A billing lead at a four-provider behavioral health group appends modifier 93 to 137 claims in a quarter. Every one pays. Eight months later a payer audit lands, and the request is not for the claims — it's for the chart notes behind them. Six notes say nothing about whether the visit was audio, video, or in person. Those six get recouped, and the extrapolation letter follows.

This is a practice-operations guide to modifier 93: what it signals, what documentation has to exist before your biller uses it, and — the part most practices miss — how audio-only telehealth quietly moves your phone system, voicemail platform, and transcription vendor into HIPAA scope.

What Modifier 93 Signals on a Claim

Modifier 93 is a CPT modifier the AMA added effective January 1, 2022, to identify a synchronous telemedicine service delivered through a real-time, interactive audio-only telecommunications system. It went live alongside the expansion of place-of-service codes 02 and 10 for telehealth.

Operationally, the modifier does one job: it tells the payer the encounter happened in real time by voice, with no video component. It does not change what service was performed, and it does not by itself establish that a service is covered.

That distinction matters for your team. Your coders determine the base code from the documented service; the modifier describes the delivery method. Practices get into trouble when someone treats the modifier as a shortcut that makes an otherwise non-covered or under-documented encounter billable.

Modifier 93 vs. Modifier 95: The One-Line Difference

Modifier 93 identifies a synchronous telemedicine service delivered by real-time audio only — a telephone or equivalent voice connection. Modifier 95 identifies a synchronous telemedicine service delivered by real-time interactive audio and video. If the video feed never connected, or dropped and the encounter continued by voice, your documentation and your modifier should reflect audio-only. Medicare also recognizes HCPCS modifier FQ for audio-only behavioral health services; some payers want one, some want the other, and a few want both. Confirm per payer rather than standardizing across all of them.

The Five Data Points Your Note Needs Before Billing Modifier 93

Auditors do not challenge the modifier. They challenge the note that is supposed to support it. Build your template so these five elements are captured every time, without the clinician having to remember:

  1. Modality, stated explicitly. "Encounter conducted by telephone, audio only." Not "telehealth visit." Not "phone." If video was attempted and failed, say so and say why.
  2. Patient consent to the modality. Verbal consent is generally acceptable when documented, but it has to be documented in the note or in a consent record tied to the date of service.
  3. Patient location and practitioner location. This drives place-of-service selection and, separately, drives state licensure exposure when a patient answers the phone from a different state.
  4. Start and stop time, or total duration. Time-based codes make this mandatory. Even when the code isn't time-based, duration is the cheapest audit defense you will ever buy.
  5. Identity verification. How your staff confirmed they were speaking to the patient — two identifiers, callback to a number on file, whatever your policy specifies.

Assign ownership. The clinician documents 1, 3, and 4. The scheduler or intake staffer captures 2 and 5 at the top of the call and drops it into the note or the encounter record. Nobody bills until all five are present.

Your Phone System Became a Business Associate and Nobody Filed the Paperwork

Here is the part that has nothing to do with billing and everything to do with your risk register.

OCR's guidance on audio-only telehealth draws a line most administrators have never had to think about. PHI spoken over a traditional landline is not electronic protected health information, so the Security Rule does not reach it. The moment you move to VoIP, a smartphone app, a softphone in the browser, or any internet-based voice platform, you are transmitting ePHI and the Security Rule applies in full. HHS lays this out in its telehealth and HIPAA guidance.

Almost no practice runs on copper anymore. So ask the uncomfortable question: does your phone vendor have a signed BAA on file?

When the Telecom Vendor Is a Conduit and When It Isn't

A carrier that merely transmits the call — the conduit exception — does not become a business associate. But most modern voice platforms do considerably more than transmit:

  • Voicemail stored on the vendor's servers
  • Voicemail-to-text transcription
  • Call recording, including "quality assurance" recording nobody turned off
  • Call analytics that retain caller identity alongside the reason for the call
  • Ambient documentation or scribe tools attached to the voice channel
  • Integration that pushes call logs into your practice management system

Any one of those means the vendor creates, receives, maintains, or transmits PHI on your behalf. That is a business associate, and you need an executed agreement before the first audio-only visit — not after. If you're missing one, you can produce a signature-ready Business Associate Agreement in a few minutes rather than waiting three weeks on vendor legal.

The Three Vendors Practices Forget

When you inventory audio-only telehealth, do not stop at the phone system. Look for the transcription service your clinicians use to dictate after phone visits. Look for the call-center or answering service that triages after-hours calls and takes clinical detail. Look for any AI scribe or summarization tool listening to the line.

Each one gets a BAA, an entry on your vendor list, and a line in your risk analysis. If your vendor inventory is a spreadsheet somebody updated in 2023, this is the point where it stops being adequate.

The Enforcement Discretion Is Gone — Confirm Your Team Knows That

During the COVID-19 public health emergency, OCR exercised enforcement discretion for telehealth conducted over everyday communication platforms. That discretion ended, with a transition period that closed on August 9, 2023. There is no remaining grace period for using a non-compliant platform because it's convenient.

Practically, that means the personal cell phone a clinician uses to return patient calls from home is now a real control question: is caller ID blocked, is the number on file with the patient, are voicemails stored on a consumer cloud account, and does your policy address it? Write the answer down before someone asks you for it.

If you have not refreshed your Security Rule risk analysis since audio-only telehealth became routine, that gap is the most commonly cited failure in OCR corrective action agreements. You can see the pattern for yourself in the OCR breach portal, where the underlying facts repeat with dull consistency. Practices that need to close the gap quickly can generate a current risk analysis and the supporting policy set rather than rebuilding the documentation from scratch each year.

Coverage Rules Move Faster Than Your Fee Schedule

Medicare's broader telehealth flexibilities have been extended in short increments through a run of appropriations bills, and the expiration date has shifted more than once. Certain behavioral health services delivered to a patient at home have separate, more durable treatment, including allowances for audio-only when the patient cannot or will not use video — with documentation expectations attached.

Do not memorize a date. Build a verification cadence instead. Assign one person to check the CMS telehealth coverage page and your top five commercial payer policies on the first business day of each month, and to log the check with a date stamp. Ten minutes a month is cheaper than a recoupment.

Commercial payers vary widely on whether they accept modifier 93 at all, whether they require it paired with a specific place of service, and whether audio-only services pay at parity. Your payer matrix should have a column for it.

A 30-Day Rollout for a Practice Standardizing Audio-Only Billing

Days 1–5 — Inventory. The privacy officer lists every technology that touches a patient voice call: phone system, voicemail, transcription, answering service, recording, any AI tool. For each, record vendor name, whether PHI is stored, and BAA status.

Days 6–10 — Close BAA gaps. Send agreements to every vendor without one. Set a hard date; if a vendor won't sign, escalate to a replacement decision rather than letting it drift.

Days 11–15 — Fix the template. Your EHR administrator adds required fields for modality, consent, patient location, practitioner location, and duration. Make modality a required field, not free text.

Days 16–20 — Write the coding policy. Not a code list — a decision process. Who selects the modifier, what documentation must exist first, what happens when video fails mid-visit, and how payer-specific requirements get checked. Route it through your compliance lead.

Days 21–25 — Train by role. Front desk learns identity verification and consent scripting. Clinicians learn the documentation fields. Billing learns the payer matrix and the hold rule for incomplete notes. Log attendance.

Days 26–30 — Audit ten charts. Pull ten completed audio-only encounters at random. Score each against the five data points. Anything under 90% goes back to training, not to billing.

What This Looks Like in a Records Request

A patient asks for their complete record and you have 30 days under the Privacy Rule. If your phone platform stores call recordings or transcripts of clinical encounters, and your practice uses them to make decisions about that patient, you need a defensible answer about whether they sit in the designated record set.

Decide that in advance and write it into your policy. Deciding it under a 30-day clock, with a patient's attorney on the other end, is how practices end up producing either too much or too little.

The same logic applies to accounting of disclosures and to breach analysis. If your voice vendor suffers an incident, you need to know within hours whether it held PHI, how much, and for how long. That answer lives in the vendor inventory you built on days 1 through 5 — which is why the inventory matters more than the modifier.

The Short Version

Modifier 93 is an administrative flag, not a coverage guarantee. It requires documentation your template probably doesn't capture yet, and it makes your voice infrastructure part of your HIPAA footprint whether or not anyone wrote that down. Fix the template, close the BAAs, and put a monthly payer check on someone's calendar.

If your risk analysis, policies, and vendor documentation haven't been updated since audio-only visits became a standing part of your schedule, build the current compliance document set and start the vendor inventory from a complete baseline. It's the difference between answering an audit and reconstructing one.