A payer sends your practice a letter requesting 25 charts. Every one of them is an established-patient office visit billed at level five. You have 30 days to respond, the records live in three systems, and your billing company wants to handle the upload. That is the moment the 99215 cpt code stops being a billing question and becomes a compliance question.

This guide is for the administrator, billing manager, or privacy officer who has to build the workflow behind that letter. It covers what the code represents administratively, how practices document and defend level selection, and — the part most billing articles skip — how the records move out the door without creating an impermissible disclosure or an unpapered vendor relationship.

What the 99215 CPT Code Represents on Your Claim

99215 sits at the top of the established-patient office and outpatient evaluation and management range (99211–99215). It is a professional service code for a visit with a patient your practice has already seen, at the highest level of the five-tier set.

Since the January 1, 2021 restructuring of the office visit E/M codes, level selection no longer turns on history and exam bullet counts. History and physical exam are performed and documented as medically appropriate, but they do not drive the level. Two things do: medical decision making, or total time on the date of the encounter.

The two selection paths your coders work from

Under the medical decision making path, CPT describes 99215 as requiring a high level of MDM, evaluated across three elements — the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications from management decisions. Two of the three elements must meet the high threshold.

Under the time path, CPT defines 99215 by a range of 40 to 54 minutes of total time spent on the date of the encounter, including qualifying non-face-to-face work by the reporting clinician. Beyond that range, practices look to prolonged services reporting; Medicare and commercial payers do not always use the same prolonged services code, and your fee schedule mapping should reflect that.

CMS publishes its own administrative guidance on these definitions in the Medicare Learning Network Evaluation and Management Services Guide. Keep the current edition in your billing team's shared reference folder and date-stamp it, because payer interpretations shift and your staff needs to know which version they were trained on.

Nothing here tells you which code fits a given encounter. That determination belongs to the treating clinician and your certified coders working from the documentation in front of them. Your job as an operator is to build the process that makes the determination reproducible and the records defensible.

How Do Practices Support a 99215 CPT Code Claim?

Practices support a level-five established patient claim by documenting, in the encounter note itself, whichever selection path the clinician used:

  • If MDM drove the level: the problems addressed at the visit and their status, the specific data reviewed or ordered and the analysis performed, and the management options considered including risk.
  • If time drove the level: a total time statement for the date of the encounter, an accounting of the activities included, and a note that the time was spent by the reporting clinician.
  • In both cases: an attestation or signature with a reliable timestamp, no unattributed copy-forward text, and an audit trail in the EHR showing who authored and who amended the note.

A compliant response to a payer request reproduces exactly that documentation — nothing less, and, importantly, nothing more than the payer is entitled to receive.

Why Level-Five Codes Draw Review Faster Than Anything Else in Your Office

Payers and contractors build utilization profiles by specialty and by rendering provider. A practice whose distribution of established-patient visits skews toward the top of the range relative to peers will surface in comparative billing analysis. That is not an accusation of anything — it is a statistical trigger, and it is how Targeted Probe and Educate reviews, recovery audit contractor requests, and commercial payer pre-payment edits typically begin.

The operational consequence is that your practice should assume level-five documentation will be read by an outside reviewer at some point. Build for that reader. If your note requires institutional knowledge to interpret, it will not survive a desk review conducted by someone who has never met your patients.

The internal audit cadence that actually gets done

Quarterly, pull a sample of five to ten encounters per rendering provider across the established-patient range. Have a coder who did not code the original claim re-abstract the documentation and note which selection path they would have followed. Record agreement rate. Feed disagreements back to the provider individually, in writing, within 15 business days.

Assign it to a named person. "The billing department" does not do internal audits. A person with a calendar reminder does.

When the Payer Asks for 25 Charts: Your Records-Release Runbook

HIPAA permits disclosure of protected health information for payment purposes without patient authorization. A payer audit of claims your practice submitted falls squarely inside that permission. The compliance risk is not whether you may respond — it is how much you send, how you send it, and who touches it on the way.

Your runbook should name a single release-of-information owner and specify these steps:

  1. Log the request the day it arrives: requester, contract or contractor name, claim numbers, date range, response deadline, and the statutory or contractual basis cited.
  2. Verify the requester. Audit-request phishing is real. Confirm the contractor against the payer's published vendor list or call a known number — never the number printed on the letter.
  3. Scope the pull to the dates of service and documentation elements at issue. A request about a specific encounter does not entitle the reviewer to the patient's entire longitudinal chart.
  4. Review before release. Someone with clinical-records judgment checks for substance use disorder records covered by 42 CFR Part 2, other-patient information accidentally scanned into a chart, and psychotherapy notes.
  5. Transmit securely through the payer's portal or an encrypted channel. Fax to an unverified number and unencrypted email are both avoidable failures.
  6. Retain proof of what was sent, to whom, on what date, and by what method — for at least six years.

Minimum necessary still applies here

The minimum necessary standard does not apply to treatment disclosures, but it does apply to payment and health care operations disclosures. That means a 25-chart audit response is exactly the situation the standard was written for. HHS guidance on the minimum necessary requirement is short enough to hand to your ROI staff as a one-page policy attachment.

Practically: define standard protocols for routine payer audit responses so your staff is not making the scope judgment fresh each time. "Encounter note, orders, results referenced in the note, and the claim" is a defensible default. "Print the whole chart" is not.

Every Hand That Touches Your Coding Is a Business Associate

Walk the path a level-five encounter takes through your organization and count the outside parties. An outsourced coding firm. A revenue cycle management vendor. The clearinghouse. An ambient documentation or scribe tool that drafted the note. A consultant you hired to audit your own E/M distribution before the payer does. A release-of-information company that fulfills records requests. A cloud storage account where somebody parked the audit response package.

Every one of those parties creates, receives, maintains, or transmits PHI on your behalf. Every one of them needs an executed business associate agreement before the first record moves — see HHS guidance on business associate contracts for what the agreement must contain.

The gap that shows up most often in practice audits is the ad hoc one. The coding consultant engaged for a six-week project. The billing company's new subcontractor. The former staff member now doing remote coding as a 1099 contractor. These relationships start with an email and a spreadsheet, not a procurement process, and the BAA never happens.

If you are chasing one of those gaps right now, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription. Get it executed before the consultant's first chart pull, not after.

Reconcile your vendor list against your data flows twice a year

List every system and service that touches encounter documentation or claims. Next to each, record the executed BAA date, the contract owner, and the renewal date. Anything without a date in the BAA column is a finding you open today, not next quarter. Practices that build this alongside their broader HIPAA risk analysis and policy documentation tend to catch the orphaned vendors, because the risk analysis forces the data-flow inventory that the vendor list depends on.

AI Scribes, Time Statements, and the Audit Trail You Are Already Creating

Ambient documentation tools change your audit posture in two directions at once. They produce richer notes, which helps a reviewer follow the MDM. They also produce a vendor-held transcript of the entire encounter, which is PHI your practice may not have inventoried.

Ask your documentation vendor four questions in writing: where is audio or transcript data stored, how long is it retained, is it used to train models, and can you configure deletion. Get the answers into the contract, not the sales deck. If the vendor retains transcripts, that retention is now part of your records footprint during any audit or litigation hold.

Separately, EHR audit logs matter for time-based coding. If the note says 47 minutes of total time and the system log shows the chart open for four, a reviewer will ask about the gap. Total time on the date of the encounter legitimately includes work outside the chart window — reviewing outside records, coordinating care, documenting later that day. Your providers should know to state what the time covered, so the log and the note tell the same story.

The Patient Who Disputes the Bill Also Has a Right of Access

A patient who receives an explanation of benefits for a level-five visit and thinks the appointment was shorter than that will call your front desk. Some of them will ask for the note.

That is a right of access request, and it runs on the standard 30-day clock with one 30-day extension available on written notice. Fee limits apply. Your front desk should not be arguing about the coding on that call — they should be logging the access request and routing it. HHS guidance on the individual right of access is the training document to use, and access failures remain among the most consistently enforced issues in OCR's portfolio.

Train the script: acknowledge, log, route to the ROI owner, confirm the delivery format the patient wants, and follow up in writing. Billing disputes and access requests are separate workstreams that arrive on the same phone call.

Assign These Five Things Before Your Next Audit Letter

  • Coding reference owner — maintains the current-year E/M guidance, distributes updates, documents training dates.
  • Internal audit owner — runs the quarterly re-abstraction sample and tracks agreement rate by provider.
  • Records release owner — executes the six-step runbook, verifies requesters, controls scope.
  • Vendor contract owner — maintains the BAA register and blocks data flow to any party without one.
  • Access request owner — runs the 30-day clock and the front-desk script.

One person can hold several of these roles in a small practice. Nobody can hold them implicitly.

If your review of the vendor register turns up a coding consultant, scribe tool, or RCM subcontractor without paperwork, close that gap first — draft and export a business associate agreement in an afternoon and get it signed before the next chart request lands. The documentation defending your 99215 cpt code claims is worth very little if the path it travels is undocumented.