A 71-year-old established patient calls your front desk in January and asks to schedule "my yearly physical." Your scheduler books it, your provider performs it, your biller submits it, and six weeks later the patient is at your window holding a bill for $310 and asking why Medicare denied a preventive visit. That sequence is one of the most common billing complaints a primary care practice fields, and it starts with a misunderstanding of the 99397 CPT code description.

This guide is for the person who owns that problem: the practice administrator, the billing lead, the privacy officer who ends up mediating the complaint. It covers what the code descriptor actually says, how practices build workflows around it, and — because this is a compliance blog — the records-handling and vendor obligations that a preventive-visit program quietly creates.

What the 99397 CPT Code Description Actually Says

CPT 99397 sits in the preventive medicine services family. The descriptor covers a periodic comprehensive preventive medicine reevaluation and management of an individual, including an age- and gender-appropriate history, examination, counseling and anticipatory guidance, risk factor reduction interventions, and the ordering of appropriate laboratory and diagnostic procedures — for an established patient, 65 years and older.

Three elements of that descriptor drive everything downstream in your workflow: periodic, established patient, and the age band. Miss any one of them and the claim goes out wrong.

The age bands are the whole point

Preventive medicine codes are stratified by age, and the established-patient series runs in parallel with the new-patient series. Your coders work from a grid that looks roughly like this:

  • Established patient: 99395 (18–39), 99396 (40–64), 99397 (65 and older)
  • New patient: 99385 (18–39), 99386 (40–64), 99387 (65 and older)

Age is determined as of the date of service, not the birthday closest to it. A patient who turns 65 in March and presents in February falls into a different band than the same patient in April. Practices that run birthday-triggered recall campaigns need that logic built into the outreach rule, not left to a scheduler's judgment.

"Established" follows the standard three-year rule for professional services from the same specialty in the same group. If your practice recently merged, absorbed a retiring physician's panel, or added a new tax ID, your new-versus-established determinations need a written rule and a documented review — this is one of the most audited distinctions in outpatient billing.

Does Medicare Cover CPT 99397?

No. Medicare does not pay for routine annual physical examinations; they are excluded by statute, which means the exclusion is not a medical-necessity judgment and cannot be overcome with better documentation. Instead, Medicare Part B covers a different set of visits:

  • G0402 — the Initial Preventive Physical Examination ("Welcome to Medicare"), available within the first 12 months of Part B enrollment
  • G0438 — the initial Annual Wellness Visit
  • G0439 — subsequent Annual Wellness Visits

These are not the same service as the one the 99397 CPT code description contemplates. The Annual Wellness Visit is built around a health risk assessment and a personalized prevention plan; it does not require a comprehensive head-to-toe examination. Patients routinely conflate the two, and so do schedulers who have not been trained on the difference.

Because the exclusion is statutory, an Advance Beneficiary Notice is not mandatory — but issuing a voluntary ABN is standard defensive practice, and many groups make it non-negotiable before any Medicare patient is seen for a service billed under 99397. Confirm current fee-schedule and modifier handling through the CMS Physician Fee Schedule Look-Up Tool rather than relying on a payer rep's phone answer.

The Front-Desk Script That Prevents the Surprise Bill

Most preventive-visit billing complaints are scheduling failures, not coding failures. Give your schedulers a decision tree and a script, and audit adherence quarterly.

Three questions before the appointment is booked

  1. Primary coverage? If Medicare is primary, the scheduler routes to a wellness visit slot, not a physical slot, and flags the chart for the voluntary ABN.
  2. When was the last preventive visit? Commercial plans define "annual" differently — some by calendar year, some as 365 days from the prior date of service. Your eligibility check should surface which one applies before the patient walks in.
  3. Any problems you want addressed at this visit? If yes, the patient hears the cost-sharing explanation up front, in plain language, before the visit — not after.

Document the script in your policy binder and keep dated versions. When a patient files a billing complaint that escalates to a state attorney general or a payer grievance, the version of the script in effect on the date of service is the artifact that matters.

When a Preventive Visit Becomes Two Services

A patient arrives for a comprehensive preventive visit and also wants three weeks of new symptoms addressed. Practices commonly report a preventive medicine code alongside an office visit E/M code with modifier 25 appended to the problem-oriented service. That is an administrative convention, not a clinical instruction — the treating clinician determines what was medically necessary and what was documented, and your role is to make sure the documentation supports whatever was reported.

What your compliance program can standardize:

  • Separation in the note. Many practices require visually distinct sections — preventive findings and counseling in one, the problem-focused history, exam, and medical decision-making in another. A single blended paragraph is the finding that shows up in every modifier 25 audit.
  • Diagnosis linkage. The preventive line carries a routine examination diagnosis; the problem line carries the condition-specific diagnosis.
  • Prospective review. Sample modifier 25 claims monthly before submission for the first two quarters after any policy change, then move to retrospective sampling.
  • Written escalation path. Coders need a documented way to query a clinician without appearing to lead the answer. Keep the query template in your compliance manual.

Never let a coder or administrator select a code on clinical grounds. Your job is to confirm the documentation supports the reported code and to send it back when it does not.

Where the 99397 CPT Code Description Meets Your Privacy Obligations

A comprehensive preventive visit generates an unusually dense record. That is the operational point of the service — and the privacy problem.

Screening instruments are PHI, and they are sensitive PHI

The counseling and risk-reduction components of a preventive visit typically produce completed screening tools: depression and anxiety instruments, alcohol and substance use questionnaires, fall-risk and cognitive assessments, sexual history, intimate partner violence screens, advance directive discussions. These arrive on paper at the front desk, get scanned, and then live in three places at once — the paper original, the scanner's temporary cache, and the chart.

Write a destruction step into the intake workflow. Scanned screening forms should be shredded the same business day, and your shredding vendor needs a signed business associate agreement because the forms are legible until they are not.

The EOB problem nobody schedules for

A preventive visit billed to a plan generates an explanation of benefits mailed to the policyholder. For an adult child on a parent's plan or a spouse on a partner's plan, that document can disclose services the patient expected to keep private.

Patients have the right to request confidential communications by alternative means or at an alternative location, and covered entities must accommodate reasonable requests. Your intake packet should offer that option affirmatively rather than burying it in the Notice of Privacy Practices. Review the current OCR guidance on individual rights at HHS.gov and make sure your front desk knows who approves those requests and how the alternate address is flagged in the practice management system.

Recall campaigns and tracking pixels

Preventive visits drive recall outreach — "you're due for your annual." Appointment reminders fall within treatment and health care operations, but the moment a third-party platform sends them, that platform is handling PHI. The same applies to the "Schedule Your Annual Physical" landing page on your website: analytics and advertising trackers on pages tied to scheduling have drawn sustained OCR attention, and the safest posture is to strip third-party trackers from any authenticated or scheduling-adjacent page and document the decision.

The Vendor List a Preventive-Visit Program Creates

Sit down with your billing lead and inventory who touches a single 99397 claim from scheduling to payment posting. A typical primary care practice lands on:

  • Eligibility and benefits verification service
  • Clearinghouse
  • Outsourced billing company or coding consultant
  • Patient outreach and recall platform (SMS, email, or IVR)
  • Document scanning and paper shredding vendor
  • Reference lab and imaging center interfaces
  • Patient statement and print-mail vendor
  • Payment processor and patient financing partner
  • External coding auditor

Every one of those is a business associate. Pull your BAA file and check three things for each: a current signature, a subcontractor flow-down clause, and breach notification timing that gives you enough runway to meet your own 60-day obligation. If any vendor on that list is operating on a handshake or an expired agreement, close the gap now — you can generate a signature-ready business associate agreement through a guided six-step wizard and export it as PDF or DOCX the same afternoon. HHS publishes sample BAA provisions if you want to compare required elements line by line.

Then check the public OCR breach portal against your vendor names before renewal. It takes ten minutes and occasionally changes a contract decision.

Denials, Audits, and the Records Requests That Follow

Preventive visit denials cluster in predictable places: frequency limits, age-band mismatches, new-versus-established errors, and modifier 25 edits. Each denial category needs a named owner and a turnaround target.

Build a monthly one-page report: denials by reason code, average days to rework, and the percentage overturned. If frequency denials dominate, the fix is in eligibility verification, not in billing. If modifier 25 denials dominate, the fix is in documentation templates.

Expect records requests to follow. Patients disputing a bill often request the full visit note, and payers conducting post-payment review request charts in batches. Both trigger obligations. Patient requests run on the 30-day access clock. Payer requests run on minimum necessary — send the encounter documentation supporting the claim, not the entire longitudinal chart, and log what you sent and when.

A 30-Day Cleanup Plan

  1. Week 1: Pull 25 preventive claims from the last quarter. Verify age band, patient status, and modifier 25 documentation against the note.
  2. Week 2: Rewrite the scheduling script. Train the front desk and document attendance.
  3. Week 3: Complete the vendor inventory above. Match each name to a signed, current BAA.
  4. Week 4: Audit the paper trail — scanned screening forms, shredding logs, alternate-communication flags in the PM system.

If the vendor step exposes more gaps than you expected, that is normal, and it is fixable in a day. Generate the agreements you are missing at baa.hipaa.app — one-time purchase, no subscription — and if the same audit reveals your risk analysis and policy set have drifted, hipaa.app handles that document package. Understanding the 99397 CPT code description is the billing half of the job. The vendor file is the other half, and it is the one that gets examined after something goes wrong.