There is a bin behind your front desk. In it sits a stack of home health plans of care — some faxed, some hand-delivered by an agency liaison, all waiting for a signature. Every one of those documents represents a billable service under the G0180 CPT code, a set of Medicare documentation requirements your practice has to be able to reproduce on demand, and a pile of protected health information sitting in an open room.

This guide is for the person who owns that bin: the practice administrator, the billing lead, the privacy officer. It covers what G0180 pays for, who signs what, what an auditor will ask for, and which parts of the workflow quietly create HIPAA exposure. It is administrative guidance on process and documentation — not clinical guidance on when certification is appropriate. That determination belongs to the certifying practitioner.

What the G0180 CPT Code Covers

G0180 describes physician certification for Medicare-covered home health services under a home health plan of care, with the patient not present. The work it captures includes reviewing reports of patient status, contacts with the home health agency, and affirming that the initial plan of care meets the patient's needs. It is reported once per certification period — a 60-day episode — and only in connection with an initial certification, not a recertification.

One clarification your billing staff should internalize: G0180 is a HCPCS Level II code, not a CPT code. Everyone calls it the "G0180 CPT code" in conversation and in search bars, but on a claim it lives in the HCPCS G-series. That distinction matters when someone goes looking for it in a CPT book and cannot find it, then assumes the code is retired.

Three companion codes travel with it:

  • G0179 — recertification of the home health plan of care, reported per recertification period rather than per initial certification.
  • G0181 — home health care plan oversight, which carries a monthly time threshold and is a fundamentally different service from certification.
  • G0182 — hospice care plan oversight, also time-based.

Certification is a signature-and-review service. Care plan oversight is a cumulative-time service. Your billing staff should never treat them as interchangeable, and your documentation templates should not share a field.

Who Certifies: The CARES Act Changed Your Signature Roster

Physicians are no longer the only practitioners who can certify Medicare home health eligibility and sign a plan of care. Federal law expanded that authority to nurse practitioners, clinical nurse specialists, and physician assistants, subject to state scope-of-practice law and Medicare enrollment status.

That expansion is an operations problem before it is a billing problem. Your practice needs a written, current list of which practitioners are authorized to certify, whether their state license permits it, and whether their Medicare enrollment supports the claim. When a locum or a newly credentialed NP starts signing plans of care that nobody vetted, you find out during an audit rather than during onboarding.

The face-to-face encounter requirement

Home health certification depends on a documented face-to-face encounter related to the primary reason the patient needs home health, occurring within a defined window around the start of care — generally the 90 days before or the 30 days after. The encounter must be performed by the certifying practitioner or another permitted practitioner, and the documentation supporting it has to exist in the certifying practitioner's own medical record, not only in the agency's chart.

Assign one person to verify that the encounter note exists and is retrievable before the certification goes out the door. In most practices this is a clinical support staffer or the billing lead, not the practitioner. Build it into the same checklist that releases the signed plan of care back to the agency.

Routing a Plan of Care: A Five-Step Workflow That Survives an Audit

Here is the sequence that works in a busy practice. Adapt the role names; keep the sequence.

  1. Intake and log. Every plan of care that arrives — fax, portal, courier, agency liaison — gets logged the day it arrives with patient name, agency name, date received, and start-of-care date. No exceptions for "the rep will wait for it."
  2. Pre-signature verification. Support staff confirms the face-to-face encounter note exists, identifies whether this is an initial certification or a recertification, and pulls the prior episode history if any.
  3. Practitioner review and signature. The certifying practitioner reviews, signs, and dates the document. An undated signature is the single most common defect that turns a payable service into a repayment.
  4. Return and retain. The signed document goes back to the agency through a tracked channel, and a copy — or the scanned original — lands in the patient's chart in your system.
  5. Charge capture. Billing posts the appropriate certification code to the date of service your practice's policy specifies, with the supporting documentation already attached in the chart.

Notice that charge capture is last. Practices that bill first and reconcile documentation later generate exactly the pattern that draws a probe: consistent certification volume with inconsistent supporting records.

How Your Practice Determines Code Selection — and Documents the Choice

You are not deciding whether a patient qualifies for home health. You are building a process that lets the practitioner's determination be documented, coded consistently, and defended later.

A workable internal standard looks like this. Billing staff confirm from the record whether this is the patient's initial certification for the current spell of home health or a subsequent recertification period, and select between the certification and recertification codes on that factual basis. Where the record is ambiguous, the question goes back to the practitioner, not to a coder's judgment. Where a practitioner reports oversight time, the time documentation must stand on its own and cannot be inferred from the certification.

Payment amounts and coverage edits vary by Medicare Administrative Contractor and by year. Check the current values in the CMS Physician Fee Schedule and search your MAC's local coverage articles in the Medicare Coverage Database rather than relying on a figure someone wrote on a whiteboard in 2023.

The financial-relationship check

Certification sits inside a referral relationship. If any certifying practitioner in your practice has an ownership or compensation relationship with the home health agency, your compliance lead should have that documented and reviewed against federal self-referral and anti-kickback rules before a single G0180 claim goes out. Log agency relationships the same way you log vendor relationships.

The Home Health Agency Is Not Your Business Associate — Your Fax Vendor Is

Every quarter, some practice mails a Business Associate Agreement to a home health agency and waits for a signature that will never make sense. A Medicare-certified home health agency is a covered entity in its own right. When your practitioner and the agency exchange PHI to coordinate a plan of care, that is a disclosure for treatment — permitted without patient authorization and without a BAA. The minimum necessary standard does not restrict treatment disclosures either.

The business associates are the parties in between:

  • Your cloud fax or fax-to-email service, which stores images of plans of care on its servers
  • Your document imaging or scanning contractor
  • Your electronic signature platform, if it is yours rather than the agency's
  • Your outsourced billing company and any contract coders
  • Your answering service, if agency liaisons leave patient-identified messages
  • Your offsite record storage and shredding vendors

Pull your vendor list and match it against the certification workflow specifically. Most practices find at least one gap — usually the fax service, because it was set up by an office manager who left three years ago. HHS publishes sample business associate agreement provisions that show the required elements, and if you need a signature-ready document rather than a template to redline, you can generate a completed Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription — which matters when you are closing three vendor gaps at once and do not want another recurring line item.

Agency portals and the shared-login problem

Many agencies now push signatures through their own web portal. That is the agency's system, and PHI flowing into it for treatment purposes is fine. The failure mode is on your side: staff creating one shared login "for the office" so anyone can sign in and route documents, or — far worse — staff signing on the practitioner's behalf.

Shared credentials destroy the audit trail on both ends and violate your own access control policy. Signing for a practitioner is a fraud exposure, not just a policy issue. Require named accounts per user in every agency portal your practice touches, and audit the list when someone leaves.

Records Requests, Audits, and the Disclosure You Have to Account For

Certification documentation gets requested constantly — by the agency during its own survey, by MACs during probe-and-educate, by UPICs and RACs. Two separate obligations apply, and staff routinely blur them.

Disclosures to Medicare contractors for audit and program integrity purposes are health oversight disclosures. They are permitted without authorization, but unlike treatment, payment, and operations disclosures, they are generally subject to the accounting-of-disclosures requirement. If a patient later asks who received their records, your log needs to show it. Practices that track only patient-directed releases will not be able to answer.

Separately, the certification, the plan of care copy, and the face-to-face encounter note sit in the designated record set. When a patient requests them, the HIPAA right of access clock applies — thirty days, with one thirty-day extension available if you notify the patient in writing. Home health documents live in a hybrid state in most practices: partly in the EHR, partly in a scanned folder, partly in the agency portal. Map where each piece lives before someone requests it, not after.

Fax misdirection is still your most likely breach

Certification workflows run on fax volume between practices and agencies. Misdirected faxes remain one of the most reliable sources of small, embarrassing, reportable disclosures. Keep verified agency fax numbers in a controlled list rather than on sticky notes, require a cover sheet with a misdirect notice, confirm transmission receipts, and log any misfire to your privacy officer the same day. HHS's proposed Security Rule update, published for comment in early 2025, points toward tighter expectations for documented technical safeguards — a good reason to fix transmission practices now rather than during a rulemaking scramble.

When a Patient Calls About a Bill for a Visit That Never Happened

Certification is furnished with the patient not present. It is still a Part B physician service, so beneficiary cost-sharing generally applies. Patients receive a Medicare Summary Notice showing a charge on a date they never came in, and they call your front desk.

Give your front desk a scripted, non-clinical explanation: this charge covers the practitioner's review and certification of the home health plan of care, which Medicare requires before the agency can provide services. Route anything beyond that to billing. Do not let staff improvise medical explanations, and do not let them discuss the patient's home health services with a caller whose identity has not been verified.

A 30-Day Cleanup Plan

Week 1. Inventory every channel through which plans of care enter and leave the practice. Name an owner for each.

Week 2. Pull ten recent certification claims. Confirm each has a dated signature, a retrievable face-to-face encounter note, and correct initial-versus-recertification coding. Whatever error rate you find in ten is roughly what an auditor will find in fifty.

Week 3. Reconcile your vendor list against that channel inventory. Execute BAAs for anything unsigned. Kill every shared portal login.

Week 4. Update your accounting-of-disclosures log to capture health oversight requests, and confirm your right-of-access procedure names where home health documents are stored.

The G0180 CPT code is a small line on a claim and a disproportionately large operational surface. Close the vendor gaps first — a signature-ready BAA takes minutes and removes the finding that is easiest for a regulator to document. If your broader risk analysis and policy set are also overdue, automating the full compliance document set is the sensible next step after the paperwork on your desk is under control.