A patient walks in at 8:40 on a Monday with 14 staples in her knee, a discharge sheet from a hospital 90 miles away, and no idea who is supposed to remove them. Your medical assistant can handle the removal in four minutes. The billing question, the records question, and the vendor question take longer — and staple removal CPT selection is the smallest of the three.

This guide is for practice administrators, billers, and privacy officers who handle these encounters weekly. It covers how practices determine and document code selection for suture and staple removal, how the global surgical package changes the answer, how to obtain the outside operative note without a pointless authorization form, and which vendors in that chain need a signed Business Associate Agreement before the claim ever leaves your building.

The Staple Removal CPT Codes Your Coders Will Actually Open the Book For

Your coding staff has a short list to work from. Current CPT includes add-on codes 15853 (removal of sutures or staples not requiring anesthesia) and 15854 (removal of sutures and staples not requiring anesthesia), both of which CPT instructs be reported in addition to an evaluation and management service. 15851 describes removal of sutures or staples requiring anesthesia. Verify the exact descriptors against your current-year CPT book — descriptors and add-on parentheticals have been revised in past cycles, and your coders should never work from memory.

Two operational cautions. First, an add-on code cannot stand alone; if there is no reportable E/M or primary procedure on the claim, the add-on has nothing to attach to. Second, payment status is a separate question from code existence. Check the status indicator and relative value units for each code in the CMS Physician Fee Schedule Look-Up Tool and then check your top five commercial payer policies, because several treat these add-ons as bundled and assign no separate payment. Build that finding into your fee schedule and your denial expectations, not into a coder's guesswork.

Who Performed the Original Procedure Decides Almost Everything

If your surgeon placed the staples and the procedure carries a 10-day or 90-day global period, removal is ordinarily part of the global surgical package — normal postoperative care is already paid for in the surgical fee. Your practice does not get a second payment for finishing what it started. Some practices in the CMS post-operative visit data collection cohort also report 99024 for those visits as a no-charge reporting code; confirm whether your state and practitioner count place you in scope.

If a different practice performed the surgery, the encounter is a new episode for your practice, and your coders document an E/M service based on what actually occurred and was recorded. If there was a formal transfer of postoperative care, modifiers 54 and 55 come into play, and the transfer must be documented in writing — not assumed because the surgeon's discharge sheet said "follow up with your PCP."

Can You Bill Separately for Staple Removal After Someone Else's Surgery?

Generally yes, when your practice did not perform the original procedure and is not in a documented transfer-of-care arrangement, the visit is reported as a separate encounter — most often an E/M service, with the staple removal CPT add-on reported if the payer recognizes it. When your own surgeon placed the staples during a global period, removal is included in the surgical fee and is not separately payable. Code selection always follows the documentation, not the scheduling reason.

The Five-Minute Intake Script That Decides the Whole Claim

Your front desk generates or destroys the claim before anyone touches the wound. Give them four questions and a place in the EHR to put the answers:

  • Which facility or surgeon performed the procedure, and on what date?
  • Did the surgeon's office schedule a follow-up with them, or tell you to come here?
  • Do you have the discharge instructions or operative summary with you?
  • Has any other office already removed part of the closure?

Those answers determine global-period status, whether an outside record request is needed, and whether the visit is a nurse-only encounter or requires a clinician. They are also PHI the moment they are written down. Scheduling notes get exported into reminder systems, printed on day sheets, and left on counters. Treat the scheduling module as part of your PHI inventory, because it is.

Requesting the Operative Report Without an Authorization Form

Front desk teams routinely mail a patient an authorization form so the practice can request an operative note from another provider. That step is usually unnecessary and it delays care. HIPAA permits a covered entity to disclose protected health information to another covered entity for treatment purposes without patient authorization, and to request it for the same purpose. HHS lays this out plainly in its guidance on disclosures for treatment, payment, and health care operations.

What you do owe is precision. Request the operative report and discharge summary for the specific encounter — not the entire chart. The minimum necessary standard applies to your requests, not only your disclosures. Write the narrow request language into a template so staff are not free-typing "please send all records" at 4:50 p.m.

Where the Inbound Record Lands

Fax and portal-delivered records arrive somewhere before they reach the chart: a fax server, a shared inbox, a scanning queue, a temporary folder on a shared drive. Assign one named owner for that queue, set a same-day filing expectation, and confirm the interim location is encrypted and access-logged. Also confirm your outbound fax destinations are verified against a maintained directory. Misdirected faxes remain one of the most mundane and most common breach triggers in small practices, and "we used the number on the discharge sheet" is not a defense.

Wound Photos: Where the Image Lives Is Your Problem

Staple removal encounters generate photographs. A medical assistant snaps a picture of the incision to send the operating surgeon, or a patient texts an image the night before asking whether the staples look infected. Both create ePHI on devices and channels you may not control.

Three decisions to make in writing before the next photo is taken. Whether clinical photography on personally owned phones is permitted at all, and if so, only through an application that stores images in the EHR and not in the device camera roll or a cloud photo backup. Whether inbound patient texts to a practice number are acceptable, and what the documented response is when one arrives. And who deletes the local copy, on what schedule, with what verification. The NIST National Cybersecurity Center of Excellence has practical reference material on securing electronic health records on mobile devices that maps well onto a small-practice policy.

Every Hand That Touches the Claim Needs a BAA

Trace one staple removal encounter through your vendor list. The outside operative note may arrive through a cloud fax service. The image may pass through a photo capture app. The claim goes to a clearinghouse. If you outsource, a billing company builds and submits it. When it denies as global-period bundled, a coding consultant may pull the chart for review. A release-of-information or scanning vendor may handle the paper. A patient statement vendor mails the balance.

Every one of those parties creates, receives, maintains, or transmits PHI on your behalf, which makes each a business associate requiring a signed agreement before work begins. The failures we see are rarely refusals — they are gaps. An agreement signed in 2019 with a billing company that has since been acquired. A coding consultant engaged verbally for a two-week denial cleanup. A fax vendor added by the office manager on a credit card. If you need a defensible document quickly for that consultant or new clearinghouse, you can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, as a one-time purchase rather than another subscription line item.

Then do the boring part: maintain a single vendor register listing each business associate, the service, the agreement date, the renewal or termination date, and the internal owner. Reconcile it against your accounts payable ledger twice a year. Accounts payable always knows about vendors your privacy officer does not.

When the Payer Asks for the Chart

Global-period denials on staple removal claims are common, and the appeal usually requires the outside operative report to prove your practice did not perform the original procedure. Disclosure to a health plan for payment purposes is permitted without authorization, so the question is scope, not permission.

Send the operative report, the visit note, and the denial correspondence. Do not send the full longitudinal chart because it is easier to export. Log the disclosure, note who assembled the packet, and keep a copy of exactly what left the building. If your appeals are handled by an outside billing vendor, confirm in writing that they follow the same scope discipline — their over-disclosure is your incident to report.

A Workflow You Can Hand to Staff Tomorrow

  1. Front desk: ask the four intake questions; record surgeon, facility, and surgery date in structured fields.
  2. Front desk: if no outside record is on file, send the narrow treatment-purpose request template the same day; note it in the chart.
  3. Clinical staff: document who performed the removal, what was removed, wound findings, and any clinician involvement, per your supervision policy.
  4. Clinical staff: route any photograph into the EHR only; delete the local copy and initial the log.
  5. Coder or biller: confirm global-period status from the outside record before selecting codes; apply modifiers only with documented transfer of care.
  6. Coder or biller: apply your payer-specific policy on the staple removal CPT add-on codes; record the policy source in your fee schedule notes.
  7. Privacy officer: verify each vendor in the chain — fax, clearinghouse, billing, coding review, statements — appears on the vendor register with a current BAA.
  8. Privacy officer: spot-check five appeal packets per quarter for over-disclosure.

None of this is difficult. It fails because it is split across four roles and nobody owns the seam. Write the names next to the steps.

Close the Vendor Gap First

Coding disputes cost you money. Vendor gaps cost you a breach notification, and they are faster to fix. Pull your accounts payable ledger this week, mark every vendor that touches PHI in a staple removal encounter, and paper the ones missing an agreement — a signature-ready BAA takes about ten minutes to produce. If your broader documentation set is also overdue, automated risk analysis and policy generation will get the rest of the binder current without a consulting engagement.