Providers billing solely based on time is perfectly okay. If there is time present that supports a higher level than the MDM would without the time, then you'll want to use the time as your level.
Example: Provider orders a 99213, but documents 50 minutes of time. You can now use the 50 minutes to code a 99215.
Example (2): Provider does not document time and the visit supports a 99214, then you have to code from the visit's MDM.
I would only see a flag potentially coming up if there is a certain provider who is consistently documenting time that would allow for numerous 99215 or 99205's to be billed. Obviously these are possible, but many of them in a row over time may cause a flag.