CMS Table of Risk: The Complete 2026 Reference for E/M Coding
The CMS Table of Risk is one of three elements in Medical Decision Making (MDM) that determines the level of an Evaluation and Management (E/M) code. Specifically, the Table of Risk classifies the risk of complications, morbidity, or mortality associated with the patient’s presenting problem(s), the diagnostic procedure(s) ordered, and the management option(s) selected during an encounter. Under the 2021 AMA/CMS MDM framework used for all E/M coding in 2026, risk is formally known as “Element 3: Risk of Complications and/or Morbidity or Mortality of Patient Management.”
The Table of Risk defines four levels — Minimal, Low, Moderate, and High — each with specific clinical examples across three categories: presenting problems, diagnostic procedures, and management options. The highest level achieved in any single category determines the overall risk for the encounter. Combined with the other two MDM elements (Number and Complexity of Problems Addressed, and Amount and/or Complexity of Data Reviewed), risk determines whether the encounter qualifies for a Straightforward, Low, Moderate, or High MDM level — and therefore which E/M code to bill.
Critically, only two of the three MDM elements need to meet or exceed a given level for the encounter to qualify at that level. This makes risk the most common “upgrade path” — a single prescribing decision or a documented hospitalization consideration can elevate MDM from Low to Moderate or Moderate to High, even when data review is minimal.
The Four Risk Levels Explained
The CMS Table of Risk organizes clinical risk into four tiers, each assessed across three columns: the nature of the presenting problem, the risk inherent in diagnostic procedures ordered, and the risk associated with the management options selected. Below is the complete reference for each level.
Minimal Risk
Minimal risk applies to encounters where the presenting problem is self-limited, the diagnostic workup is routine (or none), and management involves rest, over-the-counter medications, or simple measures. Minimal risk corresponds to Straightforward MDM (99211–99212 for established patients, 99202 for new patients).
| Category | Examples |
|---|---|
| Presenting Problems | Cold symptoms, insect bite, minor skin rash, small uncomplicated wound, medication refill (no changes) |
| Diagnostic Procedures | Venipuncture, urinalysis dipstick, EKG with no identified risk |
| Management Options | Rest, ice, OTC medications (ibuprofen, antihistamines), bandages, elevation, elastic wraps |
Low Risk
Low risk applies when the presenting problem is an acute uncomplicated illness or a stable chronic condition, standard diagnostic tests are ordered, and management involves straightforward prescription medications at current dosages. Low risk corresponds to Low MDM complexity (99213 for established patients, 99203 for new patients).
| Category | Examples |
|---|---|
| Presenting Problems | Acute uncomplicated UTI, pharyngitis, controlled hypertension, stable diabetes on current regimen, sprains without fracture |
| Diagnostic Procedures | Blood tests (CBC, CMP, lipid panel), X-rays with no identified risk factors, non-cardiovascular imaging, pulmonary function tests, skin biopsy |
| Management Options | Prescription drug management at current dose, minor surgery with no identified risk factors (wart removal, I&D of abscess), physical/occupational therapy, IV fluids without additives |
Moderate Risk
Moderate risk is the most clinically relevant upgrade threshold for primary care and specialty physicians. It applies when the patient has a chronic illness with mild exacerbation, an undiagnosed new problem with uncertain prognosis, or when prescription drug management involves a new prescription, dosage change, or medication with monitoring requirements. Moderate risk corresponds to Moderate MDM complexity (99214 for established patients, 99204 for new patients).
| Category | Examples |
|---|---|
| Presenting Problems | Chronic illness with mild exacerbation (COPD with increased dyspnea, diabetes with rising A1c), undiagnosed new problem with uncertain prognosis (new breast mass, unexplained weight loss), acute illness with systemic symptoms (pyelonephritis, pneumonia) |
| Diagnostic Procedures | Procedures with identified patient/procedure risk factors (stress test in patient with cardiac history), lumbar puncture, endoscopy, cardiac imaging with contrast, biopsy of deep tissue |
| Management Options | Prescription drug management requiring new Rx, dose change, or monitoring for toxicity (initiating ACE inhibitor, adjusting insulin, starting methotrexate with liver monitoring), minor surgery with identified risk factors (excision in anticoagulated patient), elective major surgery without identified risk factors, therapeutic IV medications |
The Most Common Upgrade Path: Prescription Drug Management
Any encounter where the physician initiates a new medication, changes a dosage, or switches drugs qualifies for at least Moderate risk. This single fact is the most underutilized upgrade path in E/M coding — every medication change documented in the note elevates risk from Low to Moderate, potentially supporting a 99214 instead of 99213. The difference in reimbursement is approximately $40–$60 per visit at 2024 Medicare national rates.
High Risk
High risk applies to encounters involving acute or chronic illness with severe exacerbation or threat to life/bodily function, drug therapy requiring intensive monitoring, or a decision regarding hospitalization or major surgery. High risk corresponds to High MDM complexity (99215 for established patients, 99205 for new patients).
| Category | Examples |
|---|---|
| Presenting Problems | Acute or chronic illness with severe exacerbation or threat to life (acute MI, stroke, COPD exacerbation with respiratory failure, diabetic ketoacidosis, suicidal ideation, sepsis) |
| Diagnostic Procedures | Procedures with identified risk of significant complications (cardiac catheterization, thoracentesis, interventional radiology with contrast in renal impairment), discography |
| Management Options | Decision regarding hospitalization or need for major surgery, drug therapy requiring intensive monitoring (warfarin initiation, chemotherapy, lithium, immunosuppressants with blood monitoring), DNR discussion/decision, parenteral controlled substances, elective major surgery with identified risk factors (CABG in diabetic patient, joint replacement in anticoagulated patient) |
How Risk Maps to E/M Codes
The Table of Risk feeds directly into Medical Decision Making complexity, which in turn determines the billable E/M code. Here is the complete mapping from risk level through MDM to CPT code:
| Risk Level | MDM Level | New Patient | Established | Medicare Rate* |
|---|---|---|---|---|
| Minimal | Straightforward | 99202 | 99212 | $67 |
| Low | Low | 99203 | 99213 | $111 |
| Moderate | Moderate | 99204 | 99214 | $167 |
| High | High | 99205 | 99215 | $224 |
*Approximate 2024 National Medicare Physician Fee Schedule rates for established patient office visits.
The revenue difference between correctly identifying Moderate risk (99214, ~$167) versus defaulting to Low risk (99213, ~$111) is approximately $56 per encounter. For a physician seeing 20 patients per day where even 5 encounters qualify for the upgrade, that represents $280/day or $72,800 per year in recovered revenue — with no change to clinical workflow, only better documentation.
Prescription Drug Management: The Most Common Upgrade Path
The single most underutilized fact in E/M coding is that prescription drug management — specifically initiating a new prescription, changing a dose, or switching medications — constitutes Moderate risk under the CMS Table of Risk. This applies to every encounter where a prescribing decision is made, regardless of how “routine” it may feel clinically.
Examples that qualify for Moderate risk:
- Starting a patient on lisinopril for newly diagnosed hypertension
- Increasing metformin from 500mg to 1000mg due to rising A1c
- Switching from one SSRI to another due to side effects
- Adding a statin for hyperlipidemia
- Starting inhaled corticosteroid for asthma
- Prescribing antibiotics for a bacterial infection (new prescription)
- Adjusting insulin dosing based on glucose log
Examples that do NOT qualify (remain Low risk):
- Continuing all current medications at same doses (“refill all”)
- Recommending OTC medications only
- Patient declines offered medication (no prescription generated)
The key documentation requirement: the note must explicitly state the prescribing decision. “Continue current medications” = Low risk. “Increasing atorvastatin from 20mg to 40mg daily due to LDL 145, goal <100” = Moderate risk. AI tools like CodeItRight.ai detect these prescribing decisions in clinical notes and flag the appropriate risk level automatically.
Surgery and Hospitalization Decisions: Automatic High Risk
Any encounter where the physician documents a decision regarding hospitalization or decision regarding major surgery qualifies for High risk under the CMS Table of Risk — even if the ultimate decision is not to hospitalize or not to operate. The clinical reasoning and decision-making process itself carries the risk, not just the outcome.
This is frequently underdocumented. Physicians routinely evaluate patients where hospitalization is considered and dismissed, but the note says only “patient stable, follow up in 1 week” instead of “Considered admission for observation given acute presentation; decided outpatient management appropriate given adequate home support, patient reliability, and ability to return if worsening. Discussed warning signs for ER return.”
Common scenarios where hospitalization/surgery decisions occur but are often underdocumented:
- Chest pain evaluation with negative troponin — decided against admission
- TIA/stroke-like symptoms with normal imaging — discharged with antiplatelet therapy
- Severe COPD exacerbation managed with nebulizer in office — decided outpatient steroids vs. admission
- Suicidal ideation assessment — safety plan vs. psychiatric hold
- GI bleeding evaluation — decided against same-day endoscopy
- Orthopedic consultation for joint replacement candidacy
- Referral to surgeon with documentation of surgical discussion
Common Misunderstandings About the Table of Risk
Misunderstanding 1: Ordering a Test Equals Risk
Ordering a routine lab test (CBC, metabolic panel, urinalysis) does not contribute to the Risk element. It contributes to Element 2 (Data). Risk from diagnostic procedures applies only when the procedure itself carries inherent clinical risk to the patient — such as lumbar puncture (Moderate), cardiac catheterization (High), or biopsy with sedation (Moderate). A blood draw has Minimal procedural risk regardless of how complex the test panel is.
Misunderstanding 2: More Diagnoses = Higher Risk
The number of diagnoses addressed affects Element 1 (Number and Complexity of Problems), not Element 3 (Risk). A patient with 8 stable chronic conditions managed on current medications has High Element 1 complexity but only Low risk if no medications are being changed and no conditions are exacerbating. Conversely, a patient with a single new problem requiring a new prescription has Low Element 1 complexity but Moderate risk.
Misunderstanding 3: Independent Interpretation of Test Results = Higher Risk
Independently interpreting a diagnostic test (reviewing the X-ray yourself rather than relying on the radiologist’s read) contributes to Element 2 (Data), not Element 3 (Risk). However, the management decision made as a result of that interpretation may affect risk. If interpreting a chest X-ray leads to a decision about hospitalization, that decision is High risk — but the interpretation itself is a Data element.
Misunderstanding 4: Risk Requires All Three Categories to Match
Risk is determined by the highest level achieved in any single category (presenting problem OR diagnostic procedure OR management option). If the presenting problem is Low risk but the management involves a new prescription (Moderate risk), the overall risk for the encounter is Moderate. You do not need Moderate in all three columns — just one.
How the Table of Risk Interacts with the Other Two MDM Elements
Medical Decision Making is determined by three elements working together. Here is how they interact:
| MDM Level | Element 1: Problems | Element 2: Data | Element 3: Risk |
|---|---|---|---|
| Straightforward | 1 self-limited problem | Minimal or none | Minimal risk |
| Low | 2+ self-limited OR 1 chronic stable | Limited (order test, review result) | Low risk (Rx at current dose) |
| Moderate | 1+ chronic with exacerbation OR undiagnosed new problem | Moderate (independent interpretation, external records, discussion with external physician) | Moderate risk (new Rx, dose change, minor surgery with risk factors) |
| High | 1+ chronic with severe exacerbation OR acute threat to life | Extensive (independent interpretation from multiple sources, discussion with multiple external physicians) | High risk (hospitalization decision, major surgery, drug therapy with intensive monitoring) |
The “2-of-3” Rule
The defining principle of the 2021 MDM framework is that only two of the three elements must meet or exceed the level. This creates important strategic implications:
- Risk + Problems = Code level (even with minimal data). A patient with a chronic illness exacerbation (Moderate problems) where the physician changes a medication (Moderate risk) qualifies for 99214 regardless of data reviewed.
- Risk + Data = Code level (even with simple problems). A straightforward condition where the physician reviews outside records AND prescribes a new drug qualifies for Moderate MDM.
- Problems + Data = Code level (even with low risk). Multiple chronic conditions with extensive data review qualifies for Moderate or High MDM even if all medications remain unchanged.
In practice, Risk is the easiest element to document and support because a single prescribing decision (documented in one sentence) satisfies Moderate risk. This is why risk is called the “swing element” — it frequently determines whether an encounter qualifies for the next code level up.
Real-World Examples: Risk Level Determination
Example 1: Stable Hypertension Follow-Up (Low Risk)
Patient returns for blood pressure check. BP 128/78 on current lisinopril 20mg. Labs from last month normal. No medication changes. Follow up in 3 months.
- Presenting problem: Chronic illness, stable = Low
- Diagnostics: Review of prior labs = Low
- Management: Continue current Rx = Low
- Overall risk: Low → supports 99213
Example 2: Hypertension with Medication Change (Moderate Risk)
Same patient, but BP 152/94. A1c also elevated at 7.4. Physician increases lisinopril from 20mg to 40mg and starts metformin 500mg.
- Presenting problem: Chronic illness with mild exacerbation = Moderate
- Diagnostics: Ordered CMP for renal function monitoring = Low (procedural risk)
- Management: New prescription + dose change = Moderate
- Overall risk: Moderate → supports 99214
Example 3: Chest Pain Evaluation (High Risk)
Patient presents with substernal chest pressure. EKG normal, troponin pending. Physician documents: “Considered admission for cardiac observation given risk factors (DM, HTN, family history). Initial troponin negative. Will monitor 3-hour repeat. If negative, discharge with stress test within 48 hours and return precautions.”
- Presenting problem: Acute illness with possible threat to life = High
- Diagnostics: EKG, troponin = Low procedural risk (but High presenting problem already establishes level)
- Management: Decision regarding hospitalization = High
- Overall risk: High → supports 99215
Documentation Tips for Optimal Risk Capture
The Table of Risk is only as useful as the documentation that supports it. Auditors and AI coding tools evaluate risk based on what is explicitly stated in the clinical note — not what was implied or obvious from context.
- Name every medication decision explicitly. “Started lisinopril 10mg daily” not “will treat blood pressure.” “Increased metformin from 500mg to 1000mg BID” not “adjusted diabetes meds.”
- Document the hospitalization consideration. Even when the answer is “no,” write: “Considered admission; determined outpatient management appropriate because [reason].”
- Characterize disease severity. Use explicit language: “mild exacerbation,” “severe exacerbation,” “inadequately controlled,” “threat to life.” Don’t leave severity for the coder to infer.
- State the uncertain prognosis. For new undiagnosed problems: “New [symptom/finding] with uncertain prognosis, differential includes [list].” This phrase alone establishes Moderate risk.
- Document monitoring requirements. When prescribing drugs that require monitoring: “Starting warfarin, will check INR in 3 days, weekly until stable.” This supports High risk.
CodeItRight.ai analyzes your clinical notes against the CMS Table of Risk in real time, highlighting where risk-supporting language exists, where documentation gaps leave money on the table, and what specific phrases would support a higher code level. Try it with any note to see your risk level analysis in 30 seconds.
Frequently Asked Questions
What is the CMS Table of Risk in E/M coding?
The CMS Table of Risk is one of three elements used to determine the level of Medical Decision Making (MDM) in Evaluation and Management (E/M) coding. It classifies the risk of complications, morbidity, or mortality associated with the patient's presenting problem(s), diagnostic procedure(s) ordered, and management option(s) selected. The Table defines four risk levels — Minimal, Low, Moderate, and High — each with specific clinical examples. Risk is assessed across three columns (presenting problem, diagnostics, management) and the highest level achieved in any single column determines the overall risk for the encounter. Under the 2021 AMA/CMS MDM framework, risk (Element 3) is one of three MDM elements along with Number and Complexity of Problems (Element 1) and Amount and/or Complexity of Data (Element 2). Only two of the three elements must meet a given level for the encounter to qualify for that MDM complexity.
What are the four risk levels in the CMS Table of Risk?
The four risk levels in the CMS Table of Risk are: (1) Minimal Risk — self-limited problems with over-the-counter treatments, rest, or bandages. Examples include cold symptoms, insect bites, and minor skin rashes treated with OTC medications. (2) Low Risk — minor acute or stable chronic illnesses with prescription drug management at current dosage, minor procedures without identified risk factors, and physical or occupational therapy. Examples include UTI treated with antibiotics, controlled hypertension, and simple wound closure. (3) Moderate Risk — one or more chronic illnesses with mild exacerbation, an undiagnosed new problem with uncertain prognosis, prescription drug management requiring monitoring for toxicity, and decisions about minor surgery with patient or procedure risk factors. Examples include diabetes with A1c elevation requiring medication change, new breast mass, and starting warfarin. (4) High Risk — one or more chronic illnesses with severe exacerbation, acute illness posing threat to life or bodily function, drug therapy requiring intensive monitoring, and decisions regarding hospitalization or major surgery. Examples include COPD exacerbation requiring ER care, acute MI, chemotherapy initiation, and decision for joint replacement surgery.
How does prescription drug management affect the risk level?
Prescription drug management is one of the most important risk-level differentiators in E/M coding. Under the CMS Table of Risk: continuing a patient on current medications at the same dose is Low risk, initiating a new prescription or changing dosage is Moderate risk (because it introduces the risk of adverse effects and requires monitoring), and starting drug therapy that requires intensive monitoring for toxicity (such as warfarin, lithium, chemotherapy, or immunosuppressants) is High risk. This means that any encounter where the physician starts a new medication, increases a dose, or switches drugs automatically qualifies for at least Moderate risk — one of the most common and overlooked upgrade paths from 99213 to 99214. The key documentation requirement is explicitly stating the medication decision: "Starting lisinopril 10mg daily for blood pressure" or "Increasing metformin from 500mg to 1000mg BID due to elevated A1c."
What is the difference between ordering a test and independently interpreting it for risk purposes?
This is one of the most common misunderstandings in E/M coding. Under the CMS Table of Risk, simply ordering a diagnostic test (like a blood panel, X-ray, or EKG) contributes to the Data element (Element 2) of MDM but does NOT count toward the Risk element (Element 3). For risk purposes, what matters is whether the physician independently interprets the test results and uses that interpretation to make management decisions. Ordering a chest X-ray is a data point. Independently reviewing the chest X-ray images yourself (rather than relying solely on the radiologist's interpretation) and making clinical decisions based on your own reading is a risk-related activity. Similarly, ordering a lab test is data — but reviewing the results and deciding to change therapy based on those results is a management decision that contributes to risk. The risk column specifically addresses "diagnostic procedures ordered" in terms of the inherent procedural risk (e.g., lumbar puncture = Moderate risk, cardiac catheterization = High risk), not the cognitive work of ordering a routine lab.
How does the Table of Risk interact with the other two MDM elements?
Medical Decision Making has three elements: (1) Number and Complexity of Problems Addressed, (2) Amount and/or Complexity of Data Reviewed and Analyzed, and (3) Risk of Complications and/or Morbidity or Mortality of Patient Management. Under the 2021 AMA/CMS framework, only TWO of the three elements must meet or exceed a given level for the encounter to qualify for that MDM complexity. This means a physician can have High risk (Element 3) and Moderate number/complexity of problems (Element 1) but Low data (Element 2) and still qualify for High MDM complexity — because two elements (risk + problems) meet the High threshold. This "2-of-3" rule is critical because risk is often the easiest element to document and support. If a physician prescribes a new medication (Moderate risk) and addresses two chronic conditions (Moderate problems), the encounter qualifies for Moderate MDM (99214) regardless of how much data was reviewed.
Why is "decision regarding hospitalization" considered High risk?
The decision regarding hospitalization or need for major surgery is classified as High risk under the CMS Table of Risk because it represents a clinical scenario where the patient's condition is severe enough that outpatient management is insufficient and the risk of morbidity or mortality without escalated intervention is significant. This applies even if the physician ultimately decides NOT to hospitalize — the clinical decision-making process itself carries High risk because the physician must weigh life-threatening possibilities. Common examples include: evaluating a patient with chest pain and deciding whether to admit for cardiac workup vs. discharge with follow-up; assessing a patient with acute abdominal pain for possible surgical abdomen; evaluating a patient with TIA symptoms for stroke risk and admission decision; and managing a psychiatric patient with suicidal ideation for possible inpatient commitment. The key documentation point is that the physician explicitly considered and documented the hospitalization/surgery decision, even if the ultimate decision was to manage outpatient.
What risk level applies to chronic illness management?
Chronic illness management spans multiple risk levels depending on the clinical status: A chronic illness that is stable, adequately controlled, and being managed on current therapy with routine monitoring is Low risk. Example: hypertension controlled on current medication with routine blood pressure checks. A chronic illness with mild exacerbation or progression requiring treatment adjustment is Moderate risk. Example: diabetes with A1c rising from 7.0 to 7.8 requiring addition of a second agent. A chronic illness with severe exacerbation, acute progression, or threat to life or bodily function is High risk. Example: COPD with acute exacerbation requiring oral steroids and possible hospitalization, or heart failure with decompensation and volume overload. The critical documentation distinction is the severity descriptor: "stable" = Low, "mild exacerbation" or "inadequately controlled" = Moderate, "severe exacerbation" or "life-threatening" = High. Physicians should explicitly characterize disease status in their notes rather than simply listing the diagnosis.
How does risk level map to specific E/M CPT codes?
Risk level maps to E/M codes through the MDM complexity framework. For established patient office visits (the most common E/M codes): Minimal risk aligns with Straightforward MDM (99211-99212), Low risk aligns with Low MDM complexity (99213), Moderate risk aligns with Moderate MDM complexity (99214), and High risk aligns with High MDM complexity (99215). Remember that risk alone does not determine the code — two of three MDM elements must meet the level. However, risk is frequently the element that "upgrades" an encounter. The most common upgrade path is 99213 → 99214: if a physician addresses a stable chronic problem (Low risk per the problem) but changes a medication (Moderate risk per management), the overall risk becomes Moderate. If the number/complexity of problems also meets Moderate (e.g., two chronic conditions addressed), the encounter qualifies for 99214 even with minimal data review. For new patient visits, the same MDM levels apply: 99202 (Straightforward), 99203 (Low), 99204 (Moderate), 99205 (High).
Apply the Table of Risk Instantly
The CMS Table of Risk is the most actionable element in Medical Decision Making because a single prescribing decision or hospitalization consideration can upgrade your encounter to the next code level. Understanding risk levels eliminates the most common source of undercoding in E/M documentation.
Continue building your E/M coding knowledge with our complete resource library: What Is E/M Coding?, the 2026 E/M Code Levels Chart, and our blog deep dives on MDM levels explained and when to upcode from 99213 to 99214. Or skip the manual work entirely — paste any clinical note into CodeItRight.ai and get Table of Risk analysis, MDM leveling, and dual-code recommendations in 30 seconds.