Guide

The billable message: 99421–99423 thresholds and patient warning

Summary

A portal reply becomes billable once you've made a clinical decision and the patient started the conversation — not when the front desk answers a scheduling question. Online digital evaluation and management codes cover an established patient's message and everything you do about it within a rolling week, billed once per period rather than per message. Confirm current thresholds through your fee schedule, and tell patients in advance that a substantive reply may generate a charge.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

The line: clinical decision-making, not just a reply

A portal message crosses from included communication to a billable encounter at the moment two things are both true: the patient started the thread with a clinical question, and answering it required you to actually think — reviewing history, weighing a symptom, deciding on a plan — rather than confirming an appointment time or forwarding a request to the front desk.

That threshold is what CPT's online digital evaluation and management codes (billed under the 99421 through 99423 family for physicians and qualified health professionals) are built around: a substantive, patient-initiated exchange that would have been a visit if it hadn't happened by message. A one-line "yes, that's fine, see you Thursday" isn't that. A message where you review a med list, ask two follow-up questions, and adjust a plan is.

It has to start with the patient

The codes only apply to patient-initiated messages — if you're the one who opens the thread, whether to follow up on a result or check in after a change, that's not billable under this framework no matter how much clinical thinking it takes. The distinction matters because it's checked: a pattern of billing messages you initiated yourself is the kind of thing a payer's post-payment review is built to catch.

It also has to be an established patient, someone you've already seen, which separates this from a phone call or an audio-only visit with a new patient; those run through their own coverage rules entirely. Document which side opened the thread as a matter of habit — most EHR portals timestamp the first message automatically, so the record usually already exists, but it's worth confirming it's captured somewhere a reviewer could actually find it later.

One code per rolling period, not per message

The online digital E/M family bills once per patient per rolling multi-day period, covering the cumulative time you spend on that patient's messages during the window, not a separate charge for each reply in a busy back-and-forth. Five short messages resolving one issue over a few days is one billable encounter, not five.

The exact time thresholds that separate the three code levels, and whether a given payer even recognizes the code family, both move year to year. CMS updates which codes are currently payable and under what conditions in a list it publishes annually — check it before you bill rather than working from a threshold you memorized last year 1Ref 1Centers for Medicare & Medicaid Services (2026).List of Telehealth Services.Supports checking CMS's annually published list to confirm which digital/telehealth-adjacent codes are currently payable before billing them..

Tell the patient before you bill them

For insured patients, no federal rule requires a specific "this may cost you" notice before an online digital E/M message. But for anyone uninsured or self-pay, the No Surprises Act's good-faith-estimate framework already requires telling the patient the expected cost of a scheduled item or service before providing it 2Ref 2Office of the Federal Register (2026).45 CFR Part 149 — Surprise Billing and Transparency Requirements.Supports the good-faith-estimate obligation for uninsured/self-pay patients as the operative rule text requiring cost notice before a scheduled item or service., with CMS's implementing guidance covering how that estimate is delivered and disputed 3Ref 3Centers for Medicare & Medicaid Services (2026).No Surprise Billing.Supports CMS's implementing guidance on how the good-faith estimate is delivered and disputed, extended here as the model for a portal-billing notice..

Extending the same courtesy to insured patients, a one-time notice, or a line in your portal's terms, stating that a substantive reply may generate a charge and a co-pay, heads off the single most common complaint solo practices get about this billing pattern: the patient who didn't know a message could cost anything.

What doesn't cross the line

Most portal traffic never approaches billable territory, and treating it as though it might trains patients to stop using the portal at all. Scheduling questions, a request to fax records, confirming a pharmacy, and a refill request that doesn't require you to evaluate anything new are commonly treated as included, non-billable communication across practices, regardless of how many messages it takes to resolve.

The distinguishing question worth asking on each message is not "how long did this take" but "did I have to think about this patient's clinical status to answer it." A five-minute conversation about which parking lot to use took time but isn't billable; a ninety-second reply adjusting a plan based on a symptom the patient described is.

The portal channel is still a HIPAA channel

Billing question aside, every message in the portal is PHI moving under the same HIPAA Privacy Rule as anything else in the chart — the same minimum-necessary standard, the same notice-of-privacy-practices obligations, the same individual rights 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.Establishes that portal messages are PHI subject to the Privacy Rule's minimum-necessary and individual-rights obligations regardless of whether the message is billed.. If your billing workflow means the message thread gets copy-pasted into a claims system or forwarded to a biller, confirm that flow doesn't leave the portal without the same protections it started with.

Compare that to voicemail and answering services, which carry the same HIPAA obligations but a much easier failure mode: a message left on an unsecured voicemail box is exposed the moment anyone else picks up the phone. The portal at least keeps the exchange inside an authenticated channel by default.

Setting the policy, and collecting for it

Write the threshold down before your first ambiguous message arrives: what counts as billable, who reviews borderline cases, and what the patient sees on their statement. A one-line policy prevents the inconsistency that makes patients feel singled out when one reply gets billed and a similar one didn't.

Because these charges tend to be small, decide in advance how you'll handle them if a patient balance sits unpaid — many solo practices fold a single online-message charge into the same small-balance write-offs policy they use for other minor balances rather than running a full collections process over a few dollars, and if you do pursue it, ordinary dunning etiquette still applies. Every claim you bill also counts toward your standing against the low-volume threshold for MIPS eligibility, so deciding whether to bill these messages at all is also a small decision about your reporting status for the year. And if a billing service handles collection on your behalf, that arrangement is a business associate relationship with its own agreement to have in place before any message-derived claim reaches them 5Ref 5HHS Office for Civil Rights (2026).Business Associates.Supports treating an outside billing service that collects on message-derived claims as a business associate requiring its own agreement..

Common questions

No — the online digital E/M codes require the patient to have started the thread. If you initiate contact, even about a result that needs discussion, bill it under a different pathway or don't bill it at all; billing a provider-initiated message under these codes is the kind of pattern payer audits are built to catch.

Once per rolling period, not once per message — the code covers your cumulative time across every exchange with that patient during the window, however many messages it took. Confirm the current period length and time bands against your payer's published policy rather than assuming they match what you billed last year.

For uninsured or self-pay patients, a good-faith-estimate obligation already applies to scheduled services and extends naturally to this kind of care. For insured patients there's no equivalent federal mandate specific to portal messages, but a one-time notice, in your portal's terms or posted at intake, heads off the complaint that a bill arrived with no warning.

Anything that doesn't require you to evaluate the patient's clinical status: scheduling, records requests, pharmacy confirmations, and refill requests that don't involve a new clinical judgment. Treating routine administrative traffic as billable trains patients to avoid the portal altogether, which costs you more in phone calls than the occasional charge would recover.

No — online digital E/M is its own category, separate from audio-only visits and live telehealth, each with different coverage rules and different codes. If the exchange needs real-time back-and-forth rather than asynchronous messages, it likely belongs under a different visit type entirely, not the online digital E/M family.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Centers for Medicare & Medicaid Services (2026). List of Telehealth Services. Centers for Medicare & Medicaid Services (CMS). link ✓Supports checking CMS's annually published list to confirm which digital/telehealth-adjacent codes are currently payable before billing them.
2.Office of the Federal Register (2026). 45 CFR Part 149 — Surprise Billing and Transparency Requirements. eCFR. link ✓Supports the good-faith-estimate obligation for uninsured/self-pay patients as the operative rule text requiring cost notice before a scheduled item or service.
3.Centers for Medicare & Medicaid Services (2026). No Surprise Billing. Centers for Medicare & Medicaid Services (CMS). link ✓Supports CMS's implementing guidance on how the good-faith estimate is delivered and disputed, extended here as the model for a portal-billing notice.
4.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkEstablishes that portal messages are PHI subject to the Privacy Rule's minimum-necessary and individual-rights obligations regardless of whether the message is billed.
5.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkSupports treating an outside billing service that collects on message-derived claims as a business associate requiring its own agreement.

https://www.gale.care/for-providers/cde-billing-portal-messages · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers