A 52-year-old new patient books an "annual physical." Your front desk verifies eligibility, the visit happens, and eleven days later the patient calls because they were billed $186 for something they were told was free. Somewhere in that chain, a preventive service billed under CPT code 99386 collided with a problem-oriented service, a plan's coverage rules, or an intake questionnaire nobody had a signed agreement to process.

This guide is for the person who owns that phone call: the practice administrator, the billing lead, the privacy officer. It covers the administrative mechanics of the preventive visit — who checks what, and when — and then makes explicit the records-handling and vendor exposure that a routine wellness encounter creates. It is not clinical guidance, and it does not tell you which code fits a given patient. That determination belongs to the rendering clinician and the documentation they produce.

What CPT Code 99386 Is, in Plain Administrative Terms

CPT code 99386 is the AMA CPT code for an initial comprehensive preventive medicine evaluation and management service for a new patient aged 40 through 64 years. It sits in the preventive medicine services family: 99381–99387 for new patients and 99391–99397 for established patients, each split by age band.

Three administrative facts drive selection within that family: the patient's age on the date of service, whether the patient is new or established under the three-year rule, and whether the documented service is a comprehensive preventive evaluation rather than a problem-focused visit. Your staff verify the first two. The clinician's documentation establishes the third. Preventive medicine codes are not selected by time or by medical decision-making level the way office visit E/M codes are, which is exactly why staff who came up on the 99202–99215 side get tripped up.

The Four Checks Your Front Desk Runs Before a 99386 Visit

1. Age on the date of service, not age at scheduling

A patient who is 39 at booking and 40 at the appointment falls in a different age band than a patient who is 39 on both dates. Build the check into the day-before confirmation call, not the scheduling script. Assign it to one role — usually the pre-visit verification clerk — and make it a discrete field in your worksheet rather than an assumption.

2. New versus established

The three-year rule turns on whether the patient received a face-to-face professional service from a physician or qualified health professional of the same specialty and subspecialty in the same group practice within the prior three years. In a multi-site, multi-specialty group this is a data question, not a memory question. Your practice management system should surface prior encounters across all locations and taxonomies. If it can't, document the manual lookup step and who performs it.

3. Payer coverage rules, including Medicare's carve-out

Non-grandfathered commercial plans generally cover certain preventive services without cost sharing under the ACA, but coverage terms, frequency limits, and network rules vary by plan. Medicare is the recurring trap: Medicare does not pay the CPT preventive medicine codes. It covers the Initial Preventive Physical Examination and the Annual Wellness Visit under its own HCPCS codes with their own documented element requirements. CMS lays out the elements and frequency rules in its Medicare Wellness Visits educational booklet. Print it, and keep the frequency rules where your schedulers can see them.

4. Financial notice before the visit, not after

When a service is likely non-covered, the patient learns that in writing before the exam room, with a signature captured and stored. That signed notice is part of your business record and, when filed in the chart, part of the designated record set the patient can later request. Decide deliberately where it lives — billing system or chart — and be consistent, because inconsistent filing is what makes records requests take four hours instead of twenty minutes.

Modifier 25 and the Two-Note Discipline

The most common billing dispute in preventive visits is the same-day problem. A patient comes in for a comprehensive preventive evaluation, and the clinician also addresses something that requires significant, separately identifiable work beyond the preventive service. When both services are reported, the problem-oriented E/M carries modifier 25.

Your operational job is not to decide whether that separate work occurred. It is to make sure the record can support the claim if a payer asks. Practices that hold up under audit tend to do three things:

  • The preventive component and the problem-oriented component are documented as distinguishable sections, with the problem-oriented work carrying its own history, findings, assessment, and plan.
  • The clinician, not the biller, appends modifier 25 or answers a structured prompt that drives it.
  • A monthly sample of modifier 25 claims goes through internal review, with results tracked by rendering provider.

Train the front desk on the patient-facing consequence, because they are the ones who absorb it. A patient told "your annual is covered at 100%" who then receives a cost-shared charge for the problem-oriented portion will call, and the call goes better when your staff can explain the two-service structure without improvising.

The Intake Questionnaire Is the Riskiest Document in the Encounter

A comprehensive preventive visit generates more sensitive data than almost any other routine encounter type in a primary care practice. Depression and anxiety screening instruments. Alcohol and substance use screens. Sexual history. Intimate partner violence screening. Tobacco use. Family history that implicates relatives who never consented to anything.

All of it is protected health information the moment your practice collects it, whether it arrives on paper, through the portal, or via a tablet in the waiting room. Three operational consequences follow.

It lands in the designated record set. Completed screening instruments used to make decisions about the patient are records the patient can request and can ask you to amend. If your intake vendor stores them outside the EHR, you now have a records-request problem that surfaces at the worst moment.

Some of it carries extra legal weight. Substance use disorder information from a Part 2 program, certain state-protected categories including reproductive and mental health information, and minors' records in states with specific consent rules all have handling requirements beyond baseline HIPAA. Federal privacy requirements around reproductive health information have been the subject of active litigation over the past two years; confirm the current posture with counsel rather than relying on a training deck written in 2024.

Waiting-room collection is a disclosure risk. A tablet handed across a counter where the next patient can read the screen, or a clipboard left face-up, is a small incident that becomes a large one when the questionnaire covers substance use or IPV. Screen angles, clipboard covers, and a "face-down until scanned" rule cost nothing.

Every Vendor That Touches a 99386 Encounter

Walk one preventive visit end to end and count the outside parties. A typical practice finds six to ten:

  1. The scheduling or online-booking platform that captured the appointment reason
  2. The eligibility and benefits verification service
  3. The digital intake or questionnaire vendor
  4. The patient portal, if separate from the EHR
  5. The appointment-reminder texting or voice service
  6. The reference lab and its results interface
  7. The clearinghouse
  8. The billing or revenue cycle management company
  9. Any coding audit consultant reviewing modifier 25 usage
  10. The document storage or release-of-information service handling records requests

Each of those creates, receives, maintains, or transmits PHI on your behalf. Each needs a business associate agreement in place before the data flows, and each of their subcontractors needs one downstream. The coding consultant is the one practices most often miss, because the engagement feels like professional advice rather than data handling — but a consultant pulling twenty-five charts to review preventive-visit documentation is squarely a business associate.

If you are staring at a vendor list with gaps, close them in writing rather than in a meeting. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, one-time purchase, and get the coding auditor and intake vendor papered this week instead of next quarter. HHS also publishes sample business associate agreement provisions that define the minimum required terms — use them as a floor, not a finished contract.

Recall Campaigns and Where the Marketing Line Sits

Preventive visits drive recall outreach. "You're due for your annual" campaigns are typically treatment or health care operations communications, which do not require prior authorization. The line moves when a third party pays your practice to include their product or service in the message. That is marketing, and it requires authorization.

Two practical rules for your outreach workflow. First, whoever builds the list — often a marketing coordinator with EHR reporting access — is handling PHI, so their access is subject to minimum necessary and their activity is auditable. Second, the vendor sending the texts is a business associate, and the message content itself matters: "Time to schedule your annual physical with Dr. Rivera" on a shared family phone is a disclosure the patient may not have anticipated. Capture communication preferences at registration and honor confidential-communication requests.

Your Website's "Schedule an Annual Physical" Page

If that page carries third-party analytics, advertising pixels, or a chat widget, evaluate what those scripts transmit. The regulatory picture for tracking technologies on public-facing pages has shifted through litigation since 2023, but the underlying exposure has not changed: a page that ties an identifiable visitor to an inquiry about a specific service, and hands that combination to an ad platform, is a disclosure your practice will have to defend. Have your web developer produce a written inventory of every script on your scheduling and patient-facing pages, dated and signed. Most administrators discover at least one tag nobody remembers adding.

When the Patient Asks for the Preventive Visit Note

The individual right of access applies to the full designated record set: the preventive visit note, the completed screening instruments, the lab results, the signed financial notice, and billing records. You generally have 30 days to respond, with one 30-day extension available if you notify the patient in writing of the delay and the reason. Fees are limited to a reasonable, cost-based amount. HHS explains the boundaries in its right of access guidance.

The failure mode is fragmentation. When intake questionnaires live in a third-party portal, scanned notices live in the billing system, and results live in a lab interface, nobody assembles the complete set on time. Build a one-page "where the record lives" map, keep it current, and hand it to whoever covers records requests during vacations.

A 30-Day Cleanup Plan

Assign these five items with names and dates:

  • Billing lead, week 1: Pull last quarter's preventive medicine claims. Confirm age band, new-versus-established status, and payer type match what was billed. Log discrepancies by root cause, not by staff member.
  • Front desk supervisor, week 2: Rewrite the scheduling and confirmation scripts so patients hear the two-service explanation before the visit, not after the statement.
  • Privacy officer, week 2: Inventory every vendor touching a preventive encounter. Match each against your executed BAA file. Note gaps.
  • Privacy officer, week 3: Execute missing agreements, including the coding consultant and any intake or texting vendor.
  • Administrator, week 4: Update the risk analysis to reflect the intake data flow and the scheduling page inventory. Document the date and the participants.

If your risk analysis, policies, and vendor documentation are scattered across three drives and a filing cabinet, automating the risk analysis and compliance document set will get you a defensible, dated record faster than another spreadsheet will. And if the immediate gap is contractual — a coding auditor, an intake vendor, a billing company operating on a handshake — put a signature-ready BAA in front of them before the next batch of preventive visits hits your schedule.