A payer holds sixty of your claims on a Tuesday morning. Same denial reason on every one: modality not supported by place of service. Your billing lead pulls three charts and finds the same pattern — the clinician saw the patient over video, the note says "telehealth visit," and nobody appended modifier 95 because the front-end template stopped populating it after the last EHR update.

This guide is for the person who has to fix that. It covers what modifier 95 signals to a payer, how practices build and document their modifier selection process, and — the part most billing articles skip — what appending that modifier reveals about the vendors sitting inside your telehealth workflow. Coding decisions belong to your coders and clinicians. Vendor decisions belong to you.

What Modifier 95 Is, in One Paragraph

Modifier 95 is a CPT modifier defined by the AMA as a synchronous telemedicine service rendered via a real-time interactive audio and video telecommunications system. Practices append it to an otherwise face-to-face service code to tell the payer that the encounter occurred in real time over both audio and video, with the patient and the practitioner in different physical locations. CPT identifies the codes eligible for synchronous telemedicine reporting in Appendix P. It is a modality flag, not a code that describes what was done — the underlying service code still carries that weight.

Modifier 95 Is Not the Only Telehealth Flag on Your Claims

Your billing staff are juggling at least four overlapping signals, and payers do not agree on which combination they want.

  • Place of service 02 — telehealth provided somewhere other than the patient's home.
  • Place of service 10 — telehealth provided in the patient's home.
  • Modifier 95 — synchronous audio and video.
  • Modifier 93 — synchronous audio-only.
  • HCPCS modifiers such as GT, GQ, FQ, and FR, which carry specific meanings for particular programs, settings, or supervision arrangements.

Some commercial payers want modifier 95 with the patient's usual place of service. Some want POS 10 and no modifier. Some want both and will deny if either is missing. Medicare's telehealth billing instructions have shifted repeatedly, and the statutory flexibilities that widened Medicare telehealth eligibility have been extended in short increments through a series of appropriations bills — which means your billing lead needs a recurring calendar reminder, not a one-time policy memo. Check the current state of play directly on the CMS Medicare telehealth page rather than relying on a payer rep's verbal assurance.

The 2025 CPT Telemedicine Codes Complicated This

CPT 2025 introduced a family of telemedicine evaluation and management codes in which the modality is baked into the code descriptor itself. Payer adoption has been uneven — some carriers accept them, others instructed practices to keep using traditional E/M codes with a modality flag. Do not let your coding staff assume alignment. Get each major payer's position in writing, date it, and store it where the billing team can find it during a denial appeal.

The Grid Your Billing Lead Should Maintain

Build a single spreadsheet, one row per payer, with these columns: accepted POS codes, required modifiers, audio-only policy, originating-site restrictions, effective date of the policy, source document URL, and date last verified. Assign one named person to re-verify the top ten payers quarterly. Practices that skip this step discover their gaps through denials, and denials arrive sixty days after the revenue was earned.

Documentation That Holds Up When a Payer Audits Modifier 95 Claims

A modality flag is an assertion. Payers audit assertions. The chart has to independently support that a real-time audio and video connection existed, and "telehealth visit" typed in a header does not do that.

Practices that survive telehealth audits generally capture, inside the encounter note itself:

  1. The modality actually used, stated affirmatively — real-time video and audio, audio-only, or in-person.
  2. The patient's physical location during the encounter and the practitioner's location.
  3. Confirmation that the patient consented to receive the service by telehealth, and where that consent is recorded.
  4. Identity verification of the patient at the start of the encounter.
  5. Start and stop times or total duration, when the service code depends on time.
  6. Anyone else present on either end — a family member, an interpreter, a supervising practitioner, a student.
  7. Any technical failure and what happened next, including a mid-visit drop from video to phone.

That seventh item is where practices lose money and take compliance hits simultaneously. If a visit starts on video and the connection fails, the modality changed. Your clinicians need a documented instruction on what to record and how to route that encounter to a coder for review. Your coders need authority to query. Your administrator needs to make sure nobody feels pressure to leave the video flag in place because the reimbursement is better.

Who Does What

Assign it explicitly. The clinician documents modality and locations. The coder selects the code and modifier based on documentation and the payer grid, and queries when documentation is ambiguous. The billing lead owns the payer grid and the denial trend report. The privacy officer owns the vendor inventory and the BAAs behind the platform. When those four roles collapse into one overworked office manager, something falls out — usually the vendor piece, because it produces no daily alarm.

Every Modifier 95 Claim Points Back to a Vendor You Must Have Under Contract

Here is the operational link most billing guidance ignores. Appending modifier 95 to a claim is a written representation, submitted to a payer, that protected health information moved across a real-time audio and video system. That system belongs to a vendor. That vendor creates, receives, maintains, or transmits PHI on your behalf. That makes it a business associate, and it needs a signed business associate agreement on file before the first visit — not after the first denial.

The OCR Notification of Enforcement Discretion that let practices use non-public-facing consumer video apps during the COVID-19 public health emergency ended in August 2023. There is no remaining grace period. HHS maintains telehealth-specific HIPAA guidance that spells out the expectation plainly: covered health care providers using remote communication technologies to provide telehealth must comply with the Privacy, Security, and Breach Notification Rules, and vendors that handle PHI in that arrangement require agreements.

Pull your claim data and run this test. Filter twelve months of claims for modifier 95. Identify every distinct platform your clinicians used to generate those encounters. Now match that list against your executed BAAs. In most practices the mismatch is not the primary telehealth platform — it is the specialist who used something else for two months in 2024, the after-hours coverage arrangement, the interpreter service dialed in over a separate bridge, or the scheduling tool that texts video links to patients.

If that comparison turns up gaps, close them before your next audit cycle. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription, which matters when you need four agreements this month and none next month.

The Claim Itself Is Disclosure, and the Modifier Is Part of the Message

Treat this as a privacy design question, not just a revenue question. A claim carrying modifier 95 tells the payer, and everyone downstream of the payer's data, that this patient received care remotely. Paired with a behavioral health, substance use, or reproductive health service code, that combination can be more sensitive than either element alone. It can also land on an explanation of benefits mailed to a subscriber who is not the patient.

You cannot suppress a required modifier. What you can do is anticipate the exposure. Train your front desk to explain, without editorializing, how a claim generates an EOB and where it gets mailed. Know how to process a request for confidential communications under 45 CFR 164.522(b) — a patient can ask that you communicate by alternative means or at an alternative location, and providers must accommodate reasonable requests. Have a written path for handling it that does not depend on one long-tenured staff member's memory.

Billing Records Sit Inside the Designated Record Set

When a patient requests their records, the request generally reaches billing records used to make decisions about that individual — not just the clinical note. Your telehealth claims, modifiers included, are usually in scope. Practices have thirty days to act on an access request, with one possible thirty-day extension and written notice of the reason. Review the HHS individual right of access guidance with whoever answers records requests, and confirm your outsourced RCM vendor can produce their portion inside your clock, not theirs.

Recordings deserve their own decision. If your platform records or transcribes visits, those artifacts are PHI subject to your retention schedule, your access obligations, and any applicable state consent-to-record law. Decide deliberately whether to record at all. "The vendor defaults to on" is not a decision.

Remote Coders, Scribes, and the Vendor List You Have Not Updated

Telehealth volume tends to pull the revenue cycle offsite along with it. Inventory these before your next risk analysis:

  • Telehealth platform vendors, including any specialty-specific one used by a single department.
  • Outsourced or contract coders and billers, and where their workstations physically sit.
  • AI scribe and ambient documentation tools, plus whatever they do with audio after transcription.
  • Interpreter and relay services joining encounters.
  • Clearinghouses and denial-management vendors touching claim data.
  • Patient engagement, reminder, and secure-messaging tools distributing visit links.

For remote staff, the Security Rule's workstation use and workstation security standards apply at the kitchen table exactly as they apply in your suite. Write down what you require: private space, screen lock intervals, no household shared logins, encrypted device, no local downloads of claim files. Then verify it at least annually rather than assuming the attestation someone signed at onboarding still describes reality.

A 60-Minute Modifier 95 Self-Audit

Run this quarterly. Block one hour, invite the billing lead and the privacy officer, and work through it together.

  1. Pull the last 90 days of claims with modifier 95, modifier 93, POS 02, and POS 10. Look for claims with a telehealth POS and no modality modifier, or a modality modifier and an office POS — either mismatch is an edit waiting to happen.
  2. Sample ten charts. Confirm each note independently states modality, both locations, and consent.
  3. Check the payer grid's "last verified" column. Anything older than one quarter gets reassigned that day.
  4. List every platform that produced those encounters. Match against executed BAAs. Record gaps with an owner and a due date.
  5. Confirm recording and transcription settings match your written retention policy.
  6. Review telehealth-related denials by reason code and route the top two to a template or training fix.

Document that you ran it. Keep the output. A practice that can show a dated, repeated self-audit is in a materially different position during an investigation than one producing screenshots after the fact.

Start With the Gap You Already Know About

Most administrators reading this can already name the vendor without a BAA. Close that one first, then work the modifier grid and the documentation template. If your broader documentation set is thin — risk analysis, policies, workforce training records — automating the HIPAA risk analysis and policy set gets you to a defensible baseline faster than rebuilding it in a word processor. And when the next telehealth vendor shows up mid-quarter, produce the business associate agreement before the first video visit, not after the first denial.