Your scheduler books 42 Medicare wellness visits for April. Three weeks later, six of them come back denied — same reason on all six: the patient already had an initial Annual Wellness Visit somewhere else. That is the g0438 cpt code in a nutshell: a once-per-lifetime service that your front desk cannot verify by asking the patient, documented against a ten-element checklist, and built on a health risk assessment that most practices collect through a vendor nobody put on the business associate list.

This guide is written for the person who owns that workflow — the administrator, billing lead, or privacy officer. It covers eligibility mechanics, documentation structure, records-handling, and the vendor exposure the AWV program creates. It is administrative guidance, not clinical guidance. Your clinicians decide what is medically appropriate; you decide how the practice documents, verifies, and protects it.

What the G0438 CPT Code Is (and Why It Isn't a CPT Code)

G0438 is a HCPCS Level II code maintained by CMS, not a CPT code maintained by the AMA. It describes the initial Medicare Annual Wellness Visit including a personalized prevention plan of service. Nearly everyone searches for it as the “g0438 cpt code,” and your staff will too — but when you write internal policy, call it what it is, because the distinction matters when you're citing coding sources in an audit response.

The short version your billing team should have memorized:

  • G0438 — initial AWV, billable once in a beneficiary's lifetime.
  • G0439 — subsequent AWV, billable at defined annual intervals thereafter.
  • G0402 — the Initial Preventive Physical Examination (“Welcome to Medicare”), a separate service tied to the first 12 months of Part B enrollment.

A beneficiary is generally not eligible for an AWV during the first 12 months of Part B coverage, and the initial AWV cannot be furnished within 12 months of an IPPE. CMS publishes the element list, frequency rules, and cost-sharing treatment in its Medicare Wellness Visits educational tool. Print the current version, date it, and keep it in your coding binder — CMS revises it, and “we followed the guidance” means nothing if you can't show which version.

The Once-Per-Lifetime Rule That Generates Most G0438 Denials

Patients change practices. They move. They see a retail clinic once and forget. None of them remember whether the visit they had in 2022 was billed as an initial AWV, a subsequent AWV, or a problem-oriented office visit — and asking them produces confident wrong answers.

The fix is procedural, not conversational.

The eligibility check your scheduler runs before the appointment is confirmed

Build a hard step into scheduling: before an AWV slot is confirmed, someone queries Medicare eligibility electronically and records the next eligible date for preventive services. The HIPAA Eligibility Transaction System, accessed through your clearinghouse or MAC portal, returns AWV and IPPE history including whether an initial AWV has already been used. That response is the difference between a clean claim and a write-off.

Assign it explicitly. In most practices this belongs to the scheduler at booking and gets re-verified by the front desk at check-in, because eligibility can change between the two. Document the check in the encounter — a one-line note with the date queried and the result. When a MAC asks why you reported the g0438 cpt code, that line is your first exhibit.

Set the financial expectation at the same moment. The AWV itself carries no coinsurance or deductible when reported and covered as a preventive service. Anything added on top may. Patients who show up expecting “free” and leave with a bill call your office manager, not the clinician.

The Ten Elements Your Template Has to Capture

The initial AWV is a documentation-defined service. CMS specifies required components; the clinician determines how they are performed and whether the service was furnished at all. Your job is making sure the chart proves each element was addressed.

The required components generally include: a health risk assessment; medical and family history; a list of current providers and suppliers; height, weight, BMI, blood pressure and other routine measurements; detection of cognitive impairment; review of potential depression risk factors; assessment of functional ability and safety; a written screening schedule covering the coming years; a list of risk factors and conditions with interventions; and personalized health advice with referrals as appropriate. Review of social determinants of health has become a standard part of many practices' AWV templates as well.

Two operational rules follow from that list:

  1. Pre-populated fields are not documentation. If your template auto-fills “no cognitive concerns” on open, an auditor will treat every AWV in that date range as suspect. Require affirmative entry.
  2. The written screening schedule must be a real deliverable. The patient gets a copy. Your chart keeps a copy. If your workflow prints it and never files it, you failed the element you actually performed.

Coding staff should never select the AWV code based on scheduling type. The code reported follows the documented service. Your policy should say so in exactly those words, and your billers should have a written escalation path — back to the clinician, not around them — when documentation doesn't support the code on the encounter form.

The Health Risk Assessment Is Where Your Privacy Exposure Lives

The HRA is the part of the AWV your practice is most likely to outsource, automate, or push to a patient's phone. It is also, element for element, the most sensitive document your practice collects outside a clinical note.

A typical HRA asks about falls, alcohol use, depression symptoms, cognitive function, home safety, firearms, food insecurity, housing stability, transportation, and social isolation. That is protected health information of a kind that damages patients when it leaks — not because it is medically dramatic, but because it is personal in ways an ordinary lab result isn't.

Ask three questions about your HRA pipeline this week:

  • Where does the patient enter it — your portal, a vendor's web form, a paper packet, a tablet at the front desk?
  • Where does the completed response live before it reaches the chart, and for how long?
  • Who at the vendor can read it, and what does your contract say they may do with it?

If the answer to the second question is “a vendor database, indefinitely,” you have a retention problem and a minimum-necessary problem in the same sentence. Tablets at the front desk deserve their own review: kiosk mode, auto-clear between patients, screen privacy filter, and no cached form data.

Vendors in the AWV Workflow That Need a Business Associate Agreement

AWV programs quietly accumulate business associates. Run this list against your vendor inventory and see how many are missing an executed agreement:

  • HRA platforms that host the questionnaire and transmit responses to your EHR.
  • Outreach and recall companies that call or text your Medicare panel to book wellness visits — they receive a patient list, which is PHI on its own.
  • Turnkey AWV staffing vendors that supply remote health coaches or nurses to conduct portions of the visit.
  • Population-health and care-gap analytics tools that flag which patients are AWV-eligible.
  • Transcription and virtual scribe services documenting the encounter.
  • Print-and-mail vendors producing the personalized prevention plan and screening schedule.
  • ACO or clinically integrated network partners, whose data flows may run under a participation agreement that does not, by itself, satisfy the BAA requirement.

HHS publishes sample business associate agreement provisions, and they are a floor, not a finished contract. For AWV vendors specifically, add terms addressing retention and deletion of HRA responses, subcontractor disclosure, breach notification timelines shorter than the outer statutory limit, and a prohibition on secondary use of assessment data for the vendor's own analytics or product development.

If you find a gap and need paper in place before the next outreach campaign runs, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription. That is a faster path than waiting three weeks for a vendor's redlines on a contract you haven't drafted yet.

One more category people miss: consumer-facing health apps that patients connect to your portal are generally not your business associates, but the vendors behind them may fall under the FTC's Health Breach Notification Rule. Know which side of that line each integration sits on before your portal admin approves it.

The AWV Chart Is Bigger Than Your Records Clerk Thinks

When a patient requests their record, the designated record set includes the HRA responses, the personalized prevention plan, the written screening schedule, and the risk-factor list — not just the clinician's narrative note. If your HRA lives in a vendor portal and never fully lands in the EHR, your records clerk will produce an incomplete set without knowing it.

Test this. Pull three completed AWVs and ask your release-of-information staff to assemble what they would send. If the HRA isn't in the export, fix the integration before someone files an access complaint. HHS has been consistent that the individual right of access covers the full designated record set and runs on a 30-day clock with one permitted 30-day extension; the OCR right-of-access guidance is the reference to hand your ROI staff.

Amendment requests deserve a note too. Patients occasionally object to an AWV entry — a depression screening result, a cognitive assessment score, a housing-instability flag. Your amendment process should already handle this; make sure the staff running it know these fields exist.

Same-Day Problem Visits and the Front-Desk Script

Patients frequently raise a new complaint during a wellness visit. When a clinician furnishes and documents a significant, separately identifiable evaluation and management service on the same day, practices report it separately with the appropriate modifier. Whether that threshold was met is a clinical documentation question, decided by the clinician and supported by the note — not by the biller and not by the scheduler.

What you own is the downstream consequence: the patient may owe cost-sharing on the separately reported service even though the AWV carried none. Write a two-sentence front-desk script, train it, and put it in the check-in packet. Practices that skip this step generate billing complaints that consume more staff hours than the revenue involved.

Add-on services and telehealth status

Practices commonly consider add-on services alongside the AWV — advance care planning, social determinants of health risk assessment, cognitive assessment services. Each has its own frequency, documentation, and cost-sharing rules that change with the annual Physician Fee Schedule. Assign one person to review CMS transmittals each January and update your internal coding reference accordingly.

Telehealth eligibility for wellness visits has shifted repeatedly with statutory extensions. Do not build a video AWV workflow on last year's memo. Have your billing lead verify current status against the CMS telehealth services list before each quarter's scheduling template goes live.

A 12-Month Operating Calendar for the AWV Program

January. Update the coding reference for the new fee schedule year. Re-issue the AWV documentation template with any element changes.

Quarterly. Audit ten AWV charts against the element list. Score them yes/no per element. Send the results to the clinicians who own them, not just to the compliance file.

Quarterly. Reconcile the AWV vendor list against executed BAAs. Any new integration since last quarter gets checked before it touches live data.

Semiannually. Pull a records-request test export and confirm HRA content is included.

Annually. Fold the AWV data flow into your security risk analysis — the HRA platform, the outreach vendor, the tablets, the print-and-mail path. If your risk analysis doesn't name these systems, it doesn't cover them. Automating that documentation set, including risk analysis reports and supporting policies, is cheaper than reconstructing it during an investigation.

The Audit File You Should Be Able to Produce in an Hour

For any encounter where you reported the g0438 cpt code, be able to assemble: the eligibility verification record, the completed HRA, the clinician's note showing each element, the written screening schedule given to the patient, the personalized prevention plan, and the claim as submitted. Six artifacts. If any of them lives only in a vendor system you can't export from, that is a finding waiting to happen — and it is a contract problem, not a technology problem.

The g0438 cpt code rewards practices that treat the AWV as a documented process rather than a scheduling category. Everything that makes the visit billable — eligibility, elements, deliverables — is also everything that makes it defensible.

Next Step

Pull your AWV vendor list today and mark every entry without a current signed agreement. For the ones that come up short, draft a Business Associate Agreement and export it in PDF or DOCX before your next outreach campaign sends a patient list out the door. It takes about ten minutes per vendor, and it closes the gap that every AWV program creates and almost none of them tracks.