Your dermatology clinic sampled skin lesions on 31 patients last week. Every one of those encounters generated four things your practice has to manage: a procedure note, a specimen with a patient identifier on the label, a claim, and — a week later — a pathology report someone will ask for. The shave biopsy CPT code is the smallest piece of that chain, and it is the piece that gets audited first.

This guide is for the administrator, biller, or privacy officer who owns that chain. It covers how practices determine and document code selection for tangential (shave) biopsies, then makes explicit the records-handling and vendor obligations that ride along with every specimen you send out the door. It is administrative guidance. Your clinicians decide what procedure they performed; your job is to make sure the documentation, the claim, and the disclosure trail all match.

What the Shave Biopsy CPT Codes Are

CPT describes skin biopsy by technique, not by body site. The tangential biopsy family — which is what most practices mean when they say "shave biopsy" — consists of:

  • 11102 — tangential biopsy of skin (for example, shave, scoop, saucerize, curette), single lesion
  • 11103 — each separate/additional lesion (add-on code, listed separately in addition to 11102)

Punch biopsy uses 11104 and 11105. Incisional biopsy uses 11106 and 11107. These technique-based codes replaced the older 11100/11101 pair effective January 1, 2019, and the change is old enough now that a claim still carrying 11100 is a sign your charge master or superbill was never rebuilt.

Shave removal is a different family entirely: 11300–11313, organized by anatomic site and by lesion diameter. The determining factor is the documented intent and extent of the procedure, not the instrument. That determination belongs to the treating clinician and must appear in the note before your coder can act on it.

The distinction that drives everything downstream

A shave biopsy CPT code represents sampling tissue for diagnostic examination. A shave removal code represents removing a lesion. Payers scrutinize the boundary because the removal codes carry site- and size-based values, and because a removal performed with the intent to treat is documented differently from a sampling performed with the intent to diagnose.

Your operational job: make sure the note states the technique, the anatomic site, the lesion size where relevant, and the clinical purpose. If your template auto-populates "shave biopsy" regardless of what happened, you have a documentation defect that will surface in the first payer audit and that your coder cannot fix retroactively.

What Your Coder Needs Before Assigning a Shave Biopsy CPT Code

Build a documentation checklist into the procedure template and audit against it monthly. At minimum:

  1. Technique performed — tangential, punch, or incisional, stated explicitly rather than implied.
  2. Anatomic site for each lesion — specific enough to distinguish separate sites ("left upper back, 4 cm inferior to scapular spine" beats "back").
  3. Lesion count and per-lesion detail — because add-on coding depends on separate lesions, not separate passes at one lesion.
  4. Purpose — diagnostic sampling versus definitive removal.
  5. Specimen disposition — sent to pathology, container count, and lab name.
  6. Hemostasis and closure method, which affects whether a separate repair is even in play.

Assign an owner. In most practices the medical assistant enters site and specimen data at the time of the procedure, the clinician attests to technique and purpose, and the coder maps to CPT. If all three steps live with one overworked person, your error rate climbs and your audit trail thins.

Multiple Lesions, Add-On Codes, and the Hierarchy Rule

Three lesions sampled at one visit do not become three primary codes. CPT instructs that when biopsies of different techniques are performed at the same session, the most complex biopsy is reported as the primary code and the remaining biopsies are reported with the corresponding add-on codes. Practices that report multiple primary biopsy codes on one claim generate predictable denials.

Add-on codes also require the underlying documentation to support genuinely separate lesions. "Two shave biopsies of the left forearm" without site differentiation invites a records request. Train your clinicians to write coordinates, not regions.

National Correct Coding Initiative edits govern what bundles into what. Your billing lead should be pulling the quarterly edit files rather than relying on whatever your clearinghouse scrubber happened to load. CMS publishes the NCCI edit files and policy manual directly, and the policy manual chapter on integumentary procedures is worth an hour of your coder's time each January.

The Same-Day E/M Question Your Front Desk Will Hear About

Patients call about this constantly: "Why did I get charged for a visit and a procedure?" Your front desk needs a scripted, accurate answer that does not stray into coding advice.

The operational reality is that a separately reportable evaluation and management service requires documentation that stands on its own — distinct history, examination, and medical decision making beyond the work inherent in the procedure — and is reported with modifier 25 when supported. Whether that threshold is met in any given encounter is a documentation judgment, made by the clinician and reviewed by your coder, not by the person answering the phone.

Script for the front desk: "The visit charge covers the evaluation your provider documented, and the procedure charge covers the biopsy itself. I can send your itemized statement and route your question to our billing supervisor." Then route it. Do not let unlicensed staff litigate modifier 25 on a call recording.

Where the Specimen Goes — and Who Is Actually a Business Associate

Every shave biopsy CPT code on your claim corresponds to a physical container that left your building with a patient name, date of birth, and often a medical record number printed on it. Map that journey and the vendor obligations become obvious.

The pathology lab is usually not your business associate

This trips up more privacy officers than it should. When you send a specimen to a dermatopathology group for interpretation, that group is a covered entity providing treatment to the patient. Disclosures between providers for treatment purposes do not require a business associate agreement. HHS has been consistent on this point — a laboratory acting as a healthcare provider is not your business associate merely because it receives PHI from you.

That does not mean the relationship needs no paperwork. You still want a written service agreement covering turnaround times, specimen rejection criteria, result delivery method, and how the lab handles amended reports. But do not waste a quarter chasing a BAA signature from an entity that does not need to sign one.

The courier, the billing company, and the coding vendor are

Here is where the real gaps sit. A courier service that transports labeled specimens and requisitions is handling PHI on your behalf. So is your outsourced billing company, your remote coding contractor, your transcription service, your patient-communication platform, your document shredding vendor, and your EHR host. Each requires an executed business associate agreement with satisfactory assurances, and HHS publishes sample BAA provisions as a baseline.

Pull your vendor list and check three columns: signed BAA on file, execution date, and whether the vendor has been acquired or renamed since signing. Acquisitions break BAAs quietly. A dermatology practice that signed with a two-person courier in 2019 and now ships through a regional logistics conglomerate is operating on a stale agreement. If you need a clean, signature-ready document without a procurement cycle, a business associate agreement generator will get you a defensible draft in one sitting.

Photographs of Lesions Are PHI, and Your Camera Policy Probably Says Nothing

Dermatology runs on images. Clinicians photograph lesions before sampling, staff attach images to the chart, and someone occasionally texts an image to a colleague for a second opinion. Every one of those images is protected health information, and identifiable features — tattoos, facial structure, jewelry — make de-identification harder than for most data types.

Write the policy explicitly: which device captures clinical images, where images are stored, whether personal phones are permitted (the answer should be no unless the device runs a managed application with no local photo-roll write access), how images are transmitted between clinicians, and how long they are retained.

Then document the analysis behind those choices. Your Security Rule risk analysis has to actually address mobile image capture, and most practice risk analyses do not — they were copied from a template written for a primary care office with no camera in the exam room. If yours is stale, automated HIPAA risk analysis and policy generation will produce the documented assessment and the corresponding policy set far faster than rewriting a Word template by hand.

The 30-Day Clock That Starts When the Path Report Lands

Patients ask for biopsy results, and the request is a right-of-access request whether or not anyone at your front desk labels it that way. Under the Privacy Rule you have 30 days to act, with one 30-day extension available if you notify the individual in writing of the delay and the expected date. HHS maintains detailed individual right of access guidance that your records staff should have bookmarked.

OCR has pursued right-of-access enforcement aggressively for years, and the pattern in those resolutions is unglamorous: small practices that ignored a request, misrouted it, or charged an unsupportable fee. The pathology report is part of the designated record set. So is the procedure note that supports the shave biopsy CPT code, the image, and the billing record.

Operational fix: log every access request at intake with a date stamp, assign a single owner, and set a calendar reminder at day 20. A request that arrives by phone, by fax, through your portal, or in a handwritten note at the front desk all start the same clock.

Denials, Appeals, and the Records That Travel With Them

When a payer denies a biopsy claim, your billing staff assemble a packet: the procedure note, the pathology report, sometimes the clinical photograph. That packet is a disclosure for payment purposes — permitted, but still subject to the minimum necessary standard.

Two failure modes recur. First, staff send the entire chart because it is faster than extracting the relevant encounter. Second, appeals go out by unencrypted email or to a fax number transcribed from a denial letter without verification. Build a verification step and a redaction step into the appeal workflow, and audit ten appeal packets a quarter against what the payer actually requested.

A 90-Minute Operational Audit for This Quarter

  • Pull 20 biopsy encounters and confirm each note documents technique, per-lesion site, and specimen disposition.
  • Confirm your charge master contains no retired biopsy codes.
  • Reconcile specimen log entries against pathology reports received; find the gaps.
  • List every vendor that touches a specimen, an image, a claim, or a chart. Match each to a signed, current BAA.
  • Time-test your access request workflow with an internal dummy request.
  • Confirm your risk analysis addresses clinical photography and remote coding access.

Coding accuracy and privacy discipline are the same discipline applied at different points in one workflow. The practice that documents lesion sites precisely is the same practice that can answer a records request in eleven days and produce a current BAA on demand.

If your risk analysis, policy set, and vendor documentation are older than your current specimen workflow, start there — generate the current compliance document set and work the vendor list against it before the next audit finds the gap for you.