The defensible visit
Most undercoding isn't a billing habit. It's a documentation problem wearing a billing costume: the visit was genuinely complex, the note couldn't show it in a shape that would survive review, and the safe code was the lower one.
This is what the record has to show, in the terms the 2021 guidelines actually use.
Start here: history and exam no longer set the level
This is the single most expensive piece of outdated habit still in circulation. Since January 2021, the level of an office visit is chosen by medical decision-making or total time — not by how many review-of-systems boxes you ticked or how many organ systems you examined.
History and exam still have to be performed and documented as medically appropriate. They just don't count toward the level any more. A note padded with a full ten-system ROS and a head-to-toe exam, describing a visit where you managed two chronic problems and changed a medication, is a note doing a great deal of work that earns nothing — while leaving the part that does earn something implicit.
MDM has three elements: problems addressed, data reviewed, and risk. You need to meet the level in two of the three. Not all three. Two.
Almost every defensible 99214 in primary care is built the same way: the problems element and the risk element. Data is frequently the one you don't need — which matters, because data is the element clinicians most often try to manufacture and least often document properly.
Element 1 — Problems addressed
"Addressed" is a specific thing. A problem is addressed when you evaluated or treated it at this encounter. Listing it on the problem list is not addressing it. Noting that another clinician manages it is explicitly not addressing it.
| Level | What qualifies |
|---|---|
| Moderate (99214) | One or more chronic illnesses with exacerbation, progression, or side effects of treatment · or two or more stable chronic illnesses · or one undiagnosed new problem with uncertain prognosis · or one acute illness with systemic symptoms · or one acute complicated injury |
| High (99215) | One or more chronic illnesses with severe exacerbation or progression · or one acute or chronic illness that poses a threat to life or bodily function |
Two stable chronic illnesses already reaches moderate. A visit where you reviewed and continued management of hypertension and type 2 diabetes — genuinely stable, genuinely addressed — meets the problems element for 99214. That is a very ordinary primary care visit.
Element 2 — Data reviewed and analyzed
Data is counted in three categories, and the counting rules are where most notes fall down.
| Category | What it is |
|---|---|
| Category 1 | Tests, documents, or an independent historian. Any combination of three: reviewing prior external notes from each unique source, reviewing the result of each unique test, ordering each unique test, or needing an independent historian. |
| Category 2 | Independent interpretation of a test performed by someone else, where you aren't separately billing for that interpretation. |
| Category 3 | Discussion of management or test interpretation with an external physician or other qualified professional. |
Moderate needs at least one of the three categories. High needs at least two. Within Category 1, you need three items to satisfy that single category.
The word doing the work in Category 1 is unique. Three results from one metabolic panel is one test, not three. A cardiology note and a nephrology note are two sources. Ordering a CBC, reviewing last month's A1c, and reviewing the hospital discharge summary is three items — a Category 1 satisfied, from a completely routine visit.
Two counting traps worth knowing. Ordering a test and then reviewing its result is generally one item, not two — you don't get to count both ends of the same test. And patient-supplied data, like home blood-pressure logs, is contested: some coders count it, some don't, and it is a poor thing to hang a level on. If a visit only reaches its level by counting a disputed data item, it isn't defensible — pick a visit that meets problems and risk instead, which most primary care visits do.
Element 3 — Risk
Risk means the risk of complications, morbidity or mortality of patient management — including the management options considered but not chosen.
Prescription drug management is the workhorse of moderate risk. Starting a medication, stopping one, changing a dose, or making a documented decision to continue one with its attendant monitoring — all of that is prescription drug management. In primary care this element is met on a large share of visits, and it is met almost invisibly, because clinicians write "continue lisinopril" and think of it as a non-event rather than as the thing that establishes moderate risk.
Other moderate-risk examples: a decision about minor surgery with patient or procedure risk factors, or a decision about elective major surgery without such factors. High risk includes drug therapy requiring intensive monitoring for toxicity, decisions about hospitalization, and decisions about de-escalation of care.
Five phrases that quietly cost you a level
1. "Stable" — when you actually did something
"Diabetes: stable, continue metformin" reads as a non-event. If you reviewed the A1c trend, considered whether to intensify, and made a decision to hold, that is medical decision-making and the note should say the decision was made and why. "Stable" is a conclusion. The reasoning that produced it is what's defensible.
2. Data reviewed, but not named
"Labs reviewed" counts for nothing you can defend. Which labs, from when, and what you concluded. The specificity isn't bureaucratic — it's the difference between a claim that survives review and one that doesn't.
3. Risk that's implied rather than stated
You adjusted a medication with real monitoring implications, and the note records the new dose but not the reasoning or the monitoring plan. The risk element is met by what you decided and why, and it has to be legible.
4. Problems mentioned but not addressed
A problem list carried into the note is not a set of problems addressed. Conversely, a problem you genuinely worked on and then mentioned only in passing is a problem you addressed and won't get credit for.
5. Copy-forward that buries today's thinking
When today's decision-making sits inside three paragraphs carried from the last visit, a reviewer cannot separate what you did today from what you did in March. Neither can you, six months from now. Copy-forward doesn't just make notes long — it makes the complexity of any individual visit unrecoverable.
What this looks like in practice
The same visit, documented two ways. A 64-year-old with type 2 diabetes and hypertension, in for follow-up.
Two chronic problems are here, so the problems element may reach moderate — but nothing else does. No data is identified. No risk is articulated. There is no evidence of decision-making at all, only of conclusions.
Same visit, same care. Problems: two chronic illnesses, one with progression — moderate. Risk: prescription drug management, stated explicitly rather than implied. That is two of three, which is all you need — and note that the data element does not carry this visit. Reviewing a result and ordering a test is two items, and Category 1 wants three. Trying to force the data element here is exactly the reflex that leads people to pad notes; the visit already qualifies without it.
The second note is longer, but not by much — and the extra length is entirely decision-making. It is not a fuller ROS or a more elaborate exam. It is the reasoning that was already in your head, written down.
Two things worth knowing beyond the level
The problem inside the preventive visit
When a patient comes in for a wellness visit and you also evaluate and manage something separate — the eczema flare, the blood pressure that's drifted — that problem-oriented work can be reported alongside the preventive service with modifier 25 appended to the office visit code. The requirement is that it be significant and separately identifiable: enough additional work that it could stand on its own as a visit, documented so that no part of the preventive exam is doing double duty to support it.
At current rates that is roughly $95–$136 of separately earned work, and it is among the most commonly missed things in primary care.
G2211
The visit-complexity add-on, worth about $16.40 on top of the base visit. It's for the continuing care relationship — where you are the ongoing focal point for a patient's care, rather than treating a discrete problem in isolation. That describes most established primary care visits.
It is substantially underclaimed. CMS noted in its CY2026 rule that actual reporting came in below its own utilization estimate — which means practices absorbed the budget-neutrality reduction that funded the code and then didn't bill it. From January 2026 it also applies to home and residence visits.
The checklist
- Did I name the problems I actually addressed — and say what I did about each?
- For anything I called stable, did I write down the reasoning that made it stable rather than just the conclusion?
- Did I name the specific data — which test, from when, which outside note, from which source?
- Is the risk visible? If I started, stopped, or changed a medication, does the note say so and say why?
- Can a reader tell what happened today without untangling it from copied text?
- If a separate problem came up in a preventive visit, is it documented well enough to stand alone?
- Does this patient have a continuing care relationship with me — and did I capture G2211?
The point of all this
None of the above is an argument for billing a level you didn't earn. That is fraud, and the caution clinicians feel about it is well-placed and worth keeping.
It is an argument that the gap between the care you delivered and the care your record can demonstrate is a real, measurable, and largely unnecessary cost. You did the thinking. The only question is whether it's written down in a shape that survives someone else reading it.
Want the number for your own practice? The calculator runs this arithmetic against your provider count, visit volume and payer mix, using published Medicare rates, and shows every step.
Run the numbersThis is educational, not compliance advice. Coding rules change, payer policies differ, and the right level for any given visit depends on facts only you have. Verify against current CPT guidance and your own coding and compliance resources before changing how your practice bills. Sources for the criteria described here: the AMA's 2021 E/M revisions, the ACS summary of the MDM table, and AAFP guidance on modifier 25.