A commercial payer's additional documentation request lands in your fax queue on a Tuesday. It names eleven dates of service, all billed with the 99214 CPT code, all from one clinician, and it gives you 30 days. Your billing company has the claims. Your EHR has the notes. Your transcription vendor has audio files nobody has thought about in two years. Somebody has to assemble a response that satisfies the payer without shipping more protected health information than the request actually requires.

This guide is for the person who does that assembly — the administrator, billing manager, or privacy officer. It covers how level selection gets documented, how to audit internally without creating new exposure, and which vendors in the chain need a signed business associate agreement before the next request arrives.

What the 99214 CPT Code Represents on Your Claim

99214 is the Current Procedural Terminology code for an office or other outpatient evaluation and management visit for an established patient at the fourth of five levels. It sits between 99213 and 99215 in the 99202–99215 family maintained by the American Medical Association.

Since the January 1, 2021 revision of the office/outpatient E/M guidelines, the level is selected on one of two bases: the level of medical decision making, or the total time the clinician personally spends on the encounter on the date of service. History and physical exam are still performed and documented as medically appropriate, but they no longer drive the level.

For 99214, CPT defines the time basis as 30–39 minutes of total time on the date of the encounter, and the medical decision making basis as a moderate level. Which basis applies to any given visit is a clinical determination made by the treating clinician and recorded in the note. Your job is to make sure the note supports whichever basis was used, and that the claim matches the note.

Time-Based Selection: What Counts and What Your Note Must Show

Total time under the current guidelines includes both face-to-face and non-face-to-face work the clinician personally performs on the date of the encounter — chart review before the visit, the visit itself, ordering, counseling, and documentation completed that day. Time spent by clinical staff does not count. Time spent on a separately reported service does not count.

Operationally, that means one thing for your templates: a note that says "30 minutes spent with patient" is weaker than one that states total time on the date of service and identifies the activities included. Ask your clinicians to record a specific number, not a range, and not a checkbox. Auto-populated timestamps pulled from EHR login duration are not the same thing as attested clinician time, and auditors know the difference.

MDM-Based Selection: The Three Elements

Medical decision making is scored across three elements: the number and complexity of problems addressed at the encounter, the amount and complexity of data reviewed and analyzed, and the risk of complications or morbidity from patient management. Two of the three must meet or exceed the level being reported.

Administratively, the failure point is almost always the data element. Clinicians frequently review outside records, discuss management with another professional, or order and independently interpret a test — and then never write it down. A note that documents the reasoning behind data review is doing compliance work, not just clinical work. Build the prompt into your template rather than chasing it during an audit.

CMS maintains the Physician Fee Schedule and related E/M policy guidance at cms.gov. Have your billing lead check it each January, because payment amounts, prolonged-service policy, and add-on code rules change on a calendar-year cycle.

Why the 99214 CPT Code Draws Audit Attention

Level 4 established-patient visits are among the highest-volume codes billed in ambulatory medicine. Volume plus discretionary level selection equals audit interest. Medicare Administrative Contractors, Recovery Audit Contractors, the CERT program, and commercial payer special investigations units all run utilization comparisons that flag clinicians whose distribution across 99212–99215 sits well outside their specialty peer group.

An outlier pattern is not by itself evidence of anything. A rheumatologist managing complex chronic disease will bill differently than an urgent care physician. But an outlier pattern with no internal audit history is a bad position to defend, because you have nothing to show that the practice was paying attention.

Run a quarterly internal review. Ten charts per clinician per quarter is a defensible baseline for a small practice. Document the sample size, the reviewer, the findings, and the corrective education. That file is the difference between "we found a problem and fixed it" and "we had no idea."

Running That Audit Without Creating a New Privacy Problem

Internal audits are health care operations under 45 CFR 164.506, so you do not need patient authorization. You do need to apply the minimum necessary standard, which HHS explains in its minimum necessary guidance.

Three habits that keep audits clean:

  • Do not export charts to spreadsheets on a laptop desktop. If your reviewer needs a worksheet, keep identifiers out of it — use account numbers, not names and dates of birth.
  • Log the access. Your EHR audit trail should show who opened which chart and why. If your reviewer is a contractor, their access should be provisioned and time-limited, not shared from a staff account.
  • Destroy working copies on a schedule. Audit worksheets are records. Assign a retention period and stick to it.

The 30-Day Records Workflow When an ADR Arrives

Assign this before you need it. A documentation request naming a batch of 99214 claims typically requires the office note, any orders and results referenced, the signed encounter, and sometimes the appointment log or time attestation.

  1. Day 1 — log it. Record the requester, date received, deadline, and claim list in a tracking log. Payer requests have hard deadlines and no grace period.
  2. Days 2–5 — scope it. Pull only the dates of service named. Do not send the full chart because it is easier. Sending a ten-year history in response to a request for one encounter is an over-disclosure you will have trouble explaining.
  3. Days 5–10 — review before sending. Have your coding lead read what you are about to submit. If a note does not support the level billed, you are better off knowing now and deciding on a voluntary refund than discovering it in a demand letter.
  4. Days 10–20 — transmit securely. Payer portals and secure file transfer beat fax. If you must fax, confirm the number against the request letter, not against memory.
  5. Day 20+ — retain the submission package. Keep an exact copy of what you sent and the transmission receipt. Appeals turn on this.

Disclosures to a health plan for payment purposes do not require an accounting under the Privacy Rule, but disclosures to a government oversight agency may fall into different categories depending on the authority cited. If a request arrives from OIG, a state Medicaid integrity unit, or a law enforcement agency rather than a payer, route it to your privacy officer before anything leaves the building.

Every Vendor That Touches a 99214 Claim Needs a BAA

Map the chain for a single level 4 established-patient visit and count the outside parties. A typical independent practice will find:

  • The EHR or practice management host
  • An ambient documentation or transcription vendor
  • An outsourced coding reviewer or certified coder contractor
  • A revenue cycle management or billing company
  • A clearinghouse
  • A denial-management or audit-defense consultant
  • A document scanning or release-of-information vendor
  • An IT managed service provider with backend database access

Each of those creates, receives, maintains, or transmits PHI on your behalf. Each requires a business associate agreement executed before access is granted. HHS publishes sample business associate agreement provisions that establish the floor — permitted uses, safeguards, subcontractor flow-down, breach notification timing, and return or destruction at termination.

The gap I see most often is the audit-defense consultant hired in a hurry. A payer request lands, the practice retains a coding expert on a Friday, and the expert gets EHR credentials on Monday with nothing signed. That is an unpermitted disclosure, and it is entirely avoidable. If you need a signature-ready agreement the same day you retain someone, a six-step BAA generator that exports to PDF and DOCX closes the gap in minutes — one-time purchase, no subscription, and no reason to grant access before it is executed.

Two contract terms worth negotiating specifically for billing vendors: a defined breach notification window measured in days rather than "without unreasonable delay," and an explicit obligation to produce claim-level records to you on request, including after termination. Practices that skip the second term discover the problem when they switch billing companies mid-audit.

When a Patient Asks About Their 99214 Charge

Billing records are part of the designated record set. A patient who asks for "everything you have about my visit" is entitled to the claim, the note, and the ledger — not just the clinical chart.

The HIPAA right of access gives you 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the new date. HHS covers the fee limits and format obligations in its right of access guidance. If the patient asks for an electronic copy and you maintain it electronically, you provide it electronically.

The Self-Pay Restriction Your Front Desk Should Know

Under 45 CFR 164.522(a)(1)(vi), a patient who pays for a service in full out of pocket can require you not to disclose information about that service to their health plan, and you must honor it. That request has to reach billing before the claim goes out. Build a flag in your practice management system and train the front desk to set it at check-in, not at the end of the month.

A 90-Day Assignment List

Days 1–30. Inventory every vendor that touches claims data. Match each against your executed BAA file. Anything without a current signed agreement goes on a remediation list with an owner and a date.

Days 31–60. Pull a distribution report of 99212–99215 by clinician for the prior twelve months. Review ten charts per clinician. Document findings and schedule education for any pattern that concerns you.

Days 61–90. Write the records-request runbook — who logs, who scopes, who reviews, who transmits, who retains. Test it with a mock request. Confirm your risk analysis reflects the systems where billing data lives; if that document is stale or missing, automated risk analysis and policy generation will get you to a defensible baseline faster than a blank template will.

None of this changes how a clinician selects a level. It changes whether your practice can prove, on 30 days' notice, that the note, the claim, and the vendor chain all line up. Start with the BAA file — it is the shortest task on the list and the one most likely to be incomplete. Generate the agreements you are missing this week, before the next documentation request tells you which ones they were.