Your front desk took 214 clinical phone calls last month. Somewhere between eleven and forty of them probably met the criteria for a billable encounter, and your practice billed none of them — or billed all of them under a phone visit CPT code that your Medicare Administrative Contractor considers invalid. Both outcomes cost you.

This guide is for the administrator, billing lead, or privacy officer who owns that problem. It covers how the audio-only code families were restructured, what your clinicians have to document before your coders can select anything, and — the part most billing guidance skips — which vendors touching those calls need a Business Associate Agreement on file before the first claim goes out.

Nothing here tells you which code fits a given patient encounter. That determination belongs to your rendering provider and your certified coder, applied against current CPT guidance and your payer's published policy.

What a Phone Visit CPT Code Is, in Plain Administrative Terms

A phone visit CPT code is a procedure code used to report a synchronous, audio-only clinical encounter between a patient and a qualified provider — no video, no in-person component. It differs from a telehealth code in one operational respect that drives everything downstream: there is no visual channel, so identity verification, consent, and documentation all have to be handled through the audio session itself.

Three things determine which code your coder can select:

  • Who rendered the service — physician or other qualified health professional versus a non-physician professional who cannot bill evaluation and management services.
  • Total time of medical discussion, documented by the clinician, not estimated later by billing.
  • Proximity to other encounters — CPT guidance has long restricted reporting when the call relates to an E/M service within a prior lookback window, or when it leads directly to a visit within a short window afterward. Your coding staff must apply the current-year rule, not the one they memorized in 2021.

Payer policy sits on top of all of that and frequently overrides it.

The 2025 Code Restructuring Your Billing Staff Is Still Cleaning Up

Effective January 1, 2025, the legacy telephone E/M family (99441–99443) was deleted from CPT and replaced by a new telemedicine E/M structure that separates audio-video services from audio-only services into distinct code ranges, plus a standalone code for a brief virtual check-in. If your superbill, charge-capture macros, or EHR favorites list still contains a deleted code, you have a denial factory running quietly in the background.

Medicare did not adopt the new AMA telemedicine E/M codes wholesale. For the physician fee schedule, CMS has continued to instruct practitioners to report established evaluation and management codes with the appropriate place-of-service and telehealth modifiers rather than the new CPT telemedicine range, while separately recognizing the brief virtual check-in code. Commercial payers went the other direction in many markets and adopted the new ranges directly.

The practical consequence: the same clinical encounter may map to a different phone visit CPT code depending on who is being billed. Build that into your charge router, not into a coder's memory.

Modifiers Are Where the Money Actually Moves

Modifier 93 identifies a synchronous service delivered by real-time audio-only telecommunications. Modifier 95 identifies audio-video. Place-of-service assignment — patient's home versus other originating site — interacts with facility versus non-facility payment. Get one of the three wrong and the claim either denies or underpays without ever triggering a rejection your team would notice.

Assign one person to maintain a payer grid: payer name, accepted audio-only codes, required modifier, required POS, effective date, and the URL of the policy you pulled it from. Review it quarterly. That grid is also your first exhibit if a payer audits the line.

The Statutory Expiration Nobody Should Be Ignoring

Medicare's broad telehealth flexibilities have been extended in short legislative increments since 2024, and the current extension window is measured in weeks, not years. Do not build your 2026 revenue assumptions on a flexibility that Congress renews a month at a time. Check the current status on CMS's telehealth coverage page before every quarterly close, and keep a documented fallback for what your schedulers do the day a flexibility lapses.

What Your Coder Needs From the Clinician — and How to Get It

Audio-only encounters fail audits on documentation far more often than on code selection. The chart note has to establish, at minimum:

  1. That the patient initiated or consented to the audio-only modality, and that consent is recorded in the note or the chart.
  2. Patient identity verification — what was used to confirm you were speaking with the patient or their personal representative.
  3. Start and stop time, or total time of medical discussion. "Approximately 15 minutes" written three days later is not a time entry.
  4. The patient's physical location during the call, which drives POS and, in some states, licensure.
  5. Whether a related E/M occurred recently or was scheduled as a result — the fact your coder needs to apply the bundling rule.

Build these as required fields in a phone-encounter template. Five structured fields cost the clinician forty seconds and eliminate the single largest source of post-payment recoupment risk in this service line.

Where a Phone Visit CPT Code Turns Into a Privacy Problem

Here is the part billing consultants skip. The moment you start billing audio-only encounters at volume, the telephone stops being a utility and becomes clinical infrastructure — and infrastructure that handles PHI needs contracts behind it.

OCR's enforcement discretion for telehealth platforms ended in 2023. There is no grace period left. HHS has published specific guidance on audio-only telehealth under the HIPAA Rules, and the analysis it lays out is the one your privacy officer should be applying.

The short version: a traditional landline carrier acting purely as a conduit for a real-time call generally does not require a Business Associate Agreement. Almost nothing else in a modern practice phone stack qualifies for that exception.

The Vendors That Almost Certainly Need a BAA

  • Cloud VoIP and unified communications providers that store call detail records, voicemail, or recordings on their systems.
  • Answering services and after-hours triage vendors taking clinical messages.
  • Call recording and quality-assurance platforms.
  • Voicemail-to-text transcription services.
  • Ambient AI scribes or transcription tools capturing the audio-only encounter.
  • Patient texting and appointment-reminder platforms used to set up or follow up on the call.
  • Your billing company or clearinghouse, which now receives a new category of encounter data.

Pull your vendor inventory today and check each of those against your executed agreements. If you find a gap — and most practices adding audio-only volume do — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon. One-time purchase, no subscription, which matters when you are papering four vendors at once and not building a compliance program from scratch.

HHS maintains a plain-language overview of who qualifies as a business associate. Use it to settle internal arguments before you sign anything.

Recording, Transcription, and the AI Scribe Question

If you record audio-only encounters, decide three things in writing before the first recording exists: whether the recording is part of the designated record set, how long it is retained, and whether your state's two-party consent law applies. Many practices record for QA, never define retention, and discover during a records request that they hold 4,000 hours of PHI with no disposition schedule.

For AI scribes, ask the vendor two questions in writing: does audio or transcript data get used to train models, and where is it stored. Get the answer in the BAA or an addendum, not in a sales email. NIST's SP 800-66r2 is a reasonable framework for documenting the risk analysis behind that decision.

Records Requests and the Audio-Only Encounter

A patient who had three phone visits and requests their chart is entitled to the records your practice maintains about those encounters — generally within 30 days, with one 30-day extension available under the Privacy Rule. Your release-of-information staff needs a documented answer to: does the export include the phone encounter notes, the call recording, the AI-generated transcript, and the voicemail?

Answer it once, write it into your ROI procedure, and train on it. The failure mode is a staff member releasing a raw call recording that captures a family member's unrelated health information, or withholding a note that clearly belongs in the designated record set. Both generate complaints.

A 45-Day Cleanup Plan

Days 1–7 — Billing lead. Audit the last 90 days of claims for deleted or invalid audio-only codes. Pull denial reason codes. Purge deleted codes from superbills, favorites lists, and charge-capture macros.

Days 8–15 — Billing lead plus clinical champion. Build the payer grid described above for your top eight payers. Publish it where coders actually look.

Days 16–25 — Practice administrator. Deploy the five required documentation fields in the phone-encounter template. Run a fifteen-chart internal review two weeks after go-live.

Days 26–35 — Privacy officer. Inventory every vendor touching call audio, transcripts, voicemail, or messaging. Match to executed BAAs. Paper the gaps.

Days 36–45 — Privacy officer plus ROI staff. Define designated record set scope for audio-only encounters, set retention for recordings and transcripts, and update the ROI procedure. Document the risk analysis update covering the new data flows.

Four Mistakes That Show Up in Audits

Billing the call that led to an in-person visit the next morning. Bundling rules exist for exactly this pattern, and post-payment reviewers look for it.

Time documented in ranges. "10–15 minutes" supports the lower level, every time, in every review.

Reusing the audio-video modifier on an audio-only call. Common in practices that started with video and added phone later. It is a misrepresentation on a claim form.

Recording without retention. Unbounded PHI storage with no schedule and no vendor agreement is a finding waiting to happen — and it will surface during a breach investigation, not during a quiet Tuesday.

Start With the Contracts, Then the Codes

Coding errors on a phone visit CPT code cost you revenue and occasionally a recoupment letter. A missing BAA on the vendor recording those calls costs you a reportable breach and an OCR investigation. Fix the second problem first — it is faster and the exposure is larger.

If your vendor list has gaps, build and export the agreements you need before your next audio-only claim batch goes out. If your risk analysis and policy set haven't been touched since you added telehealth, automating the full compliance document set is the cheaper path than reconstructing it during an investigation.