Your billing lead walks in with a one-line problem: visit volume was flat in January, but average collections per established-patient visit dropped. Nobody changed the fee schedule. Nobody changed the clinicians. The number moved anyway. If you cannot explain the 99213 RVU and the three levers sitting behind it, you cannot answer that question — and you cannot tell whether the drop came from a Medicare update, a locality adjustment, a payer contract term, or a coding pattern shift.

This guide is for practice administrators, billing managers, and compliance leads. It covers how the 99213 RVU is built, who on your staff owns each moving part, and — the part most RVU articles skip entirely — why RVU reporting becomes a protected health information problem the moment your analytics stop being aggregate. Code selection itself is a clinician and certified-coder determination; nothing here tells you which code fits which visit.

How Much Is the 99213 RVU?

CPT 99213 carries a work RVU of 1.30, unchanged since the 2021 overhaul of the office and outpatient evaluation and management code family. Add the practice expense RVU and the malpractice RVU, and the total non-facility RVU lands a little above 2.0; the facility total is lower, because the practice expense component shrinks when the site of service supplies the overhead.

Total RVUs are not dollars. Each of the three components is multiplied by a geographic practice cost index (GPCI) value for your Medicare locality, summed, and then multiplied by the annual conversion factor. That means two practices billing the identical code receive different Medicare allowables based on locality alone.

Do not treat any RVU figure — including the ones above — as a standing fact. Verify current values against the CMS PFS Relative Value Files or the Physician Fee Schedule Look-Up Tool for the current year and your locality. That verification step belongs to a named person in your practice, on a calendar date.

The Formula Your Billing Team Should Be Able to Write on a Whiteboard

Every Medicare allowable under the fee schedule follows the same shape:

  1. Work RVU × work GPCI
  2. Plus practice expense RVU × PE GPCI (using the non-facility or facility PE RVU, depending on where the service was furnished)
  3. Plus malpractice RVU × MP GPCI
  4. Total × conversion factor = allowable

Four inputs can move without anyone in your office touching a thing: the RVU values, the GPCIs, the conversion factor, and the facility-versus-non-facility flag on the claim. For CY 2026, CMS finalized separate conversion factors for qualifying alternative payment model participants and for everyone else, along with adjustments affecting the work RVUs of certain service categories. Which conversion factor applies to your clinicians is not a coding question — it is a participation question, and it changes your modeling.

The Place-of-Service Flag Is a Revenue Control, Not a Clerical Field

Because the practice expense component differs between settings, a place-of-service code entered wrong shifts the allowable. If your practice runs hospital-based clinics, provider-based departments, or shared space arrangements, assign one person to reconcile place-of-service against the actual site of service on a sample of claims each month. Document the sample size and the error rate. That documentation is what you hand an auditor instead of an explanation.

Why the 99213 RVU Matters Beyond Medicare

Most commercial contracts you sign are RVU-derived even when they never say "RVU." A contract priced at a percentage of the current Medicare fee schedule inherits every RVU and conversion factor change automatically. A contract priced off a fixed year's schedule does not — and that gap is where practices quietly lose ground for years.

Pull your top five payer contracts and answer three questions for each: Which fee schedule year is referenced? Does the contract float with the current year or lock to a base year? What notice period applies before a payer can substitute a different schedule? If your billing manager cannot answer those from memory, the answers are not being managed.

Internally, the 99213 RVU also drives compensation. Work RVU-based productivity models pay clinicians on work RVUs, not collections, which means the 1.30 work value flows straight into payroll. When work RVU values change, compensation plans built on a fixed dollars-per-work-RVU rate change in effect without renegotiation. Flag that for whoever owns clinician contracts.

How Practices Determine and Document Code Selection

Since 2021, office and outpatient E/M levels are selected using either the level of medical decision making or the total practitioner time on the date of the encounter, with a medically appropriate history and exam. 99213 sits at the low-complexity decision-making tier or the corresponding time range for established patients. Which path a clinician uses is the clinician's call; your job is to make sure the documentation supports the path used.

Operationally, that means three things:

  • A written coding policy stating that level selection rests with the treating clinician, that certified coders may query but not upcode, and that time-based selection requires the total time to be documented in the note.
  • A routine internal review — monthly or quarterly — of a fixed sample of established-patient visits, comparing note content against the billed level. Record who reviewed, how many charts, and what was found.
  • A distribution review. Compare your practice's mix across the established-patient levels against your own trailing history. A shift in your own curve is a signal to look at documentation and training, not evidence of a problem by itself.

Keep the review findings in a compliance file, not scattered across email threads. If a payer or the OIG ever asks how you monitor coding accuracy, a dated log of samples and outcomes is the answer.

The Moment Your RVU Report Becomes PHI

RVU values are public data. Your RVU reports usually are not.

A summary that says "Dr. Alvarez generated 412 work RVUs in February" is a business record. The encounter-level export that produced it — patient account numbers, dates of service, diagnosis codes, CPT codes, payer, allowed amount — is protected health information under HIPAA, and it does not stop being PHI because it lives in a spreadsheet labeled "productivity."

Three failure patterns show up repeatedly in practices of every size:

1. The Analyst Spreadsheet That Nobody Inventoried

Someone in finance builds a monthly RVU workbook. It pulls a full claims extract, sits on a local drive or a personal cloud folder, and gets emailed to three people. It is not in your asset inventory, it is not encrypted at rest, it has no access log, and it was never covered in a risk analysis. That workbook is a reportable breach waiting for a lost laptop.

2. Access That Exceeds the Question Being Asked

The HIPAA Privacy Rule's minimum necessary standard applies to internal uses, not just external disclosures. A compensation calculation needs clinician, date, code, and RVU value. It does not need patient names, addresses, or full diagnosis narratives. If your reporting tool hands every manager a full claims view because that was the easiest permission to configure, you have a minimum necessary problem documented in your own access control list.

3. Benchmarking Submissions Sent Without De-Identification

Practices join specialty benchmarking programs and send encounter-level files to get comparative RVU-per-clinician data back. Unless that file is de-identified under the Safe Harbor method or an expert determination, or the recipient is a business associate under a signed agreement, you have made a disclosure you cannot defend. Check what you are actually transmitting, field by field.

If your risk analysis does not currently list your reporting database, your BI dashboard, and the finance workbooks by name, you have a gap that is easy to close on paper and expensive to leave open. Tools that automate HIPAA risk analysis and the supporting policy set exist precisely because keeping that inventory current by hand is the task everyone postpones.

Vendor Implications: Everyone Who Touches Your RVU Data

Map this list against your business associate agreement file before the next quarter closes:

  • Revenue cycle management companies. They hold your claims data by definition. Confirm the BAA is current, names subcontractors or requires notice of them, and addresses offshore processing if any exists.
  • Coding auditors and consultants. A consultant reviewing 50 charts to assess established-patient level distribution is a business associate. A signed engagement letter is not a BAA.
  • Analytics and BI platforms. If the platform ingests claim lines, it is in scope. Ask where the data rests, who at the vendor can query it, and whether your instance is logically separated.
  • Compensation administration vendors. Work RVU feeds often carry more fields than the calculation needs. Reduce the feed.
  • Clearinghouses. Long-standing business associates that frequently have the oldest, thinnest agreements in the file.

HHS guidance on business associate obligations is the baseline. Where you find a vendor with no agreement on file, close the gap immediately — a signature-ready business associate agreement takes less time to produce than the phone call explaining why one is missing.

A 30-Day Assignment Sheet

Days 1–7 — Billing manager. Verify current-year RVU values for your highest-volume codes, including the 99213 RVU, against the CMS relative value files for your locality. Confirm which CY 2026 conversion factor applies to each clinician. Record the source file name and date pulled.

Days 8–14 — Administrator. Pull the top five payer contracts. Document the referenced fee schedule year and whether rates float. Escalate any contract locked to a base year more than two years old.

Days 15–21 — Compliance lead. Inventory every system, dashboard, and spreadsheet that contains encounter-level claims data. For each, name the owner, the access list, the encryption status, and whether it appears in the current risk analysis.

Days 22–30 — Compliance lead and administrator together. Reconcile the inventory against the BAA file. Reduce over-broad report permissions to the fields the calculation actually requires. Log every change with a date and a signature.

The 99213 RVU is a small number that touches payroll, payer contracts, internal audits, and at least five vendor relationships. Treat it as an operational control with named owners rather than a figure someone looks up once a year, and both the revenue answer and the privacy answer get easier. If your reporting systems and vendor list are not yet reflected in a current risk analysis, generate the risk analysis and policy set before your next quarterly review and start the assignment sheet from a documented baseline.