The 2026 MDM table scores an E/M visit on three elements: problems addressed, data reviewed and analyzed, and risk of patient management. A visit reaches a level when the note meets or exceeds two of the three. The four levels, straightforward, low, moderate and high, map to 99212, 99213, 99214 and 99215.
The AMA rewrote the office visit E/M rules in 2021 and carried the same MDM-or-time approach into hospital and other visits in 2023, scrapping the old key-element system that practitioners used for decades. Payers are still running audits based on the old criteria, and a lot of practices are still documenting like it's 2022. That mismatch is expensive: a primary care practice billing 99213 when the documentation actually supports 99214 is leaving roughly $20,000 to $45,000 a year on the table, depending on visit volume (an illustration, not a benchmark).
If your E/M billing hasn't been reviewed since the change, there's a real chance you're either under-coding, leaving money on the table, or over-coding in ways that look suspicious to a payer auditor. Neither is good. Here's what the rules actually say in 2026 and what your documentation needs to show.
If your documentation and billed levels haven't been checked against the current MDM framework, a compliance audit is the fastest way to find the gap before a payer does, most practices find it in the mismatch between what's charted and what's billed.
Under the current AMA guidelines, you pick one of two methods to determine your E/M level for office and outpatient visits. Medical Decision Making (MDM) or total time. You don't use key elements (history, exam, medical decision making scored separately) anymore. That system is gone for office visits.
Most practices default to MDM because it maps to what physicians naturally document. Time-based billing makes more sense for visits that run longer than usual or involve significant care coordination outside the face-to-face encounter.
MDM has three columns. You need to meet or exceed two of the three to assign a level. Not all three. Two.
| Level | Codes | Problems addressed | Data reviewed and analyzed | Risk of management |
|---|---|---|---|---|
| Straightforward | 99202, 99212 | One self-limited or minor problem | Minimal or none | Minimal |
| Low | 99203, 99213 | Two or more minor problems, or one stable chronic illness, or one acute uncomplicated illness or injury | Limited: two items from the tests-and-records group, or an independent historian | Low |
| Moderate | 99204, 99214 | A chronic illness that's worsening or causing side effects, or two or more stable chronic illnesses, or a new problem with an uncertain outcome, or an acute illness with systemic symptoms | Moderate: one of three groups, such as three items from the tests-and-records group, an independent interpretation of a test, or a discussion with an outside clinician | Moderate: prescription drug management, a decision on minor surgery with risk factors, or social factors that limit care |
| High | 99205, 99215 | A chronic illness with a severe flare, or any problem that threatens life or a body function | Extensive: two of the three groups | High: drugs that need intensive toxicity monitoring, a decision on major surgery with risk factors, or a decision about hospitalization |
Take a 58-year-old with diabetes and hypertension, both stable, who reports new fatigue with no clear cause. Two stable chronic illnesses meet the moderate problems column. The physician adjusts metformin, which is prescription drug management and meets moderate risk. Data is minimal. Two of the three columns are moderate, so the visit supports 99214.
Drop the prescription decision and the picture changes. Risk falls to low, only the problems column is moderate, and the visit is a 99213.
This is where most documentation falls short. A stable chronic condition (say, well-controlled Type 2 diabetes with no new symptoms) counts as one low-complexity problem. Two or more stable chronic conditions at the same visit move you to moderate. So does one chronic condition that's flaring, and so does an undiagnosed new problem with an uncertain outcome. High takes a severe flare or a problem that threatens life or a body function.
Your notes need to specifically address what's going on with each problem, not just list diagnoses. "HTN - stable, continue lisinopril" documents a problem. "HTN" alone doesn't.
This one trips people up because there are sub-elements. Data is grouped into three categories:
Moderate data needs one of the three groups fully met. Extensive needs two. Count carefully. A test counts once, at the visit where you order it, and that credit includes reviewing the result later, so reviewing the same lab at follow-up doesn't earn a second item. Notes from one outside source count as one item, however long the packet is. Document the source, what you ordered and why, not just "records reviewed."
Prescription drug management automatically qualifies as moderate risk. That's a big one. If you're prescribing or managing a prescription at the visit, you're already at moderate risk, which means you only need one more column at moderate to justify a 99214.
Moderate risk also covers a decision about minor surgery with risk factors, and diagnosis or treatment that social factors significantly limit. High risk takes things like drug therapy requiring intensive toxicity monitoring, a decision about elective major surgery with risk factors, a decision about hospitalization, or a decision to withhold resuscitation or de-escalate care because of a poor prognosis.
For 2026, 99214 needs at least 30 minutes of total practitioner time on the date of the visit, or moderate MDM. CPT treats time as a minimum, so 30 minutes is the threshold, not a 30 to 39 minute range. At 40 minutes the visit supports 99215.
Total time means your own time on the date of the encounter, not just face-to-face time. That includes pre-charting, reviewing records before the patient arrives, ordering, counseling, care coordination calls you make that day, and documentation done the same day. Clinical staff time doesn't count, and neither does time on another date.
| New patient | Minimum minutes | Established patient | Minimum minutes |
|---|---|---|---|
| 99202 | 15 | 99212 | 10 |
| 99203 | 30 | 99213 | 20 |
| 99204 | 45 | 99214 | 30 |
| 99205 | 60 | 99215 | 40 |
You pick time or MDM for a visit, never a blend of the two. When time supports a higher level than MDM does, time is usually the better choice, and the reverse is just as true.
Under CPT, 99417 covers each additional 15 minutes beyond the top level, which starts at 75 minutes for 99205 and 55 minutes for 99215. Medicare doesn't use 99417. It uses HCPCS G2212 and starts counting later. The Medicare Claims Processing Manual (Chapter 12) shows 99215 alone from 40 minutes, then 99215 plus one unit of G2212 from 69 minutes, two units from 84 minutes and three units from 99 minutes. For a new patient, 99205 alone runs from 60 minutes, with one unit of G2212 added from 89 minutes and two units from 104 minutes. Send 99417 to Medicare and expect a denial.
When you bill by time, document the total time and what you spent it on. "Total time: 42 minutes including pre-visit chart review (8 min), history and exam (20 min), order entry and counseling (6 min), documentation (8 min)", that's what auditors want to see. A bare "42 minutes" gets downcoded.
The biggest audit targets in 2026 are practices that switched to time-based billing but don't document the time breakdown, just a total number. And practices still using the old key-element documentation in their EHR templates without realizing the templates haven't been updated. When a payer does flag a claim on E/M level, the appeal only works if your claims management process already has the supporting documentation trail attached, not reconstructed after the fact. A single-provider practice with a 3-year lookback and a 15% downcoding-to-correct-level finding on a mid-size Medicare panel is commonly looking at a $15,000 to $30,000 recoupment demand, and that's before the cost of the appeal itself.
Many EHR systems shipped "2023 E/M compliant" templates that still prompt for Review of Systems and Past/Family/Social History as required fields. Those elements aren't required for E/M level selection anymore, but documenting them isn't wrong. The problem is when providers skip MDM documentation because they think the ROS fields are what's driving the level.
Telehealth office visits (99202–99215 with modifier 95 or GT) follow the same MDM and time rules as in-person visits. The documentation requirements are identical. Place of service code 02 (telehealth) or 10 (patient home) applies depending on where the patient is.
Hospital observation and inpatient codes (99221–99223, 99231–99233) also now use MDM or time. Same structure. The nuance here is that inpatient time can include time spent on the unit reviewing the chart, talking with nursing staff, and writing notes, not just bedside time.
Initial hospital care still calls for a medically appropriate history and exam, but the level is determined by MDM or time, not by whether you documented 10 systems or 8 systems in your review.
Related: CY 2027 physician fee schedule proposed rule.
Review level distribution by provider each quarter and compare it to peers, then check a sample against the notes.
The spread between neighboring office visit levels is bigger than most practices realize. On the 2026 non-facility schedule, 99213 pays $95.19, 99214 pays $135.61 and 99215 pays $192.39. A provider who documents a level 4 visit as a level 3 gives up $40.42 each time.
Now run it for a year. At 18 established visits a day and 220 clinic days, a provider sees 3,960 visits. If just 10% of them are under-leveled by one tier, that's 396 visits and $16,006 in lost payment from one provider. On the other side, the same drift upward is how audits begin, so measure both directions.
The 2026 MDM table scores an E/M visit on three elements: problems addressed, data reviewed and analyzed, and risk of patient management. A visit reaches a level when the note meets or exceeds two of the three. The four levels, straightforward, low, moderate and high, map to 99212, 99213, 99214 and 99215.
For 2026, 99214 needs at least 30 minutes of total practitioner time on the date of the visit, or moderate MDM. CPT treats time as a minimum, so 30 minutes is the threshold, not a 30 to 39 minute range. At 40 minutes the visit supports 99215.
No. You need two of the three columns at the moderate level: problems addressed, data reviewed and analyzed, or risk of management. A visit with a prescription drug change and two stable chronic illnesses can support 99214 even when data is minimal.
No. CPT uses 99417 for each extra 15 minutes of office time, while Medicare uses HCPCS G2212 and starts counting later. Billing 99417 to Medicare will deny, so check your payer before reporting prolonged time.
Either one. Under the current AMA guidelines for office and outpatient visits, you pick medical decision making or total time on the date of the encounter. You don't use history and exam as scoring elements anymore, though a medically appropriate history and exam should still be documented.
Total time includes your own work on the day of the encounter, such as reviewing records, ordering, counseling, care coordination and documenting, not just face-to-face time. Clinical staff time doesn't count. Document a breakdown of the activities, since payers are auditing notes that give only a total.
The billing gaps most practices don't catch until they show up as denials. Get the checklist: free, no spam.
✓ Got it! Your info is saved: view the checklist now →
We don't share your info. Unsubscribe any time.
Our billers audit your charts against current MDM guidelines and identify exactly where you're under-coding or at audit risk, at no cost.
Get Your Free Revenue Assessment