Audit Defense

2026 CMS and Commercial Payer Audits Target Prolonged Services (CPT 99417, G2212): Documentation Standards, Time Tracking, and Modifier 25‑Related Overlap Risks

Prolonged Services Are Squarely in CMS Crosshairs

Auditors have zeroed in on prolonged services codes, CPT 99417 and G2212, as 2026 medical review activity gains momentum. Through the CMS Targeted Probe and Educate (TPE) program, Medicare Administrative Contractors analyze data to find providers with high error rates or billing patterns that pose a financial risk to Medicare. As RACmonitor explains, the process isn’t random, it’s driven by data and focused on whether claims and documentation agree.

This makes prolonged services a documentation integrity problem, not just a coding one. When a MAC selects a provider for review, only 20-40 claims may be examined in a round, but each record must show exactly how time was measured and that it exceeded the required threshold for the base E/M code. If it doesn’t, the provider faces denials, education rounds, and potential prepayment review or Recovery Auditor referral. And that can spiral quickly.

For coding and CDI teams, the CMS message is blunt: prolonged service codes are being applied inconsistently. Audits keep turning up the same errors, time tracking gaps, overlapping visits, and problems with modifier 25 combinations. Commercial insurers like Aetna, Cigna, and UnitedHealthcare are following CMS’s lead, mirroring the same triggers in their audit systems.

Documentation Must Match the Clock, and the Modality

CMS has reaffirmed under the Paperwork Reduction Act that it will keep collecting documentation to confirm medical necessity and coding accuracy. For prolonged services, providers must account for every minute beyond the CPT threshold. Time-based coding remains highly vulnerable, especially for telehealth and hybrid arrangements.

According to RACmonitor, each record needs to clearly list both the patient’s location and the provider’s location during telehealth encounters. That detail often decides whether a prolonged service claim stands or fails, since CMS and payers cross-check place of service data with registered addresses. If time spent on audio-only interactions isn’t distinguished from audio-video, reviews or recoupments follow.

Auditors have also noticed boilerplate “time spent” fields carried over from templates. CMS expects individualized detail, how much time, doing what, and by whom. TPE reviewers verify that documentation supports both the base E/M and the prolonged add-on. When those pieces don’t line up, integrity fails.

Modifier 25 and the Overlap Trap

Another frequent audit target is overlap with modifier 25. Some practices bill a same-day procedure and a prolonged E/M visit together, assuming counseling or coordination time qualifies for 99417 or G2212. Auditors disagree.

CMS and major payers treat prolonged coding as additive only to non-procedural E/M visits where the threshold is surpassed for that encounter alone. When a procedure is billed using modifier 25, prolonged time can’t include any pre- or post-procedure work already bundled in the code. If reviews show that “extra time” was primarily procedural, payers retract not only the prolonged service but sometimes the base visit as well.

Revenue cycle teams should expect commercial payers to follow the CMS TPE model. Anthem and UnitedHealthcare, in particular, have been adjusting claims that combine 99417 with high-level visits and modifier 25. Documentation must show distinct, medically necessary non-procedural time beyond the E/M threshold. Without it, the combination reads as upcoding, and auditors act accordingly.

Operational Safeguards Before the Probe Hits

If you bill prolonged services, your exposure isn’t theoretical. Your data is already being compared to peers. CMS and payers mine the numbers long before any TPE letter arrives. Coordination between coding, CDI, and utilization review teams matters here. RACmonitor points out that documentation inconsistencies found after submission trace back to front-end decisions. What gets entered before the claim goes out is what will be judged later.

  • Audit your time statements: The note must show total provider time and how it exceeded the CPT threshold. Skip auto‑populated fields.
  • Scrub for procedural overlap: When modifier 25 applies, exclude any procedure‑related work from prolonged time.
  • Validate telehealth fields: Patient and provider locations must be documented; mismatched place‑of‑service data stalls claims.
  • Cross‑train CDI and coding staff: Review prolonged service logic together so your notes reflect current CMS definitions before TPE scrutiny.

The takeaway? Don’t wait for a probe. The same analytics MACs rely on are accessible internally. Run outlier checks on 99417 and G2212 use by provider. If volumes look high or notes repeat generic “spent 60+ minutes” phrases, the issue’s already visible to payers. Fix them. Because once review starts, there’s no rewriting, only explaining.

Sources

Claims Assistant