CCM Consent and Documentation Requirements: What Medicare Wants in the Record (2026)

The Short Answer

Medicare's CCM booklet (MLN909188, June 2025 edition) spells out what has to be in the record before 99490 and its companions are billed: an initiating visit for new or not-recently-seen patients, five consent items with a note that they were explained and whether the patient accepted, a patient-centred electronic care plan, and time logged per calendar month by people who may legally furnish it. Nothing in the CY 2026 Physician Fee Schedule final rule changed those consent or documentation rules. The current OIG audit of CCM (OAS-26-09-007) is about whether patients had two or more qualifying chronic conditions, which is an eligibility question the same record has to answer.

I build these controls into care-management software; the care management operations software page describes what that involves, and the CCM/PCM operations platform case study shows them in a live operation.

This is engineering and operations guidance, not legal or billing advice. Confirm billing rules with your compliance advisor before changing workflows or claims.

Where the Rules Come From

Everything below is quoted or paraphrased from one CMS document, checked on 2026-10-16: the Medicare Learning Network booklet Chronic Care Management Services, MLN909188, June 2025 edition, 13 pages. Its "What's Changed?" box says the only change in that edition was added information about advanced primary care management (APCM). The CY 2026 PFS final rule fact sheet (CMS-1832-F, October 31, 2025) does not use the word "consent" at all, and the rule text on GovInfo (90 FR 49266) finalises no change to CCM consent, care plan, time or documentation requirements. The 2026 changes that touch care management are optional APCM add-on G-codes for behavioural health integration and collaborative care, and separate payment mechanics for RHCs and FQHCs.

1. The Initiating Visit

The booklet says: "Before CCM services can start, we require an initiating visit for new patients or patients who you haven't seen within the previous 1 year. Conduct the initiating visit during a comprehensive face-to-face evaluation and management (E/M) visit, annual wellness visit (AWV), or initial preventive physical exam (IPPE)." And: "If you don't discuss CCM during an E/M visit, AWV, or IPPE, it can't count as the initiating visit."

Two things follow for the record. The visit note needs to show that CCM was discussed, and the enrolment date needs to sit on or after that visit for patients who needed one. Established patients seen within the past year do not need a separate initiating visit, a point a nurse director raised on the AAACN forum in March 2025 and another member answered the same way.

What the booklet does not say is that the care plan has to be written inside the initiating visit note. That was the exact question on that forum thread. The care plan is a separate, electronic document with its own requirements (section 3), and the initiating visit is where CCM is offered and consented.

2. The Five Consent Items

The booklet's consent section is short enough to quote whole:

"Get the patient's written or verbal consent for CCM services before you bill for them. This helps make sure patients are engaged and aware of their cost-sharing responsibilities and helps prevent duplicate practitioner billing. Inform the patient of these items and document in their medical record:

• The availability of CCM services
• Their possible cost-sharing responsibilities
• That only 1 practitioner can provide and bill CCM services during a calendar month
• Their right to stop CCM services at any time (effective at the end of the calendar month)
• That you explained the required information and whether the patient accepted or declined services

Patients must provide informed consent only once unless they switch to a different CCM practitioner."

So consent is one event per patient per practitioner, verbal or written, with five items documented. In software that is a consent record with: the date, who obtained it, the method (verbal or written), a checkbox per item that cannot be skipped, the accept or decline outcome, and the practitioner it was given to. A new consent is required only if the billing practitioner changes. The cost-sharing item matters more than it looks: the booklet notes that cost sharing applies to CCM and that some patients carry supplemental insurance to cover it, so the person obtaining consent needs a plain-language script for the coinsurance conversation.

The right-to-stop item has a timing detail worth encoding: a stop is "effective at the end of the calendar month". A patient who withdraws on the 10th can still be billed for that month if the time threshold was met, and must not be billed for the next one. A system should record the withdrawal date and close enrolment at month end automatically.

3. The Comprehensive Care Plan

The booklet requires you to "create, revise, and monitor (per code descriptors) a patient-centered, electronic comprehensive care plan based on a physical, mental, cognitive, psychosocial, functional, and environmental assessment and an inventory of resources and supports." It lists what a plan "may include": problem list, expected outcome and prognosis, measurable treatment goals, revision and monitoring when necessary, cognitive and functional assessment, symptom management, planned interventions, medical management, environmental evaluation, caregiver assessment, interaction and coordination with outside resources and practitioners, and periodic review. It adds: "Make the plan available promptly both within and outside the billing practice, and when necessary, give patients and caregivers a copy of the care plan."

Alongside the plan, the booklet requires structured recording of "the patient's demographics, problems, medications, and medication allergies using a version of certified electronic health record (EHR)". That is an EHR requirement, not something a care-management platform replaces, which is why the platforms I build hold the care plan and the minute log and link to the EHR record rather than duplicating it.

For the record, the useful design is a versioned care plan: each revision stamped with who changed it and when, a "shared with patient" event with the date, and a periodic-review reminder. The booklet's phrase "per code descriptors" is the hook: 99490 and 99439 describe establishing, implementing, revising or monitoring the plan, so the audit trail should show plan activity in the months being billed.

4. The 20-Minute Clock

The booklet's code table gives the thresholds: 99490, clinical staff, first 20 minutes; 99439, each additional 20 minutes; 99491, physician or other qualified health care professional, first 30 minutes; 99437, each additional 30 minutes; 99487, complex CCM, clinical staff, first 60 minutes; 99489, each additional 30 minutes. The codes "are based on time per calendar month".

Three rules govern whose minutes count. From the booklet: "CPT codes 99487, 99489, 99490, and 99439 include time spent directly by the billing practitioners or clinical staff. Time spent by the billing practitioner may also count toward the time threshold if not used to report 99491. CPT codes 99491 and 99437 include only time that's spent personally by the billing practitioner. Clinical staff time doesn't count toward the required reporting time threshold code." And under concurrent billing: "You can't count time toward the CCM service code for any other billed code."

The booklet does not prescribe a format for time documentation. What an auditor can check is whether the minutes existed, when they were logged, by whom, and whether the same minute was counted twice. The failure OIG actually found in its last completed CCM audit (A-07-19-05122, August 2021) was duplicate billing: $1.4 million in overpayments on 38,447 claims "for instances in which providers billed noncomplex or complex CCM services more than once for the same beneficiary for the same service period", which OIG attributed to missing claim-system edits. A time log that is append-only, stamped at entry, tied to one patient and one calendar month, and locked to a single code when the claim is built is the control that prevents both the duplicate-month error and the shared-minute error. The CCM & RPM audit readiness article covers the enforcement history in more detail.

5. Who May Furnish the Time

From the booklet: "For CCM services you don't personally provide, clinical staff can provide them under your direction on an 'incident to' basis (as an integral part of services provided by the billing practitioner). This is subject to applicable state law, licensure, and scope of practice. Clinical staff are employees or people working under contract with the billing practitioner." The clinical-staff codes are assigned "general supervision", which "means the billing practitioner doesn't personally provide the service but it's done under their overall direction and control. We don't require you to be physically present during the service."

For a care-management company that furnishes staff to practices, the record needs to show the contract relationship with each billing practitioner and which practitioner each logged minute was furnished for. That is one reason multi-practice platforms need staff-to-practice assignments as data, not as an assumption. CMS's proposed 2027 change to RPM staffing, covered in CMS's 2027 RPM staffing proposal, is a reminder that the contractor model is under active review.

What APCM Changes, and What It Does Not

The booklet's APCM section says the bundled codes (G0556, G0557, G0558) "are billed once per calendar month" and that "they don't require you to count minutes per month to bill." That removes the 20-minute log for practices that move to APCM, but it does not remove consent or the care plan, and the 2026 rule added optional behavioural-health add-on codes rather than relaxing documentation. The APCM program software page describes the consent, tiering and service-element evidence an APCM program still has to keep.

A Checklist for the Record

For each enrolled patient, a program should be able to produce, from its own system and without hand-assembly:

1. The initiating visit date and type (E/M, AWV or IPPE), or the last-seen date within a year that made one unnecessary.
2. The consent record: date, method, person obtaining it, the five items, accept or decline, and the billing practitioner it names.
3. The two or more qualifying chronic conditions, since that is what the open OIG audit is testing.
4. The current care plan with its revision history and the date a copy was given to the patient or caregiver.
5. The month's minute log by staff member, with each entry stamped when it was made and tied to one code.
6. The staff member's relationship to the billing practitioner (employee or contract) and the supervising practitioner.
7. A withdrawal date, if any, with billing stopped from the following month.

If any of those take a spreadsheet lookup or an email to assemble, that is the gap a platform closes. The spreadsheets to SaaS breakeven article works through when that is worth building.

Related Reading

• CCM & RPM audit readiness: what OIG and DOJ have found
• Building CCM/PCM software: technical requirements
• First Program Live: invoices and an audit trail from existing time logs within 30 days

Sources

• CMS MLN909188, Chronic Care Management Services, June 2025 (PDF)
• CMS fact sheet, Calendar Year 2026 Medicare Physician Fee Schedule Final Rule (CMS-1832-F), October 31, 2025
• GovInfo, CY 2026 PFS final rule text, 90 FR 49266, November 5, 2025
• OIG Work Plan OAS-26-09-007, Audit of Medicare Payments for Chronic Care Management Services at Risk of Noncompliance (announced March 16, 2026)
• OIG A-07-19-05122, Medicare Continues To Make Overpayments for Chronic Care Management Services (August 2021)
• AAACN Open Forum, Chronic Care Management (CCM) Initiating Visit Documentation (March 2025)
• AAPC forum, Chronic Care Management billing for this service (2015 to 2018)

Last reviewed 2026-10-16.