A patient books an annual physical, hears "this is covered at 100%," and gets a $187 bill six weeks later. Your front desk fields the call, your biller pulls the claim, and the answer is that a second line item rode along with the preventive service. Multiply that by forty calls a month and you have a practice-operations problem, not a billing accident. This guide covers how preventive CPT codes actually move through your practice — scheduling, documentation, claim submission, appeal — and then makes explicit the privacy, records-handling, and vendor obligations that ride along with them. It is written for administrators and billing leads, not for clinicians and not for patients.

What Are Preventive CPT Codes?

Preventive CPT codes are the CPT and HCPCS codes practices use to report wellness and screening encounters that are billed separately from problem-oriented evaluation and management. In commercial billing, the preventive medicine E/M family runs 99381–99387 for new patients and 99391–99397 for established patients, and each code within the family is tied to a patient age band. Medicare does not pay those codes — it uses its own HCPCS G-codes for the Initial Preventive Physical Examination and the Annual Wellness Visit. Selection depends on payer, patient status, age, and what the documentation supports.

That's the thirty-second version. The operational reality is messier, and it's where practices lose money and generate complaints.

The Two Code Families Your Schedulers Confuse Every Week

Commercial and self-funded plans

Most non-grandfathered commercial plans cover a defined set of preventive services with no cost sharing when delivered in network. The scope tracks federal recommendation bodies, and litigation over that framework has churned for years without dismantling it. What matters to your operation: coverage is service-specific, not visit-specific. A visit can be preventive and still generate patient responsibility if something else happened during it.

Self-funded ERISA plans add variation. Two patients with the same card logo can have different preventive schedules, different in-network definitions, and different frequency limits. Your eligibility check should capture that at scheduling, not at check-out.

Medicare's separate track

Medicare statutorily excludes the routine physical examination, which is why 99381–99397 are non-covered for Medicare beneficiaries. Instead, Medicare recognizes the Initial Preventive Physical Examination ("Welcome to Medicare"), available once per lifetime within the first twelve months of Part B enrollment, and the Annual Wellness Visit — an initial AWV code and a subsequent AWV code with a twelve-month frequency limit.

The eligibility math trips up front desks constantly. A patient who had the IPPE cannot have the initial AWV until eleven full months have passed. CMS maintains a Medicare preventive services reference your billing lead should have bookmarked and your scheduling supervisor should have read.

If a Medicare patient wants a full head-to-toe physical anyway, many practices issue a voluntary Advance Beneficiary Notice so the financial conversation happens before the exam room, not after the statement. Whether you do that, and who is authorized to do it, belongs in a written policy — not in an individual medical assistant's judgment.

How Your Practice Documents Preventive CPT Code Selection

Nothing here tells you which code fits a given patient. That determination belongs to the rendering provider and your certified coding staff, working from the documentation in front of them. What you can control is the process, and the process is what an auditor examines.

  1. Pre-visit verification. Two business days out, your scheduler or eligibility vendor confirms plan type, preventive benefit status, last preventive date on file, and age band. Result is logged in the encounter, not on a sticky note.
  2. Provider documentation. The note supports the elements the code family describes. When a separately identifiable problem is addressed, the note distinguishes it — separate history, separate assessment, separate plan.
  3. Coder review. A trained coder — internal or contracted — selects codes and modifiers from the documentation. Modifier 33 identifies preventive services on commercial claims; modifier 25 signals a significant, separately identifiable E/M performed the same day. Coders do not add documentation; they query.
  4. Query trail. Every provider query is written, timestamped, and retained. Verbal "can you just add that" requests create the exact pattern payers flag.
  5. Post-payment sampling. Ten charts per provider per quarter, reviewed against the note. Findings go to the compliance file with a remediation date.

Assign each step to a role by title. "The billing team handles it" is not an assignment, and it will not survive a payer audit or an internal investigation.

When a Preventive Visit Becomes a Problem Visit

This is where preventive CPT codes collide with patient privacy rights, and most practices have never mapped the collision.

Say a patient comes in for a wellness visit, mentions a symptom, and the encounter produces both a preventive line and a problem-oriented line. Your claim now discloses to the health plan that something beyond routine screening was addressed. The explanation of benefits goes to the policyholder — who may be a spouse or a parent, not the patient.

The confidential communications request

Under 45 CFR 164.522(b), an individual can request that you communicate protected health information by alternative means or at alternative locations, and a covered health care provider must accommodate reasonable requests without requiring a reason. Your front desk needs a form for this and a place to store the answer so it actually changes behavior — recall letters, portal messages, voicemail scripts.

Practices that serve adolescents on parental plans, behavioral health patients, or reproductive health patients should treat this as a standing operational workflow, not an exception path.

The self-pay restriction right

45 CFR 164.522(a)(1)(vi) is the one billing managers miss. If an individual pays out of pocket in full for a health care item or service and asks you not to disclose PHI about it to their health plan for payment or operations purposes, you must agree. Not "may." Must.

Operationally, that means your practice management system needs a way to split an encounter — bill the preventive portion to the plan, hold the restricted portion as self-pay — and your staff needs to know the request is honored at the point of service, before the claim goes out. HHS publishes Privacy Rule guidance for professionals that your policy should cite directly. A retracted claim is not a remedy; the disclosure already happened.

Your Vendor List Grows Every Time You Add a Preventive Program

Annual wellness programs are vendor magnets. Every one of them touches PHI, and every one of them needs a business associate agreement executed before the first record moves.

Outsourced and offshore coding

If a contracted coding firm reviews notes to assign preventive CPT codes, it is a business associate. Ask three questions before signing: where do the reviewers physically sit, does the contract permit subcontracting, and what does the BAA say about breach notification timelines flowing back to you? HHS publishes sample business associate agreement provisions as a baseline — treat them as a floor, not a ceiling. If you need a signature-ready agreement without a legal engagement, a guided BAA generator will get you a defensible document in an afternoon.

Recall and outreach campaigns

Gap-closure vendors that text patients "you're due for your annual visit" are handling PHI on your behalf. Treatment and health care operations communications are permitted, but if a third party pays you to include their product or service in the message, you are in marketing territory and authorization rules apply. Get the vendor's message templates in writing and review them before launch, not after a complaint.

Also confirm who owns the recall list, what happens to it at contract termination, and whether the vendor uses your patient data to train anything. Silence in the contract is an answer you won't like.

Tracking technologies on your wellness scheduling pages

If your "Schedule Your Annual Wellness Visit" landing page carries third-party analytics or advertising pixels, you have a disclosure question to answer. OCR's guidance on online tracking technologies has been contested in federal court and partially narrowed, but the underlying principle survives: information tied to an identifiable individual's relationship with your practice is PHI regardless of the channel it leaves through.

Have your web vendor produce a written inventory of every script on every patient-facing page. Then have your privacy officer sign off on it. Marketing does not get to make that call alone.

Minimum Necessary Applies to Claims, Too

Preventive coding pushes practices toward over-disclosure. A staff member responding to a payer's request for "the chart" often sends the entire record when the plan asked about one date of service. Payment activities are exempt from minimum necessary only in narrow circumstances, and "we always send everything" is not one of them.

Write a records-release matrix: who requests, what gets sent, who approves, where the log entry goes. Train to it. Audit it quarterly against your release log.

All of this — the vendor inventory, the tracking review, the release matrix, the sampling schedule — is supposed to fall out of your Security Rule risk analysis under 45 CFR 164.308(a)(1)(ii)(A). If your last risk analysis predates your current wellness program, your vendor list, or your patient outreach platform, it does not describe your practice. Tools that automate HIPAA risk analysis and generate the supporting policy set get you from "we have a binder somewhere" to a documented, dated assessment that maps to the systems you actually run today.

A 90-Day Cleanup Plan

  • Days 1–15. Practice administrator pulls a twelve-month report of preventive-visit claim lines and denials. Identify the top three denial reasons and the top two patient-complaint categories.
  • Days 16–30. Billing lead rewrites the pre-visit eligibility script. Front-desk supervisor trains to it and documents attendance.
  • Days 31–45. Privacy officer builds the confidential-communications and self-pay-restriction workflows, including the PM system steps. Test with two dummy encounters.
  • Days 46–60. Vendor inventory: every entity touching preventive-visit data, BAA status, execution date, subcontractor language. Fill the gaps.
  • Days 61–75. Web vendor delivers the tracking script inventory. Privacy officer approves or removes.
  • Days 76–90. First quarterly coding sample. Refresh the risk analysis to include everything above.

Ninety days, six owners, one document trail. That is a defensible program.

Start With What You Can Prove

Preventive CPT codes will keep generating revenue, denials, and phone calls no matter what you do. What you control is whether the process behind them is written down, assigned, and current. If your risk analysis is stale or your policy set predates your current vendor roster, build the documentation stack first — then run the ninety-day plan against it. The next payer audit or patient complaint will ask for paper, not intentions.