Your billing lead flags eleven virtual check-ins from last Thursday and asks a fair question: were any of these patients seen in the office the week before? If nobody can answer that in under two minutes, your practice has a workflow problem, not a coding problem. The 98016 CPT code description builds three separate timing conditions into the descriptor itself, and each one depends on scheduling data that lives outside the encounter note.

This guide is for the administrator, biller, or privacy officer who owns that workflow. It covers what the descriptor requires, who verifies each element, how Medicare has handled the code since it replaced G2012, and — the part most coding articles skip — which vendors touch a brief check-in and which of them need a signed Business Associate Agreement before your next one happens.

What the 98016 CPT Code Description Actually Says

CPT 98016 describes a brief communication technology-based service — commonly called a virtual check-in — furnished by a physician or other qualified health care professional who may report evaluation and management services. The descriptor limits it to an established patient, requires 5–10 minutes of medical discussion, and excludes the service when it originates from a related E/M service provided within the previous seven days or leads to an E/M service or procedure within the next 24 hours or soonest available appointment.

The AMA introduced 98016 effective January 1, 2025, alongside the 98000–98015 telemedicine E/M family, and it took over the ground previously occupied by HCPCS code G2012. If your fee schedule, superbill, or EHR pick list still shows G2012, that is a housekeeping item your revenue cycle staff should have closed out — and worth re-auditing this quarter.

The three boundaries your staff has to verify, not assume

  • Established patient. Someone confirms the patient relationship exists in your system, not just that a phone number matches.
  • Seven-day lookback. No related E/M service triggered the contact within the prior week.
  • Twenty-four hour forward window. The discussion did not lead to an E/M service or procedure at the next available slot.

Note the direction of the second and third conditions. The lookback is answerable at the time of the call. The forward-looking condition is not — it depends on what your scheduler does after the call ends. That is why practices that report this code cleanly hold the charge until the scheduling outcome is known, rather than dropping it the same afternoon.

None of this tells you whether 98016 fits a given patient interaction. That determination belongs to the rendering clinician, informed by the documented content and duration of the discussion, your payer's published policy, and your internal coding guidance. Your job as an administrator is to make sure the record contains enough detail for that determination to be defensible six months later.

How Medicare Has Treated 98016 Since It Replaced G2012

In the CY2025 Physician Fee Schedule final rule, CMS declined to establish separate payment for the new 98000–98015 telemedicine E/M codes and directed practitioners to continue reporting office and outpatient E/M codes with the appropriate telehealth modifier. CMS did recognize 98016 as the successor to G2012 and priced it accordingly. Brief communication technology-based services have historically sat outside the geographic and originating-site restrictions attached to the Medicare telehealth benefit, which is one reason practices treat them as an operationally distinct workflow.

Verify current-year status before you build anything permanent. Fee schedule status indicators change annually, commercial payers write their own policies, and Medicaid programs vary by state. Pull the current file from the CMS Physician Fee Schedule and confirm with your MAC rather than relying on last year's crosswalk.

The Scheduling Data Your Biller Needs Before Reporting 98016

Build the verification into the encounter workflow, and assign each step to a named role.

  1. Intake (front desk or triage staff): confirm established-patient status and log the request. Capture how the patient initiated contact — portal message, inbound call, return call to a voicemail.
  2. Pre-call check (clinical support): run the seven-day lookback against the appointment and encounter history. Record the result, not just the conclusion.
  3. Service (clinician): document start and stop time, the substance of the medical discussion, and the disposition.
  4. Post-call hold (scheduler): if an E/M service or procedure gets scheduled inside the 24-hour or next-available window, flag the encounter so the charge does not go out.
  5. Release (biller): after the hold period, confirm all descriptor elements are documented and release the charge.

Practices that skip step four generate the exact pattern payer auditors look for: a brief communication code followed immediately by an office visit for the same problem. Even when each individual claim was reported in good faith, the pattern invites a records request — and a records request means someone on your staff spends a day pulling call logs, portal threads, and appointment histories.

Medicare has long required patient consent for virtual check-in services, and beneficiary cost-sharing applies. Consent may be obtained verbally and documented in the medical record. Practically, that means one of two things: your clinician says a scripted sentence and charts it, or your staff obtains and logs consent annually with a per-encounter confirmation.

Pick one and standardize it. The failure mode is a hybrid where half your clinicians assume the front desk handled consent and the front desk assumes the clinician did. Write the script, put it in the template, and audit ten charts a month.

Cost-sharing deserves its own front-desk script. A patient who calls back to ask why a seven-minute phone call generated a bill is a legitimate complaint, and complaints about billing surprises escalate into records requests and, occasionally, into privacy complaints when the patient starts asking who else saw the note. Tell patients up front that a brief check-in may be billed and may involve a copay.

Every Channel a Check-In Travels Through Is a Vendor Question

Here is where the 98016 CPT code description stops being a billing topic and becomes a privacy one. The code contemplates "communication technology." Your practice has to name the specific technology, list the vendor behind it, and confirm a Business Associate Agreement is in place. OCR's telehealth enforcement discretion ended in 2023; there is no remaining grace period for using a consumer platform without an agreement.

Audio-only calls on staff-owned phones

A clinician calling from a personal mobile phone is not, by itself, a business associate problem — the carrier is generally treated as a conduit. The problems are downstream: call-recording apps, voicemail transcription services that route audio to a third party, contact lists that sync to a personal cloud account, and the absence of any log your biller can use to verify duration. If duration matters to the descriptor and duration lives only in a personal call history, you have a documentation gap and a device-management gap in the same place.

Portal messaging, texting, and store-and-forward

Secure messaging platforms, SMS reminder tools, telephony providers with cloud recording, transcription and ambient documentation vendors, and any answering service that takes clinical callbacks all create or receive PHI on your behalf. Each one needs an executed BAA. Review OCR's telehealth and HIPAA guidance and compare it against your actual vendor inventory rather than the inventory you remember approving.

If that comparison turns up a gap — and in most practices running virtual check-ins, it does — close it before the next encounter. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, one-time purchase, no subscription. That is faster than waiting three weeks for a vendor's legal team to send back their template, and it gives you a document you actually control.

The vendor list nobody maintains

Assign one person to own the inventory and give them a quarterly calendar reminder. For each vendor, record: what PHI it touches, BAA execution date, subcontractor language, breach-notification timeline, and where the signed copy lives. Auditors and OCR investigators ask for signed agreements, not for assurances that one exists somewhere.

Minimum Necessary Inside a Seven-Minute Call

Brief check-ins invite oversharing. A clinician working from memory rather than the chart may confirm details the patient did not ask about, or discuss the wrong patient entirely when the callback list is long. Two controls help: verify identity with two elements before any clinical discussion, and require the chart to be open on screen before the call connects.

Also address the environment. A clinician taking callbacks from a shared workroom, a car, or a home office with family within earshot creates incidental disclosure risk that no BAA covers. Put it in policy, mention it in annual training, and include it in your risk analysis. HHS and NIST's SP 800-66r2 maps Security Rule requirements to practical safeguards if you need a framework for documenting those decisions.

The Check-In Note Belongs to the Designated Record Set

When a patient requests their records, the brief check-in note comes with them. So do portal message threads containing clinical content. Call recordings, if you keep them, are records too — and if your telephony vendor retains recordings you cannot easily retrieve, you have created an access obligation you cannot fulfill inside the required timeframe.

Test this. Ask your records custodian to produce every virtual check-in note and associated message thread for one patient over the past year. Time it. If it takes longer than an hour, fix retrieval before a patient forces the issue. HHS's right of access guidance is the standard your response will be measured against, and access failures remain among the most consistently enforced provisions in OCR's history.

A 30-Day Cleanup for Practices Already Reporting 98016

Week 1. Confirm G2012 is retired from every pick list, superbill, and fee schedule. Pull the current PFS status for 98016 and each payer's written policy. Document who verified it and when.

Week 2. Write the consent script and the duration-documentation requirement into your encounter template. Train the clinicians who take callbacks. Assign the post-call hold to a named scheduler role.

Week 3. Inventory every technology channel a check-in can travel through. Match each to a signed BAA. Escalate the gaps.

Week 4. Audit twenty charts against the descriptor elements: established patient, seven-day lookback documented, no next-day E/M, duration recorded, consent recorded. Report the pass rate to your compliance committee and set a threshold for re-audit.

Close the Gaps Before the First Records Request

The 98016 CPT code description is short. The operational footprint behind it is not: scheduling data, a consent script, a duration log, a vendor inventory, and a retrievable record. Handle those five and the code is routine. Skip any of them and you have built a workflow that generates claims your documentation cannot support and disclosures your agreements do not cover.

Start with the vendor list, because it is the one item you cannot retroactively fix after an incident. Get a Business Associate Agreement drafted and signature-ready for every platform your check-ins touch, and if your broader documentation set — risk analysis, policies, workforce training records — has drifted since your last review, automate the compliance document set rather than rebuilding it by hand in a spreadsheet.