A patient books an annual physical for the first week of January. Your scheduler puts it on the template as a preventive visit, your clinical staff rooms the patient, and by Thursday the claim leaves your practice management system with the 99396 CPT code on it. Between the phone call and the payment posting, that encounter has passed through your eligibility vendor, your clearinghouse, possibly an outsourced coding team, your statement printer, and your patient portal. Each of those is a records-handling decision, not just a billing one.

This guide is for the administrator who owns that pipeline. It covers how practices operationally determine and document preventive medicine code selection, where denials come from, and which vendor agreements have to be in place before the first January claim goes out.

Quick Answer: What Is the 99396 CPT Code?

The 99396 CPT code is the preventive medicine evaluation and management code for an established patient between 40 and 64 years of age. It sits in a family organized by patient status and age band: 99395 covers established patients 18–39, 99397 covers established patients 65 and older, and the 993x6 series (99386) covers new patients in the same 40–64 band.

The code describes a comprehensive, age- and risk-appropriate preventive service including anticipatory guidance, risk factor reduction counseling, and ordering of appropriate laboratory or diagnostic procedures. "Comprehensive" here is a coding convention tied to the preventive service description, not the same construct as the history and exam levels used in problem-oriented E/M. Whether the documentation supports the code is a determination your clinician and coder make together against the CPT descriptor and your payer's policy — not something an administrator assigns from the schedule type.

The Three Checks Your Scheduler Makes Before the Visit

Most preventive-visit rework traces back to something that could have been caught before the patient arrived. Build these three checks into the scheduling script and the pre-visit worklist.

1. Established versus new

A patient is established when they have received a face-to-face professional service from the same physician or from another physician of the same specialty and subspecialty in the same group within the prior three years. Your scheduler cannot eyeball this. Pull the last date of service and the rendering provider's specialty from the practice management system, and record what you found.

2. Age on the date of service

Age bands are the single most common source of preventive denials. A patient who turns 65 in March will not stay in the same band all year. Some practices run a monthly report of upcoming preventive appointments where the patient's age crosses a band boundary within 60 days, and flag those charts for the coder before the claim drops.

3. Benefit and frequency

Run the eligibility transaction and document what it returned: whether a routine physical benefit exists, whether the plan uses calendar-year or 12-month-plus-one-day frequency, and whether the patient has already used it. Save the response in the encounter, not in a shared inbox. That record becomes your evidence when a patient disputes a balance nine months later.

Medicare Patients Do Not Fit This Code Family the Same Way

Medicare Part B does not cover routine physical examinations as a preventive medicine service. Medicare beneficiaries instead have the Initial Preventive Physical Examination and the Annual Wellness Visit, billed with their own HCPCS codes and governed by their own frequency and element requirements published by CMS.

Operationally, that means your Medicare preventive workflow is a separate template, a separate documentation prompt, and a separate financial script. If a Medicare patient requests a full physical beyond the wellness visit elements, your practice needs a written, signed advance notice explaining that the service is not a covered benefit and quoting the patient's expected charge. Have your compliance lead approve that form language once and lock it in the document library. Front-desk improvisation on non-coverage notices is how complaints start.

When a Problem Comes Up During a Preventive Visit

A patient scheduled for a physical mentions worsening reflux. The clinician addresses it. Now you have two potential services on one date, and a decision that has to be documented rather than assumed.

The mechanics: when a significant, separately identifiable problem-oriented E/M service is performed on the same day as a preventive service, practices report the appropriate problem-oriented E/M code with modifier 25 alongside the preventive code. The threshold for "significant and separately identifiable" is a clinical documentation judgment. Your job as an administrator is to make sure the documentation supports whatever gets billed — separate assessment, separate plan, work above and beyond the preventive service.

Two operational controls belong here. First, a standing internal audit sample of modifier 25 claims — ten charts a quarter is enough to spot a drift. Second, a front-desk script for the moment the patient sees two lines on their statement, because a preventive visit with zero cost sharing plus a problem visit with a copay generates predictable calls. Write the script, train to it, and log the calls.

Denials on the 99396 CPT Code and the Rework They Create

Track preventive denials as their own bucket in your denial report. Four categories cover most of the volume:

  • Frequency exhausted. The patient had a physical eleven months ago under a plan that requires a full twelve months plus a day.
  • Patient-status mismatch. A new-patient code billed for someone seen within three years, or the reverse.
  • Age band mismatch. The code does not match age on the date of service.
  • Diagnosis linkage. The routine-examination diagnosis your payer policy expects was not attached, or the abnormal-findings variant was needed and was not used.

Assign an owner and a turnaround time to each category. In most small practices the billing lead works frequency and age denials directly; anything requiring a documentation change goes back to the rendering clinician, never to the coder acting alone. Record who changed the code and why. Your practice management audit log should make that reconstructable a year later, because a records request or an audit will eventually ask.

The Self-Pay Restriction Most Practices Miss

Under the HIPAA Privacy Rule, when a patient pays out of pocket in full for a health care item or service and asks you not to disclose information about it to their health plan, you must honor that restriction. Preventive visits attract these requests — a patient may not want a specific screening or counseling service reflected in plan records.

This is an operational problem, not a legal one. Your billing system will happily sweep the encounter into the next claim batch unless someone stops it. Build a hard flag: an account-level or encounter-level hold, a written note of the restriction and the date, confirmation that payment cleared in full, and a second set of eyes before the batch runs. Also decide in advance what happens if the patient later asks you to release it. Document the process in your policies and train the two or three people who can set the flag. HHS's minimum necessary guidance is the right frame for how narrowly billing staff should see restricted encounters at all.

Every Hand That Touches a Preventive Claim Is a Vendor Question

Write out the path a single preventive claim takes through your practice. A typical list looks like this:

  1. Eligibility and benefits vendor (270/271 transactions containing patient identifiers)
  2. Practice management or RCM platform host
  3. Outsourced coding or charge-entry contractor, sometimes with offshore subcontractors
  4. Clearinghouse
  5. Statement print-and-mail vendor
  6. Patient payment processor and portal
  7. Appointment reminder and recall messaging vendor
  8. Whoever hosts your document storage and backup

Every one of those is a business associate creating, receiving, maintaining, or transmitting protected health information on your behalf, and each needs a written agreement before the data flows. HHS's business associate guidance is the baseline. Two questions to add to your intake for each vendor: does the statement or reminder text include CPT descriptors or diagnosis language, and does the vendor use subcontractors, including offshore, that need their own downstream agreements?

If your vendor list has grown faster than your paperwork — new statement printer, new payment processor, a coding contractor added during a staffing gap — you can produce a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, as a one-time purchase rather than another subscription. Close the gaps before your next preventive-visit push, not after.

Recall Campaigns and the Marketing Line

January recall lists are built from exactly the data preventive billing generates: last physical date, age, plan. Reminders about an appointment or about care the patient is due for generally fall within treatment and health care operations. A campaign promoting a third party's product or service, or one paid for by that third party, is a different animal and may require authorization.

Have your privacy officer review recall message templates before they go out, confirm the messaging vendor is under agreement, and keep the list generation inside your systems rather than exported to a spreadsheet on someone's laptop. Also confirm the vendor's breach obligations in writing — a misdirected recall batch is a reportable event, and unregulated health apps and vendors outside HIPAA face separate obligations under the FTC's Health Breach Notification Rule.

When the Patient Asks for the Billing Record

Patients who dispute a preventive charge frequently ask for records next. Billing and payment records maintained by the practice are part of the designated record set, and the right of access clock runs 30 days from the request, with one permitted 30-day extension and written notice. Your fee has to be reasonable and cost-based.

Practical setup: one intake point for access requests, one log with request date, response due date, and what was released. Train the front desk that "I want my chart and my bill" is a formal request and gets logged the same day. Review the HHS right of access guidance with your team annually — access failures remain one of the most reliably enforced areas of the Privacy Rule.

A Two-Week Setup Checklist

  • Days 1–3: Pull last year's preventive denials, bucket them, assign owners.
  • Days 4–6: Update scheduling scripts for the three pre-visit checks; add the age-band crossover report.
  • Days 7–9: Map every vendor touching a preventive claim; confirm a current signed agreement for each.
  • Days 10–12: Test the self-pay restriction flag end to end with a dummy account.
  • Days 13–14: Sample ten modifier 25 charts and document the review.

Preventive visit volume is predictable, which makes it the easiest place in your revenue cycle to fix workflows before they generate complaints. The 99396 CPT code touches your schedulers, your coders, your clinicians, and half your vendor list — treat it as a systems problem, not a coding trivia question.

When you finish the vendor map, close the paperwork the same week: generate the business associate agreements you're missing and file them with the contract, or build out the broader policy and risk analysis document set your preventive workflow already assumes exists.