch at least five outside parties before the claim pays: a specimen courier, a reference pathology lab, your coding contractor or billing company, a clearinghouse, and eventually the payer's medical review unit. Every one of those handoffs carries the patient's name, date of birth, body site, and diagnosis. The excisional biopsy CPT code your biller submits is the small end of a very long PHI chain, and you are the person who has to prove that chain was papered correctly.

This guide is for practice administrators, billing leads, and privacy officers. It covers how code selection gets determined and documented as an administrative matter, then makes the records-handling and vendor obligations explicit. It is not clinical guidance and it does not tell you which code fits a given case.

Why There Is No Single Excisional Biopsy CPT Code

Administrators frequently ask for "the" code. There isn't one. CPT organizes these services by anatomic site, technique, and what was actually removed, which means the correct family depends on documentation your coder reads after the fact.

The families your staff will most often encounter:

  • Skin biopsy codes (11102–11107) describe tangential, punch, and incisional biopsy techniques. CPT guidelines for this range address how removal of an entire lesion is handled differently from sampling.
  • Skin lesion excision codes (11400–11446 for benign, 11600–11646 for malignant) are organized by anatomic location and by lesion diameter plus margins.
  • Lymph node biopsy and excision codes (38500–38530 open, 38570–38572 laparoscopic) distinguish superficial from deep and by node region.
  • Breast biopsy and excision codes (19081–19126) distinguish percutaneous from open, and image-guided from not, including cases involving preoperative marker placement.

Your job is not to arbitrate between them. Your job is to make sure the note contains the facts a coder needs, and that the coder's reasoning is recorded somewhere auditable. CMS publishes the National Correct Coding Initiative edits and policy manual, which governs how these services bundle with closures, biopsies of adjacent sites, and same-day office visits. Payer-specific policy layers on top of that.

No. There is no single excisional biopsy CPT code. Code selection depends on the anatomic site, whether the lesion was sampled or removed in full, the measured size including margins, the pathology finding, and any imaging guidance used. Skin, lymph node, and breast excisional biopsies fall into entirely separate CPT ranges. Practices determine the code by matching the operative note against current CPT guidelines, NCCI edits, and the payer's policy, then documenting that rationale in the encounter record.

The Six Facts Your Coder Needs Before Anything Is Assigned

Build these into your procedure note template so the coder never has to guess or send a query. Queries cost you days and generate extra copies of PHI in email.

  1. Anatomic site, stated specifically — "left forearm, dorsal" not "arm." Laterality drives modifiers.
  2. Lesion size and margin width, measured before removal — recorded in centimeters, with the measurement documented as pre-excision.
  3. Technique — what instrument, what depth, whether the full lesion or a portion was taken.
  4. Closure performed — simple, intermediate, or complex, and by layer, because closure bundling rules differ across code families.
  5. Number and location of separate lesions — each with its own measurement, so multiple-procedure sequencing is defensible.
  6. Imaging or marker use — documented with the guidance modality named.

Who Measures, and When

Assign this in writing. In most practices the clinician measures and states the number aloud; a medical assistant records it on the specimen log at the same moment the container is labeled. If your workflow lets the measurement get reconstructed later from the pathology report, you have two problems: a coding accuracy problem, and a records-integrity problem you will have to explain if a payer audits or a patient requests an amendment.

Post-excision specimen dimensions are not the same as the pre-excision measurement. Your template should label the field explicitly so no one confuses the two.

Five Handoffs Between Specimen Cup and Paid Claim

Map these for your own practice. Most administrators discover at least one handoff they had never documented.

1. The specimen label. Two patient identifiers plus site and laterality, sitting in a container on a counter. This is PHI in a physical, walk-away form. Your minimum necessary analysis applies to who can see the log book and where the transport bag waits for pickup.

2. The courier. A courier moving labeled specimens is handling PHI on your behalf. Whether the courier is engaged by you or by the lab determines whose business associate it is — and if nobody can answer that question in your office, that is your gap to close.

3. The pathology lab. A reference lab acting as a provider receiving a specimen for diagnosis is engaged in treatment, and treatment disclosures between covered entities do not require a business associate agreement. What the lab often also does is host a results portal, provide interface services, or perform billing functions — and those roles may put you back in BAA territory. Read the lab's service agreement rather than assuming.

4. The coder or billing company. An outside coding contractor, offshore coding vendor, or full-service billing company is a business associate, full stop. So is the transcriptionist and the scribe platform that produced the note.

5. The clearinghouse. A clearinghouse is a business associate when it handles PHI on your behalf, and HHS says so plainly in its business associate guidance.

If you cannot produce a signed, current agreement for each business associate in that chain within ten minutes, fix that before you touch anything else in this article. A one-time signature-ready Business Associate Agreement generator walks through a six-step wizard and exports PDF and DOCX, which is usually faster than chasing a vendor's outdated template through three rounds of legal edits.

The Pathology Report Becomes Your Record the Moment It Lands

A path report from an outside lab, filed into your chart, is part of your designated record set. When the patient asks for it, your 30-day clock runs — not the lab's. OCR's right of access guidance is explicit that the source of the information does not matter; what matters is that you maintain it.

Patients also have a separate, direct right to request lab reports from the lab itself under the 2014 HIPAA and CLIA amendments. Train your front desk to stop saying "you have to get that from the lab." That sentence is a right-of-access complaint waiting to be filed, and access complaints remain one of the most common categories OCR resolves. You can see the pattern of reported incidents on the OCR breach portal.

Photographs, Lesion Maps, and Body Diagrams

Clinical photographs taken for lesion tracking are PHI, and if you use them to make care decisions they belong in the designated record set. The operational failures here are consistent and predictable:

  • Photos taken on a personal phone "just for the record" and never deleted from the camera roll.
  • Images stored in a folder outside the EHR that nobody includes when fulfilling a records request.
  • Body-diagram annotations kept on paper in a procedure binder that never gets scanned.

Decide where images live, put it in policy, and make your release-of-information staff check that location on every request. A records response that omits half the imaging is an incomplete response.

Holding Results Until the Clinician Calls

Many practices still suppress pathology results in the portal until a clinician has spoken to the patient. Under the information blocking rules, a delay like that needs to fit a recognized exception, and the preventing-harm exception is narrower than most staff assume. Review your portal release settings against ASTP/ONC's information blocking guidance and write down which exception, if any, you are relying on. A blanket 72-hour hold applied to every result is hard to defend.

When the Report Is Corrected and the Claim Has to Change

Amended pathology reports happen. When one arrives, three things must move together:

  1. Records: the corrected report is filed alongside the original, not instead of it. Do not overwrite. Retain both with timestamps.
  2. Billing: if the finding changes which code family applies, your biller documents the rebill or corrected claim with a reference to the amended report date.
  3. Disclosure log: if you already released the superseded report to a specialist, a payer, or the patient, note it. Patients may request that you notify prior recipients of an amendment.

Rebilling after a corrected report is normal. Rebilling with no documented reason is what triggers questions. Keep the reason in the claim note, and keep it short and factual.

Minimum Necessary When the Payer Asks for the Chart

Payer medical review requests are where practices over-disclose. A request for documentation supporting one excisional biopsy CPT code does not entitle the payer to the full chart, and your release staff should not default to "send everything." HHS's minimum necessary guidance applies to payment disclosures.

Give your ROI staff a standing scope for these requests: the procedure note, the pathology report, the relevant office note, and the imaging report if guidance was used. Anything beyond that gets a second set of eyes.

A 30-Day Cleanup Plan You Can Actually Assign

Week 1 — Billing lead. Pull twenty recent excision and biopsy claims. Confirm each has a documented pre-excision measurement, a specific site with laterality, and a coder note explaining the code family selected. Log the misses; do not rewrite the notes.

Week 2 — Privacy officer. Build the handoff map: label, courier, lab, coder, clearinghouse. Name the responsible party for each and attach the signed BAA or the treatment-disclosure rationale. Blanks become a task list.

Week 3 — Front desk supervisor. Script the response to "can I get my biopsy results." Include the 30-day timeline, the fee policy, and the instruction never to redirect a patient to the lab as a substitute for your own obligation.

Week 4 — Administrator. Locate every place clinical photographs live. Consolidate or document. Update your risk analysis to reflect the specimen and imaging workflows, using NIST SP 800-66r2 as your structure if you need one. If you would rather not build that document from scratch, tooling that automates the risk analysis and policy set will get you to a reviewable draft faster than a blank template will.

Close the Vendor Gap First

Coding accuracy is recoverable. You can rebill, you can query, you can educate. An unpapered vendor relationship that has been moving specimen data for two years is not recoverable retroactively — you can only sign the agreement going forward and document when you found the gap.

Start with the courier and the coding contractor, since those are the two most often missing. If you need a defensible agreement today rather than next quarter, generate a Business Associate Agreement you can send for signature and get it out of your inbox before the next specimen pickup.