Your compensation committee sends you a spreadsheet in January. One physician bills 99214 on 71% of established-patient visits. Another sits at 38%. Someone asks you to "pull the RVUs and explain the gap." Before you open the report, understand two things: the 99214 RVU is a payment-methodology number, not a clinical verdict, and the file you are about to build contains protected health information tied to named patients and named providers.

This guide is for the administrator, billing manager, or privacy officer who has to produce that analysis. It covers how the 99214 RVU is constructed, where the current-year values actually live, how practices document level selection as an administrative process, and which vendors in that workflow need a Business Associate Agreement before they see a single line of your data.

What the 99214 RVU Is, in One Section

CPT 99214 is the office or other outpatient visit for an established patient at the fourth of five levels. Medicare pays it through the Physician Fee Schedule, which assigns every code three relative value units:

  • Work RVU — physician time, technical skill, effort, and stress. For 99214 this has been 1.92 since the 2021 office-visit overhaul.
  • Practice expense RVU — staff time, supplies, equipment, overhead. Split into facility and non-facility rates; the non-facility rate is higher because your practice absorbs the overhead.
  • Malpractice RVU — the smallest of the three, based on liability insurance costs by specialty.

Each component is multiplied by a Geographic Practice Cost Index for your locality, summed, then multiplied by the annual conversion factor to produce a dollar amount. Total non-facility RVUs for 99214 land in the neighborhood of 3.5, but the practice expense component is revalued every year, so a number you memorized in 2023 is wrong today.

Two things changed the arithmetic for 2026. First, statute now produces separate conversion factors for qualifying alternative payment model participants and everyone else, so "the" conversion factor is no longer a single number. Second, CMS continued reworking practice expense methodology in the CY2026 rule. Pull the values from the CMS Physician Fee Schedule Look-Up Tool for your locality and your year. Do not reuse last year's spreadsheet constants.

Why the same code produces different revenue in two offices

Same 1.92 work RVU. Different GPCI. Different place-of-service. Different payer contract, because most commercial contracts pay a percentage of the Medicare schedule and some use a frozen prior-year schedule. If your multi-site group compares "99214 revenue per provider" without normalizing for locality and site of service, the report is noise.

Where Your 99214 RVU Numbers Actually Come From

Assign an owner to each input. In most practices these live in four different systems and nobody owns the chain end to end.

  1. Code selection — originates in the clinical documentation, finalized by the provider or a certified coder.
  2. Charge capture — the practice management system, where the code becomes a claim line.
  3. RVU assignment — a lookup table inside your PM system or your analytics vendor's platform. This table has to be updated every January, and it is the single most common source of wrong RVU reporting.
  4. Benchmark comparison — an external survey dataset or a consultant's model.

Ask your billing lead one question this week: who updated the RVU table for 2026, on what date, and against what source file? If the answer is "the vendor does it automatically," get that in writing and verify one code by hand.

How Practices Document Level Selection Without Practicing Medicine

Since 2021, office and outpatient E/M level selection rests on either medical decision making or total time on the date of the encounter. Level 4 established-patient visits correspond to moderate MDM or 30–39 minutes of total time. Which of those applies to any given encounter is a clinical and documentation judgment the treating provider makes — not something your billing office decides after the fact, and not something this article can tell you.

What your practice can control is the process around it:

The four artifacts an auditor will ask for

  • A written coding policy stating that providers select the level and that coders may query but not upcode or downcode unilaterally.
  • A documented query workflow, with the query text retained in the record and the provider's response attributable to the provider.
  • Periodic internal review — a defined sample size, a defined cadence, a named reviewer, and a written result.
  • Evidence of remediation when a review finds a pattern: education delivered, date, attendees.

When someone asks why Dr. A's 99214 rate is 71%, the defensible answer is "here is our review of 25 of her encounters and here is the reviewer's finding," not "she is above the benchmark." Distribution curves are a screening tool. They are not evidence about any individual chart.

Your RVU Dashboard Is a PHI System, Whether Anyone Labeled It One

Here is where most practices get sloppy. The productivity report that drives compensation is built from claim-level data: patient identifier, date of service, diagnosis, procedure code, rendering provider. Under HIPAA that is protected health information. Billing and payment are permitted uses under treatment, payment, and health care operations — but the permission does not suspend the rest of the rule.

Three obligations attach immediately:

Minimum necessary. A compensation committee needs aggregate RVUs by provider by month. It does not need patient names, dates of birth, or diagnosis strings. HHS guidance on the minimum necessary requirement expects you to define role-based access and limit disclosures to what the purpose requires. Build the aggregate view once and stop emailing the underlying extract.

Access controls that match the report. If your analytics tool grants "read all claims" to anyone who can view a dashboard, your access matrix is wrong. Practice administrators, coders, and department chairs need different scopes. Document who has each scope and review it when someone changes roles.

Disposition of the extract. The CSV a manager exported to build a 99214 RVU trend chart is now an unmanaged copy of PHI sitting in a downloads folder or a shared drive. Your policy should say where extracts may live, how long they persist, and who deletes them. If they live on a laptop, encryption is not optional in practice, and neither is a documented device inventory.

Every Vendor Touching Your 99214 RVU Data Needs a BAA

Walk the workflow and count the outside parties. A typical mid-size practice finds five to nine:

  • The billing company or RCM service submitting claims
  • The clearinghouse routing them
  • The outsourced or contract coder reviewing charts
  • The ambient documentation or transcription tool sitting in the exam room
  • The analytics or benchmarking platform that renders the RVU dashboard
  • The compensation consultant who receives provider-level production files
  • The external audit firm running your annual coding review
  • The cloud host and backup provider underneath all of it

Each one that creates, receives, maintains, or transmits PHI on your behalf is a business associate and requires a written agreement before access begins. HHS's business associate guidance is explicit that the relationship is defined by function, not by job title or by whether the vendor calls itself a technology company.

The consultant is the one practices miss. A compensation advisor who receives provider-level production data derived from claims is handling PHI unless you have genuinely de-identified it first — and stripping patient names is not de-identification. If you cannot point to the executed agreement, stop the data transfer today and paper it. If your current template is a decade old and silent on breach notification timelines, subcontractor flow-down, and return or destruction at termination, generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, and it takes less time than the email thread you are about to start with legal.

The three contract clauses that matter for coding vendors specifically

  1. Scope of permitted use. May the vendor use your claims data to build or improve its own benchmarking product? If the contract is silent, assume they will and negotiate it explicitly.
  2. Subcontractor flow-down. Offshore coding subcontractors are common. Your BAA must require equivalent written agreements downstream, and you should ask for the list.
  3. Return or destruction. Name the deadline in days after termination and require written certification. Otherwise a departed vendor keeps five years of your encounter data indefinitely.

When an RVU Review Turns Into a Records Request

Coding reviews generate the same charts patients ask for. When a patient submits a right-of-access request, the 30-day clock applies regardless of whether those charts are currently in an auditor's queue. Two operational rules keep you out of trouble:

Your designated record set does not include the internal audit memo about a provider's coding pattern — that is an operations work product. It does include the underlying clinical documentation and the billing records. Train whoever fields requests to distinguish them, and write the distinction into your access policy so the decision is not improvised at the front desk.

Second, if an outside auditor holds the only annotated copy of a chart, your response timeline depends on their responsiveness. Put a retrieval SLA in the engagement letter. Fifteen business days is a reasonable ask.

A 60-Day Plan You Can Hand to Someone

Days 1–10. Billing manager verifies the 2026 RVU table against the CMS look-up tool for three sample codes, including 99214, and documents the check. Confirm which conversion factor applies to your group.

Days 11–25. Privacy officer inventories every export path out of the PM system. For each destination, record the recipient, the fields transmitted, the business purpose, and whether a signed BAA exists. Expect surprises.

Days 26–40. Close the BAA gaps. Execute agreements before restoring any paused data flow, not after.

Days 41–60. Rebuild the compensation report as an aggregate view with role-based access. Delete the standing CSV exports. Document the retention rule for anything that must persist.

The 99214 RVU is a number you look up. The governance around it is the part that gets audited — by CMS, by a payer, or by OCR after someone emails a production file to the wrong address. If your broader policy set, risk analysis, and workforce training documentation are as stale as your RVU table was, automating the compliance document set is a faster path than another year of good intentions. Start with the vendor inventory this week; the contracts follow from it.