Your nurse practitioner saw nine patients in their residences last Tuesday. Six of those encounters produced a claim that your biller had to code from a handwritten note, a phone photo of a med list, and a voice memo recorded in a driveway. Two came back denied on place of service. One patient's daughter asked why a stranger was writing notes about her mother on a personal iPad.

That is the real shape of a house call program, and it is why home visit CPT codes are a practice-operations problem before they are a billing problem. This guide covers the code families, the documentation your payers and auditors expect, and the privacy and vendor exposure that opens the moment PHI leaves your four walls. It is written for administrators, billing leads, and privacy officers — not for clinicians choosing a code at the bedside.

Quick Answer: What Are the Home Visit CPT Codes?

CPT groups physician and qualified health professional home encounters under Home or Residence Services. The current families your coders work from are:

  • New patient home or residence E/M: 99341, 99342, 99344, 99345 (code 99343 was deleted effective January 1, 2023).
  • Established patient home or residence E/M: 99347, 99348, 99349, 99350.
  • Prolonged service add-ons: the CPT prolonged services add-on reported with the highest-level home visit code, and, for Medicare, the separate HCPCS G-code designated for prolonged home or residence services (G0318).
  • Home health procedures and services performed by non-physician staff: the 99500–99600 series, which covers items such as prenatal and postnatal home visits, stoma care, catheter care, and home ventilator management. Coverage for this series varies widely by payer, and several codes are not separately payable under Medicare.

The 2023 CPT revision folded the old domiciliary, rest home, and custodial care codes (the 99324–99328 and 99334–99337 ranges) into the Home or Residence Services family. If your encounter forms, superbills, or EHR favorites still list those deleted codes, you are generating denials on a schedule.

How Your Coders Determine the Level — and What They Need From the Field

Home visit E/M levels follow the same framework as other office and outpatient E/M services: the reported level is supported either by the level of medical decision making or by total time spent on the date of the encounter. Your coders should never work from a laminated card printed in 2021. They should work from the current CPT descriptors and the time thresholds published for each level in the current year's book.

Your job as an administrator is to make sure the note contains the raw material for either path.

Time capture that survives an audit

Total time on the date of the encounter can include reviewing records before the visit, the face-to-face portion, and post-visit documentation and coordination — but not travel. Practices routinely lose revenue here because clinicians record only the face-to-face minutes, and lose audits because they record a suspiciously round number for every patient.

Build a time field into the encounter template with start and stop entries, plus a short free-text line for pre- and post-visit work. Have your billing lead spot-check ten notes per clinician per month for times that are identical across a full day's route. Identical times are the pattern that draws payer attention.

Medical decision making documented in plain language

When the level rests on medical decision making, the note has to show the problems addressed, the data reviewed, and the risk involved. In the home, the data element is often the part that goes missing — the pill bottles counted on the kitchen counter, the glucometer log, the outside hospital discharge summary the daughter handed over. Those are reviewable data, and they exist only if someone writes them down.

Nothing in this guide tells you which code fits which patient. Level selection is a clinical and coding judgment made against the current CPT descriptors and your payer's policy. Your operational obligation is to make that judgment documentable, reviewable, and consistent.

Place of Service Is Where Home Visit Claims Actually Die

A correctly leveled home visit code on the wrong place of service is a denial. The residence is not one setting; it is at least five, and the distinction matters to payment.

  • POS 12 — Home
  • POS 13 — Assisted Living Facility
  • POS 14 — Group Home
  • POS 16 — Temporary Lodging
  • POS 33 — Custodial Care Facility
  • POS 04 — Homeless Shelter

CMS maintains the authoritative list in its place of service code set. Print it, post it, and require the field clinician to record the residence type in the note — not the biller to guess from the street address. An address in a building that houses both independent apartments and an assisted living wing will be coded wrong roughly half the time if you let the biller infer it.

Do not conflate a home visit with the Medicare home health benefit

This is the single most common misunderstanding I see in practices launching house calls. A physician or advanced practice clinician visiting a patient's residence and reporting a home visit E/M code is a distinct thing from the Medicare home health benefit, which involves agency services and a homebound determination. Certification and recertification of a home health plan of care are separately defined HCPCS services with their own documentation requirements.

Train your front desk to describe the service accurately when patients call. "A provider comes to your house" and "you qualify for home health" are different offers, and confusing them creates eligibility disputes your billing staff will inherit.

Why the visit happened at the residence

Payer medical review of home visits frequently focuses on why the encounter occurred in the residence rather than in your office. Build a required one-line field into the template: mobility limitation, cognitive impairment, oxygen dependence, no transportation, behavioral factors, wound that cannot travel. One sentence, patient-specific, every visit. Templated language repeated verbatim across a panel is worse than nothing.

The PHI Leaves the Building With Your Clinician

Here is where your privacy officer earns their title. Every home visit generates protected health information created, stored, and transmitted outside your controlled physical environment. Your Security Rule risk analysis has to reflect that, and most practices that add house calls never update it.

Walk the actual workflow and inventory the exposure points:

  • The laptop or tablet in the car, and whether it is encrypted at rest and configured to auto-lock.
  • The clinician's personal phone used for photos of wounds, med bottles, or a signature page.
  • The printed route sheet listing nine names, addresses, and chief complaints, sitting on the passenger seat.
  • The paper superbill or intake form carried back to the office in a bag.
  • Text messages between the clinician and the scheduler about patient access issues.
  • Cellular hotspots and, worse, the patient's own home Wi-Fi.

Device loss and theft remain a recurring category in the incidents posted to the OCR breach reporting portal, and mobile workflows concentrate that risk. HHS and ONC publish practical guidance on managing mobile devices in your practice that maps well onto a house call program. Encryption is not required by name in the Security Rule, but it is an addressable implementation specification, and an encrypted lost device generally avoids a reportable breach under the safe harbor. Undocumented decisions not to encrypt do not age well.

Incidental disclosures in someone else's living room

The kitchen is not an exam room. A spouse, an adult child, or a paid aide will be within earshot. The Privacy Rule tolerates incidental disclosures when you apply reasonable safeguards and the minimum necessary standard, and HHS explains the boundaries in its minimum necessary guidance.

Give clinicians a scripted question — "Are you comfortable discussing your care with your son in the room?" — and a field to record the answer. When a patient objects, that objection has to travel with the chart, because the next clinician on the route may be a different person entirely.

Vendor Additions That Quietly Require a BAA

House call programs pull in vendors your existing agreements never covered. Before your first billed home visit, audit the list:

  • The mobile documentation or route-optimization app the clinicians chose themselves.
  • The transcription or ambient scribe service used in the car after each stop.
  • The mobile diagnostic partner drawing labs or running portable imaging at the residence.
  • The answering service handling after-hours calls from homebound patients.
  • The billing company or coding contractor reviewing home visit CPT codes on your behalf.
  • The cloud storage bucket where wound photos land.
  • The courier moving specimens or paper forms.

Each of these creates, receives, maintains, or transmits PHI on your behalf. Each needs an executed business associate agreement in place before the data starts moving — not after the first invoice. If a vendor on that list is operating without one, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX the same afternoon. One-time purchase, no subscription, and it closes the gap faster than waiting on the vendor's legal team to send their version.

Two vendor traps specific to home visits. First, subcontractors: the mobile phlebotomy company may use independent contractors, and those contractors need downstream agreements. Ask. Second, the clinician's personal device — a BYOD phone is not a business associate, it is your workforce member's equipment holding your PHI, which means it belongs in your policies, your device inventory, and your remote-wipe capability, not in a contract.

A Worked Example: Tuesday's Route, Thursday's Claims

Assign the roles explicitly, or they land on whoever complains last.

  1. Monday, scheduler: builds the route, confirms residence type for each stop, flags any patient with a documented restriction on discussing care with family present. Route sheet is generated inside the EHR, not exported to a spreadsheet.
  2. Tuesday morning, clinician: encrypted tablet only. No personal-phone photography — images captured through the sanctioned app, which stores them in the chart rather than the camera roll.
  3. Tuesday, per encounter: records place of service, reason the visit occurred in the residence, start and stop times, pre- and post-visit work, and who else was present.
  4. Wednesday, coding lead: reviews each note against the current CPT descriptors, checks whether the level is supported by time or by medical decision making, and queries the clinician when neither path is documented. Queries go through the EHR, not email.
  5. Wednesday, billing lead: validates place of service against the residence type in the note, confirms no deleted domiciliary codes are in play, and checks whether a prolonged services add-on is supported and which add-on the payer recognizes.
  6. Thursday, claims out. Friday, privacy officer: reviews the week's device sync logs for any tablet that failed to check in, and any photo that landed outside the sanctioned app.

That last step takes fifteen minutes and is the one everybody skips.

The Quarterly Review That Keeps This Program Clean

Four things, every quarter, owned by a named person:

  • Code set refresh. Confirm your encounter templates and EHR favorites match the current year's home visit CPT codes and that no deleted codes remain selectable.
  • Payer policy check. Home visit coverage, frequency limits, and recognized add-on codes vary by payer and change annually. Pull each major payer's current policy and record the date you pulled it.
  • Device inventory reconciliation. Every tablet, laptop, and hotspot in the field, matched against your asset list, with encryption status confirmed.
  • Risk analysis update. A mobile workforce changes your threat picture. If your risk analysis and policy set still describe a single-site office practice, refresh them — automated tools that produce risk analysis reports and the supporting policy set will get you a defensible document faster than a blank Word file will.

Home visits are good medicine and good margin when the operational scaffolding holds. The scaffolding is boring: a place of service field that gets filled in, time entries that are not all identical, an encrypted tablet, and a signed agreement with every vendor whose software rides along in the car.

Start with the vendor list, because it is the gap with a documented enforcement history and the fastest one to close. Pull your house call vendors into one column, mark which have an executed agreement, and draft the missing BAAs before your next batch of claims goes out.