A payer sends your office manager a letter requesting 20 charts for a prepayment review. Nineteen of them are established patient office visits billed at level four. Someone on your staff now has to pull notes, redact nothing, disclose exactly enough, log the disclosure, and hit a 30-day response window — all without touching the clinician's coding judgment. That is the operational reality behind the cpt code 99214 definition: it is not just a billing decision, it is a records-handling event with vendor and privacy consequences attached.

This guide is for practice administrators, billing leads, and privacy officers. It covers what the code definition requires administratively, who in your office touches it, which vendors end up holding the underlying PHI, and what happens when a patient or a payer asks to see the file.

What the CPT Code 99214 Definition Actually Says

CPT 99214 is the level four office or other outpatient visit for an established patient. It sits between 99213 and 99215 in the established patient series. New patient visits use a different range entirely, and confusing the two is one of the most common front-desk-to-billing handoff errors.

Since the 2021 overhaul of the office and outpatient evaluation and management guidelines, the code is selected on one of two bases: the level of medical decision making, or the total time the reporting clinician spends on the encounter on the date of service. History and exam are still documented as medically appropriate, but they no longer drive the code level. CMS publishes its own explanation of the current framework in the Medicare Learning Network Evaluation and Management Services Guide, which is the document your billing team should keep bookmarked.

The two roads: decision making or time

Under the medical decision making road, 99214 corresponds to a moderate level of MDM. MDM is scored across three elements — the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications or morbidity from management decisions. Two of the three must meet or exceed the level being reported.

Under the time road, the code corresponds to 30 to 39 minutes of total time spent by the reporting clinician on the date of the encounter. Total time includes qualifying non-face-to-face work on that calendar date — chart review before the visit, ordering, documenting, and coordinating care — but not staff time and not time already billed under another service.

Say this plainly to your billing staff and put it in writing: the clinician selects the code. Your administrative role is to confirm that the documentation on file supports what was selected, flag gaps, and route questions back to the clinician. Billing staff who change levels on their own authority create both a compliance problem and a chart integrity problem.

Quick Answer: The CPT Code 99214 Definition in One Paragraph

The cpt code 99214 definition, in current CPT terms, is an office or other outpatient visit for the evaluation and management of an established patient that requires a medically appropriate history and/or examination and either a moderate level of medical decision making or 30–39 minutes of total time spent by the reporting physician or other qualified health professional on the date of the encounter. It is the level four code in the established patient series (99211–99215). Code selection is a clinician judgment supported by contemporaneous documentation; administrative staff verify documentation completeness, not clinical appropriateness.

Who Touches the Code Between the Exam Room and the Clearinghouse

Map this once and post it. Most practices discover they have more hands on a single encounter than they assumed.

  • Front desk: confirms established versus new patient status based on the three-year rule and the same specialty/same group test. Errors here surface as denials weeks later.
  • Clinician: documents the encounter, attests to time if time is the basis, selects the code.
  • Scribe or ambient documentation tool: drafts the note. If this is a vendor product or a remote human scribe, PHI leaves your building.
  • Coding reviewer: internal or outsourced, checks documentation support against the level selected.
  • Billing/RCM staff: builds the claim, applies modifiers, submits.
  • Clearinghouse: transmits the claim to the payer.
  • Payer audit responder: whoever in your office pulls records when a review letter arrives.

Every one of those steps except the first two typically involves a third party. That is where the privacy work starts.

Time-Based Documentation Creates a Metadata Trail You Now Have to Govern

When a practice bills on time, auditors do not stop at the attestation line. They look for corroboration: EHR audit log entries, secure message timestamps, order entry times, telehealth platform session records. Your practice is effectively producing a secondary evidentiary record about clinician activity, and that record lives in systems your privacy officer may not have inventoried.

Three operational consequences follow. First, your EHR audit log retention setting matters — if logs roll off at 90 days and a payer requests records at month seven, you have an attestation with no corroboration. Second, telehealth session metadata sits with a vendor, which means a business associate holds part of your billing defense. Third, if you use an ambient documentation product, the audio or transcript may or may not be retained, and you need to know which before an auditor asks.

Write down, per system: what is logged, how long it is kept, who can export it, and whether export requires vendor involvement. Review it annually alongside your risk analysis.

Every Vendor in the 99214 Path Is a Business Associate

A coding audit firm reviewing your level four distribution is handling PHI. So is your clearinghouse, your outsourced billing company, your remote scribe service, your ambient note-generation vendor, and any consultant who reviews charts to advise on documentation patterns. Each one needs a signed business associate agreement in place before it receives PHI, not after the engagement letter is countersigned. HHS explains the scope of the relationship in its business associates guidance.

The gap I see most often in practice: the billing company has a BAA from 2016, but the coding audit vendor it subcontracted to last quarter does not appear anywhere in your files. Subcontractors need agreements too — your BA is responsible for flowing the obligations down, and your privacy officer should be asking for confirmation, in writing, at least once a year.

If you are onboarding a coding reviewer or a documentation vendor this month and do not have a current template, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX. It is a one-time purchase rather than a subscription, which suits practices that sign a handful of agreements a year rather than dozens.

What to keep in the vendor file

  1. Executed BAA with effective date and signature block.
  2. Written confirmation of subcontractor flow-down.
  3. The vendor's breach notification contact and stated timeline.
  4. A note on what PHI the vendor actually receives — full chart, encounter note only, or claim data.
  5. Termination provisions covering return or destruction of PHI.

Minimum Necessary When a Payer Asks for the Note

Disclosures for payment purposes do not require patient authorization, but they are still governed by the minimum necessary standard. A prepayment review of a level four visit needs the encounter note, relevant orders, and the time attestation — not the patient's entire longitudinal chart, and not unrelated specialty consults. HHS lays out the standard in its minimum necessary guidance.

Build a payer-audit response packet

Standardize it so the answer does not depend on who opens the mail:

  • Encounter note for the date of service in question, signed and dated.
  • Orders, results reviewed, and referral documentation tied to that encounter.
  • Time attestation where time is the basis for level selection.
  • Cover sheet listing exactly what is enclosed.
  • An internal log entry: date, requester, records sent, staff member responsible.

Assign one named backup. Audit letters arrive when the office manager is on vacation.

The Patient Who Disputes the Level and Then Requests the Chart

A patient sees a level four charge on an explanation of benefits for what felt like a ten-minute visit and calls your billing line. Handle the billing question, but recognize what often comes next: a records request.

Billing records are part of the designated record set. So is the encounter note. Under the right of access, you have 30 days to respond, with one 30-day extension available if you notify the patient in writing of the reason and the new date. The HHS right of access guidance is the authority your staff should be reading, not a summary someone pasted into a training deck in 2019.

Two things that trip practices up here. Fees must be reasonable and cost-based, and a records request cannot be conditioned on payment of an outstanding balance. And if the patient asks you to amend the note because they disagree with the documented content, that is an amendment request under the Privacy Rule — you have 60 days to act, with one 30-day extension, and a denial must be in writing with the patient's right to submit a statement of disagreement.

Coding disputes and amendment requests are different tracks. Train your front desk to recognize which one is in front of them.

A 90-Day Internal Review Cadence You Can Actually Run

You do not need an enterprise program. You need a repeatable loop.

  1. Month one, week one: pull the level distribution for established patient office visits by clinician for the prior quarter. Look at your own trend line over time, not just an external benchmark.
  2. Month one, week two: sample five encounters per clinician. Check documentation completeness — signature, date, time attestation if applicable, orders present.
  3. Month one, week three: route findings to each clinician individually and in writing. Documentation gaps, not coding verdicts.
  4. Month two: retrain on the specific gaps found. If three clinicians all omit time attestation language, that is a template problem, not a people problem.
  5. Month three: re-sample the flagged clinicians. Close the loop in writing.

Keep the review documents. If an external audit ever arrives, evidence of a functioning internal review process matters more than a perfect distribution curve.

Retention, Storage, and Where the Records Actually Sit

HIPAA requires six-year retention for required documentation such as policies, BAAs, and disclosure logs. Medical record retention itself is set by state law and payer contract, and those periods are frequently longer. Your billing records, audit responses, and internal coding review files should be governed by a single written retention schedule rather than three departmental habits.

Then confirm where those files live. Coding review spreadsheets on a shared drive, audit response PDFs in an email folder, and time-attestation exports on someone's laptop are all PHI locations that belong in your risk analysis. If your risk analysis and supporting policy set are overdue for a refresh, tools that automate the risk analysis and full compliance document set can shorten that project considerably — though the vendor inventory work still requires someone in your office who knows which contracts exist.

Start With the Vendor File

Take the workflow map above, list every third party that touches an established patient encounter from documentation through claim adjudication, and check each one against your BAA folder. Whatever is missing, close it this month — draft and export the agreement before the next chart leaves your network. The coding side of the cpt code 99214 definition belongs to your clinicians. The records-handling side belongs to you.