Office visit coding determines revenue capture for millions of primary care and specialty encounters each year. The 2026 E/M guidelines continue to allow providers to select 99202-99215 codes based on either medical decision making (MDM) complexity or total time spent on the date of service. Getting these selections wrong triggers denials, audit adjustments, and lost revenue. This guide provides decision trees for both coding pathways, identifies the documentation elements auditors examine first, and explains where most coding errors occur.
Revenue cycle leaders need coders who consistently apply the correct methodology. One misapplied modifier or misread time threshold can shift an entire quarter's metrics.
Understanding the two coding pathways for office visits
CMS offers two distinct routes for selecting the correct E/M level: complexity of medical decision making or cumulative time spent on the encounter date.
MDM-based coding evaluates three elements. The number and complexity of problems addressed. The amount and complexity of data reviewed or ordered. The risk of complications, morbidity, or mortality associated with the presenting problem, diagnostic procedures, or treatment options. Two of three elements must meet or exceed the threshold for a given level.
Time-based coding counts all time the physician or qualified healthcare professional personally spends on the encounter date, including face-to-face and non-face-to-face activities. This includes reviewing records before the visit, examining the patient, documenting findings, ordering tests, and communicating results. Time spent by clinical staff does not count toward the total.
You cannot mix pathways. If you select a code based on time, document total time clearly. If you select based on MDM, document the three MDM elements. Most audit flags occur when documentation shows a time-based selection but lacks a time statement, or claims MDM complexity without supporting the required elements.
MDM complexity decision tree for 99202-99215
Start with the problem complexity. A self-limited or minor problem supports level 2. Two or more self-limited problems, or one stable chronic illness, support level 3. One or more chronic illnesses with exacerbation or progression, or one undiagnosed new problem with uncertain prognosis, support level 4. One or more chronic illnesses with severe exacerbation or threat to life or bodily function support level 5.
Data review thresholds
Level 2 requires minimal or no data review. Level 3 requires review of tests or discussion with an external provider. Level 4 requires independent interpretation of tests or review of external notes from each unique source. Level 5 requires independent historian involvement or interpretation of advanced imaging.
The AMA's CPT guidelines define "unique source" as a separate healthcare organization or distinct specialty. Reviewing three notes from the same cardiology group counts as one source. Reviewing one note from cardiology and one from nephrology counts as two sources.
Risk assessment criteria
Level 2 involves minimal risk, such as over-the-counter drug management. Level 3 involves low risk, such as prescription drug management or minor surgery with no identified risk factors. Level 4 involves moderate risk, like prescription drug management requiring intensive monitoring or decision regarding elective major surgery. Level 5 involves high risk, such as drug therapy requiring intensive monitoring for toxicity or emergency major surgery.
Auditors verify that documentation supports the selected risk level. Stating "patient is high risk" without specifying the clinical rationale fails the audit. Documentation must explicitly name the medications requiring monitoring, the surgical decision under consideration, or the emergency intervention planned.
Time-based selection thresholds and documentation
New patient visits follow these thresholds. 99202 requires 15-29 minutes. 99203 requires 30-44 minutes. 99204 requires 45-59 minutes. 99205 requires 60-74 minutes. Established patient visits use different ranges. 99212 requires 10-19 minutes. 99213 requires 20-29 minutes. 99214 requires 30-39 minutes. 99215 requires 40-54 minutes.
Documentation must state total time. "35 minutes spent on this encounter" satisfies the requirement. "Prolonged encounter" does not. Generic templates that auto-populate time fields without physician verification trigger audit scrutiny.
Time includes reviewing prior records and test results before the visit, performing the history and exam, counseling and educating the patient, ordering tests and medications, documenting in the health record, and communicating with other providers about the patient on the encounter date. Travel time, scheduling activities, and time spent by non-physician staff do not count.
When time and MDM suggest different levels
Choose the pathway that supports the higher level, but document both if possible. If MDM supports 99214 and time supports 99213, code 99214 and document the MDM elements that justify it. If time supports 99215 but MDM only reaches level 4, code 99215 and document total time spent.
Auditors review both pathways during post-payment review. If your documentation supports the level under either pathway, the code stands. If it fails both, expect a recoupment demand.
Common office visit coding errors auditors catch first
Upcoding based on patient complexity rather than encounter complexity is the most frequent error. A patient with 12 chronic conditions does not automatically warrant a level 5 code. The code reflects what the physician addressed during this specific visit, not the patient's overall medical history.
Template overreliance
Documentation templates that auto-populate MDM levels without customization fail audits routinely. If every note for a given provider shows identical language about "extensive data review" and "high risk decisions," auditors flag the pattern. Real encounters vary. Documentation should too.
Cloned notes trigger automated flags in payer systems. When 90% of your 99214 claims contain identical phrases, expect prepayment review requests.
Time documentation gaps
Stating "prolonged visit" without a numeric time value does not support time-based coding. Neither does "spent extra time counseling" or "complex discussion." Document the actual minutes: "42 minutes spent on this encounter."
Rounding time inappropriately also draws scrutiny. If every timed encounter ends in 0 or 5 (20 minutes, 35 minutes, 40 minutes), auditors question accuracy. Real encounters end at irregular intervals.
Modifier 25 misuse
Appending modifier 25 to an E/M code on the same date as a procedure requires documentation of a separate, identifiable service. The E/M must address a problem beyond the typical pre- and post-procedure work. Simply documenting a brief history and exam related to the procedure does not support modifier 25.
Payers increasingly use natural language processing tools to scan notes for distinct diagnoses and independent decision making. If the documentation shows only procedure-related discussion, the E/M code gets denied.
Decision trees for new versus established patients
New patient codes (99202-99205) apply when the patient has not received face-to-face service from the physician or another physician of the same specialty in the same group within the past three years. Established patient codes (99211-99215) apply otherwise.
The distinction affects both time thresholds and MDM expectations. A 30-minute encounter codes as 99203 for a new patient but 99214 for an established patient. Verify patient status before assigning codes.
Group practice rules complicate this. If Dr. Smith sees a patient for the first time, but Dr. Jones in the same cardiology practice saw the patient two years ago, the patient is established. Specialty matters. If Dr. Jones is a cardiologist and Dr. Smith is a cardiac electrophysiologist in the same group, check your payer's policy. Most treat subspecialties within the same taxonomy code as the same specialty.
How specialty-specific documentation requirements affect code selection
Primary care, internal medicine, and family practice typically document broader problem lists and preventive elements. Specialty practices focus documentation on the referred condition. Both approaches can support the same E/M level if the MDM or time requirements are met.
Surgical specialists often undercode office visits by focusing only on the surgical decision. Preoperative risk assessment, medication management, and coordination with other providers all contribute to MDM complexity. If you spent 40 minutes managing anticoagulation decisions before a scheduled procedure, that supports 99215 for an established patient.
Behavioral health visits require clear documentation of changes in medication management or complexity of psychiatric comorbidities. Stating "continued current medications" supports a lower level than "adjusted sertraline from 50mg to 100mg due to inadequate response, discussed potential side effects and follow-up plan."
When specialty documentation practices diverge from E/M guidelines, coding accuracy suffers. A coding quality audit identifies these gaps before payers do.
Payer-specific variations and local coverage determinations
Medicare follows CMS guidelines as published in the Medicare Physician Fee Schedule. Commercial payers generally adopt the same framework but may apply different audit thresholds or documentation requirements.
Some Medicare Administrative Contractors issue local coverage articles with additional specificity. MAC J15 published guidance in 2025 emphasizing independent historian documentation for level 5 visits. MAC JE requires specific language about prescription drug monitoring for moderate and high-risk MDM.
Commercial payer contracts sometimes specify different time thresholds or require additional documentation elements. UnitedHealthcare's 2026 provider manual requires time documentation even when coding by MDM for any code above 99213. Anthem's policies define "unique source" more narrowly than CMS.
Revenue cycle teams must track these variations by payer. Coding one way for all claims leaves money on the table or invites denials. Outsourced coding partners with payer-specific validation workflows reduce this risk.
Avoiding prolonged services code confusion
Prolonged services codes (99417 for office visits) apply only when total time exceeds the maximum for 99205 or 99215. You cannot report prolonged services based on MDM complexity alone. Time documentation is mandatory.
For 99205, add 99417 when time reaches 75 minutes. For 99215, add 99417 when time reaches 55 minutes. Each additional 15 minutes beyond the initial threshold allows one additional unit of 99417.
Document total time and the activities that consumed it. "85 minutes spent on this encounter, including 30 minutes coordinating with cardiology regarding medication interactions and 20 minutes reviewing prior imaging studies" supports 99205 plus one unit of 99417.
Payers audit prolonged services claims at higher rates than standard E/M codes. Ensure documentation clearly shows why the encounter required extended time. Routine visits that happen to take longer due to patient talkativeness or system delays do not qualify.
FAQ
Can I use both MDM and time to justify the same E/M code?
You select the code using one pathway or the other, not both simultaneously. However, documenting both MDM elements and total time provides audit protection. If an auditor questions your MDM selection, time documentation may still support the level. The code stands if either pathway meets the threshold.
What happens if my documentation supports different levels under MDM versus time?
Choose the pathway that supports the higher level and clearly document which method you used. If time supports 99214 but MDM only supports 99213, document total time and select 99214. Auditors will review the pathway you selected. As long as your documentation supports the level under that specific method, the code is defensible.
Do I need to document all three MDM elements for every office visit?
Only if you're coding based on MDM complexity. If you select the code based on time, you must document total time but are not required to detail MDM elements. That said, including MDM documentation provides a fallback if your time statement is questioned. Most coding experts recommend documenting both when feasible.
How do I document "independent interpretation" of test results for higher MDM levels?
State what you reviewed and what clinical conclusion you reached. "Reviewed chest X-ray personally, noted new infiltrate in right lower lobe consistent with pneumonia" satisfies the requirement. Simply stating "reviewed imaging" does not. The documentation must show you formed an independent clinical impression, not just that you looked at a report someone else generated.
What counts as a "unique source" when calculating data review for MDM?
A unique source is a separate healthcare organization or a distinct specialty within your organization. Three notes from different cardiologists in your group count as one source. One note from cardiology and one from endocrinology count as two sources. External records from a different hospital system count separately even if they're the same specialty. CMS defines this in the 2021 E/M guidelines, which remain current in 2026.
Building accuracy into office visit coding workflows
Accurate E/M coding requires consistent application of guidelines, specialty-specific expertise, and regular audit feedback. Coders need decision support tools that present MDM and time thresholds in clear visual formats. Physicians need documentation templates that prompt for required elements without creating cloned notes.
Revenue cycle directors report that E/M coding errors account for 18-23% of total claim denials in primary care and specialty practices. Most of these are preventable with structured coding protocols and quality review processes.
Outsourced coding teams bring specialty-trained coders, ongoing audit programs, and payer-specific validation workflows. MedCodex Health maintains coder certifications across 40+ specialties and conducts monthly inter-rater reliability testing to ensure consistent E/M code selection. When your internal team is underwater or your denial rates are climbing, MedCodex Health offers a 30-day coding pilot with side-by-side accuracy comparison. No long-term contract required, just measurable improvement in coding accuracy and revenue capture.