Your April schedule has 140 Annual Wellness Visit slots on it, and a third of them were booked by an outreach vendor that pulled a list of Medicare patients out of your EHR last month. That vendor also collects the health risk assessment by text link before the visit. If you cannot say, from memory, whether a signed Business Associate Agreement covers that arrangement, your AWV Medicare program has a privacy problem sitting underneath a revenue win.

This guide is for the administrator, biller, or privacy officer who owns the Annual Wellness Visit workflow end to end. It walks the operational mechanics — eligibility clocks, required elements, documentation, code selection ownership — and then makes explicit where PHI moves, which vendors touch it, and what you owe a patient or a payer who asks for the record.

What the AWV Medicare Benefit Actually Is on Your Schedule

Medicare defines the Annual Wellness Visit through two HCPCS codes: G0438 for the initial AWV and G0439 for subsequent AWVs. Separately, the Initial Preventive Physical Examination — the "Welcome to Medicare" visit, G0402 — is available only during a beneficiary's first 12 months of Part B enrollment.

The AWV is not a head-to-toe physical. The benefit is built around a health risk assessment, a review of medical and family history, a list of the patient's current providers and suppliers, routine measurements, screening for cognitive impairment, a depression and functional-safety risk review, a personalized prevention plan, and a written screening schedule looking out over the next several years.

That distinction drives your front-desk script. Patients hear "wellness visit" and expect a physical; when the clinician documents an AWV instead, the complaint lands on your desk, not the exam room's. Script it at booking and again at check-in.

The Eligibility Clock Nobody Checks Until the Denial Arrives

The AWV is a once-per-12-month benefit, and CMS counts it by month, not by calendar year. A patient seen in March 2025 becomes eligible again in March 2026 — 11 full months must pass after the month of the prior visit. There is also a sequencing rule between the IPPE and the initial AWV that your billers should have in writing.

Build the eligibility check into pre-visit prep, not post-visit billing. Someone on your team should verify last-AWV history through your Medicare Administrative Contractor's provider portal or your clearinghouse eligibility response before the patient walks in. Assign it by name: a scheduler, a pre-visit coordinator, or the biller who works the next-day list.

One operational note with privacy consequences: staff who query eligibility portals routinely screenshot the results and drop them in a shared network folder. Those screenshots are PHI. If your program relies on them, the folder needs the same access controls, logging, and retention rules as any other chart location — and it should appear in your data inventory.

AWV Medicare Eligibility and Elements, in Four Lines

Who qualifies: A Medicare Part B beneficiary who has had Part B for more than 12 months and has not received an AWV in the past 12 months.

How often: Once per 12 months, counted from the month of the last AWV.

What it includes: A health risk assessment, history and provider list, height/weight/BMI/blood pressure, cognitive impairment detection, depression and functional-safety risk review, a personalized prevention plan, and a written screening schedule.

What the patient pays: When the visit meets Medicare's requirements and is billed as a covered preventive service, there is no coinsurance and no deductible. Cost sharing can appear if a separately reportable problem-oriented service is furnished the same day.

The Pre-Visit HRA Is Where PHI Leaves Your Building

Almost nobody collects the health risk assessment on paper anymore. It arrives through a patient portal message, a texted form link, a tablet in the lobby, or a phone call from a vendor's staff two days before the appointment. Every one of those channels is a disclosure path.

Map them. For each channel, write down the vendor name, what data elements it collects, where the data rests, how long it rests there, and whether the vendor can see identified responses. HRA content is unusually sensitive: fall history, alcohol use, mood, memory concerns, home safety, and — if you are also capturing a social determinants of health risk assessment, which CMS made separately payable under G0136 beginning in 2024 — housing instability, food insecurity, and transportation gaps.

Five Questions for Your HRA or Forms Vendor

  • Is there an executed BAA, and does it cover the specific product you are using — not just the parent company's older contract?
  • Does the vendor use HRA responses for its own analytics, product development, or population reports sold to others? De-identification claims need to be specific about method.
  • Where do completed responses live after they land in your chart, and can you order deletion?
  • Are subcontractors involved — SMS gateways, cloud hosting, translation services — and does the BAA flow obligations down to them?
  • Does the texted link expose PHI to anyone holding the phone, and does the vendor's notification path meet your breach notification timelines if their platform is compromised?

Outreach Lists, Texting, and the Line You Should Not Cross

Recall and gap-closure outreach for an AWV Medicare program is treatment and health care operations activity. You do not need an authorization to contact your own patients about a preventive service they are due for. What you do need is minimum necessary discipline in the message itself.

Keep diagnoses, medication names, and screening results out of texts and voicemails. "You're due for your Medicare wellness visit — call us to schedule" is fine. Anything that reveals a condition to whoever picks up the phone is an unnecessary disclosure, and it is the kind that generates complaints.

The harder line is vendor incentive. If an outreach or care-gap vendor is compensated by a third party for steering patients toward a product, or is using your patient list to market its own services, you have crossed from operations into marketing, and HIPAA's marketing rules apply. Read the vendor's data-use clause before you read its pricing page.

When You Outsource the Visit Itself

A growing number of practices run AWVs through outside clinical staff — contracted nurse practitioners, telehealth panels, or a vendor that performs the visit, documents in your EHR, and drops a coded encounter into your billing queue. Operationally, this works. Contractually, it is where BAA gaps concentrate.

Decide, in writing, whether that vendor is a business associate or part of your workforce. A staffing arrangement where you direct and supervise the clinician's work looks like workforce; a company that performs a service on your behalf using your PHI, with its own supervision and its own systems, is a business associate and needs an agreement before the first login is provisioned. HHS publishes sample business associate agreement provisions that show the required elements, though the sample deliberately leaves out the operational terms you actually want — audit rights, deletion on termination, subcontractor disclosure, and notification timing.

If you are onboarding an AWV vendor this quarter and do not have counsel on retainer for a routine contract, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase, not a subscription, which matters when you need one agreement in place before a Monday go-live rather than a platform commitment.

Two more items on the outsourced-visit checklist. First, EHR access: give vendor staff scoped roles, not shared credentials, and put their accounts on your quarterly access review. Second, offboarding: when the contract ends, someone must actually disable those accounts. Terminated-vendor accounts left active are a recurring finding in the incident summaries posted on the OCR breach portal.

Documentation, Code Selection, and Who Owns Which Part

Your coders and clinicians determine code selection from what the documentation supports — the required elements, the time spent, and any separately reportable services. Administratively, your job is to make sure the record contains what a reviewer would look for and that the routing of that record is defined.

A workable division of labor:

  1. Scheduler: verifies benefit eligibility and last-AWV date; sets patient expectations at booking.
  2. Pre-visit coordinator: confirms HRA completion, chases missing responses, loads the provider/supplier list.
  3. Clinician: documents the required elements, the personalized prevention plan, and the written screening schedule, and notes any additional service furnished.
  4. Coder/biller: reviews documentation, selects codes and modifiers, and flags encounters where the elements are incomplete before the claim goes out.
  5. Privacy officer: owns the vendor list, the BAA file, and the annual review of which systems hold HRA data.

Same-Day Problem Visits and the Patient Statement Problem

When a clinician addresses an acute or chronic problem during the same encounter, a separately reportable service may be documented and billed alongside the AWV. The patient then sees cost sharing on a visit they were told was free. Your front desk absorbs that call.

Fix it in two places: a check-in disclosure that explains when additional charges can apply, and a billing-side review that confirms the documentation actually supports two distinct services before the statement mails. Advance care planning is a related case — CMS guidance describes cost sharing being waived for advance care planning when it is furnished on the same day as an AWV and reported with modifier 33. Get your MAC's current guidance in writing and keep it in the billing binder. CMS's Medicare Learning Network is the source of record your staff should cite, not a vendor webinar deck.

Records Requests: The Prevention Plan a Patient Asks For

The personalized prevention plan and written screening schedule are part of the designated record set. When a patient — or an adult child with a valid authorization — asks for them, the HIPAA right of access applies: 30 days, in the form and format requested if readily producible, with fees limited to a reasonable, cost-based amount.

The complication is location. If the HRA and the prevention plan live in a vendor's portal rather than your EHR, your release-of-information staff need a documented path to retrieve them inside the 30-day window. Test that path before someone requests it under deadline. Vendors that take three weeks to answer a data-export ticket turn your access obligation into your violation.

Also decide who fulfills advance directive copies. Those documents get scanned, forwarded to hospitals, and handed to family members. Route them through the same authorization checks as any other disclosure.

Payer Audits and What Your Team Hands Over

Preventive service claims draw documentation requests. Disclosures to a MAC, a CERT contractor, or a Recovery Audit Contractor for payment and oversight purposes are permitted — you do not need patient authorization — but they still need to be minimum necessary and, in some cases, tracked.

Build a standing audit-response packet definition: which note types, which HRA pages, which screening schedule, which eligibility verification. Send that and nothing more. Whole-chart dumps in response to a single-encounter request are a habit worth breaking, and they widen your exposure if the transmission goes to the wrong fax number.

A 30-Day Cleanup Checklist for Your AWV Program

  • List every vendor that touches AWV data — scheduling, outreach, forms, transcription, coding, staffing — and match each to an executed, current BAA.
  • Pull three completed AWV encounters at random and confirm every required element and the prevention plan are documented and retrievable.
  • Time a records request for an AWV prevention plan end to end. If it exceeds two weeks, fix the retrieval path.
  • Review your outreach message templates for anything that discloses a condition.
  • Run an access review on external users with EHR credentials and disable anything stale.
  • Confirm your risk analysis reflects any HRA or outreach platform added in the last year. If your documentation set has drifted, tools that automate risk analysis reports and the supporting policy set will get you current faster than a spreadsheet rebuild.

An AWV Medicare program is one of the few workflows that adds revenue, closes quality gaps, and expands your vendor footprint at the same time. Do the vendor paperwork with the same seriousness you gave the scheduling template. If you are onboarding an HRA platform, an outreach service, or a contracted AWV clinician this month, build and export the Business Associate Agreement before the first record moves — one purchase, signature-ready, and one fewer gap for an auditor to find.