Your front desk books a "free Medicare physical" for a patient whose Part B coverage started fourteen months ago. That claim will deny. Then the patient calls about a bill she was told wouldn't exist, and someone on your team spends forty minutes reconstructing who said what.

This guide is for the administrator, biller, or compliance lead who owns that workflow. It covers how practices identify and document the correct welcome to Medicare CPT code family, how to verify the once-per-lifetime eligibility window before the appointment is confirmed, and — the part almost nobody maps — where the screening data from that visit actually travels. The Welcome to Medicare visit generates more third-party data flows than a standard sick visit, and most practices have never put a Business Associate Agreement behind half of them.

The "welcome to Medicare CPT code" is not a CPT code

Start with the vocabulary problem, because it causes real scheduling errors. Staff search for a welcome to Medicare CPT code and find nothing in the CPT preventive medicine series, then default to a routine physical code that Medicare does not cover. The visit is billed with HCPCS Level II G codes, not CPT codes.

CMS calls the service the Initial Preventive Physical Examination (IPPE). The core code is G0402. The screening electrocardiogram associated with the IPPE has its own set — G0403, G0404, and G0405 — split by whether your practice performs the tracing, the interpretation and report, or both.

Separately, the Annual Wellness Visit uses G0438 for the initial AWV and G0439 for subsequent years. These are different services with different frequency rules, and claim edits exist specifically to catch practices that treat them as interchangeable.

Your billing team should be confirming code definitions and frequency limits against current CMS material, not against a laminated card from 2019. The Medicare Learning Network publishes the preventive services educational material that your coders and your MAC both reference. Assign one person to check it quarterly and date-stamp the check.

Which code covers the Welcome to Medicare visit?

The Welcome to Medicare visit is billed as the Initial Preventive Physical Examination using HCPCS code G0402 — not a CPT preventive medicine code. It is available once per lifetime and only during the first 12 months of a patient's Medicare Part B enrollment. A screening EKG furnished as a component of the IPPE is reported with G0403, G0404, or G0405 depending on which portion the practice performs. After the 12-month window closes, the patient's preventive option becomes the Annual Wellness Visit (G0438 or G0439).

The 12-month clock, and who is responsible for checking it

Eligibility for this service is a date problem, and date problems belong to scheduling, not billing. If your billing team discovers the window closed, the visit already happened and the money is already gone.

Write the rule into your scheduling protocol: no IPPE appointment gets confirmed without a documented Part B effective date. Not a patient's recollection of when they "went on Medicare" — the effective date from your eligibility verification.

The front-desk sequence that prevents the denial

  1. Patient requests a Medicare wellness or "free physical" appointment.
  2. Scheduler runs eligibility and records the Part B effective date in the designated field, not in a free-text note.
  3. If the visit will occur within 12 months of that date and no prior IPPE appears in history, schedule as IPPE.
  4. If the window has closed or an IPPE was already furnished, schedule the appropriate wellness visit type and note the reason for the change.
  5. Front desk delivers the cost-sharing script — verbatim, from a card — and documents that it was delivered.

That script matters more than most practices realize. The IPPE itself carries no Part B deductible or coinsurance when billed as a preventive service, but the associated screening EKG and any separately identifiable problem-oriented service furnished the same day may generate patient responsibility. Patients hear "free" and stop listening. Your script should say, in plain language, that the wellness portion is covered and that anything addressed beyond it may be billed normally.

Your eligibility checks are a PHI trail

Every one of those verification steps creates a record. Screenshots of payer portals pasted into scheduling notes, exported eligibility batch files sitting in a shared drive, a spreadsheet of "patients newly eligible for IPPE" that someone built in 2023 and never deleted.

That spreadsheet is PHI. It identifies individuals, their coverage, and their care status. It belongs inside your access-controlled systems with a retention limit, and the people who can open it should be the people who need it. HHS guidance on the minimum necessary standard applies to internal uses, not just outbound disclosures — a fact that gets lost when the outreach list lives on the practice manager's desktop.

Documenting the required elements without drifting into a physical

Coding decisions belong to your clinicians and certified coders. What belongs to you, as the administrator, is making sure the documentation template captures every element CMS describes for the service, so that code selection is defensible when a reviewer asks.

CMS describes the IPPE as a bundle of review, screening, counseling, and planning components — including review of medical and social history, review of potential risk factors for depression and other mood disorders, review of functional ability and level of safety, a limited exam with specified measurements, review of current opioid prescriptions and screening for substance use disorder, end-of-life and advance care planning discussion, education and referral, and a written screening schedule for the patient going forward.

Three operational consequences follow:

  • Your template must have a field for every element, including the ones clinicians skip. If the written screening schedule isn't generated and stored, the documentation is incomplete regardless of how good the encounter was.
  • Staff must understand this is not a head-to-toe physical. When a clinician performs and documents a comprehensive exam, patients reasonably expect the visit to have been one — and the encounter note now describes a service Medicare doesn't cover under this code.
  • Same-day problem-oriented services need clean separation. Practices commonly evaluate whether the record supports a distinct, separately identifiable service and document that decision explicitly. Your job is to make sure the note allows that determination to be made by someone reading it cold, months later.

Run a ten-chart internal review within sixty days of any template change. Have your coder score element completeness, not code accuracy — completeness is what you can fix with training.

Where the PHI actually goes: the vendor list this visit creates

Here is the part that shows up in a breach assessment and not in a billing webinar. The IPPE collects sensitive screening data — depression risk, substance use, functional limitations, safety in the home, advance care planning preferences — and in most practices that data touches software you did not build.

Health risk assessments and screening questionnaires

If patients complete depression screens, functional assessments, or intake questionnaires on a tablet in your lobby or through a link texted before the visit, the vendor behind that form is handling PHI. It needs a Business Associate Agreement. So does the platform that sent the text.

Ask three questions of every such vendor: where is the completed questionnaire stored, how long do they retain it after it syncs to your chart, and who on their side can read it. "It's encrypted" answers none of those.

The EKG device nobody put on the list

Screening EKGs furnished with the IPPE often run through a cartridge device with a cloud portal for storage and interpretation. That portal holds identifiable tracings. Every practice I have reviewed that missed a BAA missed a diagnostic device vendor first.

Outreach campaigns built on new-enrollee lists

Marketing your wellness visits to newly enrolled patients is a legitimate operation — but if a third party mails or dials on your behalf using your patient list, that party is a business associate, and the content of the communication determines whether you have crossed from care coordination into marketing that requires authorization. Get counsel on the content. Get a signed agreement on the data flow either way.

If you are looking at that list and realizing two or three names have no executed agreement, the fix is same-day, not next-quarter. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — then send it out before the next IPPE is scheduled. Compare the output against the sample provisions HHS publishes so you know which required terms you are looking at.

Substance use screening and Part 2

Most physician practices are not Part 2 programs, and the substance use screening within an IPPE ordinarily sits in the chart under HIPAA. But if you refer into, receive records from, or share staff with a federally assisted substance use disorder program, the handling rules for those records differ from the rest of the chart. The 2024 final rule aligned Part 2 more closely with HIPAA in several respects, and it did not make the distinction disappear. Know which category your records fall into before someone requests them.

Denials and the records requests that follow them

A denied IPPE claim rarely ends at the claim. Patients dispute the bill, request their record to see what happened, or file a complaint. Your response clock starts the day the request arrives — generally 30 days for a right-of-access request, with one 30-day extension available if you notify the patient in writing.

Two practical points. First, the eligibility documentation your scheduler captured is what lets you explain a denial without guessing. Second, if the patient requests the record, the screening questionnaires and the advance care planning material are part of the designated record set if you maintain them there — including the ones that live in a vendor's system. If you cannot retrieve a vendor-held form on demand, you have an access problem, not just a vendor problem.

A 30-day cleanup plan

  1. Days 1–5: Pull your scheduling appointment types. Confirm IPPE and AWV are distinct types with distinct lengths and distinct pre-visit instructions.
  2. Days 6–10: Write and print the cost-sharing script. Train front desk. Document the training date and attendees.
  3. Days 11–15: List every system that touches IPPE screening data — questionnaire tool, text platform, EKG portal, scribe or transcription service, clearinghouse, billing company. Check each against your executed BAA file.
  4. Days 16–25: Send agreements for the gaps. Set a follow-up date, not a hope.
  5. Days 26–30: Audit ten IPPE encounters for element completeness and for whether the Part B effective date was captured before the visit.

If that exercise surfaces gaps beyond vendor agreements — a risk analysis that predates your current systems, policies that name software you no longer use — the broader HIPAA risk analysis and policy document set is the next thing to put on your calendar. Nothing about the welcome to Medicare CPT code is exotic. What makes it a compliance item is volume: it is a high-frequency visit that collects unusually sensitive screening data through unusually distributed tooling.

Start with the vendor list. It takes an afternoon, and it is the item most likely to appear in a breach report you would rather not file.