A 52-year-old new patient books a "complete physical" for next Thursday. Before she reaches the exam room, your practice has run an eligibility inquiry through a clearinghouse, pushed a 14-page intake questionnaire through a patient-portal vendor, and queued a lab interface order. The visit itself may take 45 minutes. The data trail it creates will outlive the encounter by six years or more.

This guide covers the 99386 CPT code description from the operator's chair: what the code says, how your staff verifies the age band and new-patient status, how split preventive-plus-problem visits get documented under your internal policy, and — the part most coding articles skip — which vendors touch the screening data and whether you have a signed agreement with each of them.

The 99386 CPT Code Description in One Paragraph

CPT 99386 describes an initial comprehensive preventive medicine evaluation and management service for a new patient aged 40 through 64 years. The service includes an age- and gender-appropriate history and examination, counseling, anticipatory guidance, and risk-factor reduction interventions, plus the ordering of appropriate laboratory and diagnostic procedures. It sits in the new-patient preventive series that runs 99381 through 99387 by age band, with a parallel established-patient series at 99391 through 99397. The code is time-independent and driven by patient status and age at the date of service, not by encounter length.

Where 99386 Falls in the Series

  • 99381–99387: new patient, infant through 65 and older
  • 99386 specifically: new patient, ages 40–64
  • 99391–99397: established patient, same age bands

Your role is not to decide whether a preventive service was clinically indicated. Your role is to confirm that what gets reported matches what the documentation supports, that patient status was verified against your practice management system rather than someone's recollection, and that payer-specific policy was checked before the claim went out.

Two Front-End Checks That Cause Most 99386 Denials

Age at the Date of Service

The age band is 40 through 64. A patient who turns 65 between scheduling and the visit moves out of the band. Practices that schedule preventive visits eight or ten months out see this regularly. Build the check into your pre-visit workflow: whoever runs the two-day-out eligibility sweep also confirms the patient's age on the appointment date, not the booking date.

New Versus Established

CPT treats a patient as new when no physician or qualified health professional of the same specialty and subspecialty in the same group practice has provided a face-to-face professional service within the prior three years. That is a database question, not a memory question. If your practice has multiple locations, a recently acquired satellite office, or locum coverage, the three-year lookback needs to run across the whole tax ID and specialty grouping.

Assign this explicitly. In most practices the registration lead owns the lookback and the billing lead owns the audit sample — pull twenty preventive claims a quarter and re-verify status against the encounter history. When the sample shows drift, the fix is usually a registration script, not a coder correction.

Coverage Reality: Why 99386 Rarely Goes to Medicare

Routine physical examinations are statutorily excluded from Medicare coverage. Medicare instead recognizes its own initial preventive physical examination and annual wellness visit codes, which have their own required elements and frequency limits. The 40–64 age band overlaps with Medicare beneficiaries who qualify through disability or end-stage renal disease, so a 52-year-old on Medicare is not unusual in a primary care panel.

That creates a financial-communication obligation. When a service is statutorily excluded, a mandatory advance notice is not required, but many practices issue a voluntary notice anyway so the patient knows the visit will be self-pay before it happens. Put the decision in writing as practice policy and train the front desk to the script. Billing surprises generate complaints, and complaints often arrive as records requests — which starts a different clock entirely.

For commercial coverage, most non-grandfathered plans cover recommended preventive services without cost sharing, and preventive-service modifiers are commonly appended per payer instruction. Grandfathered plans, short-term products, and self-funded arrangements vary. Maintain a payer policy library with a review date on each entry, and name one person responsible for refreshing it. A stale policy file is the single most expensive document in a billing department.

When a Problem Shows Up During a Preventive Visit

A patient comes in for the comprehensive preventive service and mentions a knee that has been swelling for three weeks. The clinician addresses it. Now your practice has to decide, under its own documented policy and the payer's published rules, whether that constitutes a separately reportable problem-oriented service alongside the preventive code.

Do not let that decision get made ad hoc at the keyboard. Practices that handle this cleanly do three things:

  1. Write a documentation standard. The problem-oriented work should be identifiable as its own narrative — separate history, separate assessment, separate plan — not a sentence buried inside the preventive template.
  2. Route split visits to a coder. Any encounter reporting a preventive code plus an office visit code goes to a second set of eyes before release, at least until your error rate stabilizes.
  3. Track the split rate by clinician. If one provider splits 8% of preventive visits and another splits 60%, that is a training and audit signal, not a coding mystery.

Keep the framing administrative. Your compliance program does not determine what the clinician should have addressed. It determines whether the record supports what was reported and whether the patient was told, in advance, that a second charge might apply.

The Data a Preventive Visit Generates — and Everyone Who Touches It

Here is where the 99386 CPT code description stops being a billing topic and becomes a privacy topic. A comprehensive preventive encounter for an adult typically collects, in one sitting: family history, occupational and environmental exposures, tobacco and alcohol use, substance use screening, depression and anxiety screening, sexual history, intimate-partner-violence screening, and immunization status.

That is one of the most sensitive data concentrations your practice creates all year. Then it moves. Inventory the actual path:

  • Digital intake or pre-visit questionnaire vendor
  • Patient portal and secure messaging platform
  • Ambient documentation or transcription service
  • Reference lab and its results interface
  • Clearinghouse for eligibility and claims
  • Revenue cycle management or outsourced billing firm
  • Statement print-and-mail vendor
  • Appointment reminder and recall/outreach platform
  • Population health or care-gap reporting tool
  • Offsite backup and IT managed services provider

Ten vendors is a conservative count for a mid-size primary care practice. Each one that creates, receives, maintains, or transmits protected health information on your behalf is a business associate, and each needs a written agreement with the required elements.

Your Vendor List Is Longer Than Your BAA Folder

Run the comparison this week. Pull the vendor list above, then pull your executed agreements. In most practices that exercise turns up two or three gaps — usually the newest tool, the one a clinician signed up for directly, or the reminder platform that came bundled with something else.

HHS publishes sample business associate agreement provisions that spell out the required terms, but sample text is not a signature-ready contract. If you need to close gaps quickly and consistently, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, which matters when you are papering three vendors at once rather than running a program.

Log every executed agreement with the vendor name, effective date, subcontractor flush-down language status, and the internal owner. When a vendor breach notification arrives, that log is the first thing you will need and the last thing you will want to assemble under pressure.

Minimum Necessary Applied to a Screening Questionnaire

The screening battery from a preventive visit tends to travel farther than it should. Three specific failure points:

Referrals. When your staff sends records to an orthopedic consult, the packet should not include the full intake questionnaire with substance use and IPV screening. Build a referral packet template that pulls defined elements, and train staff to the template rather than to "send the chart." HHS guidance on the minimum necessary requirement is the standard to anchor that policy to.

Portal proxy access. If a spouse holds proxy access to an adult patient's portal account, they may be able to view screening responses the patient answered privately. Audit adult proxy grants at least annually and require re-authorization rather than letting grants persist indefinitely.

Substance use records. The federal alignment of substance use disorder confidentiality rules with HIPAA carries a compliance date of February 16, 2026 — under three weeks from now. If any part of your organization operates as a covered program under those rules, your notice of privacy practices, consent forms, and redisclosure handling need to reflect the aligned requirements. If you are not certain whether the rules reach you, that determination belongs to counsel, not to a coder.

The Records Request That Follows a Preventive Visit

Patients request records after preventive visits more than after any other encounter type — for life insurance underwriting, employment physicals, disability paperwork, and second opinions on incidental lab findings.

HIPAA gives you 30 days to act on an access request, with one 30-day extension available if you notify the individual in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount. Review the HHS right of access guidance and confirm your fee schedule and log actually match it.

Two operational traps specific to preventive encounters:

  • Scope. A request for "my physical results" reaches the designated record set — questionnaires, lab reports, portal messages, and the clinical note — not just the encounter summary your EHR prints by default.
  • Delay. Holding results pending a clinician callback can implicate information blocking rules. Review the information blocking framework and document any exception you intend to rely on before you rely on it, not afterward.

A 30-Day Cleanup Plan Around Preventive Visit Codes

  1. Days 1–5. Registration lead documents the age-band and three-year lookback check in the pre-visit script. Billing lead pulls twenty preventive claims and verifies patient status.
  2. Days 6–10. Payer policy library refreshed for preventive coverage, modifier instruction, and split-visit rules. Owner and review date recorded on each entry.
  3. Days 11–15. Written internal policy for preventive-plus-problem documentation, plus a routing rule sending every split claim to coder review.
  4. Days 16–22. Vendor inventory reconciled against executed business associate agreements. Gaps papered. Log updated with owners.
  5. Days 23–26. Referral packet template locked down. Adult portal proxy grants audited.
  6. Days 27–30. Access request log reviewed for turnaround time and fee consistency. Front-desk financial script for statutorily excluded services rehearsed.

None of that requires new software. It requires named owners and dates, which is the part that usually goes missing.

Start With the Paper You Can Fix Today

The 99386 CPT code description is straightforward: new patient, ages 40 through 64, comprehensive preventive service. The exposure is not in the code — it is in the ten vendors that touch the screening data and the agreements you may not have on file for all of them.

Close that gap first. Build your Business Associate Agreement with a guided six-step wizard and export it for signature in an afternoon, then work outward to your risk analysis and policy set once the contracts are current. Documentation you can produce on demand is worth more than documentation you intend to write.