A commercial payer sends your office a letter requesting 25 charts. All 25 are established-patient office visits billed at level 3. You have 30 days to respond, the requesting entity is a contractor you have never heard of, and your billing company holds the claim data while your EHR holds the notes. That is the moment when coding 99213 stops being a coder's problem and becomes an administrator's problem.

This guide covers the operational mechanics of how practices select, document, and defend that code — and then makes the privacy, records-handling, and vendor implications explicit. It is administrative guidance for practice managers, billing leads, and privacy officers. It is not clinical guidance, and it does not tell you what code fits a given patient encounter. That determination belongs to your clinicians and certified coders.

What Coding 99213 Requires Since the 2021 E/M Rewrite

99213 is a CPT code for an office or other outpatient visit for an established patient. Before 2021, level selection leaned on counting history and exam bullet points. That scoring method is gone for the 99202–99215 family.

Since January 1, 2021, level selection for these codes rests on one of two things: the level of medical decision making (MDM), or the total time the reporting practitioner spends on the encounter on the date of service. History and exam still have to be medically appropriate and documented — they just no longer drive the level.

The practical consequence for your operation: your chart template must support both paths, because your clinicians will use both, sometimes within the same session. CMS maintains its payment and policy material for these services under the Physician Fee Schedule, and CPT code definitions themselves come from the AMA. Your compliance library should contain the current-year version of both, not a 2021 printout someone saved to a shared drive.

The Time Path

When time drives the selection, CPT defines a total-time range for each level. For 99213, that range is 20–29 minutes of total time on the date of the encounter; 99212 sits at 10–19 minutes and 99214 at 30–39 minutes. Countable time includes the reporting practitioner's own pre-visit chart review, the face-to-face or telehealth encounter, documentation, and same-day care coordination. It excludes staff time and time spent on separately reported services.

Operationally, the failure mode is a template that auto-inserts "Total time: 25 minutes" on every note. That is a phrase, not documentation. Auditors compare stated time against EHR audit-log timestamps, appointment slot length, and the volume of encounters that day. When 40 notes claim 25 minutes and the schedule ran 15-minute slots from 8:00 to 5:00, the arithmetic answers for you.

The MDM Path

When MDM drives the selection, three elements are in play: the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications or morbidity from management decisions. Two of the three must meet or exceed the level being reported. 99213 corresponds to a low level of MDM.

The administrative job is making the note show the reasoning, not the conclusion. "Reviewed outside labs" tells an auditor nothing. Naming what was reviewed and what it changed does. Your coders cannot infer data complexity that the clinician did not write down, and they should never be asked to.

Is 99213 Based on Time or Medical Decision Making?

Either. For established-patient office visits, the practitioner may select the level using total time on the date of the encounter (20–29 minutes for 99213) or the level of medical decision making (low, meeting two of three MDM elements). Only one method is used per encounter, and the note should make clear which one supports the level reported. History and exam are performed and documented as medically appropriate but do not determine the level. Practices document the chosen basis in the note itself so a reviewer does not have to guess.

Building the Audit Packet Without Overdisclosing

Payer audits of 99213 are common because it is consistently among the highest-volume evaluation and management codes reported to Medicare Part B and to commercial plans. High volume plus a level immediately below a higher-paying level makes it a natural target for utilization comparison. Expect requests. Build the workflow before one arrives.

Assign these roles in writing:

  • Intake owner (usually the practice manager): logs the request date, calculates the response deadline, and verifies who is actually asking.
  • Verification owner (privacy officer): confirms the requesting entity's authority — is it the health plan itself, or a contractor acting as the plan's business associate? Get that in writing on letterhead with a contract reference before a single page leaves the building.
  • Assembly owner (billing lead): pulls the note, the claim, the encounter-level charge detail, and any orders or results referenced in the note.
  • Review owner (coder or contracted auditor): reads each packet against the level reported and flags mismatches before submission, not after.
  • Transmission owner: sends through the payer's secure portal or SFTP. Never a personal email account, never an unencrypted attachment, never a fax to a number nobody verified.

Minimum Necessary Applies to Audit Responses

Disclosing records to a health plan for payment purposes is permitted without patient authorization. That permission is not a license to send the entire chart. HHS guidance on the minimum necessary standard requires you to limit the disclosure to what is reasonably needed for the stated purpose.

In practice: if the request names 25 dates of service, send 25 encounters. Do not export a full longitudinal record because it is one click faster. Redaction is not required for permitted payment disclosures, but scope discipline is — and a coversheet listing exactly what you sent, page-counted, protects you when the payer later claims a document was missing.

One quiet exception worth flagging to your team: if any of those encounters touch substance use disorder treatment records governed by 42 CFR Part 2, the consent rules are stricter than HIPAA's. Route those to your privacy officer before assembly, not after.

The Vendors Who Touch Every 99213 You Bill

Walk one claim from encounter to payment and count the outside entities that see PHI along the way. A typical small practice list looks like this:

  • The EHR or practice management host
  • An ambient documentation or transcription tool that drafts the note
  • A billing company or RCM vendor that scrubs and submits the claim
  • A clearinghouse
  • An outside coding auditor or consultant reviewing E/M level distribution
  • A patient statement and payment processor
  • A collections agency for aged balances
  • An offshore subcontractor working under one of the above

Every one of those is a business associate, and each needs a signed agreement in place before it receives PHI. HHS explains the scope in its business associate guidance. The one most practices miss is the subcontractor tier — your billing company's offshore coding team is not covered by your agreement with the billing company unless that agreement obligates downstream BAAs. Ask for confirmation in writing. Ask annually.

The coding auditor deserves special attention. Practices bring in outside reviewers precisely because they are nervous about their level distribution, and in the hurry to get an opinion, the charts go out under a consulting engagement letter with no privacy terms at all. If you are onboarding a reviewer, an ambient scribe, or a new billing partner this quarter, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — rather than waiting three weeks for a contract redline you will not read closely anyway.

Ambient Scribes and the Time-Documentation Problem

AI documentation tools raise two distinct issues at once. The privacy issue is straightforward: the vendor is a business associate, the audio is PHI, and you need to know whether recordings are retained, for how long, and whether they are used to train models. Get the answer in the agreement, not the sales deck.

The coding issue is subtler. Some tools generate a suggested E/M level. A suggestion is not a determination. Your policy should state plainly that the billing practitioner reviews and attests to the level and the basis for it, and that vendor-suggested codes are never submitted unreviewed. Document who holds that responsibility, because in an audit the vendor will not be standing next to you.

When a Patient Asks Why They Were Billed a Level 3

Patients increasingly compare their explanation of benefits against the visit length. Your front desk will field the question. Two operational facts matter.

First, billing records are part of the designated record set. Under the HHS right of access guidance, a patient can request the note and the billing detail for a specific date of service, and you generally have 30 days to respond, with one permitted 30-day extension on written notice. "We don't release coding information" is not a defensible answer.

Second, if the patient believes the code is wrong, that is a billing dispute, not an amendment request — unless they are asserting the record itself is inaccurate, in which case the amendment process applies and you must respond within 60 days. Train the difference. The two paths have different owners, different forms, and different clocks.

Disclosures to a health plan for payment do not require an accounting of disclosures entry. Requests from an attorney, an employer, or a life insurer are a different category entirely and need authorization review.

A Quarterly Review Cadence That Catches Drift Early

Run this every quarter. It takes a half day and it is the cheapest insurance you will buy.

  1. Pull your E/M distribution by practitioner for established-patient visits. Compare each clinician against the practice average and, where available, against published specialty benchmarks. You are looking for shape, not a target number.
  2. Sample 10 charts per clinician. For each, confirm the note states whether time or MDM supports the level, and that the stated basis is actually documented.
  3. Cross-check time claims against audit logs on a small sample. Timestamps that contradict stated total time are the single most damaging finding an outside auditor can make.
  4. Check modifier use. Where a separately reportable procedure occurred on the same day, confirm the documentation supports a distinct service. Administrative review only — your coder makes the call.
  5. Reconcile your vendor list against your BAA file. Any name in the workflow without a current signed agreement gets escalated the same week.
  6. Log the findings and the remediation. Undocumented internal review is worth very little when someone asks what you did about a pattern you already noticed.

If your policy set, risk analysis, and vendor inventory live in three different formats maintained by two people who have both left, the reconciliation step will fail every quarter. Tools that automate risk analysis and the underlying policy document set exist for exactly that reason. Whatever you use, the requirement is the same: a current, dated, retrievable record.

Two Files, One Set of Facts

The habit that survives both a payer audit and a patient records request is the same habit: write the basis for the level in the note, at the time of the encounter, in the clinician's own words. Coding 99213 defensibly is not about volume, benchmarks, or template phrasing. It is about whether a stranger reading the chart 18 months later can see how the level was reached.

Everything else is logistics — who verifies the requester, who assembles the packet, who transmits it securely, and whether every vendor in the chain signed an agreement before they saw a single chart.

Before your next coding review or billing vendor onboarding, put the paperwork in front of the workflow: build and export a signature-ready BAA for each entity that will touch your encounter data, and keep the executed copies where the person answering the audit letter can find them in under five minutes.