It is early March, spring tryouts are three weeks out, and your front desk just took nineteen calls in one morning asking whether you "do sports physicals" and what they cost. Somebody at the desk quoted $45. Somebody else told a parent to "just use insurance." Your biller is now looking at a batch of encounters with no clear instruction on which sports physical CPT code family applies, and half the school forms went home in a folder without an authorization on file.

This guide is for the person who has to fix that: the administrator, billing lead, or privacy officer who owns the workflow. It covers how practices determine and document code selection for preparticipation exams, how to handle the money conversation, and — the part most practices skip — the records-handling and vendor obligations that attach the moment a completed clearance form leaves your building.

Why There Is No Single Sports Physical CPT Code

Start with the fact that drives every downstream problem: CPT, maintained by the AMA, does not contain a code whose descriptor reads "sports physical" or "preparticipation physical evaluation." There is no tidy one-to-one mapping. What exists are several code families that practices select from based on what was performed, what was documented, and what the patient's coverage recognizes.

The families your coders work from generally include:

  • Preventive medicine E/M services — the age-stratified series for new patients (99381–99387) and established patients (99391–99397), used when a comprehensive preventive evaluation and management service is performed and documented.
  • Unlisted preventive medicine service — 99429, which some payers and some practices apply when the encounter does not meet the requirements of a listed preventive code.
  • Office or other outpatient E/M — the 99202–99215 range, when the encounter is problem-oriented rather than preventive.
  • Preventive medicine counseling — 99401–99404, for separately identifiable counseling provided to a patient without symptoms or an established illness.

On the diagnosis side, ICD-10-CM includes Z02.5, encounter for examination for participation in sport, alongside the routine child and adult health examination codes. Which Z code appears, and in what order, follows from what the visit actually was.

Nothing above tells you which code fits a given patient. That determination belongs to the rendering clinician, supported by the documentation in the record and constrained by the payer's published policy. Your job as an administrator is to make sure the decision is made deliberately, recorded consistently, and defensible if a payer asks.

What CPT Code Is Used for a Sports Physical?

There is no dedicated sports physical CPT code. Practices select from preventive medicine E/M codes (99381–99387 new, 99391–99397 established), the unlisted preventive medicine code 99429, or office visit E/M codes, depending on the service performed and documented. ICD-10-CM Z02.5 identifies an examination for sport participation. Many commercial and Medicaid plans treat a standalone preparticipation exam as non-covered, so practices often collect the charge as self-pay after a documented financial notice. Code selection follows documentation and payer policy — not the label on the school's form. CMS maintains the HCPCS Level II code set and publishes its updates through its HCPCS coding resources.

Building the Decision Into Your Workflow, Role by Role

Ambiguity at the code level is survivable. Ambiguity about who decides is not. Assign it in writing before the season.

Scheduling and the front desk

Your scheduler needs one script and two questions: is this a standalone clearance exam, or is the family also due for a comprehensive well visit? And does the patient have coverage you have verified for preventive services this benefit year? The answers change the visit type, the appointment length, and the money conversation. Record both answers in the appointment note so the clinical team is not discovering them at the exam room door.

The rendering clinician

The clinician documents the service performed and selects the code. Your role is to give them a template that captures the elements the code family requires and a place to note whether the school's form was completed, partially completed, or deferred. Do not let a coder "upgrade" a code because the form was long. Do not let a coder "downgrade" one because the payer denied it.

The billing lead

Billing verifies that documentation supports the submitted code, applies the payer's policy on preventive versus problem-oriented services, and flags any encounter where a non-covered service was billed to a plan. If you identify an overpayment from a federal program, the 60-day repayment obligation is real and it starts on identification, not on discovery of the underlying error. Build a monthly reconciliation for the spring and late-summer volume spikes rather than an annual one.

The privacy officer

Privacy owns everything that happens to the paper. That is the half of this workflow nobody staffs.

The Self-Pay Conversation Your Front Desk Owns

Many plans exclude a standalone preparticipation exam from covered benefits, or cover a comprehensive well visit once per period and nothing else. That means a meaningful share of these encounters are cash.

Put the price in writing, on a one-page notice, signed before the exam. For Medicare-covered patients an ABN has a specific form and process; for commercial and Medicaid patients, follow the plan's rules on member billing for non-covered services, which frequently require advance written notice. Keep the signed notice in the record, not in a shoebox at the front desk. When a parent disputes a $60 charge nine months later, the signed notice is the whole defense.

One operational note that saves real money: if your practice runs a discounted community clinic, decide in advance whether you are billing anyone at all. Mixing free screenings and billed encounters in the same session produces the messiest audit trail your coder will ever see.

The School Form Is a Disclosure, Not a Deliverable

Here is where practices get into trouble. The clearance form is protected health information. Handing it to the parent or the adult patient is fine — that is a disclosure to the individual or their personal representative. Faxing it to the athletic director, uploading it to the district's athlete-clearance portal, or emailing it to a club coach is a disclosure to a third party, and absent an applicable exception it requires a written authorization that meets the elements in 45 CFR 164.508.

"The school always gets these" is not an exception. Neither is "the coach said they needed it today."

Build one authorization form that names the specific school, league, or district; describes the information as the completed preparticipation clearance form; and carries an expiration tied to the school year. Have it signed at check-in, not chased down afterward. Your scanning step should refuse to release the form if the authorization is missing — make it a hard stop in the workflow, not a reminder.

Minimum necessary and the adolescent chart

A preparticipation record can sit next to notes on mental health, substance use, contraception, or gender-related care. The school needs the clearance determination and whatever the form itself asks. It does not need the rest of the chart. Apply the minimum necessary standard deliberately: release the form, not the visit note, not the full problem list, not the medication history unless the form requests it.

State law governs whether a minor may consent to certain services and whether a parent may access those records as a personal representative. Your privacy officer should have a written summary of your state's rules posted where staff release records, because the front desk will be asked to make that call under pressure in front of an impatient parent.

Once the form reaches the school, FERPA takes over

A completed form maintained by a public school district generally becomes an education record subject to FERPA, not HIPAA. That matters for two reasons. First, parents who ask you to "get the form back" from the school are asking the wrong party. Second, if your practice provides services under contract inside a school building, the analysis changes and you need to know which rule applies to which record. HHS and the Department of Education publish joint guidance on FERPA and HIPAA for student health records; read it before you sign a school-based services agreement.

Mass Screening Events: Physical Safeguards in a Gymnasium

If your practice staffs a district screening night, you are operating a temporary clinical site with no walls. Plan the safeguards the way you would plan the stations.

  • No shared sign-in sheet where one family reads the next family's name and date of birth.
  • Screens angled away from the line. Laptops locked when unattended, not "minimized."
  • Any station collecting history gets physical separation or a partition, because incidental disclosure in a gym is not incidental when forty people can hear it.
  • Named chain of custody for paper: one person, one locked container, one reconciliation count before the forms leave the building.
  • A written plan for the forms that do not get completed that night, so they do not ride home in a volunteer's car.

Document the event in your risk analysis. A temporary site with volunteer staffing is exactly the scenario that shows up in a breach narrative six months later.

The Vendor List a Sports Physical Season Exposes

Count the third parties that touch a single preparticipation encounter. Your practice management and records system. Your clearinghouse. Your scanning or document-management service. Your fax-to-email provider. The forms or e-signature tool that collects parent history. Possibly a per-diem clinician working through a staffing agency. Possibly a transcription service.

Each one that creates, receives, maintains, or transmits PHI on your behalf is a business associate and needs an executed agreement before the season starts, not after. The district's athlete-clearance portal is usually a different animal — the district is typically not acting on your behalf — which is exactly why the authorization discussed above carries the weight there. Get the distinction right in writing, because the answer drives whether you need a BAA or a signed authorization, and confusing the two leaves you with neither.

If a vendor is live in your workflow with no agreement on file, the fastest legitimate fix is to generate a signature-ready Business Associate Agreement — a six-step wizard, PDF and DOCX export, one-time purchase rather than a subscription. Send it, get it signed, log it. Then keep a dated vendor inventory so next spring's staffing agency does not slip through the same gap. HHS publishes the required contract provisions if you want to check any agreement against the baseline.

Records Requests, Retention, and the Coach Who Calls

When a parent requests the completed form or the visit record, the right of access clock runs 30 days with one 30-day extension on written notice. Train the desk to log the request the day it arrives, in a place your privacy officer reviews weekly. Verbal requests count.

When a coach calls asking whether an athlete was cleared, the answer is that your staff cannot confirm or deny the existence of a record without authorization. Give them that sentence verbatim; do not make a receptionist improvise it. If your practice regularly serves a district, negotiate the information flow up front and paper it with authorizations at intake.

Retention follows state law and, for minors, frequently runs to a set number of years past the age of majority. Your document-management vendor's default purge schedule is not a legal analysis. Check it.

Your Pre-Season Checklist

  1. One written policy naming who selects the code and who verifies documentation supports it.
  2. Verified payer policies on preventive and preparticipation services for your top five plans.
  3. A signed financial notice on file before any self-pay exam.
  4. A single authorization form for release of the completed clearance form.
  5. A hard stop in the release workflow when authorization is missing.
  6. A posted summary of your state's minor consent and personal representative rules.
  7. Chain-of-custody assignment for every off-site event.
  8. A dated vendor inventory with a BAA logged for each business associate.
  9. A records-request log reviewed weekly against the 30-day clock.
  10. A monthly billing reconciliation during volume spikes.

The coding question — which sports physical CPT code family applies — resolves with documentation and payer policy. The privacy question resolves only if somebody built the workflow. If your vendor agreements are the weak link, close that gap first: produce the BAAs you are missing this week, and if your broader policy set and risk analysis are also overdue, automate the full document set rather than rebuilding it by hand every spring.