E/M Coding Audit Guide
2023+ CMS Guidelines
Complete reference for evaluating and managing Evaluation & Management (E/M) code documentation under the 2021+ CMS guidelines. Master Medical Decision Making (MDM) assessment, time-based coding, and proper documentation for CPT codes 99202-99215.
Overview: E/M Coding in 2023+
Evaluation and Management (E/M) services represent the most frequently billed CPT codes in healthcare. On January 1, 2021, CMS implemented the most significant changes to E/M coding in over 20 years, fundamentally simplifying how providers select office visit codes (99202-99205 for new patients, 99211-99215 for established patients).
Key Takeaway
Since 2021, you can select E/M codes based on EITHER:
- Medical Decision Making (MDM) complexity — Assessed through 3 elements
- Total time on date of encounter — Includes face-to-face and non-face-to-face activities
History and physical examination are no longer required for code selection (but remain clinically relevant).
Why This Guide Matters
Proper E/M coding ensures:
- Revenue integrity — Capture appropriate reimbursement without under/over-coding
- Compliance protection — Reduce audit risk and defend code selections
- Quality metrics — Support accurate risk adjustment and quality reporting
What Changed in 2021?
The 2021 E/M revisions eliminated the complex history and examination requirements that had been in place since 1997. Here's a comprehensive breakdown:
What's Gone (Pre-2021)
- • History requirements (HPI, ROS, PFSH)
- • Examination bullet points
- • "Key components" rule
- • Complex documentation matrices
- • Different time definitions for new vs. established
What's Current (2021+)
- • MDM-based code selection
- • Time-based code selection
- • Total time on date of encounter
- • Simplified 3-element MDM grid
- • Prolonged services (99417) for extended visits
Important Note for Auditors
While history and examination are no longer required for code selection, they:
- • Remain clinically relevant and medically necessary
- • Must be performed and documented when appropriate for patient care
- • Cannot be ignored to "game" the coding system
- • Should align with MDM complexity (e.g., high MDM visit should have comprehensive documentation)
Medical Decision Making (MDM) Assessment
MDM is assessed through three elements. You must meet the threshold for 2 out of 3 elementsto qualify for a given level.
Element 1: Number and Complexity of Problems Addressed
| MDM Level | Problem Criteria | Examples |
|---|---|---|
| Straightforward | 1 self-limited or minor problem | Cold, uncomplicated UTI, simple rash |
| Low | 2+ self-limited problems, OR 1 stable chronic illness, OR 1 acute uncomplicated illness/injury | Stable hypertension, acute bronchitis, simple sprain |
| Moderate | 1+ chronic illness with exacerbation/progression, OR 2+ stable chronic illnesses, OR 1 undiagnosed new problem with uncertain prognosis, OR 1 acute illness with systemic symptoms | COPD exacerbation, diabetes + hypertension management, pneumonia |
| High | 1+ chronic illness with severe exacerbation/progression/side effects, OR 1 acute or chronic illness/injury that poses threat to life or bodily function | CHF exacerbation requiring admission, uncontrolled diabetes with complications, acute MI |
Audit Tip:
"Addressed" means documented. The problem must be evaluated, assessed, and have a management plan. Simply mentioning a chronic condition in the problem list without discussion doesn't count toward MDM complexity.
Element 2: Amount and Complexity of Data Reviewed/Analyzed
Data is awarded points based on categories. Add up the points to determine the level:
Data Categories & Points:
Category 1: Tests, Documents, or Independent Historian(s)
- • Review of prior external note(s) from each unique source = 1 point each
- • Review of result(s) of each unique test = 1 point each
- • Ordering each unique test = 1 point each
- • Assessment requiring independent historian(s) = 1 point
Note: Maximum 2 points for Category 1 (e.g., review 5 labs = 1 point total, not 5 points)
Category 2: Independent Interpretation of Tests
- • Independent interpretation of test performed by another physician/QHP = 2 points
Requirement: Must document your own interpretation, not just agree with radiology report
Category 3: Discussion of Management or Test Interpretation
- • Discussion of management or test interpretation with external physician/QHP/appropriate source = 1 point
Must document: Who you spoke with, date, and what was discussed
Total Points = MDM Level:
| MDM Level | Points Required |
|---|---|
| Straightforward | Minimal or none |
| Low | Limited (Must meet requirements of at least 1 of 2 categories) |
| Moderate | Moderate (Must meet requirements of at least 1 of 3 categories) |
| High | Extensive (Must meet requirements of at least 2 of 3 categories) |
Common Audit Finding:
Providers often order tests (which counts for points) but fail to document review of resultsin the current encounter. Make sure to explicitly state: "Reviewed today's CBC showing..." or "Labs from 3/15 reviewed, showing..."
Element 3: Risk of Complications, Morbidity, and/or Mortality
Risk is based on the highest single item in the risk table. You don't add up multiple items.
| Risk Level | Examples |
|---|---|
| Minimal | • Rest, gargles, elastic bandages • Superficial dressings • OTC drugs |
| Low | • Over-the-counter drugs • Minor surgery with no identified risk factors • Physical/occupational therapy • Prognostic indicators suggest better prognosis |
| Moderate | • Prescription drug management (most common trigger) • Decision regarding minor surgery with identified risk factors • Decision regarding elective major surgery without identified risk factors • Diagnosis or treatment significantly limited by social determinants of health • Parenteral controlled substances |
| High | • Drug therapy requiring intensive monitoring for toxicity (e.g., chemotherapy, anticoagulation) • Decision regarding elective major surgery with identified risk factors • Decision regarding emergency major surgery • Decision not to resuscitate or to de-escalate care because of poor prognosis • Threat to life or bodily function (e.g., AMI, PE, severe respiratory distress) |
Risk Assessment Shortcuts:
• Moderate Risk: Most visits involving prescription medications (antibiotics, blood pressure meds, etc.) automatically qualify
• High Risk: Reserved for life-threatening situations or intensive monitoring drugs (warfarin, chemotherapy)
• Low Risk: OTC recommendations, physical therapy, minor procedures
MDM Level Summary: 2 of 3 Elements Required
| Code | MDM Level | Problems | Data | Risk |
|---|---|---|---|---|
| 99202/99212 | Straightforward | Minimal (1 self-limited) | Minimal or none | Minimal |
| 99203/99213 | Low | 2+ self-limited, 1 stable chronic, or 1 acute uncomplicated | Limited (1 of 2 categories) | Low |
| 99204/99214 | Moderate | 1+ chronic with exacerbation, 2+ stable chronic, or 1 undiagnosed with uncertain prognosis | Moderate (1 of 3 categories) | Moderate (prescription drug mgmt) |
| 99205/99215 | High | 1+ chronic with severe exacerbation or threat to life/bodily function | Extensive (2 of 3 categories) | High (intensive monitoring drug or threat to life) |
Time-Based Coding (Alternative to MDM)
Instead of using MDM, you can select E/M codes based on total time on the date of encounter. This is particularly useful for visits that are time-intensive but may not involve high MDM complexity.
What Counts as "Total Time"?
INCLUDES:
- ✓ Preparing to see the patient
- ✓ Face-to-face time during the visit
- ✓ Obtaining and reviewing separately obtained history
- ✓ Performing examination and evaluation
- ✓ Counseling and educating patient/family
- ✓ Ordering medications/tests/procedures
- ✓ Referring and communicating with other providers
- ✓ Documenting clinical information
- ✓ Reviewing data and results (same date)
- ✓ Independently interpreting tests (same date)
EXCLUDES:
- ✗ Activities on a different calendar date
- ✗ Staff time (nurse intake, etc.)
- ✗ Teaching learners (unless also time-counted)
- ✗ Travel time between locations
- ✗ Time spent on separately reportable procedures
Time Thresholds for Code Selection
| New Patient | Established Patient | Time Range | Typical Time |
|---|---|---|---|
| 99202 | 99212 | 15-29 min / 10-19 min | 20 min / 15 min |
| 99203 | 99213 | 30-44 min / 20-29 min | 35 min / 25 min |
| 99204 | 99214 | 45-59 min / 30-39 min | 50 min / 35 min |
| 99205 | 99215 | 60-74 min / 40-54 min | 65 min / 45 min |
| 99417 (Prolonged) | Each additional 15 min | 75+ min / 55+ min | |
Time Documentation Requirements
To use time-based coding, you MUST document:
- 1. Total time spent (e.g., "Total time: 35 minutes")
- 2. Statement that time was basis for code selection (e.g., "Code selected based on time")
- 3. Brief description of activities (optional but recommended for audit defense)
Example: "Total time today: 35 minutes. Discussed treatment options, reviewed labs, coordinated with cardiology, and educated patient on medication changes. Code selected based on time."
Prolonged Services (99417)
CPT code 99417 is an add-on code for prolonged office visit services. Key requirements:
- • Can only be used with 99205 or 99215 (highest level codes)
- • Requires both high-complexity MDM AND time threshold (75+ min for new, 55+ min for established)
- • Billable in 15-minute increments (e.g., 90 minutes = 99205 + 99417)
- • Must document total time and reason for extended visit
Note: Most payers do not reimburse 99417 for commercial plans, but Medicare does. Check payer policies before billing.
Practical Code Selection Examples
Real-world scenarios to demonstrate proper E/M code selection:
Example 1: 99213 (Established Patient, Low Complexity)
Scenario: 58-year-old established patient presents for follow-up of hypertension. Currently on lisinopril 20mg daily. Blood pressure today 138/88. Patient reports good adherence, no side effects.
MDM Analysis:
- Problems: 1 stable chronic illness (hypertension) = LOW
- Data: No labs ordered, no external records reviewed = Minimal
- Risk: Prescription drug management (lisinopril) = MODERATE
✓ Result: 2 of 3 elements meet LOW criteria → 99213
Alternative: If time was documented (e.g., 22 minutes), 99213 could also be justified by time.
Example 2: 99214 (Established Patient, Moderate Complexity)
Scenario: 65-year-old established patient presents with uncontrolled diabetes (A1c 9.2%) and new onset neuropathy. Reviewed endocrinology note from last month. Discussed insulin initiation. Ordered diabetic education and nephrology referral.
MDM Analysis:
- Problems: 1 chronic illness with progression (diabetes + new neuropathy) = MODERATE
- Data: Reviewed external note (endocrinology) + ordered test (A1c) = MODERATE (1 of 3 categories)
- Risk: Prescription drug management (insulin initiation) = MODERATE
✓ Result: All 3 elements meet MODERATE criteria → 99214
Note: This visit would also qualify for 99214 by time if 30-39 minutes was documented.
Example 3: 99215 (Established Patient, High Complexity)
Scenario: 72-year-old established patient with CHF exacerbation. Patient presents with increasing dyspnea, orthopnea, and weight gain of 8 lbs in 3 days. Reviewed today's CXR (shows pulmonary edema), BNP (elevated at 1,200), and echocardiogram from cardiology. Discussed management with cardiologist. Initiated IV diuretics and admitted to hospital.
MDM Analysis:
- Problems: 1 chronic illness with severe exacerbation (CHF requiring admission) = HIGH
- Data: Reviewed external records (cardiology echo) + reviewed unique tests (CXR, BNP) + discussed management with cardiologist = EXTENSIVE (2 of 3 categories)
- Risk: Decision for hospital admission + drug therapy requiring monitoring (IV diuretics) = HIGH
✓ Result: All 3 elements meet HIGH criteria → 99215
Note: If visit took 55+ minutes, could also add 99417 for prolonged services.
7-Step E/M Audit Process
1Identify Encounter Type
Confirm the visit qualifies as an office/outpatient visit and determine if the patient is new or established.
- • New Patient: Has not received professional services from this physician/group within past 3 years (99202-99205)
- • Established Patient: Has received professional services from this physician/group within past 3 years (99211-99215)
2Choose Coding Method
Determine if the visit will be coded based on MDM complexity or time. Check documentation for explicit time statements.
- • If time is documented with statement "code selected based on time" → Use time-based method
- • If no clear time statement → Default to MDM-based method
3Assess MDM Components
If using MDM method, evaluate all three elements:
Element 1: Number/Complexity of Problems
Count problems addressed and assess severity (self-limited, stable chronic, exacerbation, life-threatening)
Element 2: Data Reviewed
Award points for tests ordered/reviewed, external records reviewed, and discussions with other providers
Element 3: Risk Assessment
Identify highest risk factor (prescription drugs = moderate, intensive monitoring = high)
4Calculate MDM Level
Determine overall MDM level by identifying which level is met by at least 2 of 3 elements.
Example: If Problems = Moderate, Data = Low, Risk = Moderate → Overall MDM = Moderate (2 of 3 at Moderate)
5Verify Time Documentation (if applicable)
If using time-based coding, verify:
- ✓ Total time is clearly documented (e.g., "Total time: 32 minutes")
- ✓ Statement that code was selected based on time
- ✓ Time falls within appropriate range for selected code
- ✓ Activities performed are documented (optional but recommended)
6Match Code to Level
Select the appropriate CPT code based on your assessment:
| Level | New Patient | Established Patient |
|---|---|---|
| Straightforward | 99202 | 99212 |
| Low | 99203 | 99213 |
| Moderate | 99204 | 99214 |
| High | 99205 | 99215 |
7Document Audit Trail
Record your audit findings including:
- • Code selected and rationale (MDM or time-based)
- • MDM element breakdown (if applicable)
- • Any documentation gaps or recommendations for provider
- • Compliance notes (e.g., "Documentation supports 99214 based on moderate MDM - 2 of 3 elements met")
Common Documentation Pitfalls
Pitfall #1: Overcoding Based on Old Rules
Problem: Selecting 99214/99215 based solely on comprehensive exam and detailed history.
Solution: Remember that history/exam no longer drive code selection. Focus on MDM or time.
Pitfall #2: Counting Problems Not Actually Addressed
Problem: Listing 10 chronic conditions in problem list but only actively managing 2 of them.
Solution: Only count problems that are evaluated and managed during the visit. Simply listing "HTN, DM, CKD" without discussing them doesn't count.
Pitfall #3: Incomplete Data Documentation
Problem: Ordering labs but not documenting review of results (even if reviewed on same day).
Solution: Explicitly state: "Reviewed today's CBC showing WBC 12.5..." or "Labs from 3/15 reviewed, showing A1c 8.2..."
Pitfall #4: Time Documentation Without Statement
Problem: Documenting "35 minutes" but not stating that code was selected based on time.
Solution: Add: "Total time: 35 minutes. Code selected based on time." This explicit statement is required for time-based coding.
Pitfall #5: Risk Overestimation
Problem: Claiming "high risk" for routine prescription refills.
Solution: High risk is reserved for drugs requiring intensive monitoring(warfarin, chemotherapy) or life-threatening situations. Most prescription management = moderate risk.
Pitfall #6: Using Both MDM and Time
Problem: Justifying code with both "moderate MDM" and "30 minutes."
Solution: Choose one method (MDM or time), not both. If documenting time, state "code selected based on time." Otherwise, use MDM.
Frequently Asked Questions
What changed in E/M coding guidelines in 2021?
CMS eliminated the history and examination requirements for code selection. Office visit codes (99202-99215) can now be selected based on either Medical Decision Making (MDM) complexity OR total time spent on the date of encounter. This significantly simplified documentation requirements while maintaining code level integrity.
What's the difference between 99213 and 99214?
99213 requires Low complexity MDM (or 20-29 minutes), while 99214 requires Moderate complexity MDM (or 30-39 minutes). The key differentiators are: (1) Number of problems addressed, (2) Amount of data reviewed and analyzed, (3) Risk of complications. 99214 typically involves managing multiple chronic conditions, reviewing external records, or addressing high-risk situations.
Can I use time-based coding for all E/M visits?
Yes, for office visits (99202-99215) you can select the code based on total time on the date of encounter. This includes face-to-face and non-face-to-face time spent on patient care activities on that date. You must document the total time and the activities performed. However, you cannot use both time AND MDM for the same visit - choose the method that results in the most appropriate code level.
What counts as "data reviewed" for MDM?
Data includes: (1) Review of prior external notes from each unique source, (2) Review of test results (labs, imaging, etc.), (3) Ordering tests, (4) Independent interpretation of tests, (5) Discussion of management or test interpretation with external physician. Each category has specific documentation requirements. For example, simply ordering a test doesn't count - you must review and consider the results.
How do I determine "risk" for MDM assessment?
Risk is assessed based on: (1) Risk of morbidity from additional diagnostic testing or treatment, (2) Risk of complications from patient's illness or treatment. High risk includes drug therapy requiring intensive monitoring, decision for elective major surgery, parenteral controlled substances, or diagnosis/treatment significantly limited by social determinants of health. Moderate risk includes prescription drug management, decision for minor surgery, or diagnosis with uncertain prognosis.
Do prolonged services codes still apply?
Yes, but they changed. For office visits, CPT 99417 can be added for each additional 15 minutes beyond the maximum time for the highest-level code (e.g., beyond 74 minutes for 99205 or 54 minutes for 99215). You must meet BOTH time AND high-complexity MDM requirements. Prolonged services for non-face-to-face care (99358-99359) still exist but have specific documentation requirements.
Automate Your E/M Audits with ChartWhisper
Stop manually auditing E/M documentation. ChartWhisper automatically assesses MDM levels, validates code selection, and flags documentation gaps in real-time—ensuring compliance while capturing every revenue opportunity.
✓ Automated MDM assessment • ✓ Real-time code validation • ✓ Compliance protection