Fourteen claims come back from your clearinghouse in one batch, all rejected, all from the same nurse-run screening clinic you set up for a school district contract. Your biller pulls the encounters and finds the pattern in ninety seconds: someone searched for a PPD vaccine CPT code, landed on a vaccine product code, and built the superbill template around it. Nobody administered a vaccine. Every one of those visits was a tuberculin skin test.

This guide is for the person who has to fix that template, retrain the staff who used it, and then answer the harder question nobody asked: who else received those records, and did your practice have paper in place before they did. Coding accuracy and privacy exposure travel together on TB screening, because TB screening crosses the line between patient care and employee health more often than almost anything else you bill.

There Is No PPD Vaccine, and That Single Fact Fixes Most Coding Errors

PPD stands for purified protein derivative — the tuberculin antigen placed intradermally to screen for tuberculosis infection. It is a diagnostic test. It does not immunize anyone against anything.

The tuberculosis vaccine is BCG (Bacillus Calmette-Guérin), which is rarely given in the United States and lives in an entirely different section of the CPT book. When your front desk or a temp staffer types "PPD vaccine CPT code" into a search bar, they are combining two unrelated services, and the code they pick determines whether the claim pays, whether the encounter documentation matches what happened, and whether the result lands in a patient chart or an employment file.

Fix the vocabulary first. In your registration screens, encounter templates, and staff-facing scheduling notes, the service is a tuberculin skin test or a TB blood test. Reserve the word "vaccine" for actual immunizations. That one edit prevents a surprising share of downstream rework.

What CPT Code Families Cover TB Testing Versus BCG Vaccination?

Administrators asking about a PPD vaccine CPT code are usually looking at one of four distinct code families. Your certified coder confirms the current-year descriptor and your payer's policy before any of them go on a claim:

  • Tuberculin skin test (intradermal placement). CPT 86580 carries the descriptor for an intradermal tuberculosis skin test. It sits in the immunology section, not the vaccine section — which is why immunization administration codes do not attach to it the way they attach to a vaccine product.
  • TB blood tests (interferon-gamma release assays). CPT 86480 and 86481 describe cell-mediated immunity antigen response measurement for tuberculosis. These are laboratory services, usually performed by a reference lab on a drawn specimen.
  • BCG vaccine product. CPT 90585 describes BCG vaccine for tuberculosis, live, for percutaneous use. This is the only place the word "vaccine" legitimately enters the conversation.
  • Immunization administration. The 90460–90474 range covers administration of an actual vaccine product and pairs with a product code, never with a skin test code.

CPT descriptors are revised, added, and deleted annually. Verify against your current-year AMA CPT reference and your payer's published policy rather than a saved template from three years ago. For Medicare-covered scenarios, coverage determinations and edits are searchable in the CMS Medicare Coverage Database.

How Your Practice Documents Code Selection

Do not let code selection live in someone's memory. Build a short internal reference — one page — that names the service, the code family your coder assigned, the payer policies you checked, and the date of last review. Assign an owner and a review cadence tied to the annual CPT update.

The encounter note has to support whatever gets billed. For a skin test, that generally means the placement date, the site, the lot and expiration of the antigen used, the person who placed it, the read date, the measured induration in millimeters, and the person who read it. If your template does not capture all of those fields, your biller is guessing and your auditor will say so.

The Read-Visit Denial Everyone Runs Into

The most common billing dispute on skin testing is whether a separate visit code is payable when the patient returns 48 to 72 hours later for the reading. Many payers consider the reading bundled into the test code. Some allow a low-level established-patient visit under specific circumstances. Your practice determines this per payer, documents the determination in that one-page reference, and stops relitigating it at the front desk. Check the National Correct Coding Initiative edits as part of that review.

The Two-Chart Problem: Your Employee's TB Result Is Not PHI

Here is where TB screening becomes a privacy issue rather than a billing issue. Under HIPAA, employment records held by a covered entity in its role as employer are excluded from the definition of protected health information. HHS explains the boundary in its guidance on employers and health information in the workplace.

So when your medical assistant places a skin test on your new hire because your infection-control policy requires baseline TB screening, the result you file in that employee's personnel record is an employment record. When the same medical assistant places a skin test on a patient who came in for a pre-employment clearance ordered by an outside employer, the result is PHI.

Same antigen, same vial, same reader, same 72-hour clock, two completely different sets of rules for retention, access, and disclosure.

Where the Wall Actually Breaks Down

In practice, three things collapse the distinction, and all three are fixable:

  1. Staff screenings get charted in the EHR. Someone creates a patient record for a coworker because that is the only place with a template for the test. Now employee health data sits in the clinical system, discoverable through normal chart access, visible to anyone with a broad role permission.
  2. The same person owns both files. Your practice manager runs employee health and has full EHR access. No one has drawn a line about which hat is on.
  3. Retention schedules diverge. Occupational health records carry their own retention obligations that differ from your clinical record retention policy and from state medical records law. If both live in the same bucket, you are complying with the shorter one by accident.

Write down which system holds employee TB screening results, who has access, and how long you keep them. If you are using the EHR because it is convenient, restrict access by role and flag those records so they never get released in response to a patient records request or a subpoena aimed at clinical charts.

The 72-Hour Operational Window Nobody Schedules For

A skin test is a two-visit service with a hard clock. Placement, then a read at 48 to 72 hours. Miss the window and the test is unreadable, which means the patient returns for a new placement and your biller now has a duplicate-service problem to explain.

Assign these four things explicitly:

  • Scheduling: the read appointment gets booked at placement, not "call us Thursday." Front desk owns this.
  • Reminder: a 24-hour reminder that names the read window. If your reminder tool is a third-party texting platform, it is touching PHI and belongs on your vendor list.
  • Reading and documentation: a named clinical role, with induration recorded in millimeters, not "negative."
  • Result release: who sends the result where, and under what authority. This is the step that generates complaints.

For two-step baseline testing protocols, the sequence spans one to three weeks. Build the recall into your workflow rather than relying on the patient to come back.

Vendors in the TB Screening Path, and Which Ones Need a BAA

Pull up your vendor inventory and check whether these are on it:

Reference laboratory (for IGRA blood testing). A lab performing testing at your order is generally a covered entity in its own right, and disclosures between you and the lab for treatment purposes do not require a business associate agreement. What you do need is a documented understanding of how results come back, who receives them, and whether the lab's portal is provisioned with individual named accounts instead of a shared login.

Billing company or coding contractor. Handles PHI on your behalf. BAA required. If the same contractor also processes your employee health screenings, the BAA does not cover that work — employment records are outside its scope, and you need a separate confidentiality provision.

Occupational health vendor screening your own staff. This is frequently misfiled. If the vendor is performing employee screening for you as an employer, the relationship may not be a business associate relationship at all. If the same vendor also sees your patients or touches your clinical system, it is. Document which one it is and paper it accordingly.

Mobile or event-based screening contractors. School district contracts, employer health fairs, and shelter screenings all bring in staffing agencies and mobile providers. These engagements produce PHI in the field, often on personal devices, often with no agreement in place because the contract was signed by whoever answered the phone.

If that last paragraph described a vendor you cannot find paper for, close the gap this week. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — one-time purchase, no subscription — which is considerably faster than waiting for legal review on a screening contract that starts Monday.

Records Requests: Schools, Employers, Camps, and Clearance Letters

TB results generate an unusual volume of outside requests, and each one has a different legal basis.

The patient asks for their own result. That is a right-of-access request. You have 30 days, with one possible 30-day extension, and your fee is limited to what the rule permits. OCR has published extensive individual right of access guidance, and access failures have been a persistent enforcement theme.

An employer asks for their applicant's result. You need a valid authorization unless a narrow exception applies. "They sent the patient here" is not an exception. Release the specific result, not the chart.

A school asks for a student's clearance. The Privacy Rule includes a limited provision for disclosing proof of required immunizations to schools with documented agreement from a parent or guardian. TB screening results are not immunization records, so treat these as authorization-based releases unless your state law says otherwise.

Public health reports a positive. Tuberculosis is a reportable condition in every state. Reporting to a public health authority is a permitted disclosure, and a public health authority is not your business associate. See HHS guidance on public health disclosures. Log the disclosure in your accounting-of-disclosures record anyway.

Every one of these releases should be minimum necessary. Sending an eight-page chart when the requester needed a one-line result is the most common avoidable disclosure in a screening clinic.

A 20-Minute Audit for Your Next Staff Meeting

  1. Search your encounter templates and fee schedule for the word "vaccine" attached to any TB service. Correct the labels.
  2. Confirm your one-page code reference exists, names its owner, and shows a review date inside the current CPT year.
  3. Pull three recent skin test encounters. Verify site, lot, expiration, read date, and induration in millimeters are all documented.
  4. Identify where staff TB screening results live and who can see them. Restrict if needed.
  5. Match every vendor in the screening path against a signed agreement or a documented reason no agreement is required.
  6. Time-check your last five records requests against the 30-day clock.

Do not let the coding question stop at the claim. A mislabeled PPD vaccine CPT code on a template is a symptom; the underlying condition is a screening workflow that nobody has mapped end to end, including the parts where records leave the building.

Start with the vendor paper, because that is the gap with the longest lead time and the least ambiguity. Build the BAA you are missing, then work backward through your templates and access controls. If your broader documentation set — risk analysis, policies, workforce training records — has not been touched since your last screening contract, automating the compliance document set gets you to a defensible baseline faster than rebuilding it by hand.