Audit Defense

2026 OIG and RAC Focus on Telehealth Frequency Audits: Defending Repeated E/M (99213‑99214) and Virtual Check‑In (G2012) Utilization Patterns

Last week one of my groups in Florida got a “data-driven review” letter from Cigna. They’d flagged a provider for excessive use of 99213 on telehealth visits, averaging three times per month per patient during Q1 2026. The physician was managing diabetic patients weekly via G2012 check‑ins between regular telehealth visits, trying to keep A1C under control. Totally appropriate care, but the metrics triggered an audit. That’s the environment we’re in right now. Every high-touch chronic care pattern looks suspicious to OIG and RAC auditors hungry for a “telehealth abuse” headline.

Why Telehealth Frequency Is the 2026 Hot Button

Since early 2026, CMS’s audit partners have shifted their post‑pandemic fraud hunt toward repeated E/M services billed under telehealth. RACmonitor reported that CMS’s current strategy uses data-driven targeting models, the same ones behind the new moratoria on home health and hospice enrollment, to identify “outlier” billing behavior across categories. The analytics are being applied hard to virtual E/M (especially codes 99213 and 99214) and G2012 virtual check‑ins because utilization exploded from 2020‑2024 and then stayed flat in 2025 instead of dropping as CMS expected. RACs are now correlating these frequency spikes with patterns that look like duplication at the claim level.

OIG has been blunt about these priorities in its 2026 Work Plan. They’re watching for “excessive frequency of telehealth services per beneficiary” and “patterns inconsistent with patient acuity.” Translation: if a patient shows repeated 99214 visits every week for stable hypertension, that’s a red flag. The program safeguard contractors have even started flagging same‑day 99214 and G2012 combinations as potential unbundling unless the documentation clearly separates the services.

When Carriers Decide What’s “Too Frequent”

Medicare Administrative Contractors still aren’t aligned. Novitas uses a “no more than one telehealth E/M per 7 days per diagnosis” benchmark, while NGS accepts weekly 99213 follow-ups for behavioral health. Commercial payers repeat CMS language but twist it to suit themselves. UnitedHealthcare has been denying 99214 billed more than twice a month per patient without a modifier 25‑attached service, effectively nudging providers to downgrade to 99213 or G2012. Anthem’s 2026 virtual care policy explicitly caps G2012 to once per week per patient, and demands documentation of a “distinct episode of care.”

That’s how a cardiology group I work with ended up in trouble. Eight physicians billed G2012 for chronic HF follow‑ups plus 99214 monthly tele‑E/Ms. Anthem retro‑recouped $47,000, saying the G2012 contacts “duplicated” the follow‑up management already captured in the 99214. Once we reviewed the encounter notes, half the check‑ins were medication titration between visits, legit clinical work. The miss was in the template. It never spelled out that the check‑in was an “interval reassessment outside of prior 99214 management plan.”

Fixing the Notes and the Numbers Before the Audit Letter Arrives

Defending repeated 99213‑99214 telehealth comes down to contemporaneous documentation. If you’re seeing the same patient twice a week virtually, make it obvious why. Every encounter should connect to an evolving care plan, med change, or new symptom. Templates that copy “follow‑up on chronic issue, stable” are appeal poison. Don’t use them.

Here’s one success story from March 2026. A primary care group in Colorado was flagged by Aetna for excessive 99214s billed by telehealth, averaging 2.4 per patient per month. We reviewed fifty claims. Forty‑three had meaningful differences, lab review, med change, new complaint, but none included modifier 25 to show a separate E/M beyond the standing plan. After adding modifier 25 and clarifying “distinct service for new issue” in resubmissions, Aetna cut its takeback from $62K to under $8K. That’s not luck; it’s proper coding hygiene.

G2012 is its own headache. CMS defines it as “brief communication technology-based service” of 5‑10 minutes. MACs have been denying it when notes show more than 10 minutes or when it reads like a full E/M. If your clinicians spend 15 minutes, they’re undercoding, should probably bill 99212 via telehealth. But if they stay at 5‑10 minutes, document the exact length and purpose: “7‑minute phone call adjusting diuretics per BNP result.” Not “spoke with patient.” Short, specific, defensible.

Audit Readiness: Don’t Wait for the Knock

Before OIG or a RAC auditor asks, pull your own frequency data. Run a report showing average 99213 and 99214 telehealth claims per beneficiary per month, sorted by diagnosis. Flag anything that tops one per week for stable chronic codes like E11.9 or I10, and build your written rationales now. When a payer compares your TIN to national averages, that preparation saves you weeks of panic.

Also, align your telehealth policy with what the 2026 MPFS actually allows. Crosswalk every code against the post‑2025 telehealth list. If you’re pairing G2012 with remote monitoring CPT 99457 on the same day, make sure the note proves they’re separate clinical events. That combo sits on the RAC “easy denial” script this year.

Look, auditors in 2026 don’t care about clinical bandwidth or hospital staffing. They care about outliers. The only counterweight is proactive self‑review. On Monday morning, sit down with your data person and your denials lead. Run a 90‑day utilization check for CPT 99213, 99214, and G2012 by provider, cross‑check against your payer mix. If one doctor doubles the rest, fix those notes before the payer comes knocking. Simple as that.

The audits are coming either way. Practices that treat frequency management like preventive medicine, solid documentation, accurate modifiers, realistic scheduling, will protect their revenue while everyone else scrambles to rewrite past notes.

Sources

Claims Assistant