It's 4:40 on a Thursday. A physician finishes a 42-minute audio-video visit with a patient your practice has seen four times in the last two years. The note is thorough. Your coder opens the encounter, sees the time stamp, and asks you a question you should already have an answer to: do we submit the 98007 CPT code, or do we submit an office visit code with a telehealth modifier for this payer?

That question is administrative, not clinical, and it lands on your desk. This guide walks through what the 98007 CPT code covers, why claims scrubbers reject it for some payers, the documentation fields that live outside the chart note, and the vendor and records-handling obligations a video visit creates whether or not anyone in the building notices.

What the 98007 CPT Code Covers

98007 is part of the CPT telemedicine evaluation and management family introduced in the 2025 code set. Codes 98000–98003 describe synchronous audio-video E/M for new patients; 98004–98007 describe synchronous audio-video E/M for established patients, ascending in level. 98007 is the highest level in the established-patient audio-video group.

Three operational facts your billing staff need memorized:

  • Modality is baked into the code. The 98004–98007 range requires real-time two-way audio and video. Audio-only encounters map to a separate range (98008–98015), and a brief technology-based check-in has its own code (98016).
  • Level selection follows the familiar E/M logic. Like office and outpatient E/M, these codes are selected using medical decision making or total time on the date of the encounter. Your coding policy should state which method your practice applies and how the provider documents it.
  • New versus established still matters. The same three-year, same-specialty, same-group logic your team already applies to office visits determines whether you are in the 98000 range or the 98004 range.

Nothing here tells a clinician what to document or which level fits a given patient. Your job is to make sure the documentation supports whatever level is chosen, that the modality claim is true, and that the encounter data can be reproduced if a payer or a patient asks.

The short answer for the person who searched this at 9 a.m.

98007 is the top-level CPT code for a synchronous audio-video evaluation and management service delivered to an established patient. It is not an add-on, not audio-only, and not a Medicare-universal code. Whether you may bill it depends on the payer's adopted code set for the date of service. Verify per payer before you turn it on in your charge master.

Why Your Scrubber Rejects the 98007 CPT Code Even When the Note Is Perfect

Publication in CPT is not the same as payment. When these telemedicine E/M codes appeared, the Medicare Physician Fee Schedule did not adopt 98000–98015 for payment; the program instead directed continued reporting of office and outpatient E/M codes with the applicable telehealth modifier and place-of-service code, while recognizing the brief check-in code. Commercial and Medicaid payers went their own directions, and some adopted the new range immediately.

So your practice is running two coding paths at once for the same clinical service. That is a workflow problem, not a coding controversy.

Assign it to a person. Your billing lead should maintain a one-page payer grid: payer name, whether 98004–98007 are accepted, the fallback code family, the required modifier (95 for audio-video, 93 for audio-only), the required place of service (02 or 10), and the date the policy was last verified. Rebuild that grid every January and after any fee schedule rule cycle. Federal telehealth authorities have been extended in short increments and have lapsed at least once, so a grid you verified fourteen months ago is decoration.

The CMS telehealth coverage pages are the authoritative starting point for the Medicare side. Commercial policy lives in your provider manuals, and you should be saving dated PDFs of those pages, because "the portal said so in March" is not a defense in an audit.

The Documentation Fields That Live Outside the Chart Note

A telemedicine E/M claim asserts things about the world that no clinical note naturally captures. Your intake and rooming workflow has to capture them, which means your practice is now collecting more patient data than it did for an in-person visit.

Patient location at the time of service

You need it for place-of-service selection, for state licensure questions, and for some payers' coverage rules. That means someone asks the patient where they are and writes it down. A home address is PHI. "Patient's car in the Target parking lot" is PHI. Decide where that field lives in your system, who can see it, and how long you keep it.

Practitioner location

Home-office practitioners create a second address in your records. Your policy should say whether the practitioner's home address is recorded in the encounter, in a credentialing file, or both, and who has access.

Modality actually used, not modality scheduled

Video fails constantly. If a visit scheduled as audio-video degrades to audio-only, the code family changes. Build a single required field — "video connected: yes/no" — and train staff that it is a factual observation, not a billing preference. Coders working from a template that always says "audio-video" are generating false claims on the days the video dropped.

Many states require documented consent to telehealth, and several payers require it too. Capture it once per patient per policy period, timestamped, with the method noted. A consent that lives only in a platform vendor's database is a consent you will struggle to produce during an audit or a records request.

Time and decision making

If your policy uses total time, the provider documents total time on the date of the encounter. If it uses medical decision making, the note reflects that. Your role is to enforce internal consistency so a coder is never guessing which basis applies. Mixed-method documentation is the single most common finding when practices self-audit new code families.

The Vendor Question the 98007 CPT Code Forces You to Answer

Here is the part most practices skip. Billing a video E/M code is an assertion that a video platform carried protected health information. That platform is a business associate. So, usually, are several services stacked behind it.

Walk one telemedicine encounter end to end and list every third party that touched PHI:

  1. The video platform itself, including its cloud hosting subcontractor.
  2. The SMS or email service that sent the visit link.
  3. The virtual waiting room and in-visit chat, if separately provided.
  4. Any interpreter service dialed into the session.
  5. Any ambient documentation or transcription tool listening to the encounter.
  6. Recording storage, if the practice records.
  7. The clearinghouse that transmits the claim.

Every one of those needs a Business Associate Agreement executed and in force on the date of service — not signed later, not "in legal review." The enforcement discretion that let practices use non-public-facing consumer video tools during the public health emergency ended in 2023. There is no telehealth exception anymore. HHS telehealth resources are explicit that standard Privacy and Security Rule obligations apply.

If your vendor list has gaps — and after two years of ad hoc telehealth expansion, most do — close them before you expand your telemedicine code set. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX, one-time purchase, which is faster than routing a fourteenth redline through outside counsel for a $40-a-month scheduling add-on.

Read the platform's terms for the recording default

Some platforms record by default. Some retain session metadata for analytics. Some reserve the right to use de-identified data. Read the data processing terms, not the marketing page, and make the retention period match your own record retention policy. A vendor holding video of your patients for 36 months when your policy says 12 is a breach waiting to be scoped.

Records Requests for a Visit That Happened on Video

A patient calls the week after a telemedicine visit and asks for everything. Your 30-day clock under the HIPAA right of access starts at the request, not at the point your staff figures out where the data lives. See the OCR guidance on the individual right of access for the mechanics.

Decide these questions in writing, in advance:

  • Is the video recording part of your designated record set? If your practice uses recordings to make care decisions, it likely is. If you record for training or quality purposes only, document that distinction and be consistent. Inconsistency is the finding.
  • Is the in-visit chat transcript in the record? If a patient typed a symptom into chat and the clinician acted on it, treat it as clinical documentation and get it into the chart.
  • Can you retrieve it without the vendor? If the answer is no, your BAA needs a data return and access clause with a response time you can actually meet inside 30 days.

Also decide who fields the request when the patient asks specifically for the recording. Front desk should not be improvising that answer.

A Worked Example: Turning On the 98004–98007 Range

Here is a four-week sequence a two-site, eleven-provider group can actually execute.

Week 1 — Payer grid. Billing lead confirms acceptance of the 98007 CPT code and its siblings for your top eight payers by volume. Records the fallback path for every payer that declines. Saves dated screenshots.

Week 2 — Fields and templates. Practice manager adds required fields for patient location, practitioner location, and video-connected yes/no. Coding lead updates the internal coding policy to state the level-selection method and the audio-only fallback rule.

Week 3 — Vendors. Privacy officer inventories every third party in the telemedicine path, confirms an executed BAA for each with an effective date preceding first use, and documents recording defaults and retention. Any vendor without a current agreement gets one or gets removed from the workflow.

Week 4 — Training and go-live. Front desk gets a two-page script covering consent capture, location questions, and what to say when video fails. Providers get a one-page reminder on time documentation. Billing runs the first two weeks of claims through a 100% pre-submission review.

Adding a telehealth platform is also a change to your environment, which means your risk analysis should reflect it. If your last assessment predates the platform, that gap shows up in any investigation. Practices that need to refresh the underlying documentation can automate the risk analysis and policy set rather than rebuilding a spreadsheet from 2023.

What to Audit Every Quarter

Pull ten telemedicine claims at random and check five things: the modality claimed matches the video-connected field, the modifier and place of service agree with the payer grid, consent is on file and current, the level-selection basis is documented consistently, and every vendor in the path had an executed BAA on that date of service. Log the findings. Fix the pattern, not just the ten charts.

When something does go wrong — a recording left in an unsecured folder, a link sent to the wrong patient — you assess it as a breach under the standard four-factor analysis. Public breach reports on the HHS breach portal are a useful sanity check on how these incidents get characterized once they leave your building.

Next Step

Before you add the 98007 CPT code or any of its siblings to your charge master, name every vendor that will touch a video encounter and confirm you hold a current agreement with each one. If you find a gap, build the Business Associate Agreement and get it signed before the first claim goes out. It is a one-time purchase and a shorter task than the incident report you would otherwise write.