A patient turns 65 in July, activates Part B on August 1, and calls your front desk in September asking for "the free Medicare physical." Your scheduler books a 40-minute slot. Nine months later, the claim for CPT G0402 denies — because a nurse practitioner at an urgent care already delivered the Initial Preventive Physical Examination in October, and nobody checked. That is a once-in-a-lifetime benefit gone, a write-off, and an angry phone call.

This guide is for the person who owns that workflow: practice administrators, billing leads, and privacy officers. It covers what the code represents, who verifies eligibility and when, what documentation billing staff should see before a claim drops, and — the part most coding articles skip — the privacy, records, and vendor exposure this specific visit creates.

What CPT G0402 Is (and Why It's Technically Not a CPT Code)

G0402 is the code for the Initial Preventive Physical Examination (IPPE), commonly called the Welcome to Medicare visit. It is a once-in-a-lifetime benefit, furnished face-to-face, and available only during the first 12 months of a beneficiary's Medicare Part B enrollment. Medicare waives the Part B deductible and coinsurance for the IPPE itself.

One correction worth making inside your own practice: G-codes are HCPCS Level II codes maintained by CMS, not CPT codes maintained by the AMA. Staff and search engines both say "CPT G0402," and everyone knows what is meant, but your internal fee schedule, superbill, and payer correspondence should label it correctly as HCPCS. Sloppy nomenclature in an appeal letter invites a slower response.

CMS publishes the covered elements and frequency rules in its preventive services materials; keep the current version bookmarked rather than relying on a printout from three years ago. Start at the CMS Medicare preventive services page and confirm anything that affects your fee schedule against your MAC's local guidance.

The 12-Month Window Your Scheduler Has to Police

Eligibility for the IPPE runs from the Part B effective date, not from the patient's 65th birthday and not from the date they became your patient. Someone who delayed enrollment because of employer coverage may activate Part B at 68 — and the window opens then.

Verify before the visit, not after the claim

Assign eligibility verification to a named role, not to "whoever answers the phone." The 270/271 eligibility transaction returns preventive service history for Medicare beneficiaries, including whether an IPPE has already been used and the next eligible date for wellness visits. Your MAC portal shows the same data.

Build the check into the scheduling script: when a caller requests a Medicare wellness or welcome visit, the scheduler runs eligibility and records three things in the appointment note — Part B effective date, IPPE used yes/no, and next eligible annual wellness visit date. Two minutes at scheduling prevents a denied once-per-lifetime code.

When CPT G0402 collides with the annual wellness visit

The IPPE and the initial annual wellness visit (G0438) are distinct benefits with distinct rules, and Medicare does not cover an AWV within 12 months of the IPPE. Practices that treat "wellness visit" as one scheduling type end up billing the wrong service and appealing the wrong denial.

Create separate appointment types in your scheduling system with different durations and different intake packets. If your system supports it, add a hard stop that requires the eligibility fields to be populated before the appointment saves.

Documentation Your Billing Staff Should See Before the Claim Drops

Billing staff do not decide whether a visit meets the definition of an IPPE — the rendering provider does. What billing staff can and should do is confirm that the note contains the components CMS lists for the service, and hold the claim if it does not. That is a completeness check, not a clinical judgment.

The IPPE elements described by CMS include review of medical and social history, review of potential risk factors for depression and other mood disorders, review of functional ability and level of safety, an examination that captures height, weight, body mass index, blood pressure, and visual acuity screening, review of current opioid prescriptions and screening for potential substance use disorders, end-of-life planning discussion if the patient agrees, education and counseling with referrals as indicated, and a written screening schedule for the patient covering the following years.

Turn that into a pre-billing checklist in your practice management system. If your coders are reconstructing intent from a narrative note, your template is wrong. Fix the template rather than training coders to guess.

Diagnosis coding and payer edits

Practices determine diagnosis linkage from the documented encounter and the instructions in the current CMS guidance and their MAC's edits. Document the internal rule you follow, date it, and re-verify it each January when code sets and edits update. Do not let a single biller carry that rule in their head — when they leave, the rule leaves with them.

The Add-Ons: Screening EKG and Same-Day Problem Visits

A one-time screening electrocardiogram is available in connection with the IPPE, reported with G0403, G0404, or G0405 depending on whether the practice performed the tracing, the interpretation and report, or both. Unlike the IPPE itself, the screening EKG carries patient cost sharing. Patients who were told "this visit is free" and then receive a bill for the EKG will call your billing line, and the call will be unpleasant.

Write a one-paragraph financial notice, hand it to the patient at check-in for this visit type, and have the front desk note in the encounter that it was provided. That single step removes most of the downstream complaints.

The same applies when a provider addresses an unrelated problem during the visit. Practices report a separately identifiable evaluation and management service with the appropriate modifier when the documentation supports it — and the patient owes deductible and coinsurance on that portion. Your check-in script should say the preventive portion has no cost sharing and other services addressed during the visit may.

Why the CPT G0402 Chart Is More Sensitive Than a Routine Physical

Here is the part that belongs to the privacy officer. The IPPE encounter deliberately collects depression risk screening, substance use screening, opioid prescription review, functional and safety assessment, and end-of-life planning discussion. In one note you have mental health, substance use, cognitive function, home safety, and advance directive content.

Nothing about that is optional or improper — it is the benefit. But it changes the risk profile of the record. A release-of-information request that your staff would fulfill without a second thought for a sports physical deserves a closer read here.

Practical handling rules

  • Minimum necessary on outbound disclosures. When a specialist requests "recent records," send what the request supports. Sending the full IPPE note by reflex discloses substance use screening and end-of-life discussion to a provider who asked about a knee.
  • State law overlays. Several states impose additional consent requirements for mental health and substance use information. Your ROI staff need a one-page reference for your state, kept current.
  • 42 CFR Part 2 awareness. Most primary care practices are not Part 2 programs, but if any part of your organization holds itself out as providing substance use disorder treatment, confirm which records fall under Part 2 and how your policies reflect the alignment provisions that took effect in early 2026.
  • Advance directive copies. If the patient brings one, decide in advance whether you scan it into the chart, and where. An advance directive floating in a shared drive is a breach waiting to be reported.

Every Vendor That Touches an IPPE — and Whether You Have a BAA

Run this list against your vendor inventory today. Each of these routinely handles protected health information generated by a CPT G0402 encounter:

  1. The clearinghouse or eligibility service running your 270/271 transactions.
  2. Any health risk assessment or wellness questionnaire platform, including tablet and kiosk intake tools.
  3. Outsourced pre-visit call services that collect history by phone before the appointment.
  4. Third-party "wellness visit program" vendors that supply staffing, templates, or scoring.
  5. Your billing company or offshore coding partner.
  6. Appointment reminder and patient messaging platforms, including SMS.
  7. Scanning, transcription, and document storage services.
  8. Whoever prints and mails the written screening schedule if you do not do it in-house.

For each one, you need a signed business associate agreement, a record of when it was signed, and a note on what the vendor is permitted to do with the data. HHS publishes sample business associate agreement provisions as a baseline — treat them as a floor, not a finished contract. If you have vendors operating on a handshake, a six-step wizard that produces a signature-ready business associate agreement will close the gap faster than waiting on legal review.

The vendor list also has to appear in your security risk analysis. If your last risk analysis predates the wellness-visit software you rolled out, it is stale, and a stale risk analysis is the single most common finding in OCR enforcement. Practices that need to rebuild the whole document set — risk analysis, policies, workforce procedures — without a six-month consulting engagement can generate a complete HIPAA compliance document set and keep it versioned as vendors change. Pair that with the HHS Security Rule guidance materials so your policies map to actual regulatory language.

When the Patient Asks for the Record and Questions the Bill

The written screening schedule you hand the patient is not the record — it is a summary. Patients who later request the full IPPE documentation trigger your right of access obligations: 30 days to respond, one 30-day extension with written notice, and cost-based fees only. Review the HHS individual right of access guidance if your fee schedule has not been reviewed recently.

Two failure modes show up repeatedly with this visit type. First, patients ask for the record by email, and staff either refuse outright or send it unencrypted without documenting the request. The correct handling is to honor the requested method, warn the patient of the risk, and note the warning in the file. Second, billing disputes about the EKG or same-day problem visit turn into detailed explanations sent to a spouse or adult child who is not authorized. Train billing staff that a payment question does not create a disclosure authorization.

A 30-Day Cleanup Checklist

  • Week 1: Split "wellness visit" into distinct appointment types with eligibility fields required at scheduling. Name the person who runs verification.
  • Week 2: Rebuild the encounter template so every CMS-listed IPPE element has a discrete field. Add the pre-billing completeness checklist.
  • Week 3: Draft the check-in financial notice covering the screening EKG and same-day problem services. Train the front desk on the script.
  • Week 4: Reconcile the eight-item vendor list above against signed BAAs. Update the risk analysis to reflect any tool added in the last 18 months. Give ROI staff the sensitive-content handling sheet.

Run the whole thing again each January when code sets, fee schedules, and MAC edits update.

The Welcome to Medicare visit is a good benefit and a clean revenue line when the operational scaffolding holds. The scaffolding is eligibility verification, template discipline, a financial script, and a current vendor inventory. If the last item is where you are weakest — and for most practices it is — build the risk analysis and policy set now, before a records request or a denied claim forces the issue on someone else's timeline.