Every January, someone in your practice has to reload a spreadsheet. If nobody does it, your fee schedule quietly runs on last year's numbers, your productivity dashboard misreports every provider, and your compensation committee makes decisions on stale math. That spreadsheet is the CMS relative value unit file, and understanding what is RVU in medical billing is the difference between a fee schedule you can defend and one you inherited.

This guide is written for administrators, billing managers, and privacy officers — not for coders looking for code-specific answers. It covers how RVUs are built, who maintains them in your practice, and the part almost nobody addresses: the RVU productivity report is a PHI export, and the vendors who build it are business associates.

What Is RVU in Medical Billing: The Short Answer

An RVU — relative value unit — is the unit CMS uses to express the relative resource cost of one billable service compared to every other billable service under the Medicare Physician Fee Schedule. It is not a dollar amount. It becomes a dollar amount only after geographic adjustment and multiplication by a conversion factor.

Every service on the fee schedule carries three RVU values:

  • Work RVU (wRVU) — physician time, technical skill, mental effort, and stress. This is the component most compensation models use.
  • Practice expense RVU (PE RVU) — clinical staff time, supplies, equipment, and overhead. Published in two versions: facility and non-facility.
  • Malpractice RVU (MP RVU) — professional liability insurance cost attributable to that service.

The payment formula CMS applies looks like this:

[(wRVU × work GPCI) + (PE RVU × PE GPCI) + (MP RVU × MP GPCI)] × Conversion Factor = allowed amount

GPCI stands for Geographic Practice Cost Index — three separate indices per locality, one for each RVU component. A practice in a high-cost metro locality and a practice in a rural locality bill the same code and receive different allowed amounts, because the GPCIs differ.

A worked example, with no code attached

Take a hypothetical service valued at 1.50 wRVU, 1.20 non-facility PE RVU, and 0.10 MP RVU. In a locality where all three GPCIs are 1.000, the total is 2.80 RVUs. Multiply by the conversion factor and you have the non-facility allowed amount. Move that same service into a hospital outpatient department and you use the facility PE RVU instead — a lower number, because the facility absorbs the overhead and bills separately.

That site-of-service differential is the single most common source of fee schedule errors in practices that operate both office-based and hospital-based service lines. If your billing system stores only one PE column, someone chose for you.

The 2026 Wrinkle: Two Conversion Factors

For calendar year 2026, CMS finalized two conversion factors for the first time — a higher one applied to qualifying alternative payment model participants and a slightly lower one for everyone else. This split was written into statute years ago under MACRA and finally took effect this year.

Operationally, that means your fee schedule build is no longer a single-variable update. Your billing lead has to know which conversion factor applies to which rendering provider, and that status can change year to year based on APM participation.

CMS also revised practice expense methodology for facility-based services and applied an efficiency adjustment to work values on certain non-time-based services in the CY 2026 rule. The practical consequence: RVU values shifted for a meaningful number of services, not just the conversion factor. If you updated only the CF this January, your fee schedule is wrong.

Where the files actually live

CMS publishes RVU files quarterly — RVU26A, RVU26B, and so on — through the Physician Fee Schedule pages on cms.gov. For one-off lookups, the MPFS Look-Up Tool returns component RVUs, GPCI-adjusted amounts, and global period indicators.

Assign this to a named person, not a role. "Billing" does not reload a file. Maria reloads the file, by the 15th of the month following each quarterly release, and logs the version she loaded.

The Three Places RVUs Show Up in Your Operations

1. Fee schedule construction

Most practices set charges as a multiple of the Medicare allowed amount — 200%, 250%, whatever the market and your payer contracts support. If your RVU file is stale, every charge derived from it is stale. Commercial contracts that pay a percentage of Medicare inherit the same problem in reverse.

2. Provider compensation

Work RVU-based compensation pays a dollar rate per wRVU produced, often with a threshold and tiered rates above it. This model requires a monthly per-provider wRVU total, which requires a per-encounter extract from your practice management system.

3. Capacity and staffing analysis

Administrators use total RVUs per provider per session to compare templates, evaluate a new hire's ramp, or model what happens if you add a Friday clinic. Reasonable uses. Each one starts with the same extract.

The Report That Turns RVUs Into Protected Health Information

Here is where the privacy officer needs to be in the room. A wRVU total — "Dr. Patel produced 412 wRVUs in April" — is a compensation figure. It is not PHI. Nobody's health information is in it.

The extract that produces it usually is. A typical productivity pull includes date of service, rendering provider, procedure code, diagnosis code, place of service, and — because the report writer needed a unique key — the patient account number or MRN. That is individually identifiable health information under 45 CFR Part 160. It does not stop being PHI because the destination is a compensation model instead of a claim.

Three failure patterns show up repeatedly:

  • The desktop spreadsheet. The extract lands in a folder on the administrator's laptop, gets emailed to the compensation committee, and lives in three inboxes indefinitely. No encryption analysis, no retention rule, no deletion.
  • The consultant with a login. A compensation consultant is given read access to the practice management system so they can "pull what they need." Read access to the PM system is access to the entire patient database.
  • The BI tool nobody inventoried. An analytics platform ingests claims data nightly to power an RVU dashboard. It was procured by the CFO, not by IT, and it is not on the vendor list.

Minimum Necessary, Applied to a Productivity Dashboard

The minimum necessary standard requires you to limit uses and disclosures of PHI to what is reasonably needed for the purpose. HHS maintains guidance on the minimum necessary requirement that is worth putting in front of whoever writes your reports.

Apply it concretely to RVU reporting:

  1. Drop the diagnosis codes. RVU values attach to procedure codes. Diagnosis rarely affects the wRVU calculation and almost never affects the compensation math. If the report writer included them because they were in the source table, remove them.
  2. Replace the patient identifier with a hash or a row count. If you need to detect duplicates, hash the account number. If you do not, drop it entirely.
  3. Aggregate before you distribute. The compensation committee needs provider-level monthly totals. It does not need encounter-level detail. Only the person reconciling discrepancies needs to drill down, and only for the period in question.
  4. Set a retention rule. Detail extracts get deleted after reconciliation closes. Aggregate totals persist. Write it down; audit it quarterly.

Every Vendor Touching RVU Data Is a Business Associate

Run your list. The billing company that submits your claims. The clearinghouse. The analytics platform hosting the dashboard. The compensation consultant who receives encounter-level files. The MSO that runs your revenue cycle. The accounting firm that gets a claims extract to model provider comp.

Each of them creates, receives, maintains, or transmits PHI on your behalf. Each needs a signed business associate agreement in place before the first file moves, with the required provisions under 45 CFR 164.504(e) — permitted uses, safeguards, subcontractor flow-down, breach notification timing, and return or destruction at termination.

The gap is usually not the billing company. Billing companies have BAAs; that is their business. The gap is the analytics vendor procured on a credit card and the consultant engaged on a two-page letter of engagement. If you are papering one of those relationships this quarter, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, no waiting on outside counsel for a standard-form agreement.

What to ask the analytics vendor before signing

  • Where does the data rest, and is it encrypted at rest and in transit?
  • Which subcontractors touch it — cloud host, monitoring service, offshore support?
  • Can they ingest a de-identified or limited data set instead of full claims?
  • What is their deletion commitment when the contract ends, and how do they evidence it?
  • Do they log access at the user level, and will they produce those logs on request?

Billing Records Are in the Designated Record Set

This catches practices off guard. The designated record set includes billing records used to make decisions about individuals — not just the clinical chart. A patient exercising their right of access can reach the billing record, and your 30-day clock applies.

What that does not mean: nobody is entitled to your internal wRVU productivity report or your compensation model. Those are business records, not records about that individual. What it does mean: the claim history, the codes billed, and the amounts charged for that patient's encounters are in scope. HHS covers the boundaries in its individual right of access guidance.

Practical step: confirm your front desk knows which system holds the billing record and who fulfills that portion of a request. If your billing is outsourced, your BAA should obligate the vendor to support access requests within a timeframe that lets you meet your own deadline.

How Practices Determine Code Selection — and Why That Stays Out of Admin's Hands

RVU totals are downstream of code selection. Code selection is downstream of documentation. Neither belongs to the compensation committee.

The defensible workflow looks like this: the rendering provider selects the code based on the service documented. A certified coder reviews against documentation, queries the provider when documentation and code do not align, and the provider — not the coder, not the administrator — resolves the query. Compliance samples charts periodically against a written audit plan and reports findings to leadership.

Administrators own the process, the audit cadence, the query log, and the education plan. They do not own the code. Any incentive structure that rewards higher wRVU output without an independent documentation audit is a structure your compliance officer should flag in writing.

The compensation-model guardrail

Tying physician pay to wRVUs is common and lawful, but the arrangement has to be commercially reasonable, set at fair market value, and structured so compensation is not determined in a manner that varies with the volume or value of referrals. Get the rate benchmarked, get the arrangement in writing and signed before it takes effect, and keep the benchmarking documentation with the contract.

A 30-Day Cleanup for Your RVU Workflow

  1. Days 1–5. Confirm which RVU file version your fee schedule runs on and whether both 2026 conversion factors are mapped correctly by provider.
  2. Days 6–10. Pull the actual RVU productivity extract. Read the column headers. Identify every PHI field and every recipient.
  3. Days 11–15. Cross-check every recipient against your business associate inventory. Note the gaps.
  4. Days 16–25. Execute missing BAAs. Rewrite the report to strip unnecessary identifiers.
  5. Days 26–30. Document the whole thing — file owner, refresh cadence, extract specification, distribution list, retention rule — and add the extract to your risk analysis asset inventory.

That last step matters more than it sounds. A data flow you have never documented is a data flow you have never assessed, and your risk analysis is the artifact OCR asks for first. If your inventory and policy set need rebuilding around flows like this one, automated risk analysis and compliance documentation will get you to a defensible baseline faster than a blank template will.

Start With the Extract, Not the Formula

You now know what an RVU is in medical billing: three weighted components, geographically adjusted, multiplied by a conversion factor that split into two this year. The formula is the easy part — CMS publishes it and updates it on a schedule.

The harder part is the monthly file nobody inventoried, sitting on a laptop, routed to a consultant who never signed anything. Find that file this week. Then put a signed business associate agreement in place with every vendor on the distribution list before the next month-end close.