A patient books what she calls "my free annual physical." Six weeks later your billing line gets a call: she owes $142, and she wants to know why. Then she asks for a copy of everything in her chart from that visit, plus the claim you sent her insurer. You now have a billing dispute, a 30-day right-of-access clock, and a possible complaint — all from one appointment.

This is an operations guide to preventive visit CPT codes for the people who run the practice: administrators, billing leads, and privacy officers. It covers how the code families are structured, where the workflow breaks, and the vendor and records-handling exposure that preventive encounters create. It is administrative guidance on process and documentation, not clinical guidance on what to code for a given patient.

What Preventive Visit CPT Codes Cover — and What They Don't

Preventive medicine service codes in CPT are organized by patient status and age. The 99381–99387 range applies to new patients and the 99391–99397 range to established patients, with each code tied to an age band. Medicare does not pay those codes; it uses its own HCPCS set — G0402 for the Initial Preventive Physical Examination (the "Welcome to Medicare" visit), G0438 for the initial Annual Wellness Visit, and G0439 for subsequent Annual Wellness Visits.

Which code applies is determined by the rendering clinician's documentation, the patient's age, new-versus-established status under payer rules, and the plan's own coverage policy. Your billing staff's job is to make sure the documentation supports whatever was selected and that the encounter type matches what the patient was scheduled for. Your job as administrator is to make sure those two things can't quietly drift apart.

The single most common operational failure: the patient books a "physical," the visit turns into management of three chronic conditions, and nobody tells the patient the visit changed shape before they walk out.

Preventive visit versus problem visit, in one paragraph

A preventive medicine service is an age-appropriate comprehensive evaluation and counseling encounter performed in the absence of a presenting problem. A problem-oriented office visit (the 99202–99215 family) is performed to evaluate or manage a complaint or condition. When both happen at the same appointment, payers generally expect two separately documented services, with modifier 25 appended to the office visit code, and the patient may owe cost sharing on the problem portion even though the preventive portion is covered at no cost. Medicare's Annual Wellness Visit is not a head-to-toe physical exam; it is a structured risk-assessment and planning service, which is why patients who expect a physical often feel shortchanged.

The Front-Desk Script That Prevents Half Your Preventive Visit Denials

Denials on preventive claims cluster around three causes: the patient already used the benefit this year, the patient's plan defines the benefit interval differently than your scheduler assumed, or the visit was Medicare and the patient was still inside the 12-month IPPE window.

Build the check into scheduling, not into billing. Three steps, assigned to named roles:

  • Scheduler: asks the date of the patient's last preventive or wellness visit and records it in the appointment note. For Medicare patients, confirms enrollment date if the patient is newly enrolled.
  • Front desk (48 hours out): runs the eligibility inquiry, captures the preventive benefit response, and flags any interval conflict to the clinical team before the patient arrives.
  • Rooming staff: confirms with the patient, in plain language, that if the visit expands into managing an existing condition, a second charge may apply. Documents that the conversation happened.

That last step is the one practices skip, and it is the one that converts a $142 balance into a complaint to your state insurance department or a Better Business Bureau post. Advance notice costs thirty seconds.

The eligibility check is a PHI transaction

An eligibility inquiry is a HIPAA standard transaction. It moves patient identifiers and coverage data through your practice management system, usually through a clearinghouse, sometimes through a third-party eligibility vendor bolted on top. Every hop is a disclosure, and every intermediary is a business associate. If you cannot name the entity that returns your eligibility responses, your vendor inventory is incomplete.

When the Preventive Visit Becomes Two Services

Split billing is where documentation discipline earns its keep. The operational rule your coders should be able to recite: the problem-oriented work must be separately identifiable in the note, not embedded inside the preventive narrative.

Practical controls that hold up in an audit:

  1. Template separation. Your note template carries a distinct, labeled section for the problem-oriented service, with its own history, assessment, and plan.
  2. Pre-bill review. Any claim carrying a preventive code plus a modifier-25 office visit routes to a designated coder before it goes out. Not every claim — that one combination.
  3. Quarterly sample. Pull 20 split-billed preventive encounters per quarter, review documentation support, and log the results. Assign this to your compliance lead, not to the person who coded them.
  4. Denial feedback loop. When a payer strips the modifier-25 line, the denial goes back to the rendering clinician with the note attached, not just to the billing queue.

Track your modifier-25 rate on preventive encounters as a standing metric. You are not aiming for zero — you are aiming for a rate you can explain, with documentation behind it. Payers run the same analytics, and an outlier practice gets a records request long before it gets a phone call.

Where Preventive Visit CPT Codes Create Privacy Exposure

Preventive encounters generate an unusual concentration of sensitive data relative to their revenue. A single wellness visit can capture depression screening results, alcohol and substance use screening, sexual health history, cognitive assessment findings, intimate-partner-violence screening, and advance directive discussions. That is a dense payload, and it flows outward on the claim, the EOB, and the after-visit summary.

The EOB problem

When a dependent adult or an adolescent on a parent's policy receives a preventive service, the explanation of benefits goes to the policyholder. Patients can request confidential communications under 45 CFR 164.522(b) — an alternate address, an alternate phone, a suppressed statement. Your intake packet should offer that request affirmatively, and your billing system needs a field that actually honors it. A checkbox that nobody downstream reads is worse than no checkbox.

The self-pay restriction

Patients may request that you not disclose a service to their health plan when they pay out of pocket in full. That request is mandatory to honor under 45 CFR 164.522(a)(1)(vi) when the disclosure is for payment or operations and the item was paid in full. Preventive visits are a frequent trigger — a patient wants a screening done but does not want it on the claim history. Your front desk needs a documented path to accept payment, suppress the claim, and flag the encounter so no automated batch sweeps it up next month.

Minimum necessary in your reporting exports

Quality reporting, population health dashboards, and payer gap-closure programs all pull from preventive encounter data. The HHS minimum necessary standard applies to those disclosures. Review what your export actually contains — many default extracts ship entire problem lists and full note text when the receiving program needs a handful of fields.

Your Vendor List for a Single Preventive Visit

Walk one wellness visit end to end and count the outside parties touching PHI:

  • The appointment reminder and recall texting service
  • The digital intake and health-risk-assessment questionnaire tool
  • The ambient documentation or transcription service, if your clinicians use one
  • The clearinghouse and any eligibility-verification layer
  • Your outsourced billing company, if you use one
  • Your coding audit consultant
  • The patient portal and secure messaging platform
  • The print-and-mail statement vendor
  • The quality-reporting or registry submission vendor

Nine potential business associates for one $180 encounter. Each one requires a signed agreement before PHI moves, and HHS guidance on business associates makes clear the obligation sits on you as the covered entity, not on the vendor's sales team. Subcontractors count too — your billing company's offshore data-entry partner is in scope.

If you find gaps when you run this exercise — and most practices do, usually around the newest tools — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, which matters when you need three agreements this week and none next quarter.

The Records Request That Follows a Billing Dispute

Preventive visit disputes convert into records requests at a high rate, because the patient's argument is "the visit wasn't what you billed." Treat every one as a formal right-of-access request.

You have 30 days to act, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount covering labor for copying, supplies, and postage — not search and retrieval time. The HHS right of access guidance is the authority your staff should have bookmarked, and OCR has pursued a long string of enforcement actions specifically on access delays and overcharging.

Two adjacent requests follow the same disputes. A patient may request an amendment under 45 CFR 164.526 — you have 60 days to act, and if you deny, the patient can file a statement of disagreement that must travel with the record. A patient may also request an accounting of disclosures. Know which of your systems can produce that log before someone asks.

A 60-Day Cleanup Plan

Days 1–15: Map

Billing lead pulls 12 months of preventive claims by code family. Identify denial reasons, modifier-25 rate by clinician, and the volume of patient balance disputes tied to preventive encounters. Privacy officer independently lists every vendor that touched those encounters.

Days 16–30: Close vendor gaps

Match the vendor list against executed BAAs. Any vendor without one either gets an agreement or gets cut off from PHI. Document the decision either way — an unresolved gap discovered during a breach investigation is far more expensive than one you fixed and logged.

Days 31–45: Fix the front end

Rewrite the scheduling script, add the benefit-interval field, and add the advance-notice conversation to the rooming checklist. Train the whole front desk in one session and record attendance.

Days 46–60: Verify

Re-audit 20 preventive encounters against the new workflow. Confirm confidential-communication flags and self-pay restrictions actually suppress statements. Confirm your reporting exports carry only the fields the recipient needs.

Fold the findings into your security risk analysis rather than filing them separately — the preventive visit workflow is a data flow, and it belongs in the same document set as everything else. If your risk analysis and policy set hasn't been refreshed since the last time you added a vendor, that is the real finding.

Start With the Vendor Column

Coding accuracy on preventive visit CPT codes protects your revenue. The vendor and records-handling controls around those same encounters protect everything else. If your walk-through turned up a tool with no agreement on file, build the BAA now — it takes less time than the first phone call you'd make after a breach.