On a normal Tuesday your biller opens the hold queue and finds nineteen claims stopped: six missing a time statement, four with a level that doesn't match what the note supports, three flagged by a payer edit, and six sitting behind a telehealth place-of-service question. Every one of those holds started with an office visit cpt code chosen inside your EHR by a clinician who moved on to the next patient forty seconds later.

This guide is for the administrator, billing lead, or privacy officer who owns that queue. It covers how office visit code selection actually moves through a practice, what documentation has to exist to defend it, and — the part most billing articles skip — which HIPAA obligations attach to that code the moment it leaves your building.

Which Office Visit CPT Codes a Practice Uses, and Who Decides the Level

The office and outpatient evaluation and management (E/M) family covers new patient visits (99202–99205) and established patient visits (99211–99215). Code 99201 was deleted effective January 1, 2021, and if it still appears in a superbill template, a charge macro, or a fee schedule import, that's a cleanup task for this week.

Since the 2021 revisions, level selection for these codes is based on either the level of medical decision making or the total time the clinician spends on the encounter on the date of service. History and exam are performed as medically appropriate but no longer drive the level. CMS publishes an Evaluation and Management Services Guide through its MLN program that your coding staff should have bookmarked and re-read whenever the annual update drops.

Who decides? The treating clinician selects the code. Your coding staff verify that the documentation in the record supports what was selected, query when it doesn't, and escalate patterns rather than re-coding silently. That distinction matters in an audit: a practice that documents queries and clinician responses looks very different from one where a biller quietly changed levels.

The three things your workflow has to capture every time

  • Basis of selection. Did the clinician level the visit on medical decision making or on time? The note should make this unambiguous.
  • Time statement, when time is the basis. Total time on the date of the encounter, stated as a number, attributable to the billing clinician.
  • Encounter setting. In-person, audio-video, or audio-only, with the place of service and any modifier your payer requires.

The Telehealth Column That Breaks Your Charge Templates

Telemedicine coding has been the least stable part of this workflow for several years running. CPT added a dedicated telemedicine E/M code family in the 2025 code set, while Medicare has continued to instruct billing through office visit codes with specific place-of-service values and modifiers. Commercial payers split in both directions.

Do not resolve this with a hallway conversation. Build a payer matrix — one row per plan, columns for audio-video policy, audio-only policy, required POS, required modifier, and the date you last verified it. Assign a named owner and a quarterly re-verification date. Medicare telehealth authority has moved through a series of short-term extensions, so "we checked last spring" is not a defensible position; verify current policy with your MAC before the quarter closes.

Minimum Necessary Applies to the Claim, Not Just the Chart

Disclosures for payment are permitted under HIPAA without patient authorization, but permitted is not unlimited. The minimum necessary standard still governs what you send. A clean claim with an office visit cpt code, diagnosis codes, and demographics is minimum necessary. A claim attachment containing the full progress note, the behavioral health intake, and three years of prior visits usually is not.

Where practices get sloppy: appeals and medical necessity reviews. When a payer denies and asks for records, the reflex is to export the whole chart because it's one click. Build a review step. One person — usually the billing lead or the privacy officer's designee — confirms the request scope and sends the encounter records responsive to that scope, with a log entry recording what went out, to whom, and on what date.

The Cash-Pay Restriction That Overrides Your Billing Routine

Here is the obligation most front desks have never been trained on. Under 45 CFR 164.522(a)(1)(vi), if a patient pays for a service in full, out of pocket, and asks you not to disclose information about that service to their health plan, you must agree. This is not a discretionary restriction. It is one of the few HIPAA requests a covered entity cannot decline.

Operationally, that means the office visit cpt code for that encounter never reaches the clearinghouse. Your workflow needs three pieces:

  1. A front-desk script and a written form so the request is captured at check-in or check-out, not after the claim has already gone out in the nightly batch.
  2. An EHR flag that suppresses the encounter from the claim batch and from statement runs, tested by someone who watches the batch, not assumed to work.
  3. A documented handling rule for what happens if the patient's payment fails or the check bounces — you need a written procedure for contacting the patient before any billing resumes.

Practices with high-volume batch billing lose these requests constantly. Ask your billing lead to pull the last twelve months of restriction requests and match them against submitted claims. If that reconciliation has never been run, run it this quarter.

Billing Records Are Part of the Designated Record Set

When a patient submits a records request, your staff usually think "chart." HIPAA's definition of the designated record set at 45 CFR 164.501 includes both medical records and billing records maintained by or for the covered entity. A patient who asks for their billing records is entitled to them, including the codes submitted on their claims.

The clock is the same as any access request: 30 days, with one 30-day extension that requires written notice explaining the delay. OCR has pursued right-of-access enforcement steadily since launching the initiative in 2019, and the pattern in those resolutions is unglamorous — small practices that took months, not sophisticated adversaries.

The operational failure point is that billing data usually lives in a different system, or at a different vendor, than the clinical note. If your revenue cycle is outsourced, your access-request procedure must include a step for retrieving billing records from that vendor within a turnaround that leaves you room inside the 30 days. Put that turnaround in the contract, not in an email.

What to hand over, concretely

Encounter-level detail: dates of service, the codes submitted, charges, adjustments, payments, and patient responsibility. You are not obligated to produce internal analytics or the vendor's proprietary scoring output, but you are obligated to produce the billing record itself. Decide your standard package once, document it, and stop re-litigating it per request.

Everyone Who Sees an Office Visit CPT Code Is on Your Vendor List

Sit down and trace a single claim from the exam room to the remittance. On a typical trace you will find: the EHR vendor, an ambient documentation or scribe tool, a coding-assistance module, a clearinghouse, an outsourced coding reviewer, an RCM or billing company, a patient statement printer, a payment processor, an eligibility service, a denial-analytics platform, and possibly an accounts receivable collector.

Every one of those that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and needs a signed agreement before it touches data. HHS's business associate guidance is explicit that clearinghouses and billing services fall in scope. Subcontractors of those vendors need agreements too, executed downstream by the vendor — and your contract should require it.

Two categories get missed almost universally. First, coding consultants and locum billers brought in for a backlog: short engagement, verbal arrangement, full chart access, no BAA. Second, AI-assisted documentation and coding-suggestion tools that a clinician enabled from within the EHR marketplace without telling anyone in administration. Both belong in your inventory.

If your vendor review turns up gaps — and it will — you can produce a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, as a one-time purchase rather than another subscription. Close the paperwork gap the same week you find it, then log the executed agreement with a renewal date.

A Governance Cadence That Fits a Real Practice

You don't need a coding committee. You need four recurring tasks with names attached.

Weekly — billing lead

Clear the hold queue and categorize every hold by root cause: missing time statement, documentation mismatch, payer edit, eligibility, telehealth policy. Categorization is the whole point; a raw count tells you nothing about what to fix.

Monthly — billing lead plus one clinician

Review a sample of encounters per clinician against documentation. Look for patterns, not individual errors. Document the review, the findings, and any education delivered. This file is what you hand an auditor.

Quarterly — administrator

Refresh the payer matrix. Reconcile cash-pay restriction requests against submitted claims. Confirm that every vendor with claim access has a current BAA and that no one has been added to the EHR marketplace without review.

Annually — privacy and security officer

Update the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A) to reflect any new billing, coding, or documentation systems. OCR's proposed overhaul of the Security Rule, published in January 2025, remains unfinalized as of this writing, but its direction — mandatory asset inventories, tighter vendor verification — is worth planning around rather than waiting out. If your documentation set is stale, tooling that automates the risk analysis and policy set will get you further in a weekend than another delayed committee meeting.

The Audit Scenario to Rehearse

A payer requests records for forty encounters across two clinicians, all high-level established patient visits, and gives you fourteen days. Who pulls them? Who reviews scope before release? Who logs the disclosure? What format goes out, through what channel, and is that channel encrypted?

Practices that answer those four questions in under a minute handle the request as routine work. Practices that don't spend the fourteen days improvising, and often over-disclose in the process. Write the procedure now, while nothing is on fire, and store it where the billing lead can find it without asking you.

Start With the Vendor Trace

Pick one claim from last week. Trace it end to end, list every organization that touched it, and check each against your BAA file. If the list has holes, generate the agreements you're missing and get them signed before your next audit — or your next records request — finds the gap for you.