A commercial payer denies eleven claims from your Tuesday therapy panel in a single remittance batch. The reason code points at time documentation. Your biller wants the clinicians to "just add start and stop times," your clinical director wants to know why billing is reading session notes at all, and you have a records request from that same payer sitting in the fax queue asking for supporting documentation on four of the eleven.

That is the actual job. Mental health CPT codes sit at the intersection of revenue and privacy, and in a behavioral health practice the privacy side bites harder than it does in orthopedics. This guide covers the operational mechanics — who selects codes, what gets documented, what timelines apply — and then makes the records-handling and vendor implications explicit. It is written for administrators and billing staff, not clinicians, and it is not clinical guidance about which code fits which patient.

The Code Families Your Billing Desk Actually Touches

You do not need to know behavioral health coding the way a coder does. You need to know which families exist so you can build edits, route denials, and recognize when a claim line reveals more than it should.

Diagnostic evaluation

Two descriptors cover the intake visit: one for psychiatric diagnostic evaluation without medical services (90791) and one that includes medical services (90792). The distinction turns on the rendering provider's scope and what the documentation shows. Your front desk should never be the party guessing which one goes on the encounter.

Time-based psychotherapy

Individual psychotherapy is reported by time: 90832, 90834, and 90837, with published time ranges that determine which one applies. When psychotherapy is furnished on the same day as an evaluation and management service by the same provider, the add-on codes 90833, 90836, and 90838 come into play alongside the E/M level.

Because these are time-defined, the documentation requirement is not optional narrative — it is a measurable fact in the chart. That single reality drives most behavioral health denials you will ever work.

Crisis, family, and group

Psychotherapy for crisis uses 90839 for the first block of time and 90840 as an add-on for each additional increment. Family psychotherapy is split between a code for sessions without the patient present (90846) and one with the patient present (90847). Group psychotherapy is 90853. Interactive complexity, 90785, is an add-on layered onto certain services.

Testing, assessment, and integrated care

Psychological and neuropsychological testing runs through the 96130–96146 range, split between professional evaluation services, test administration by a professional, administration by a technician, and automated instruments. Health behavior assessment and intervention services occupy 96156 and the 96158–96171 range. Collaborative care management uses 99492, 99493, and 99494, with general behavioral health integration at 99484. Brief emotional and behavioral screening is 96127.

CPT is maintained and updated annually by the American Medical Association. Verify descriptors and time ranges against the current codebook every January rather than against last year's cheat sheet taped to the billing monitor.

What Are the Most Common Mental Health CPT Codes?

The codes most behavioral health practices submit in volume are:

  • 90791 / 90792 — psychiatric diagnostic evaluation, without and with medical services
  • 90832 / 90834 / 90837 — individual psychotherapy, reported by time
  • 90833 / 90836 / 90838 — psychotherapy add-ons billed with an E/M service
  • 90846 / 90847 — family psychotherapy without and with the patient present
  • 90853 — group psychotherapy
  • 90839 / 90840 — psychotherapy for crisis, base and add-on
  • 90785 — interactive complexity add-on
  • 96130–96139 — psychological and neuropsychological testing services

Which code applies to a given encounter is determined by the rendering clinician based on the service actually furnished and documented. Administrative staff verify that documentation supports the code submitted; they do not select it.

Who Does What: Role Assignment That Survives an Audit

Write this down as policy, because "the biller changed it" is a finding you do not want in a payer audit or an OIG-style review.

  1. Rendering clinician selects the code and documents the elements the descriptor requires, including start and stop times where the code is time-defined.
  2. Billing staff verify the claim matches the note, check modifier and place-of-service logic, and route mismatches back to the clinician as a query. They do not change codes unilaterally.
  3. Practice administrator owns the denial queue, the payer-specific rules file, and the annual CPT update walkthrough.
  4. Privacy officer owns disclosure logging, the minimum-necessary standard applied to payer document requests, and the vendor inventory.

Run a monthly sample audit: ten encounters per rendering provider, pulled at random, checked for documentation-to-claim agreement. Thirty minutes. Log the result. A practice that can produce twelve months of audit logs is in a materially different position than one that cannot.

Psychotherapy Notes Are Not the Chart — and Not What You Bill From

This is the distinction that behavioral health practices get wrong most often, and it maps directly onto coding operations.

Under the Privacy Rule, "psychotherapy notes" means the clinician's notes documenting or analyzing the contents of a counseling session, maintained separately from the rest of the record. The definition explicitly excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.

Read that exclusion list again. Every element your coders and billers rely on to support mental health CPT codes is expressly outside the psychotherapy-notes protection. Session times, modality, frequency, diagnosis — that is ordinary PHI in the designated record set.

Two operational consequences follow. First, if psychotherapy notes are not physically or logically separated in your system, they lose the special status and the heightened authorization requirement that attaches to them. Second, your billing team does not need access to psychotherapy notes to do its job, and your access controls should reflect that. HHS maintains guidance on HIPAA and mental health information that spells out how these provisions interact.

The access-request wrinkle

Patients have a right of access to their designated record set, generally within 30 days of the request, with one 30-day extension available if you notify them in writing of the reason and the new date. Psychotherapy notes are the narrow carve-out — they are excluded from the access right. Billing records, claim history, and the coded encounter data are not. HHS publishes detailed individual right of access guidance that your records clerk should have bookmarked.

Train the front desk on one sentence: a request for "my therapy records" is a request you route to the privacy officer, not one you fill from the printer at the desk.

Where Mental Health CPT Codes Leak

A CPT code on a claim line is a diagnosis-adjacent disclosure. "90853" on a statement tells anyone who opens the envelope that group psychotherapy happened. Map every place that code travels.

  • Clearinghouse — every claim, every code, every patient
  • Billing company or RCM vendor — often with direct EHR access
  • Eligibility and benefits check tools — frequently overlooked in vendor inventories
  • Statement and patient-communication vendors — print-and-mail, SMS reminders, payment portals
  • Coding consultants and outsourced auditors
  • Telehealth platform and any AI scribe or transcription service
  • Collections agencies
  • Analytics, ad, or chat scripts on a scheduling page — these transmit before anyone signs anything

Each of the first seven is a business associate. Each needs a signed agreement in place before PHI moves, and each needs to appear on a list you can produce on demand. If your inventory lives in someone's memory or in an email thread from 2022, fix that first. Practices that need to close gaps quickly can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, which matters when you are papering six vendors in a week.

Confidential communications and the wrong envelope

Patients may request that you communicate with them by alternative means or at alternative locations, and you must accommodate reasonable requests. In behavioral health this is not a formality. A statement listing psychotherapy codes mailed to a shared household address, or an explanation of benefits routed to a policyholder who is not the patient, produces the complaint you will spend a month answering.

Build the accommodation flag into registration, make it visible to your statement vendor's data feed, and test it once a quarter with a live sample.

The February 16, 2026 Part 2 Deadline Sitting on Your Calendar

If any part of your organization meets the definition of a federally assisted substance use disorder program, 42 CFR Part 2 applies on top of HIPAA. The 2024 final rule aligning Part 2 more closely with HIPAA carries a compliance date of February 16, 2026. You have weeks, not quarters.

Operationally, that means revisiting your consent forms, your notice of privacy practices, your breach notification workflow, and — critically for this article — the way SUD-related encounter data flows to billing vendors and clearinghouses. Many integrated behavioral health practices assumed Part 2 did not touch them because SUD treatment is a small share of visits. Confirm that assumption with counsel rather than with a hallway conversation.

Payer Documentation Requests: Send Less Than They Ask For

When a payer requests records to support a psychotherapy claim, the request often reads broadly: "all records for dates of service." Minimum necessary still applies to disclosures for payment purposes.

Set a standard response packet: the encounter note supporting the coded service, the treatment plan summary, and the time documentation. Not the full chart. Not psychotherapy notes — which require patient authorization for most disclosures, including to payers. Log every disclosure so you can answer an accounting request without reconstructing a year of faxes.

Assign one person to own payer records requests. Two people sharing that queue is how a full chart goes out the door on a Friday afternoon.

Telehealth Coding and the Privacy Questions That Ride Along

Behavioral health carries the heaviest telehealth volume of any specialty, and the billing mechanics change more often than any other area. Place of service codes distinguishing the patient's home from other originating sites, and modifiers indicating audio-only versus audio-video, are payer-specific and shift with each rulemaking cycle. Check the current-year CMS Physician Fee Schedule materials rather than relying on institutional memory, and keep a per-payer rules file your billers actually update.

The privacy side: confirm your platform is covered by a business associate agreement, confirm session recording is off by default, and confirm your waiting-room configuration does not display other patients' names. Ask your vendor in writing whether session content or metadata is used for model training. Get the answer in the contract, not in a support ticket.

Your Next Two Weeks

Pull your vendor list and mark every entity that receives claim data containing mental health CPT codes. Confirm a signed BAA exists for each. Confirm your psychotherapy notes are stored separately from the designated record set, and that billing roles cannot open them. Run one ten-chart documentation audit per provider and file the result. Put the February 16 Part 2 date on the calendar with an owner's name next to it.

If the vendor review turns up missing paperwork, build the agreements you need in a single sitting and get them signed before the next claim batch goes out. If the gaps run wider than contracts — risk analysis, policies, the full document set — automate the compliance documentation rather than rebuilding it from templates each year. Neither is a certification, because no such government credential exists; both are the paperwork you will be asked to produce when someone asks how mental health CPT codes and the data behind them are protected in your practice.