Your scheduler blocks twelve Annual Wellness Visit slots for June. Two of those patients had an AWV nine months ago, one is still inside her first year of Part B, and four completed a health risk assessment through a texting vendor whose contract nobody in your office has read. That is four separate problems — eligibility, code selection, documentation, and vendor exposure — and only one of them shows up on a denial report. This guide walks administrators and billing staff through medicare wellness visit requirements as an operational workflow: who checks what, when, and what happens to the patient data the visit generates.

What Medicare Wellness Visit Requirements Cover — and What They Don't

Three distinct services get lumped together at the front desk, and staff conflate them constantly.

The Initial Preventive Physical Examination (IPPE)

Also called the "Welcome to Medicare" visit. Medicare covers it once per lifetime, and only within the first 12 months of Part B enrollment. It is reported with HCPCS G0402. A screening EKG furnished as part of the IPPE is reported separately and, unlike the IPPE itself, is generally subject to the deductible and coinsurance.

The Initial Annual Wellness Visit

Reported with G0438. Available once per lifetime, after the patient has had Part B for at least 12 months, and not within 12 months of an IPPE. Practices routinely bill G0438 twice for the same beneficiary because the patient changed practices and nobody checked the history — this is one of the most common preventable denials in the category.

The Subsequent Annual Wellness Visit

Reported with G0439, once every 12 months thereafter. In practice, the billable window opens after 11 full months have passed following the month of the last wellness visit. If the last AWV was in March 2025, March 2026 is the first eligible month.

None of these is a head-to-toe physical. There is no required hands-on examination beyond specified routine measurements. When your clinicians and your patients both expect "a physical," your front desk absorbs the complaint — so script the expectation at booking, not at check-in.

What Are the Required Elements of a Medicare Annual Wellness Visit?

For the initial AWV, the documented elements are:

  • Administer a health risk assessment (HRA) completed by the patient or caregiver
  • Establish medical and family history
  • Establish a list of current providers, suppliers, and prescriptions
  • Record height, weight, body mass index, blood pressure, and other routine measurements as appropriate
  • Detect any cognitive impairment
  • Review potential risk factors for depression and other mood disorders
  • Review functional ability and level of safety
  • Establish a written screening schedule for the next 5 to 10 years
  • Establish a list of risk factors and conditions with recommended interventions
  • Furnish personalized health advice and referrals to health education or preventive counseling

Voluntary advance care planning and a social determinants of health risk assessment may be furnished as optional elements and are reported separately. For the subsequent AWV, the clinician updates the history, provider list, risk factor list, and screening schedule rather than establishing them fresh. Both visit types waive the Part B deductible and coinsurance when the requirements are met and the service is correctly reported.

Your practice determines code selection based on documented eligibility and the elements actually performed and recorded — not on what the template auto-populated. Build your internal policy so that a coder can trace every element to a discrete field in the note.

The Eligibility Check Your Scheduler Owns

Assign this to a named role, not to "whoever answers the phone." Before the appointment is confirmed, someone verifies four things through the Medicare eligibility system your practice uses:

  1. Part B effective date, which determines IPPE versus AWV eligibility
  2. Date of any prior IPPE
  3. Date of any prior initial AWV, including at a prior practice
  4. Date of the most recent subsequent AWV

Document the check in the scheduling note with a date and initials. When a denial arrives eight weeks later, that note is the difference between a five-minute correction and a forty-minute reconstruction.

Second operational rule: if the clinician addresses a problem during the same encounter and the practice reports a separate evaluation and management service, that portion may carry cost-sharing. Patients who were told "this visit is free" and then receive a bill call your office, not CMS. Give front-desk staff a two-sentence script covering that possibility at check-in.

Before you schedule any wellness visit virtually, confirm current telehealth eligibility and place-of-service requirements with your Medicare Administrative Contractor. That landscape has changed repeatedly, and your MAC's published guidance is the controlling operational source. CMS publishes billing and coverage education through the Medicare Learning Network; assign one person to check it quarterly and circulate changes.

The Health Risk Assessment Is a PHI Pipeline — Map It

Here is where wellness visits stop being a billing topic and become a privacy topic. The HRA is a required element, and almost nobody collects it on paper anymore. It arrives through a patient portal, a text-message link, a tablet in the waiting room, an interactive voice response call, or a third-party population-health platform that your health system's ACO selected without consulting you.

Every one of those channels moves protected health information. And the content is unusually sensitive: cognitive screening responses, depression risk questions, fall history, home safety, alcohol use, and — if you use the optional social determinants assessment — housing instability, food insecurity, utility shutoffs, and interpersonal safety.

Write down, for each intake channel: where the data is captured, where it is stored before it reaches the chart, who at the vendor can see it, how long the vendor retains it, and what happens to it when you terminate the contract. If you cannot answer those five questions for a channel you are actively using, stop using it until you can.

Minimum necessary applies to your own staff, too

An HRA that lands in the chart as an unstructured PDF is visible to every user with chart access, including the referral coordinator who only needs a diagnosis and a phone number. HHS guidance on the minimum necessary standard expects you to define role-based access for routine disclosures and uses. Review whether your record system lets you restrict sensitive assessment results by role — and if it does not, document that limitation in your risk analysis rather than pretending it isn't there.

When Your HRA or Outreach Vendor Is a Business Associate

If a vendor creates, receives, maintains, or transmits PHI on your behalf, it is a business associate and you need an executed agreement before it touches a single record. That covers the texting platform sending HRA links, the analytics company scoring risk, the AI documentation tool drafting the wellness note, the call center booking the appointments, and the ROI service releasing the resulting chart.

Common gaps I see in wellness-visit programs specifically:

  • A BAA with the parent EHR vendor but not with the separately contracted patient-engagement module
  • An agreement signed in 2019 that never got updated when the vendor added subcontractors or offshore support
  • An ACO or MSO that hands you a platform and assumes its own agreements cover your practice
  • No breach-notification timeline in the contract shorter than the outer statutory limit, which leaves you unable to meet your own 60-day obligation

HHS publishes sample business associate agreement provisions as a starting point, but the sample is a floor, not a contract. If you need to close a gap this week rather than next quarter, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, which matters when you are papering three small vendors at once and cannot justify a legal spend for each.

One more distinction worth training your outreach staff on: reminding patients that they are due for a wellness visit is a treatment or health care operations communication. It becomes marketing — requiring authorization — if a third party pays you to include promotion of its product or service in that outreach. If a vendor offers to run your AWV recall campaign "at no cost," find out who is funding it before you say yes.

The Written Screening Schedule Is a Record Patients Can Request

The AWV produces documents patients specifically ask for: the personalized prevention plan, the written screening schedule, the risk factor list. Under the HIPAA individual right of access, your practice generally must provide these within 30 days of the request, in the form and format requested if readily producible.

Two operational consequences. First, if the prevention plan lives only inside a third-party platform and not in your designated record set, your ROI staff will miss it — and an incomplete response to an access request is one of the most reliably enforced failures in this space. Inventory where the plan actually resides.

Second, patients increasingly ask you to send records to an app. Consumer health apps that are not covered entities or business associates fall outside HIPAA once the data lands, and may instead be subject to the FTC's Health Breach Notification Rule. You still have to honor a valid patient-directed transmission. Document the request, note that the destination is patient-selected, and do not use that as a reason to stall — improper delays raise information-blocking questions as well as access-rule questions.

A 90-Day Cleanup You Can Actually Run

Days 1–30: Inventory

List every system and vendor that touches wellness visit data, from scheduling through HRA capture through claim submission. Name an owner for each. Pull the BAA for each. Mark the ones you cannot find.

Days 31–60: Close contracts and access

Execute or refresh the missing agreements. Review role-based access to assessment results. Confirm retention and return-or-destroy terms with each vendor in writing.

Days 61–90: Fix the workflow and the note

Rebuild the eligibility check into scheduling with a documented initial-and-date. Audit fifteen completed wellness visit notes against the element list above and record what was missing. Feed the findings into your security risk analysis — this is exactly the kind of change that should trigger an update, and platforms that automate risk analysis and policy documentation make that refresh a task rather than a project.

What Good Looks Like

A practice that has its medicare wellness visit requirements under control can answer four questions cold: who verified eligibility and when, which elements are documented and where, which vendors held the data and under what agreement, and how fast the prevention plan can be produced on request. Everything else — denial rates, patient complaints, audit outcomes — follows from those four.

Start with your vendor list this week. If any name on it is handling health risk assessments without a current agreement in your files, put a signature-ready BAA in front of them before the next wellness visit is scheduled.