It's mid-May, and your schedulers just opened the summer template. By August 1, a mid-size pediatric or family practice will churn through several hundred preparticipation physical evaluations — school forms, camp forms, league forms, state athletic association forms, each with a different signature block. Every one of those visits creates three separate operational decisions: which sports physical exam CPT code family the encounter falls into, how the completed form gets to the school, and who at your practice is allowed to hand it over.

This guide is for the administrator, biller, or privacy officer running that surge. It covers the coding mechanics as administrative workflow, then makes the disclosure, records-request, and vendor implications explicit. It does not tell you what to code for a given patient — that determination belongs to the clinician and your documented policy.

What CPT Code Do Practices Use for a Sports Physical?

There is no single CPT code named "sports physical." Practices route the encounter into one of three billing paths, and the path depends on what was documented and what the payer's policy says:

  • Preventive medicine visit codes (99381–99387 new patient, 99391–99397 established patient). Age-banded comprehensive preventive services. Practices use these when the preparticipation evaluation is performed as part of a full, documented well visit that meets the code's descriptor — age- and gender-appropriate history, exam, anticipatory guidance, and risk-factor counseling.
  • Unlisted preventive medicine service (99429). Used by some practices when the encounter is a standalone clearance exam that does not meet a comprehensive preventive descriptor. Because it is an unlisted code, payers require a narrative description and most price it manually or deny it outright.
  • Self-pay, no claim submitted. Many practices set a flat cash price and never generate a claim, because the payer's medical policy excludes exams performed for school, camp, employment, or insurance purposes.

The diagnosis code is usually where the money decision actually gets made. Z02.5, encounter for examination for participation in sport, is an administrative-examination code. Many commercial plans and Medicaid programs treat Z02.5 as a non-covered indication. When the visit is a genuine well-child exam that also satisfies the sports form, practices typically report the routine child health examination code (Z00.121 or Z00.129) as primary — and the documentation has to support that, not the other way around.

Your coding policy should say, in writing, who decides and on what basis. "Whatever gets paid" is not a policy; it is an audit finding waiting to happen.

The Documentation Test Your Billers Should Apply

Train billers to look for evidence in the note, not the form. A completed one-page clearance sheet is not documentation of a comprehensive preventive service. If the encounter note contains only vitals, vision screening, and a musculoskeletal screen, a preventive medicine code is unsupported — regardless of whether the patient was also due for a well visit.

Build a hard-stop edit in your charge review: any preventive medicine code paired with Z02.5 as the only diagnosis goes to a coder queue before it leaves the building. That single edit catches most of the sports-physical billing errors I've seen in chart audits. CMS maintains the current ICD-10-CM files and guidelines at cms.gov; make sure whoever maintains your code tables is pulling from there and not from a three-year-old cheat sheet taped inside a cabinet door.

Counseling and Add-On Services

Preventive counseling codes (99401–99404, time-based individual counseling) and separately reportable services like immunization administration frequently attach to these visits. Two operational notes: your consent and payment workflow must handle the possibility that the exam is self-pay while the vaccines are billed to the plan, and your front desk needs a script for that split. Patients hear "self-pay" and assume nothing is going to insurance. If a vaccine claim shows up on an explanation of benefits later, you will get the call.

The Completed Form Is a Disclosure, Not a Deliverable

Here is the part that gets skipped. The clearance form does not belong to the school. It is protected health information that your practice discloses to a third party, and unless another HIPAA permission applies, you need a valid authorization from the patient or their personal representative before it leaves your control.

In practice that means the parent or guardian signs an authorization — or a combined form that includes the authorization language — at the time of the visit. Verbal permission from whoever brought the child is not documentation. Build the authorization into the intake packet so the front desk collects it once, at check-in, and scans it into the chart alongside the form.

Two wrinkles worth writing into your policy:

  • Adolescents and minor-consent services. The preparticipation history asks about mental health, disordered eating, menstrual history, and prior concussions. Some of that touches services a minor may consent to independently under your state law, which affects who counts as the personal representative for that information. Your privacy officer needs a written answer for your state before the August rush, not during it.
  • Once it reaches the school, HIPAA stops. A record held by a school in its education files is generally governed by FERPA, not HIPAA. You cannot promise a parent that the school will restrict who sees it, and you should stop your staff from making that promise.

Send the Clearance Page, Not the History Packet

The single most common oversharing failure in this workflow is faxing or uploading the entire four-page preparticipation packet — including the family cardiac history and the behavioral health screen — when the athletic department only needs the signed clearance determination.

That is a minimum necessary problem. HHS guidance on the minimum necessary requirement expects you to limit routine, recurring disclosures by policy, not by case-by-case judgment at a busy front desk. Define the disclosure set once: clearance page and immunization record only, unless the authorization specifies more. Then make the release template default to that set so a rushed medical assistant cannot accidentally send the whole chart.

The Self-Pay Restriction Most Practices Miss

Because sports physicals are so often cash-pay, the restriction right at 45 CFR 164.522(a)(1)(vi) comes up more here than almost anywhere else in a primary care practice. If a patient — or the parent — pays out of pocket in full for the service and asks you not to disclose it to their health plan, you must honor that request. It is not discretionary.

Operationally, that means three things. Your front desk needs a way to record the request at the point of payment. Your billing system needs a flag that suppresses claim generation for that encounter, including any downstream statement or clearinghouse batch. And your team needs to know that the restriction covers the plan, not the school — the authorization for the school form is a separate document with a separate decision.

Test this. Pick two self-pay encounters from last season and trace whether any data about them reached a payer, a clearinghouse, or an eligibility vendor. If it did, you have a finding to remediate before this year's volume hits.

Running "Physical Night" Without Creating Incidental Disclosures

Group events in a school gym or a clinic lobby compress a month of privacy risk into four hours. Walk the space before the event and fix these:

  1. No shared sign-in sheets where a parent can read the previous twelve names. Use single-slip check-in.
  2. Station spacing and sound. Cardiac history questions asked in a hallway are audible. Curtains or separated rooms, not a taped line on the floor.
  3. Clipboard control. Completed history forms go face-down into a closed bin under staff supervision, never left on a table.
  4. Chain of custody for paper. One named person transports the bin back to the practice, logs the count, and confirms scanning within one business day.
  5. Volunteers are workforce. Coaches, athletic trainers, and student helpers who touch forms are part of your workforce for that event. They need a short training record and a confidentiality acknowledgment on file.

All of this belongs in a written policy and, if you are doing it at scale, in your risk analysis as a documented scenario with documented safeguards. If your policy set and risk analysis have not been refreshed since you started running off-site events, that is the gap to close — you can generate the risk analysis report and the supporting policy set rather than rebuilding it from a template someone downloaded in 2019. Auditors and OCR investigators ask for the current document, dated, with the scenarios you actually operate.

The Vendor List This Workflow Touches

Sports physical season quietly expands your business associate inventory. Check each of these:

  • School or league forms portals. If the school contracts with the platform, you are disclosing to the school's vendor — that requires the parent's authorization, and no BAA between you and that vendor. If you contract with a forms platform to collect intake, it is your business associate and needs an agreement.
  • E-fax and secure messaging. Still the default channel for athletic departments. Confirm the agreement is current and that transmission logs are retained.
  • Payment processing for cash visits. A card processor handling only payment transactions is generally not a business associate, but the terminal, the receipt storage, and any card-on-file notes in the chart are yours to secure.
  • Scanning, shredding, and off-site storage for the paper volume the event generates.
  • Scheduling or reminder tools your marketing staff spun up for the season without telling you.

Any vendor on that list that creates, receives, maintains, or transmits PHI on your behalf needs a signed agreement before the first form moves. If you find one without paperwork, you can produce a signature-ready business associate agreement the same day instead of waiting on their legal department's template queue.

The 30-Day Clock When a Parent Asks for the Form Back

Parents lose these forms constantly, and they will call your office in July asking for another copy. That is a right-of-access request, not a favor. You have 30 days to provide the record in the form and format requested if readily producible, with one 30-day extension available and written notice required.

You may charge only a reasonable, cost-based fee — labor for copying, supplies, postage — and you may not charge a search or retrieval fee. HHS's right of access guidance is explicit about that, and access complaints remain one of the most common categories OCR resolves. Do not let a front-desk staffer invent a "$25 form fee" in August.

Also decide, now, how long you retain these records. Minors' records retention is set by state law and is usually measured from the age of majority, not the date of service. Purge schedules built for adult charts routinely destroy pediatric records too early.

A One-Page Checklist to Hand Your Team This Week

  1. Written coding policy naming who selects the sports physical exam CPT code path and what documentation supports each option.
  2. Charge-review edit flagging preventive medicine codes reported with Z02.5 alone.
  3. Authorization language in the intake packet, scanned to the chart before any form is released.
  4. Default release set limited to the clearance page and immunization record.
  5. Self-pay restriction flag that actually suppresses claim generation, tested on two prior encounters.
  6. Event checklist for off-site physicals, including volunteer training records.
  7. Vendor inventory refreshed, with agreements in place for every platform touching intake or transmission.
  8. Records-request script with the 30-day clock and the cost-based fee limit spelled out.

Run the checklist in May and the August surge is a staffing problem. Skip it and it becomes a privacy problem with a paper trail. If your policies, risk analysis, and vendor documentation are the weak link, build the current document set now — before three hundred clearance forms start moving through your front desk.