On a January Monday, a mid-sized family practice can run forty rapid strep tests before lunch. Each one generates a claim line, a device log entry, a result in the chart, and — if a parent calls the school nurse — a disclosure decision. Getting the strep test CPT code right is the easy part. Keeping the CLIA paperwork, the analyzer vendor contract, and the records-release workflow aligned behind it is where practices actually get burned.

This guide is for practice administrators, billing leads, and privacy officers. It covers how the strep testing code families are structured, what CMS expects on the claim form, and the vendor and disclosure obligations that come attached to running a lab inside your own building. It is administrative guidance — not clinical guidance, and not a substitute for your payer policies.

Which CPT Codes Cover Strep Testing?

Group A Streptococcus testing spans several CPT families, distinguished by method, not by symptom or severity:

  • 87880 — infectious agent detection by immunoassay with direct optical (visual) observation, Streptococcus group A. The classic rapid antigen test read from a cassette or reader.
  • 87430 — Streptococcus group A detection by enzyme immunoassay technique, qualitative or semiquantitative.
  • 87650 / 87651 / 87652 — Streptococcus group A by nucleic acid probe: direct probe, amplified probe, and quantification, respectively. Molecular point-of-care platforms typically fall in this family.
  • 87081 — culture, presumptive, pathogenic organisms, screening only. Commonly the send-out throat culture screen.
  • 87070 — culture, bacterial, any source except urine, blood, or stool, with isolation and presumptive identification.

The correct strep test CPT code for any given encounter is determined by the test method the ordering clinician selected and the device your practice actually ran — never by the diagnosis. Your coders read the device name off the log, match it to the manufacturer's stated methodology, and select from the descriptor. That's the whole decision tree.

Waived versus non-waived is a compliance line, not a coding line

Many rapid antigen and some molecular strep platforms hold CLIA waived status; others are moderate complexity. That status determines what certificate your site needs, what personnel qualifications apply, and what an inspector can cite you for. It does not change the descriptor you bill.

If your clinic added a molecular strep platform during a respiratory surge and nobody re-checked the certificate type, that's a finding waiting to happen. CMS maintains the authoritative material on certificate categories and waived-test requirements through its Clinical Laboratory Improvement Amendments program.

The QW Modifier and the CLIA Number on Your Claim

Two mechanical items sink more strep claims than code selection ever does.

First, the QW modifier. CMS exempts a short list of waived codes from requiring QW — a handful of dipstick and simple bench tests. The immunoassay strep codes are not on that exemption list, so when your site performs them under a certificate of waiver, most payers expect the QW appended. Pull the current CMS list of tests granted waived status each time it updates and confirm which of your in-house codes need the modifier.

Second, the CLIA certificate number. Laboratory services billed on the CMS-1500 require your site's CLIA number in item 23. If your practice operates multiple locations under separate certificates, your billing system needs location-level logic — not a single hardcoded number in the group profile. A satellite office billing under the main campus certificate is a denial engine and, in an audit, an unpleasant conversation.

Assign both items an owner. In most practices it's the billing lead, with the office manager responsible for keeping certificate expiration dates on a renewal calendar.

How Practices Determine and Document Code Selection

You do not want your coders reverse-engineering methodology from a chart note. Build the determination into the workflow so the artifact exists before the claim goes out.

The three artifacts an auditor asks for

  1. The order. A clinician-authenticated order in the chart identifying the test performed. "Strep" alone is thin; the specific test name is better.
  2. The result. Documented in the record with date, time, and the identity of the staff member who performed and read it. Point-of-care logs count, but only if they're retained and retrievable.
  3. The quality-control record. External QC per manufacturer instructions, lot numbers, expiration dates, and corrective action when a control fails. This is the artifact practices most often cannot produce two years later.

Maintain a one-page internal crosswalk: device name → manufacturer methodology → CPT descriptor → QW status → CLIA complexity. Update it whenever purchasing swaps vendors. When a coder has a question, they read the crosswalk instead of guessing, and you have a document that shows an auditor how the practice made its determinations.

Same-day office visits

Whether a nurse-visit or established-patient E/M service can be reported alongside the test on the same date depends on payer policy, medical necessity documentation, and the level of clinician involvement. That is a payer-contract question your billing lead answers with written policy citations in hand — not a judgment call made at the front desk. Keep the payer policy PDFs in a shared folder with retrieval dates noted.

Every Strep Result Is PHI, Including the One on the Analyzer Screen

Here's where the operations guide turns into a privacy guide.

A rapid strep result is protected health information from the moment the specimen is labeled. That includes the patient name written in marker on a specimen bag sitting on the counter, the printed strip in the shared bin, and the result queue on an analyzer screen visible from the waiting room.

Walk your testing area at eye level from the patient side of the counter. If you can read a name and a result, so can everyone in line. This is the most common physical-safeguard gap in primary care and urgent care, and it costs nothing to fix — reposition the device, add a privacy filter, change the screen timeout.

The device is an information system

Modern point-of-care readers are networked. They push results to your EHR through an interface, phone home for firmware updates, and let vendor support staff pull diagnostic logs remotely. Any one of those paths can carry PHI.

Three questions for your IT lead about every analyzer on your floor:

  • Is it on the clinical network, a segmented VLAN, or — worse — the guest Wi-Fi?
  • Does it store patient identifiers locally, and for how long?
  • Can vendor support access it remotely, and is that access logged and time-limited?

Add each device to your asset inventory. If it isn't in the inventory, it isn't in your risk analysis, and the risk analysis is the first document HHS requests when something goes wrong. HHS publishes its Security Rule guidance materials for exactly this purpose.

The Vendor List Behind a Rapid Test

Count the outside parties that touch a single strep encounter. It's usually more than administrators expect.

  • The analyzer manufacturer or its service arm, if it accesses result data or provides remote support — business associate.
  • Middleware or interface vendors moving results from device to EHR — business associate.
  • Your billing company or clearinghouse transmitting the claim — business associate.
  • The specimen courier for send-out cultures, if it handles labeled specimens on your behalf — evaluate carefully; most are not pure conduits.
  • Document storage or shredding services handling paper logs — business associate.

The reference laboratory itself is generally a covered entity receiving a disclosure for treatment purposes, which does not require a BAA. Practices routinely get this backwards in both directions — chasing a lab for an unnecessary agreement while the middleware vendor with live database access has nothing signed at all.

If you just discovered a gap on that list, close it before the next purchase order. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription — which is faster than routing a template through counsel for a $4,000 benchtop analyzer. HHS explains the underlying obligations in its business associate guidance.

Records Requests: Minors, Schools, Employers, and Sports Physicals

Strep results generate disclosure requests that other lab results don't, because third parties want them.

Schools and daycares. A parent asking you to fax a return-to-school note is one thing. A school nurse calling directly to ask whether a child tested positive is a disclosure to a third party. Your front desk needs a scripted response and an escalation path to the privacy officer — not discretion.

Employers. When an employer sends a worker in for testing and wants results, you need a valid authorization signed by the individual. Employer payment for the visit does not create a right to results. Put this in your front-desk training and re-run it every fall.

Minors and personal representatives. Parental access to a minor's record is governed by a mix of HIPAA and state law, and state law on minor consent varies considerably. Your policy should name the specific state statutes you operate under and identify who resolves edge cases. "Ask the doctor" is not a policy.

The 30-day clock

When a patient or their personal representative requests a copy of their record, you have 30 days to provide it, with one 30-day extension available if you notify them in writing of the reason and the new date. Fees must be reasonable and cost-based. HHS's right of access guidance is the controlling reference, and OCR has pursued a long series of enforcement actions under its right-of-access initiative.

Point-of-care results are the ones most likely to be missing from an access response, because they sometimes live only in a device log or a scanned paper strip rather than the structured chart. Test your own process: request a full record for a test patient who had an in-house strep test and see whether the result comes back.

A 90-Minute Audit You Can Run This Week

Block the time. Bring the billing lead, the office manager, and whoever handles IT.

  1. Pull 20 recent strep claims. Confirm the code matches the device actually used, QW is present where required, and the correct location-level CLIA number populated item 23.
  2. Pull the matching charts. Confirm order, result, performing-staff identity, and QC record for those dates.
  3. Walk the testing area. Sight-line check on screens, specimens, and printed results. Photograph what you find.
  4. List every analyzer and interface. Match each to a signed BAA with a current date. Flag the ones without.
  5. Check certificate expirations. Every site, every certificate, on a calendar with a 90-day reminder.

Document what you found and what you changed. That memo is worth more in an audit than a perfect result would be, because it demonstrates an active compliance process.

Close the Vendor Gaps Before the Next Surge

Respiratory season is when practices add devices, add staff, and add shortcuts. It's also when the paperwork slips furthest behind the operations. If your audit turned up analyzers, interface vendors, or couriers without executed agreements, draft and export the missing BAAs this week rather than at renewal time. If the gaps run wider than contracts — risk analysis, policies, the full document set — automated compliance documentation will get you to a defensible baseline faster than a template folder will.