It is the provider's decision. Remember, it is "decision regarding" NOT necessarily decision to have.
From the
AMA 2021 Outpatient guide (my emphasis added last sentence):
"Risk: The probability and/or consequences of an event. The assessment of the level of risk is affected by the nature of the event under consideration. For example, a low probability of death may be high risk, whereas a high chance of a minor, self-limited adverse effect of treatment may be low risk. Definitions of risk are based upon the usual behavior and thought processes of a physician or other qualified health care professional in the same specialty. Trained clinicians apply common language usage meanings to terms such as high, medium, low, or minimal risk and do not require quantification for these definitions (though quantification may be provided when evidence-based medicine has established probabilities). For the
purposes of MDM, level of risk is based upon consequences of the problem(s) addressed at the encounter when appropriately treated. Risk also includes MDM related to the need to initiate or forego further testing, treatment, and/or hospitalization.
The risk of patient management criteria applies to the patient management decisions made by the reporting physician or other qualified health care professional as part of the reported encounter. "
Also: "The risk of complications and/or morbidity or mortality of patient management decisions made at the visit, associated with the patient’s problem(s), the diagnostic procedure(s), treatment(s).
This includes the possible management options selected and those considered but not selected, after shared MDM with the patient and/or family. For example, a decision about hospitalization includes consideration of alternative levels of care. Examples may include a psychiatric patient with a sufficient degree of support in the outpatient setting or the decision to not hospitalize a patient with advanced dementia with an acute condition that would generally warrant inpatient care, but for whom the goal is palliative treatment.
So your example would be moderate (level 4 risk) if patient or procedure risk factors are not identified. High (level 5 risk) if the risk factors are identified. It does not matter if the patient did or did not have the surgery. The provider's thought process to make a medical decision took place