A payer sends your practice a records request covering 38 dates of service across four providers. The letter asks for one thing you did not expect: documentation supporting the total time reported on each claim line. Your biller pulls the notes and finds three different formats — one provider writes "45 min," one logs start and stop times, one wrote nothing at all and let the EHR's built-in timer populate the field. That is a time CPT problem, and it is now also a records-handling problem.

This guide is for the administrator, billing lead, or privacy officer who owns that response. It covers how practices capture and document time for time-based CPT coding, who touches that data along the way, and where the HIPAA obligations attach — because time data is protected health information the moment it is tied to a patient encounter.

What "Time CPT" Actually Refers to on Your Claim Line

CPT is maintained by the American Medical Association, and several code families use time as a selection or reporting element rather than as a footnote. Broadly, practices encounter time in four operational patterns:

  • Total time on the date of the encounter. Since the 2021 office visit revisions and the 2023 expansion to other evaluation and management categories, providers may select an E/M level based on either medical decision making or total time. Your policy has to state which basis was used, per encounter.
  • Threshold codes. Some services are defined with a minimum number of minutes before the code may be reported at all, and additional codes or add-ons for time beyond that.
  • Timed units. Therapy and certain treatment services are billed in units tied to minutes of direct one-on-one time, with CMS applying its own unit-calculation rules for Medicare claims.
  • Cumulative monthly time. Care management, remote monitoring, and behavioral health integration services accumulate staff or clinician minutes across a calendar month, often across multiple people.

Nothing in this article tells you which code fits a given visit. Code selection belongs to the rendering provider, guided by AMA CPT instructions, your written coding policy, and payer-specific rules. CMS publishes its own claims-processing instructions in the Internet-Only Manuals, and those instructions frequently differ from commercial payer policy. Your job as an administrator is to make sure whatever the provider selected is documented, reproducible, and defensible — and that the underlying data is handled lawfully.

What Counts as Time for Time-Based CPT Codes?

For time CPT reporting, practices generally document the following, subject to the specific code's instructions and the payer's policy:

  1. Who performed the time. Physician, advanced practice clinician, or clinical staff under supervision — each code family treats these differently.
  2. What activities were included. Some codes count only face-to-face or direct one-on-one contact. Others count qualifying non-face-to-face work performed on the same calendar date, such as record review, ordering, and documentation.
  3. The date the time occurred. Time is generally counted per date of encounter or per calendar month, not banked across periods.
  4. The number of minutes, stated as a number. A range ("30–45 minutes") is weaker on audit than a single figure or a start/stop pair.
  5. Exclusions. Time already counted toward another billed service, and time spent by staff whose work is not creditable to that code, must not be double-counted.

The operational rule: if a reviewer cannot reconstruct the minutes from the note without calling the provider, the documentation is not finished.

Where Time Gets Captured — and Every System That Touches It

Here is where administrators get surprised. Time data rarely originates in one place, and it almost never stays inside your EHR.

EHR timers and ambient documentation tools

Many systems track elapsed chart-open time and offer to auto-populate a total time field. Auto-populated time is not provider attestation. If your providers rely on a timer, your coding policy must require them to review and affirm the number, and your note template should record that affirmation. Ambient documentation vendors that draft notes from recorded conversations create a second copy of the encounter — including its duration — on infrastructure you do not control.

Telehealth platforms

Video platforms generate session logs with join and leave timestamps. Billing staff love these because they look like objective evidence. Understand that once you cite platform logs in an audit response, those logs are part of your evidence chain, and you need a retention answer for them. Ask your vendor how long session metadata is kept and whether it is exportable.

Remote monitoring and care management dashboards

These platforms exist largely to accumulate minutes. Staff click a timer, log an activity, and the system totals the month. The vendor is holding patient identifiers, device readings, staff names, and a minute-by-minute activity trail. That is a business associate relationship with substantial detail, not a passive tool.

Outsourced coding and billing

If a third party reviews your notes to validate time-based code selection, that vendor reads full clinical documentation, not just claim data. Confirm the scope in writing.

Time CPT Data Is PHI, and It Expands Your Vendor Perimeter

A start/stop time attached to a patient name, a session log with a patient identifier, a monthly minutes report keyed to an MRN — all PHI. Every outside company that creates, receives, maintains, or transmits it on your behalf is a business associate and needs an agreement in place before the first record moves. HHS explains the scope in its business associate guidance.

Two failure patterns show up repeatedly in practices:

  • The pilot that became production. A provider trials an ambient scribe or a minute-tracking app for a month. No agreement, no risk analysis entry, no procurement review. Eighteen months later it is billing-critical and nobody can name the vendor's security contact.
  • The subcontractor gap. Your care management platform runs on a cloud host and uses a transcription subcontractor. Your agreement with the platform should obligate it to bind those downstream parties. Ask for the list.

If you are onboarding a time-tracking or documentation tool this quarter and the vendor sends you a marketing PDF instead of a contract, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription. Getting the agreement executed before go-live is dramatically cheaper than reconstructing the relationship during a breach investigation. The OCR breach portal is full of incidents where the reported entity was a service provider, not the practice.

Minimum necessary applies to audit responses too

When a payer requests time documentation, send the documentation that supports the claim — not the entire chart because exporting the whole record was faster. Disclosures for payment purposes are permitted, but the minimum necessary standard still governs volume. Write a standing audit-response protocol that names who assembles the packet, who reviews it before transmission, and what gets logged.

Patients Can Request the Time Documentation You Just Created

The designated record set includes billing records. A patient who disputes a charge can request the documentation supporting the reported time, and your practice generally has 30 days to respond, with one 30-day extension available if you notify the patient in writing. "It's in the billing system, not the chart" is not a basis for denial.

Practical consequences for your workflow:

  • If a start/stop time lives only in a vendor dashboard, your release-of-information staff need a documented path to retrieve it inside the deadline. Test that path before you need it.
  • Patients may submit amendment requests when a logged duration contradicts their recollection. You must have a process to accept, evaluate, and respond — including denial with an explanation of their right to submit a statement of disagreement.
  • Information blocking rules reach electronic health information broadly. If you are withholding time-related records from a patient's app request without a valid exception, review the ONC information blocking materials with your compliance lead.

A Workable Control Set: Roles, Fields, and Cadence

Assign four roles by name

  • Coding policy owner — usually the billing manager. Maintains the written policy stating how each time-based code family is documented and which payer rules apply.
  • Template owner — clinical informatics or the EHR administrator. Ensures the note template captures minutes, participants, activities, and provider attestation as discrete fields.
  • Vendor owner — privacy officer or administrator. Keeps every system that touches time data on the business associate inventory, with agreement dates and subcontractor disclosures.
  • Audit responder — release-of-information or compliance staff. Owns the packet assembly protocol and the disclosure log.

Standardize five fields

Whatever your system, make these consistent across every provider: date the time was performed, total minutes as a number, who performed it, whether the basis for code selection was time or medical decision making, and a provider attestation line. Inconsistency across providers is what turns a single-claim question into a broad review.

Run a monthly ten-chart internal review

Pull ten claims with time-based codes at random. Check whether the minutes are reconstructable from documentation alone, whether the same minutes were counted toward another billed service, and whether any supporting evidence sits outside your EHR. Log the findings. Six months of these logs is the most persuasive artifact you can hand a reviewer who asks whether your practice monitors its own coding.

Update the risk analysis when time tools change

Adding an ambient scribe or a monitoring dashboard changes where PHI lives, which means your risk analysis is out of date the day it goes live. NIST's SP 800-66r2 maps the Security Rule to practical safeguards and is a reasonable structure for documenting the reassessment. If maintaining that documentation set manually has become the bottleneck, automated HIPAA risk analysis and policy generation will get you to a defensible baseline faster than another spreadsheet revision.

Worked Example: One Claim, Four Systems

A clinical staff member logs 22 minutes of care management activity in a vendor dashboard across three touchpoints. The supervising clinician adds 9 minutes of review the same month and attests in the EHR. The billing service reviews both records, selects the code per your written policy, and submits. Nine months later, a payer requests support.

Your response packet needs the dashboard activity log, the EHR attestation, and your coding policy in effect that month. That means three vendors touched the claim — dashboard, EHR, billing service — plus the payer receiving the disclosure. Four relationships, three executed agreements required, one disclosure to log, and a retention question for the dashboard export. If any of those four links is undocumented, you have a compliance gap that has nothing to do with whether the code was right.

Do This in the Next Two Weeks

List every system in your practice that records a duration tied to a patient. Check each one against your business associate inventory. Where an agreement is missing or predates a material change in the vendor's services, put a current, signature-ready agreement in front of the vendor before your next audit letter arrives — the wizard produces an executable document in a single sitting, with no recurring cost. Then pull ten time CPT claims and see whether the minutes hold up on paper. Both tasks fit in an afternoon, and both are questions you would rather answer on your own schedule.