Eight. That is the number of tobacco cessation counseling sessions Medicare Part B will cover for a beneficiary in a twelve-month period, and it is the number your billing staff most often gets wrong. Two cessation attempts per year, up to four sessions each. Miss the counter and you eat the ninth claim.

This is a practice-operations guide to the smoking cessation CPT codes: what the descriptors actually require you to capture, who on your staff owns each step, and — the part almost nobody plans for — where the tobacco-use data you generate ends up leaving your practice. If you sign vendor contracts, answer records requests, or defend a payer audit, this is written for you.

What Are the Smoking Cessation CPT Codes?

Two CPT codes describe tobacco use cessation counseling as a distinct service, and they are separated by time:

  • 99406 — smoking and tobacco use cessation counseling visit, intermediate, greater than 3 minutes up to 10 minutes.
  • 99407 — smoking and tobacco use cessation counseling visit, intensive, greater than 10 minutes.

Counseling of three minutes or less is not separately reportable under these codes; it is considered part of the associated evaluation and management service. The rendering clinician determines which descriptor matches the counseling actually delivered. Your job as an administrator is to make sure the record supports whatever was selected — not to select it.

Older HCPCS G-codes for tobacco cessation counseling were retired years ago. If your charge master, superbill, or EHR order set still lists them, that is a cleanup task for this quarter.

The Three Data Points Your Coder Needs on Every Claim

Time-based counseling codes fail audits for boring reasons. Build your template so the note captures, at minimum:

  1. Total counseling time, stated as a number, not "brief" or "extended."
  2. The content of the counseling — what was discussed, what was recommended, what the patient agreed to.
  3. The rendering provider's identity and credential, because scope and incident-to rules govern who may report the service.

When cessation counseling occurs on the same date as a separately identifiable E/M service, modifier 25 is typically appended to the E/M. Your billing lead should have a written internal policy on when that modifier is applied, reviewed with your coding resource annually. "We've always done it this way" is not a policy.

The Session Counter Nobody Owns

Medicare structures tobacco cessation counseling as two cessation attempts per twelve-month period, with up to four sessions per attempt — eight total. Coverage rules also distinguish beneficiaries who are asymptomatic from those with a tobacco-related disease or on medications affected by tobacco, which changes cost-sharing treatment. Verify current national coverage language in the CMS Medicare Coverage Database before you rewrite your policy; do not rely on a vendor's summary slide.

Operationally, the failure point is ownership. Ask yourself right now: who in your practice knows a given patient is on session six of eight? If the answer is "the EHR probably tracks it," test that assumption with three live charts this week.

A workable assignment looks like this:

  • Front desk flags the tobacco cessation visit type at check-in so it routes to the right template.
  • Clinical staff record the session number in a structured field, not free text.
  • Billing runs a monthly report of patients approaching the annual limit and routes it back to the care team before the next appointment is booked.

Commercial coverage differs. Tobacco cessation interventions carry a strong preventive services recommendation, and non-grandfathered plans generally must cover them without cost sharing when delivered in network — but frequency limits, place-of-service restrictions, and prior authorization behavior vary by payer. Keep a one-page payer grid and date it. Rebuild it every January.

Where Smoking Cessation CPT Claims Create Privacy Exposure

Here is the part that gets skipped. A 99406 or 99407 on a claim is a durable, structured, machine-readable assertion that a named individual uses tobacco. That data does not stay in your chart. It travels to the payer, to the clearinghouse, onto the explanation of benefits, and — depending on your integrations — into population health tools, quality reporting pipelines, and referral platforms.

Every one of those hops is a disclosure you are accountable for. The relevant test is not whether the disclosure was permitted; it is whether you disclosed the minimum necessary for the purpose. HHS maintains plain guidance on that standard, and it applies squarely here: the minimum necessary requirement is not satisfied by "the interface sends the whole encounter."

Tobacco Status Is Not Automatically 42 CFR Part 2 Data

Compliance leads regularly overcorrect here, so be precise. The heightened confidentiality protections of 42 CFR Part 2 attach to records from federally assisted substance use disorder programs — a status that depends on your organization's holding out and function, not merely on whether a note mentions a substance. Tobacco cessation counseling delivered in a general primary care practice is ordinarily governed by HIPAA, not Part 2.

That said, the compliance date for the 2024 Part 2 modifications landed this month, on February 16, 2026, and those changes align Part 2 more closely with HIPAA on notices, breach reporting, and patient consent. If your organization operates any unit that meets the Part 2 program definition — and some multi-service practices do without realizing it — get a written legal determination on record. Do not decide this in a staff meeting.

The Employer Wellness Disclosure Trap

Occupational medicine and employer-contracted practices see this constantly: an employer sponsoring a tobacco cessation benefit asks for a list of participating employees, or for confirmation that a named employee completed counseling, so it can apply a premium differential.

Treat that request as a disclosure to a third party requiring individual authorization unless a specific exception applies and your counsel has confirmed it. "The employer paid for it" is not a HIPAA permission. Build a standing authorization form for these programs, keep the signed copy, and log the disclosure. Your accounting-of-disclosures obligation does not care that the request seemed routine.

The Vendor List: Quitlines, Text Programs, and Digital Coaching

Most practices billing smoking cessation CPT codes also refer out — to a state quitline, a text-message support program, a pharmacist-led clinic, or a digital cessation app the health plan promotes. Each referral pathway needs a documented answer to one question: is this entity a business associate, or is this a permitted treatment disclosure between covered entities?

Rough sorting logic your privacy officer can apply:

  • Referral to another provider for treatment — generally a permitted disclosure for treatment purposes. No BAA required, but minimum necessary still governs what you send.
  • A vendor performing a function on your behalf — outreach, patient engagement, coaching delivered under your practice's name, analytics on your patient panel — that is a business associate relationship. Get the agreement signed before the first record moves.
  • A patient self-enrolling directly with a consumer app — not your business associate, and often not covered by HIPAA at all. Say so plainly in the handout you give the patient. Consumer health apps that fall outside HIPAA are regulated instead under FTC authority, including the Health Breach Notification Rule.

The most common gap I see: a referral portal that transmits tobacco status, contact information, and appointment history to a coaching vendor, running for eighteen months on a signed order form with no executed BAA. If you find one of those this week, you can generate a signature-ready Business Associate Agreement through a guided wizard and close the gap in an afternoon rather than waiting on a legal queue.

What to Ask Before the Contract Is Signed

  1. What data elements does the integration transmit, field by field? Ask for the actual specification.
  2. Where is the data stored, and for how long after termination?
  3. Do subcontractors touch it, and are downstream BAAs in place?
  4. Will the vendor return or destroy data on termination, and in what format?
  5. What is the breach notification timeline in the contract, and does it give you enough runway to meet your own 60-day obligation?

Your "Quit Smoking" Landing Page Is a Compliance Object

Marketing builds a cessation program page with a scheduling widget and an inquiry form. Analytics and advertising trackers come along by default. Now a visitor's interest in tobacco cessation, tied to an IP address and a device identifier, flows to third parties you never vetted.

OCR's position on online tracking technologies has been litigated and narrowed, but the underlying exposure has not gone away — and state privacy statutes, wiretapping claims, and FTC enforcement all reach this conduct independently. Run a tracker inventory on every page that touches scheduling, intake, or symptom-specific content. Assign it to whoever owns your website, with a due date, and require a written report.

A 30-Day Cleanup Plan You Can Actually Run

Week 1 — Inventory. Pull every claim with a smoking cessation CPT code from the last twelve months. Identify the templates used, the providers reporting them, and every downstream system that received the encounter data.

Week 2 — Documentation audit. Sample ten charts. Confirm counseling time is stated numerically, content is described, and the rendering provider is identifiable. Route defects to your coding resource, not to the clinicians directly, so feedback is consistent.

Week 3 — Vendor reconciliation. Match every recipient of that data to a signed BAA or a documented treatment-disclosure rationale. Anything unmatched goes on a remediation list with an owner and a date.

Week 4 — Update the risk analysis. New data flows mean your security risk analysis is stale. This is the required, documented, organization-wide assessment — not a checklist someone downloaded. If maintaining it by hand is why it keeps slipping, tools that automate HIPAA risk analysis reports and the supporting policy set will get you to a defensible document faster than another quarter of good intentions. No product carries government endorsement, and HHS certifies no one — but a current, evidenced analysis is what an investigator asks for first.

Records Requests, Retention, and Information Blocking

When a patient requests their record, cessation counseling notes go with it. You have 30 days, with one possible 30-day extension, and the fee limits are narrow. Review the OCR guidance on the individual right of access with your records clerk annually — right-of-access enforcement has been steady and unglamorous, and the fact patterns are almost always operational, not malicious.

Separately, withholding tobacco-related documentation from an authorized electronic request without a valid exception implicates information blocking. Your "we don't release sensitive notes electronically" habit needs to be written down, justified, and narrow.

On retention: HIPAA requires six years for compliance documentation — policies, risk analyses, BAAs, disclosure logs. Medical record retention itself is set by state law and payer contract. Keep the two schedules on separate pages so nobody conflates them.

Start With the Data Map

Billing smoking cessation CPT codes correctly is a coding problem your practice can solve in a week. Knowing where the resulting data goes is a governance problem, and it is the one that shows up in a breach notification letter.

Pick one thing today: pull the last twelve months of 99406 and 99407 claims and trace the data downstream. Then bring your risk analysis and BAA inventory current so the trace has somewhere to land. Generate the risk analysis and policy set if that is the step that has been stalling — and put the next review date on the calendar before you close the file.