The Ultimate Guide to CPT Codes 99213–99215 (2026): E/M Documentation & Billing Explained

Schedule Your Free Consultation

An internal medicine practice in Ohio got slammed with a Medicare audit last quarter. The contractor reviewed 100 established patient visits and downcoded 65% of their 99214 claims to 99213. That's $13,000 they had to pay back. The physician was baffled. "These weren't simple visits," she insisted. "I was managing diabetes, hypertension, heart disease multiple conditions!" Didn't matter. Her documentation showed stable chronic conditions with routine refills. That's low complexity MDM, not moderate. Managing stable conditions isn't the same as managing complex problems.

That's the brutal reality of CPT codes 99213–99215. Physicians think documenting multiple diagnoses automatically justifies 99214. It doesn't. Medical decision-making complexity isn't about how many problems exist it's about how complicated your thinking and management were today.

These codes determine your established patient visit reimbursement. Bill them wrong and you're either leaving revenue on the table or facing recoupment demands. Let's break down what actually matters.

What CPT Codes 99213–99215 Actually Cover

These codes bill established patient office visits. Established means you or someone in your group practice has provided professional services to this patient within the past three years. Not new established.

The codes differ by complexity, which translates directly to payment differences. Higher complexity pays more but requires stronger documentation and carries higher audit risk.

You select the code based on either Medical Decision Making or total time. Most practices use MDM since that's what they're documenting anyway. Time works when you're counseling extensively and can prove exact minutes.

The MDM Framework That Determines Your Code

Medical Decision Making has three scored elements. Meeting requirements in two of three determines your level:

•       Number and complexity of problems addressed

•       Amount and complexity of data reviewed

•       Risk of complications from management

Here's what everyone misses: you need TWO elements at the level you bill. One isn't enough. Auditors score each element and look for two supporting the code. Miss this and they downcode.

99213: Low Complexity That Gets Overcoded

Low complexity MDM. Stable chronic conditions, minor acute issues, routine refills. Minimal data review, low-risk management.

Real example: Patient with well-controlled hypertension and diabetes comes for routine follow-up. Blood pressure good, blood sugar stable, refill medications, return in three months. Stable conditions, minimal decision-making, low risk. That's 99213.

The mistake? Providers automatically bill 99214 because the patient has multiple chronic diagnoses. But if everything's stable and you're just continuing the same plan, that's low complexity. Stable doesn't equal complex.

99214: The Workhorse Code Everyone Undercodes

Moderate complexity MDM. This is where most established patient visits should actually fall. Problem worsening, medication adjustments, data interpretation, moderate-risk decisions.

Real example: Diabetic patient comes in with blood sugars running high. You review home glucose log, recent A1C showing poor control, adjust insulin dosing, order repeat labs, discuss diet modifications. Problem with new data requiring management change, moderate risk prescribing. Solid 99214.

Here's the frustrating part: many providers undercode this as 99213 out of audit fear. If you're actively managing worsening conditions or making medication changes based on reviewed data, you're in 99214 territory. Don't leave money on the table.

Documentation needs to show the problem, the data you reviewed, and why your decision carries moderate risk. "Adjusted medications" isn't enough. "Increased metformin from 500mg to 1000mg BID based on A1C of 8.2, discussed hypoglycemia risk" is enough.

99215: High Complexity That Gets You Audited

High complexity MDM. Severe exacerbations, extensive data review, high-risk management, multiple comorbidities with acute issues. This should be your sickest established patients only.

Real example: CHF patient presenting with worsening shortness of breath. You review recent echo, labs showing renal function decline, chest X-ray showing pulmonary edema. You're adjusting diuretics, arranging cardiology consult, considering hospitalization. High-risk decisions on deteriorating patient. That justifies 99215.

The problem? Practices overuse 99215 for patients who don't meet high complexity criteria. Having multiple stable chronic conditions doesn't make every visit high complexity. Auditors target 99215 heavily. If you're billing it more than 10-15% of established visits, expect scrutiny.

Your documentation needs to scream complexity. List every problem you actively managed. Document every piece of data reviewed with specifics. Explain why your decisions carry high risk. Make auditors understand why this wasn't routine.

Time-Based Billing: When You Can Actually Use It

You can select E/M level by total time instead of MDM. Total time includes everything done on encounter date:

•       Reviewing records before visit

•       History, exam, counseling

•       Ordering tests and prescriptions

•       Documenting the encounter

•       Same-day communications with other providers

What doesn't count: Separately billable procedures. Staff time without you. Travel between locations.

If billing by time, document it. "Total time: 32 minutes." Don't estimate. Track it or don't bill by it.

The Billing Mistakes Costing Practices Money

After working with countless practices, we see these errors constantly:

Coding Based on Diagnosis Count

Patient has six diagnoses on problem list, so every visit must be 99214 or 99215. Wrong. What matters is what you actively managed today and how complex those decisions were. Stable chronic conditions getting routine refills? That's 99213 regardless of diagnosis count.

Undercoding From Audit Paranoia

Some practices got audited once and now code everything 99213 even when 99214 or 99215 is clearly justified. That's thousands in lost revenue annually. If documentation supports higher complexity, bill it.

Copy-Paste Documentation

You copy forward last visit's note with minor tweaks. Assessment and plan identical for months. Auditors spot this instantly. It suggests you're not actually providing the level of decision-making your codes claim. Plus it's just lazy documentation.

Not Documenting Risk

You prescribe warfarin but don't document why that's moderate or high risk. You adjust cardiac medications but don't mention potential complications. Auditors score risk based on what you document, not what you know. If risk isn't documented, they score it as low.

What's Happening With E/M Audits in 2026

Payers are using sophisticated analytics to identify outlier coding patterns. If your 99214 and 99215 utilization rates are significantly higher than specialty peers, you're getting reviewed.

We're seeing more prepayment reviews where payers demand documentation before paying claims. They're also conducting retrospective audits, pulling charts from 12-18 months ago and downcoding based on insufficient MDM.

Medicare publishes E/M data by specialty. Outliers get flagged for focused medical review. That means every claim gets scrutinized until you prove your coding is appropriate.

Protecting Your Revenue

Don't wait for audit letters. Here's what works:

•       Build MDM templates: Templates should prompt for problems, data review, risk. Make documentation easier.

•       Conduct quarterly audits: Pull random charts. Score MDM elements. Check if documentation supports codes. Fix patterns immediately.

•       Train providers: Most physicians don't understand two-out-of-three scoring. Teach them what auditors actually look for.

•       Partner with billing experts: Professional RCM teams catch coding errors before claims submit and help optimize revenue without audit risk.

Questions About CPT 99213–99215

What's the actual difference between 99213 and 99214?

MDM complexity. 99213 is low stable conditions, routine management, minimal data, low risk. 99214 is moderate worsening problems, medication adjustments, data interpretation, moderate-risk decisions. If you're actively problem-solving beyond routine refills, you're in 99214 territory.

When should 99215 actually be billed?

When you have high complexity MDM severe exacerbations, extensive data review, high-risk management. Not just because patient has multiple chronic conditions. Those conditions need to be unstable or deteriorating with complex decision-making required. Bill 99215 more than 15% of visits and payers will audit.

Can time override MDM level?

Yes. You can use total time OR MDM to determine code level. If you document exact time and it meets threshold, you can bill that level even if MDM doesn't support it. But you must document actual time and justify why visit took that long.

What triggers an audit for 99215?

High utilization compared to peers. Payers run reports showing your 99215 percentage versus specialty average. Outliers get audited. Also, patterns like billing 99215 for same patient every visit regardless of acuity trigger reviews fast.

How often can 99214 be billed?

As often as documentation supports moderate complexity. There's no frequency limit. But if you bill 99214 for 90% of visits while peers bill it 60%, payers will review your charts. The code itself isn't the problem insufficient documentation supporting the code is.

What actually qualifies as moderate risk?

Prescription drug management (not routine refills). Decisions about minor surgery. Management of acute uncomplicated illness with systemic symptoms. These carry moderate risk. Low risk is over-the-counter meds and self-limited issues. High risk is emergent situations, major surgery decisions, or drug therapy with high risk of severe side effects. Document which category and why.