A biller in a three-provider primary care practice works a stack of eleven denials on a Monday morning. Nine of them are wellness visits. Two were billed too soon after the last one, three were billed for patients still inside their first twelve months of Part B, and four went out under a preventive medicine CPT code that Medicare does not pay. The scheduler who booked all of them had searched "cpt code for annual wellness visit" and copied the first thing she found.

This guide is for the administrator who owns that stack. It covers what actually bills for a Medicare Annual Wellness Visit (AWV), the eligibility checks that prevent most denials, and the privacy, records, and vendor obligations the AWV quietly creates — because the health risk assessment your patients fill out before the visit is protected health information the moment it exists.

Is There a CPT Code for the Annual Wellness Visit?

No. There is no CPT code for annual wellness visit services under Medicare. The AWV is reported with HCPCS Level II G-codes: G0438 for an initial AWV and G0439 for a subsequent AWV. The separate Initial Preventive Physical Examination — the "Welcome to Medicare" visit — is reported with G0402.

The CPT preventive medicine codes your staff keep finding (99381–99387 for new patients, 99391–99397 for established patients, by age band) are age-based annual physicals. Many commercial and Medicaid plans pay those. Traditional Medicare does not cover a routine physical, which is why the mix-up produces patient balances and angry phone calls.

Your practice determines which code applies from the payer's rules, the patient's enrollment and visit history, and what the documentation actually supports — not from a search result. CMS publishes the current requirements in its Medicare Wellness Visits education material, and your MAC's local guidance governs edge cases.

The Code Families Your Staff Actually Touch

Medicare wellness codes

G0402 covers the one-time preventive exam available during a beneficiary's first twelve months of Part B. G0438 is a once-per-lifetime initial AWV. G0439 is the subsequent AWV, generally reportable once every twelve months, with CMS requiring eleven full months to pass after the month of the last covered wellness visit.

Federally qualified health centers report the AWV differently, and rural health clinics have their own payment mechanics. If you operate under either designation, your coding lead should confirm the current requirements directly with your MAC rather than reusing a physician-office cheat sheet.

Commercial and managed-care plans

Plans other than traditional Medicare may want the CPT preventive medicine codes, may accept the G-codes, or may want both a wellness visit and a separate care-gap assessment. Medicare managed-care plans frequently overlay their own annual assessment programs on top of the AWV benefit. Your payer matrix — not the coder's memory — should record which code set each plan expects.

Add-on services performed at the same encounter

Advance care planning (99497, and 99498 for additional time) and a social determinants of health risk assessment (G0136) are commonly performed alongside a wellness visit when documentation supports each service separately. Depression screening (G0444) and other preventive screenings have their own frequency limits. Each add-on stands or falls on its own documentation, including time when the code is time-based.

When a patient raises a new or worsening problem during the wellness visit, practices commonly report a problem-oriented E/M service with modifier 25 in addition to the AWV. That only survives review when the record clearly separates the wellness elements from the problem-focused work. Train your clinicians to document them as distinct sections, not one narrative blob.

The Eligibility Check That Prevents Most AWV Denials

Build a hard stop into scheduling. Before an AWV slot is confirmed, someone verifies three things:

  1. Part B effective date. Patients inside their first twelve months of Part B are in IPPE territory, not AWV territory.
  2. Date of the last covered wellness visit, including one performed elsewhere. Eligibility inquiries through your clearinghouse or Medicare's eligibility system return preventive-service history; your staff has to actually read it.
  3. Whether an initial AWV was ever billed. G0438 does not repeat. A second one denies.

Assign this to a named role — usually the front-desk lead or a patient access coordinator — and log the verification in the appointment note. When a denial arrives anyway, your appeal is stronger because you can show what you checked and when.

One more operational note that saves refunds: the AWV is a Part B preventive benefit with no coinsurance or deductible when billed correctly. Add a separately billable problem-oriented service, and cost sharing applies to that portion. Patients need to hear that at check-in, not on a statement six weeks later.

Who Does What in a Clean AWV Encounter

The AWV is a documentation-driven service delivered largely by staff working under the required level of supervision. Write down the assignments:

  • Scheduler: eligibility and frequency verification, sends the health risk assessment, confirms the patient understands this is not a head-to-toe physical.
  • Medical assistant or nurse: collects height, weight, BMI, blood pressure, updates the medication list, the family and social history, and the list of the patient's other providers and suppliers.
  • Clinical staff or clinician: reviews the completed HRA, screens for cognitive impairment using whatever tool your practice has standardized, reviews functional ability and risk factors.
  • Clinician: personalized health advice, the written screening schedule covering the coming years, and referrals.
  • Coder or biller: confirms the record contains every required element before the claim drops, and confirms any add-on has its own supporting documentation.

The written personalized prevention plan is the deliverable patients remember. It goes into the chart, which makes it part of the designated record set and subject to the patient's right of access.

The Health Risk Assessment Is PHI Before the Patient Arrives

Most practices push the HRA out ahead of the visit — portal message, emailed link, mailed paper form, or a tablet in the waiting room. Every one of those channels creates a privacy question your compliance file should already answer.

If you use a general-purpose survey or form tool to collect HRA responses, that tool is handling PHI on your behalf. It is a business associate, and it needs a signed business associate agreement before the first patient answers the first question. "It's just a questionnaire" is not a defense; the responses include identifiers, diagnoses, medications, alcohol use, mood screening, and fall risk.

Waiting-room tablets need their own controls: session timeout, no autofill or saved form data, no local storage of completed responses, a privacy screen, and a documented wipe procedure between patients. Paper HRAs need a locked collection point, not the clipboard stack on the check-in counter where the next patient can read the last one.

If you discover an HRA vendor, a scheduling-outreach service, or a wellness-visit staffing partner that has been touching patient data without paperwork, close the gap in an afternoon. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription — then route it for signature and log it on your vendor register.

AWV Vendors You Probably Haven't Papered

The AWV attracts vendors because it is a scheduled, repeatable, reimbursable encounter. Walk your list against reality:

  • Outreach and recall services that text or call your Medicare panel to fill wellness slots. They receive names, phone numbers, and the reason for the call.
  • AWV documentation platforms that generate the prevention plan and screening schedule, often sitting alongside your EHR rather than inside it.
  • Contracted staffing or telehealth partners who perform the AWV elements remotely under your practice's billing.
  • Quality and risk-adjustment consultants who pull charts to find missing wellness visits and unclosed care gaps.
  • Health plan assessment vendors who request records from you to support their own quality reporting.

The last category is different. When a health plan or its contractor requests records for the plan's own quality assessment or care management, you are usually disclosing to another covered entity for health care operations — permitted without patient authorization, but only after you verify the requester's identity and authority, and only in the amount actually needed. Do not hand over a full chart because someone faxed a request on plan letterhead. Document who asked, what you sent, and under what basis.

Minimum necessary applies with equal force to your own vendors. An outreach service needs contact information and appointment eligibility. It does not need the HRA responses.

Records Requests and Audits Tied to Wellness Visits

Two request types show up repeatedly once your AWV volume grows.

Patient access requests. Patients ask for the prevention plan, the screening schedule, or the cognitive screening result. That is designated record set content, and the HIPAA right of access gives you 30 days to produce it, in the form and format requested if you can readily produce it. Train the person who opens the mail to recognize these as access requests even when the patient writes "can I get my wellness paperwork."

Payer and oversight audits. MACs, CERT contractors, and plan auditors request AWV documentation because the required elements are checklist-verifiable. Disclosures for payment are one thing; disclosures to a health oversight agency are accountable disclosures that belong in the accounting you must produce on request. Your release-of-information log should distinguish the two.

A practical control: keep a one-page AWV documentation checklist mapped to the required elements, and have the coder confirm it before release. The same checklist that protects your claim protects your audit response.

The Front-Desk Script That Prevents the Angry Callback

Patients hear "annual wellness visit" and expect a physical. Standardize what your staff says:

"This visit is a prevention planning visit covered by Medicare with no copay. We'll review your history, your medications, your risk factors, and build a written screening schedule. It doesn't include a full head-to-toe exam. If you want to discuss a specific problem while you're here, we can, and that part may have a copay."

Post that script at check-in and in the scheduling queue. It reduces refunds, reduces complaints, and reduces the number of patients who tell you afterward that they were billed for something they didn't consent to.

A 30-Day AWV Cleanup You Can Actually Finish

Week 1: pull six months of wellness visit denials and categorize them — frequency, wrong code family, missing documentation element, or modifier 25 problems. Fix the top category first.

Week 2: add the three-point eligibility check to scheduling as a required field, and name the owner.

Week 3: inventory every system and service that touches HRA data, outreach lists, or AWV documentation. Match each against a signed agreement. Note the gaps.

Week 4: close the gaps, update your vendor register, and confirm your risk analysis reflects the HRA collection channels you actually use. If your policy set and risk analysis are stale, the tooling that automates HIPAA risk analysis reports and the supporting document set will get you to a defensible baseline faster than rebuilding templates by hand.

The coding question that started this — what CPT code for annual wellness visit services applies — has a short answer and a long tail. The short answer is G0438 or G0439 for Medicare, CPT preventive medicine codes for many other plans, verified per payer. The long tail is the eligibility check, the documentation checklist, the HRA channel, and the signed agreements behind every vendor in the workflow. Start with the vendor gaps this week; those are the ones that turn into breach notifications rather than denials.