A patient's Part B coverage took effect on March 1, 2026. Your window to schedule, perform, and bill her Initial Preventive Physical Examination closed — or will close — twelve months later. Miss it and the benefit is gone permanently, because the IPPE is a once-in-a-lifetime service. This guide covers how administrators actually run IPPE Medicare workflows: who verifies eligibility, what the note has to contain before your coders touch it, how outreach campaigns create HIPAA exposure, and which vendors in that chain need a signed business associate agreement before they see a single beneficiary identifier.

Nothing here is clinical guidance. It is administrative process: eligibility gates, documentation governance, records handling, and vendor control.

What Is the IPPE Under Medicare?

The Initial Preventive Physical Examination — commonly called the "Welcome to Medicare" visit — is a one-time preventive benefit available to a beneficiary within the first 12 months of Part B enrollment. It is a review-and-referral encounter built around history, risk factors, functional assessment, selected measurements, education, counseling, and a written screening schedule for the years ahead. It is not a head-to-toe physical, and it is distinct from the Annual Wellness Visit. Per CMS guidance, cost sharing for the IPPE itself is waived; a screening EKG furnished as a result of an IPPE referral carries its own code set and its own cost-sharing treatment.

The 12-Month Window That Governs IPPE Medicare Eligibility

Everything downstream depends on one date: the effective date of the patient's Part B coverage. Not the date they turned 65. Not the date they registered with your practice. Part B effective date.

Your front desk cannot eyeball this. Build eligibility verification into scheduling as a hard gate, not a courtesy check. The staff member booking the appointment should confirm three things before the slot is held:

  • Part B effective date, pulled from your eligibility transaction or MAC portal — not from what the patient remembers
  • Whether an IPPE has already been furnished anywhere, by anyone, at any time
  • Whether an Annual Wellness Visit has been furnished, which affects sequencing

Document the verification in the encounter record with the date, the source, and the initials of the person who checked. When a claim denies eight months later and the patient calls upset about a bill they were told they would not receive, that one line of documentation is what settles it.

The three denial patterns that repeat

Practices lose money on IPPE Medicare claims in predictable ways. First, the service is furnished after the 12-month window has closed, usually because scheduling ran off the patient's birthday instead of the Part B effective date. Second, the once-per-lifetime edit fires because another practice already performed the IPPE and nobody asked. Third, the encounter is documented as a wellness visit but delivered — or vice versa — and the note does not support what was submitted.

Assign one person to run a monthly denial review filtered to preventive service codes. Twenty minutes a month catches a systemic scheduling error before it becomes forty claims.

Documentation Governance: What Has to Be in the Note Before Coding Touches It

Your coders do not decide what happened in the room. They map documentation to code selection using CMS instructions, your payer policies, and your internal coding policy. Your job as an administrator is to make sure the note contains enough for that mapping to be defensible.

CMS describes the IPPE as comprising a defined set of elements — medical and social history review, review of potential risk factors for depression and other mood disorders, functional ability and safety assessment, certain measurements, a review of current opioid prescriptions and screening for substance use disorder where indicated, education and counseling based on findings, referrals as appropriate, and a written plan or checklist of the preventive services the patient is eligible for going forward. The authoritative descriptions live in the Medicare Claims Processing Manual and the MLN preventive services materials; keep a current copy of both in your CMS Internet-Only Manuals bookmarks and re-check them each January.

Practical governance steps:

  1. Build a structured template in your record system that mirrors the published element list, so missing elements are visible before the note is signed.
  2. Require that the written screening schedule given to the patient be saved to the chart as a discrete document, not summarized in free text.
  3. Route every IPPE note through a pre-bill review for the first 90 days after you launch the workflow, then sample 10 percent thereafter.
  4. Write down, in a one-page internal coding policy, how your practice determines code selection between the IPPE and the wellness visit codes, and who resolves ambiguity. Name the role, not the person.

If a screening EKG is furnished as a result of an IPPE referral, that is a separate service with a separate code family and separate cost-sharing treatment. Your registration staff need to know that so patient financial counseling is accurate at check-in — "the visit is fully covered" is a sentence that generates complaints when an EKG deductible lands.

Outreach Campaigns and the HIPAA Marketing Line

Because the window is twelve months and closes permanently, practices run recall campaigns: lists of newly enrolled beneficiaries, letters, texts, and portal messages. This is where privacy officers should be paying attention.

Communications describing a health-related service that your own practice provides generally fall within treatment or health care operations, not marketing, and do not require authorization. The line moves the moment a third party pays you to make the communication. If a vendor, a device supplier, or a downstream service is compensating your practice to steer IPPE patients toward it, you are in marketing territory and you need authorization. Get your compliance lead to review any outreach script that mentions a named outside entity.

Texting and calling: two rulebooks, not one

HIPAA permits appointment-related communication. Telephone consumer protection rules are separate and enforced by a different agency, and your texting vendor's consent capture is your problem, not theirs. Before you launch an SMS recall campaign, confirm three things: consent is captured and timestamped in a system you control, opt-outs propagate to every downstream list within 24 hours, and the message content is minimum necessary. "Please call us about a Medicare preventive visit" is fine. Diagnoses, medication names, and screening results are not.

The Vendor Chain Nobody Maps Until After the Breach

Walk the IPPE workflow end to end and count the outside parties who touch protected health information:

  • The clearinghouse or eligibility service that returns Part B effective dates and Medicare Beneficiary Identifiers
  • The patient outreach platform sending letters, emails, or texts to a list generated from your beneficiary population
  • Any health risk assessment or intake questionnaire tool the patient completes before arrival
  • Transcription or documentation-support services touching the encounter note
  • Overread or interpretation services for a screening EKG
  • Care-gap analytics or population health vendors that receive your Medicare panel
  • Any outside company running preventive visit programs on your behalf, including staffing arrangements

Every one of those is a business associate. HHS is explicit that a business associate relationship exists whenever a person or entity creates, receives, maintains, or transmits PHI on behalf of a covered entity — see the department's business associate guidance. A signed agreement has to be in place before data moves, not after the first invoice.

The failure mode is mundane: marketing signs a text vendor, billing signs an analytics tool, and neither routes the contract through compliance. If you are adding a vendor to the IPPE Medicare workflow this quarter and you do not have a current agreement on file, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription. That removes the excuse that legal review takes six weeks.

Keep the vendor inventory in one place with the agreement date, the renewal date, the data elements shared, and the owner inside your practice. Review it twice a year. A vendor list that lives in three people's inboxes is not an inventory.

Sensitive Content Inside a Routine Preventive Visit

Substance use and opioid review

The IPPE element set includes review of current opioid prescriptions and screening for substance use disorder. Notes generated in a general medical practice are ordinarily HIPAA records, not 42 CFR Part 2 records — Part 2 applies to federally assisted programs whose primary function is substance use disorder treatment. But the moment you receive records from such a program to complete that review, redisclosure restrictions travel with them. Train your release-of-information staff to flag inbound Part 2 material and segregate it, because it cannot be forwarded on the strength of an ordinary authorization.

Advance directives and end-of-life discussion

If the visit includes discussion of advance care planning documents, decide in advance where the executed directive lives in the chart, who can retrieve it after hours, and how it is transmitted to a hospital on request. A directive that exists only in a scanned miscellaneous folder is functionally missing at 2 a.m.

When the Patient Asks for the Record

The written screening schedule you hand the patient is part of their designated record set. So is the completed risk assessment. Under the HIPAA right of access, you have 30 days to produce records in the form and format requested, with one 30-day extension available if you notify the patient in writing. OCR has pursued right-of-access enforcement steadily since 2019; the department's access guidance is the reference to keep in your ROI binder.

Test this. Ask your ROI clerk to produce a complete IPPE record for a sample patient, including the intake questionnaire that lives in a third-party tool. If the questionnaire cannot be pulled without emailing the vendor, you have both an access problem and a vendor problem.

A 90-Day Implementation Sequence

  1. Days 1–15. Map the workflow and name owners: scheduling, eligibility verification, documentation template, pre-bill review, denial review, ROI.
  2. Days 16–30. Inventory every outside party in the chain. Confirm executed agreements. Close gaps.
  3. Days 31–45. Rebuild the template against current CMS element descriptions. Train clinical and front-desk staff separately — they need different things.
  4. Days 46–60. Draft outreach scripts. Run them past compliance for the marketing question. Verify consent capture and opt-out propagation.
  5. Days 61–90. Audit the first cohort: eligibility documentation present, elements documented, denials reviewed, patient financial counseling accurate.

Fold the findings into your security risk analysis rather than treating them as a billing-only exercise. New vendors, new data flows, and new patient-facing channels all belong in that assessment; automated tooling for risk analysis and the supporting policy set can shorten the documentation burden considerably.

Start With the Contracts

Before your next IPPE outreach list leaves the building, pull the vendor inventory and check the agreement dates. If any name on that list is missing a current contract, build the business associate agreement today and get it signed before the data moves. It is the cheapest step in this entire workflow and the one auditors ask about first.