Use this guide as a structured companion to your official CDEO study materials, not a replacement for them. Work through the ten groups in order, because early groups build the documentation, privacy, and compliance foundation that later coding and reimbursement concepts assume. For each concept, read the rule, study the resolved example to see the decision applied, and note the mistake line as a self-check before moving on. Return to weak groups after practice questions reveal gaps.
Foundations of CDI and the CDEO Role
1. Proactive CDI versus retrospective auditing
Clinical documentation improvement works prospectively, shaping the record before claims are submitted, whereas auditing reviews code support after submission. A CDEO builds internal documentation guidelines and educates providers so deficiencies are prevented rather than discovered downstream.
Example: Before billing, staff notice an ordered lab panel lacks documented rationale and ask the provider to amend the note that day; the claim goes out supported because the fix happened before submission.
Mistake to avoid: Treating CDI as a post-denial cleanup task instead of a pre-billing workflow.
Reference: AAPC CDEO study guide sample
2. CDI goals extend beyond revenue
Successful programs emphasize documenting clinical conditions, treatment and management, and treatment outcomes rather than maximizing reimbursement. As payment models shift from fee for service toward quality of care and patient outcomes, documentation must efficiently communicate the quality delivered.
Example: A program tracks whether treatment response and revised diagnoses are captured at each visit, rather than whether a higher-paying code can be defended; leadership reviews outcome documentation, not just revenue lift.
Mistake to avoid: Justifying the CDI program solely by dollars captured.
Reference: AAPC CDEO study guide sample
3. CDEO responsibilities versus auditor responsibilities
An auditor reviews records after claims are submitted to confirm that CPT, HCPCS Level II, and ICD-10-CM codes are supported and that coding and billing processes were correct. The CDEO instead facilitates compliant record entries through internal guidelines and remedies deficiencies audit findings reveal. The roles overlap but differ in timing and purpose.
Example: After an audit finds unsupported modifier use, the CDEO reviews the findings, educates the providers involved, and adds a pre-billing checklist so the same error stops recurring.
Mistake to avoid: Assuming the coder who bills the claim is automatically performing CDI.
Reference: AAPC CDEO study guide sample
4. Setting-specific documentation challenges
Documentation challenges differ by setting. Home health entities need a compliant plan of care from the ordering provider or services are unjustified; outpatient diagnostic centers often have tests ordered without clear medical necessity; inpatient facilities struggle coordinating multiple providers; rehabilitation centers must keep care plans current for Medicare patients.
Example: A home health agency cannot justify billed visits because the ordering provider never supplied a compliant plan of care; the CDEO institutes a checklist blocking admission until that plan is on file.
Mistake to avoid: Applying one generic documentation checklist to every care setting.
Reference: AAPC CDEO study guide sample
5. The least expected documentation standard
CMS documentation guidelines for evaluation and management services define the minimum, or least expected, documentation supporting an encounter. CDI pushes beyond that floor toward complete, accurate records that improve communication, support appropriate treatment and planning, enable early problem detection, and provide evidence of excellent care.
Example: A provider counsels a patient on medication risks and confirms understanding but writes none of it down; the CDEO flags the note because the counseling cannot be evidenced later.
Mistake to avoid: Treating the minimum required elements as the documentation goal.
Reference: AAPC CDEO study guide sample
6. Financial and legal consequences of deficient records
A well-documented record is a provider's best legal defense, and deficient documentation signals that payments may be inaccurate. Diagnoses recorded in the record but omitted from the claim can trigger denials, while accurate documentation helps claims pay correctly the first time and reduces rebilling and appeals.
Example: A note documents a chronic condition the claim omits, and the payer denies for lack of supporting diagnosis; after correction and resubmission, the practice adds a diagnosis cross-check step.
Mistake to avoid: Assuming good care alone produces clean claims and legal protection.
Reference: AAPC CDEO study guide sample
Medical Record Documentation Requirements
7. Core elements of every encounter note
Each encounter note should include the reason for the encounter, relevant history, examination findings, prior diagnostic test results, an assessment or diagnosis, a plan of care, and the date with legible identity of the observer. Internal guidelines should make these elements verifiable before coding begins.
Example: A note contains history and exam but no assessment or plan; the coder returns it for completion before assigning any code, because the encounter is not yet codable.
Mistake to avoid: Coding from a note that lacks an assessment or provider identity.
Reference: AAPC CDEO study guide sample
8. Timeliness of documentation
Providers should document during the encounter or as soon as possible afterward. Most practices set a limit, ranging from twenty-four hours to a few days, for completing or authenticating the record, and the CDEO monitors timeliness rather than assuming notes appear promptly.
Example: A practice sets a two-day completion window and the CDEO runs a weekly report of unclosed encounters, prompting the provider to finish notes before the deadline passes.
Mistake to avoid: Allowing open-ended record completion with no monitoring.
Reference: AAPC CDEO study guide sample
9. Cloning and over-documentation in the EHR
Electronic health records have allowed over-documentation, cloned records, and similar compliance failures to flourish. Evidence of copying data from previous dates of service that is not relevant to the current service is a documentation deficiency, and digitized data lets payers enforce compliance aggressively through audits and recoupments.
Example: A review of the past medical history copied from a prior visit shows items irrelevant to today's problem; the copied block is flagged and the provider is educated on attesting currency.
Mistake to avoid: Assuming copied text proves work was performed at the current visit.
Reference: AAPC CDEO study guide sample
10. Common preventable record deficiencies
Simple, preventable deficiencies include sloppy text, misspelled words, nonsensical phrases, incomplete dictation, skips indicating unheard words, incomplete sentences, incorrect or missing dates of service, missing dosage and strength of ordered medications, and missing orders for diagnostic tests. Each undermines the record's reliability.
Example: A medication order lists the drug but neither dosage nor strength; the record is returned for completion because the order cannot be safely verified or supported.
Mistake to avoid: Dismissing sloppy text as cosmetic rather than a compliance risk.
Reference: AAPC CDEO study guide sample
11. Rationale for ordered services must be inferable
If the rationale for ordering diagnostic or ancillary services is not documented, it must be easily inferred by an independent reviewer or third party with appropriate medical training. This is a standard internal documentation guideline the CDEO enforces for every ordered test.
Example: An autoimmune panel is ordered with no documented indication and nothing in the note allows a reviewer to infer one; the CDEO queries the provider before the claim goes out.
Mistake to avoid: Assuming clinical obviousness substitutes for documented rationale.
Reference: AAPC CDEO study guide sample
12. Medication list and allergy currency
The CDEO reviews medication lists and ensures they are updated at each visit to show whether each prescription is still current and accurate. Allergy status deserves equal attention, because an undocumented allergy could lead to a prescribed medication that endangers the patient.
Example: A patient mentions a penicillin allergy that appears nowhere in the record; the list is updated at the visit before any prescribing occurs, preventing a dangerous oversight.
Mistake to avoid: Letting stale medication lists carry forward visit after visit.
Reference: AAPC CDEO study guide sample
HIPAA Privacy Fundamentals
13. What makes a provider a covered entity
A healthcare provider becomes a covered entity by transmitting health information electronically in connection with standard transactions such as claims, eligibility inquiries, or referral authorization requests. Simply using email does not trigger coverage, and transmitting through a billing service or third party counts the same as transmitting directly.
Example: A two-physician practice sends claims through a billing vendor; it is still a covered entity because the standard transaction occurred on its behalf through a third party.
Mistake to avoid: Believing outsourced billing removes covered-entity obligations.
Reference: AAPC CDEO study guide sample; HHS Summary of the HIPAA Privacy Rule
14. The three types of covered entities
The Privacy Rule covers health plans, healthcare clearinghouses, and providers who transmit standard electronic transactions. Clearinghouses, including billing services and repricing companies, process nonstandard information into standard format and usually function as business associates. Workers' compensation and auto-only insurers are not health plans.
Example: A repricing company that converts nonstandard claim data into standard format is identified as a clearinghouse, and because it handles identifiable data for a client, only certain Privacy Rule provisions apply to it.
Mistake to avoid: Classifying a billing service as a health plan.
Reference: HHS Summary of the HIPAA Privacy Rule
15. PHI applies to every medium
Protected health information is individually identifiable information relating to past, present, or future health, care, or payment for care, held by a covered entity or business associate in any form. Electronic, paper, and oral information all receive protection, and common identifiers like names and birth dates make data identifiable.
Example: Two staff members discuss a patient's results aloud in a shared workspace; the conversation involves protected health information and must follow the same safeguards as the chart itself.
Mistake to avoid: Applying privacy safeguards only to electronic records.
Reference: HHS Summary of the HIPAA Privacy Rule
16. De-identification of health information
De-identified information carries no use or disclosure restrictions. De-identification occurs either through a formal determination by a qualified statistician or by removing the specified identifiers of the individual and of relatives, household members, and employers, which is adequate only when the entity has no actual knowledge the remainder could identify the person.
Example: An analytics dataset has names, full dates, and medical record numbers stripped, and the practice has no knowledge it could re-identify anyone; it is used internally without patient authorization.
Mistake to avoid: Removing only the patient's name and calling the data de-identified.
Reference: HHS Summary of the HIPAA Privacy Rule
17. Business associates and required contracts
A business associate is a non-workforce person or organization performing functions for a covered entity that involve protected health information, such as claims processing, billing, data analysis, or utilization review. A written agreement must impose safeguards, limit uses and disclosures, and the covered entity cannot authorize anything the Privacy Rule forbids. Health information exchanges with routine access are treated as business associates.
Example: A transcription vendor routinely handles identifiable dictation for a clinic; a signed agreement limits its uses, requires safeguards, and obligates it to report any improper disclosure before work begins.
Mistake to avoid: Letting a contractor access PHI with no agreement in place.
Reference: AAPC CDEO study guide sample; HHS Summary of the HIPAA Privacy Rule
18. When state law survives federal preemption
Contrary state laws are generally preempted by the federal requirements, meaning federal rules apply when compliance with both is impossible. Exceptions exist for state laws that provide greater privacy protections, that mandate reporting of disease, injury, abuse, birth, or death, or that require certain health plan reporting.
Example: A state confidentiality statute gives patients broader record protections than HIPAA; the practice follows the stricter state standard because more protective laws survive preemption.
Mistake to avoid: Assuming HIPAA always overrides a stricter state privacy law.
Reference: HHS Summary of the HIPAA Privacy Rule
Permitted Uses, Disclosures, and Individual Rights
19. Treatment, payment, and operations permissions
A covered entity may use and disclose protected health information without authorization for its own treatment, payment, and healthcare operations. It may also disclose for treatment activities of any provider, payment activities of another covered entity or provider, and certain operations of another entity when both have a relationship with the individual.
Example: A consult note is sent to the referring physician without patient authorization because it is a treatment activity, which the Rule permits for any provider involved in the patient's care.
Mistake to avoid: Demanding written authorization for routine referral communications.
Reference: HHS Summary of the HIPAA Privacy Rule
20. The only two required disclosures
A covered entity must disclose protected health information in only two situations: to individuals or their personal representatives when they request access or an accounting of disclosures, and to HHS when it undertakes compliance investigation, review, or enforcement. Everything else is either permitted, prohibited, or authorization-based.
Example: A patient requests an accounting of disclosures; the practice must honor it, even though most routine treatment and payment disclosures are exempt from what gets counted.
Mistake to avoid: Treating a payer's records request as a mandatory HIPAA disclosure.
Reference: HHS Summary of the HIPAA Privacy Rule
21. When written authorization is mandatory
Written authorization is required for any use or disclosure beyond treatment, payment, operations, or the permitted categories, such as releases to life insurers, employers receiving physical results, or pharmaceutical marketing. Authorizations must be plain-language and specific, and marketing involving remuneration requires an authorization revealing that payment.
Example: A life insurer wants the results of a coverage physical; the practice obtains the patient's written authorization first, in plain language with an expiration and revocation right.
Mistake to avoid: Releasing exam results to an employer based on a verbal request.
Reference: HHS Summary of the HIPAA Privacy Rule
22. The minimum necessary principle
Covered entities must make reasonable efforts to use, disclose, and request only the minimum information needed for the purpose, with role-based access policies identifying who needs what. The entire record may not be sent unless specifically justified. The standard does not apply to treatment disclosures, individual requests, authorized uses, HHS reviews, or disclosures required by law.
Example: Front-desk staff can view scheduling data but not full clinical notes; role-based access settings enforce the minimum necessary for their duties.
Mistake to avoid: Granting the entire workforce unrestricted full-record access.
Reference: HHS Summary of the HIPAA Privacy Rule
23. Special handling of psychotherapy notes
Psychotherapy notes, the separated notes a mental health professional records analyzing private counseling conversations, require authorization for most uses, including most treatment, payment, and operations purposes. Narrow exceptions include the originator's own treatment, training, legal defense, and HHS oversight. They are also excluded from the individual's right of access.
Example: A life insurer requests a therapist's process notes; staff recognize these are psychotherapy notes and obtain specific authorization rather than treating them like the rest of the chart.
Mistake to avoid: Treating psychotherapy notes like ordinary progress notes.
Reference: HHS Summary of the HIPAA Privacy Rule
24. Notice of privacy practices and acknowledgement
Each covered entity must maintain a notice of privacy practices describing uses and disclosures, duties, individual rights, and complaint contacts. Direct treatment providers must deliver it at the first service encounter, post it prominently, make a good-faith effort to obtain written acknowledgement of receipt, and document any failure to obtain it, with emergencies handled as soon as practicable.
Example: A patient declines to sign the acknowledgement at check-in; staff document the failed good-faith attempt, which satisfies the provider's obligation.
Mistake to avoid: Skipping documentation when the patient does not sign.
Reference: HHS Summary of the HIPAA Privacy Rule
Compliance, OIG Guidance, and Audit Response
25. Benefits and right-sizing a compliance program
OIG guidance for individual and small group practices lists compliance program benefits including increased documentation accuracy, faster proper payment, minimized billing mistakes, and reduced chances of a CMS or OIG audit. Practices should begin with the components most likely to provide identifiable benefit given their own history, not implement everything at once.
Example: A two-provider practice with past modifier problems adopts just the coding and billing risk components first, rather than building every element a hospital would use.
Mistake to avoid: Copying a hospital-sized program wholesale onto a small practice.
Reference: AAPC CDEO study guide sample
26. OIG coding and billing risk areas
OIG-identified coding and billing risk areas include billing for items or services not rendered, submitting claims for services that are not reasonable and necessary, double billing, billing non-covered services as covered, misusing provider identification numbers, unbundling, failing to properly use modifiers, clustering, and upcoding the level of service.
Example: A practice bills each component of a service separately instead of the all-inclusive code; an audit flags unbundling, and the claims are corrected and repaid.
Mistake to avoid: Viewing upcoding as a paperwork slip rather than a fraud risk.
Reference: AAPC CDEO study guide sample
27. Reasonable and necessary services risk area
Physicians may order any test they believe appropriate, including screenings, but Medicare pays only services meeting its definition of reasonable and necessary. This risk area includes advance beneficiary notices, certificates of medical necessity, and the danger of billing non-covered services as if covered.
Example: A physician appropriately orders a screening test Medicare will not cover; the practice issues an advance beneficiary notice beforehand so the patient can accept financial responsibility knowingly.
Mistake to avoid: Assuming clinical appropriateness equals Medicare coverage.
Reference: AAPC CDEO study guide sample
28. Choosing among RAC response options
After a recovery audit contractor finds an overpayment, the provider chooses among options. The discussion period, roughly days one through thirty, lets the provider submit information the contractor may reconsider. A rebuttal explains financial hardship, not the medical documentation. A redetermination is the first appeal, filed within thirty days to prevent offset on day forty-one.
Example: Unhappy with a recoupment, the provider submits additional records to the contractor during the discussion period; the contractor reviews them and reverses the overpayment decision.
Mistake to avoid: Using the rebuttal to re-argue documentation it was never designed to review.
Reference: AAPC CDEO study guide sample
29. The record validates the claim
Medical record documentation verifies that a claim for payment is accurate as submitted. The record validates the site of service, the appropriateness of the services provided, the accuracy of the billing, and the identity of the provider. When any element conflicts with the claim, the record, not the claim, controls.
Example: A claim shows a facility place of service while the note describes an office visit; the discrepancy is corrected from the record before resubmission.
Mistake to avoid: Relying on the claim form to prove what happened.
Reference: AAPC CDEO study guide sample
30. The formal chart audit cycle
An ongoing chart evaluation process is critical to a successful compliance program. A formal review with a report of findings has greater impact than case-by-case comments to providers. The extent and frequency of audits vary with practice needs, and more reviews over time reduce the likelihood of major problems.
Example: The practice runs a quarterly sample audit, issues a written findings report, and holds an education session; repeat audits show the flagged errors declining over time.
Mistake to avoid: Limiting feedback to informal hallway comments with no record.
Reference: AAPC CDEO study guide sample
Physician Queries and Provider Communication
31. Purpose and scope of the physician query
The physician query clarifies conflicting, ambiguous, or incomplete information about significant conditions or procedures in the patient's record. It is the compliant alternative to guessing, and it protects both the provider and the coder whenever the documentation cannot support a definitive code selection.
Example: One note section says diabetes while another says prediabetes; rather than picking one, the coder queries the provider to reconcile the conflicting statements.
Mistake to avoid: Guessing which of two conflicting statements is correct.
Reference: AAPC CDEO study guide sample
32. Conflicting documentation triggers a query
When medical record documentation conflicts, whether within one clinician's notes or between clinicians, the patient's provider must be queried for clarification. This applies to diagnoses and to laterality. Code assignment otherwise rests on the provider's documentation, with only narrow listed exceptions for data like BMI or coma scales.
Example: A therapist documents a left ankle sprain while the physician references right ankle pain; the physician is queried, because conflicting laterality cannot be resolved by preference.
Mistake to avoid: Letting another clinician's note silently override the provider's statement.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
33. Queries as ongoing education
Beyond obtaining clarification, the query serves as an educational tool that improves physician documentation over time and deepens coders' understanding of clinical scenarios. Answered queries are therefore feedback data worth tracking, not one-off paperwork to discard once the code is assigned.
Example: After repeated queries about undocumented laterality, the provider begins recording side consistently; trending the queries turned a recurring gap into a fixed habit.
Mistake to avoid: Discarding answered queries instead of trending them for education.
Reference: AAPC CDEO study guide sample
34. Maintaining an acronym and abbreviation list
Maintaining an acronym and abbreviation list reduces the documentation burden on providers and helps coders review documentation and assign correct codes. It converts ambiguous shorthand into a shared, verifiable vocabulary across the practice rather than a source of coding error.
Example: An unfamiliar abbreviation appears in a consult note; the coder resolves it through the practice's approved abbreviation list instead of assuming a meaning from context.
Mistake to avoid: Guessing an abbreviation's meaning from context.
Reference: AAPC CDEO study guide sample
35. Secure communication with providers
HIPAA regulations require a provider's office to use the best means possible to keep data secure, and that duty extends to routine communication with providers. Queries, audit findings, and record requests containing protected health information should travel through safeguarded channels with appropriate access controls.
Example: A query containing identifiable clinical details goes to the provider through the encrypted portal rather than a personal text message, keeping the exchange secure.
Mistake to avoid: Texting patient details over unsecured consumer apps.
Reference: AAPC CDEO study guide sample; HHS Summary of the HIPAA Privacy Rule
36. The five-step documentation mastery process
Mastering the documentation process means knowing the required documentation for each service rendered, educating providers to document as soon as possible, developing tools for consistency, following up with auditing, and educating providers and staff on requirements. The steps form a loop; auditing without education and tools never closes it.
Example: An audit reveals missing plan-of-care documentation, so the CDEO builds a template prompting the plan, educates the providers, and re-audits to confirm the fix held.
Mistake to avoid: Auditing without closing the loop with education and tools.
Reference: AAPC CDEO study guide sample
Quality Measures, Risk Adjustment, and Value-Based Care
37. The shift from volume to value
Reimbursement models are shifting from fee for service to quality of care and patient outcomes. This creates a need to efficiently communicate the quality of care provided and the outcomes associated with it, which is precisely the work product a documentation improvement program generates.
Example: A practice documents treatment response and revised diagnoses at every visit, so its quality reporting reflects actual outcomes rather than claim volume alone.
Mistake to avoid: Measuring CDI success only by dollars captured.
Reference: AAPC CDEO study guide sample
38. CMS Star Rating program context
The CMS Star Rating program is one of the quality frameworks a documentation expert encounters in the outpatient setting. Ratings of plan performance rest on measure data, and measure data ultimately rest on encounter documentation, so documentation gaps translate directly into missed or inaccurate quality performance.
Example: A measure depends on showing a chronic condition was assessed and managed; because the visit note documents the assessment, the encounter counts toward performance.
Mistake to avoid: Assuming quality ratings draw only from claims with no documentation behind them.
Reference: AAPC CDEO study guide sample
39. HEDIS as a plan measure framework
The Healthcare Effectiveness Data and Information Set is a widely used compendium of performance measures applied to health plans. Outpatient documentation of services, diagnoses, and results determines whether encounters satisfy those measures, making the record the upstream source of plan-level quality reporting.
Example: A documented service and supporting diagnosis make an encounter countable for a plan's measure set; the same service performed but poorly documented does not count.
Mistake to avoid: Assuming measure reporting needs no diagnosis documentation.
Reference: AAPC CDEO study guide sample
40. Quality Payment Program support role
The Quality Payment Program ties clinician payment to quality and performance rather than volume alone. The CDEO supports participation by ensuring documentation substantiates every reported measure, because performance reporting that outruns the record creates compliance exposure rather than just a score.
Example: Before submitting performance data, the practice verifies each reported measure is supported by the encounter notes, preventing a mismatch between submission and record.
Mistake to avoid: Treating quality reporting as a billing task separate from documentation.
Reference: AAPC CDEO study guide sample
41. Risk adjustment models and documentation accuracy
Risk adjustment models, including the CMS hierarchical condition category model for Medicare populations and the HHS model for commercial populations, rely on documented diagnoses to describe patient burden. The documentation expert's job is accuracy: capture what the provider documented, and query when chronic condition status is unclear.
Example: A chronic condition documented as actively assessed at the visit is reportable for risk adjustment; one mentioned only as historical context prompts a query rather than capture.
Mistake to avoid: Adding severity from lab values without provider documentation.
Reference: AAPC CDEO study guide sample
42. Distinguishing status and exposure from confirmed illness
Status and exposure codes differ fundamentally from codes for confirmed active illness. Asymptomatic HIV infection status, tobacco use versus tobacco dependence, and vaccination status codes all describe conditions or exposures, not disease. Coding active illness from a positive status or risk factor alone misstates the patient's condition.
Example: A record states the patient is HIV positive with no symptoms or related illness; the correct assignment is the asymptomatic status code, not the code for HIV disease.
Mistake to avoid: Coding active disease from exposure or positive status alone.
Reference: AAPC CDEO study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
Reimbursement Mechanics and Medical Necessity
43. The RBRVS framework and the relative value file
The resource-based relative value scale underlies physician payment, valuing services through relative value units rather than flat amounts. The Medicare fee schedule relative value file also carries practical intelligence for documentation work, including global surgery status indicators and the global days assigned to surgical codes.
Example: Before billing a postoperative visit, the coder checks the relative value file and sees the procedure carries ten global days, which changes what can be reported.
Mistake to avoid: Assuming a code's payment implies its global period; verify status.
Reference: AAPC CDEO study guide sample
44. Global surgery status indicators
Global surgery status indicators classify surgical codes. Zero-zero-zero means same-day values only; zero-one-zero adds a ten-day postoperative period; zero-nine-zero marks major procedures with a ninety-day package; triple-X means the global concept does not apply, as with E/M, lab, and imaging; unlisted, maternity, and add-on codes have their own indicators.
Example: A minor procedure carries a ten-day postoperative indicator, so the same-day evaluation and management visit is bundled and not separately payable.
Mistake to avoid: Billing a same-day E/M for a same-day-only procedure without distinct documented cause.
Reference: AAPC CDEO study guide sample
45. Billing inside and after the global period
Services inside a surgical global period are part of the package and not billed separately, though routine postoperative visits within the period can be recorded with the tracking code for internal purposes. Once global days expire, the CDEO must ensure follow-up services are billed and paid correctly again.
Example: A bone cyst aspiration carries ten global days; a follow-up on day fifteen is billed as a normal E/M, while one on day seven is tracked internally with the no-charge post-op visit code.
Mistake to avoid: Billing a standard E/M inside the window for routine post-op care.
Reference: AAPC CDEO study guide sample
46. Modifiers and NCCI edits
National Correct Coding Initiative edits exist to prevent payment that bundling rules prohibit. A modifier may allow separate reporting only when the documentation genuinely supports a distinct service or circumstance. Modifiers are documentation-driven tools, never automatic fixes applied whenever a claim denies.
Example: A claim rejects under an edit; the coder appends a modifier only after confirming the note documents a truly distinct, separately identifiable service, not merely to force payment.
Mistake to avoid: Appending a modifier automatically whenever a claim rejects.
Reference: AAPC CDEO study guide sample
47. Medical necessity caps the code level
Services coded on the volume of documentation rather than the medical necessity of services rendered lead to overpayment. Electronic record templates can generate text supporting a higher level than the encounter's necessity justifies, so the documented clinical picture, not the note's length, governs the final code.
Example: A template-heavy follow-up note could support a mid-level code, but the presenting problem and management warrant a lower level; the coder selects the lower level to match necessity.
Mistake to avoid: Letting template length, not necessity, pick the E/M level.
Reference: AAPC CDEO study guide sample
48. What counts toward time when reporting an E/M by time
When an E/M service is reported based on time, the counted provider time includes preparing to see the patient, reviewing the record, obtaining or reviewing history, performing the examination, counseling and educating the patient or caregivers, ordering medications or tests, communicating with other providers when not separately reported, documenting, independently interpreting results when not separately reported, communicating results, and coordinating care. Time must NOT be counted for any service that is reported separately, for travel, or for general teaching that is not required for the management of a specific patient.
Example: During a visit whose level will be selected by time, the provider also performs a separately reported skin biopsy; the minutes spent on the biopsy are excluded from the E/M time total, so the level is chosen from the remaining qualifying minutes alone.
Mistake to avoid: Counting separately reported procedure time toward the E/M time total.
Reference: AAPC CDEO study guide sample
Outpatient Diagnosis Coding Conventions
49. Index first, then Tabular verification
Code selection begins in the Alphabetic Index, locating the documented term and following its subterms, then verifying the code in the Tabular List. Beginning the search directly in the Tabular List leads to coding errors. The classification's own conventions and instructions take precedence over the general guidelines.
Example: The coder starts at the relevant main term, follows the subterms to a code, then verifies it in the Tabular List, applying any required additional characters before finalizing.
Mistake to avoid: Grabbing a plausible code directly from the Tabular List.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
50. First-listed diagnosis selection
Outpatient settings use the first-listed diagnosis in place of the principal diagnosis used inpatient. The coding conventions and the general and chapter-specific guidelines take precedence over the outpatient guidelines when determining it, so the reason for the encounter leads unless a specific rule directs otherwise.
Example: A patient presents for a wart removal with stable hypertension also noted; the wart reason is sequenced first and the chronic condition follows as an additional diagnosis.
Mistake to avoid: Sequencing a stable chronic condition above the encounter's reason.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
51. Uncertain diagnoses in outpatient coding
When no definitive diagnosis is established by the end of an outpatient encounter, codes for the documented signs and symptoms are reported in lieu of a diagnosis. This contrasts with inpatient rules for uncertain diagnoses, so setting determines whether a suspected condition can be coded as if confirmed.
Example: The note lists possible pneumonia with imaging pending; the coder reports the documented cough and fever rather than pneumonia, because confirmation did not occur by visit end.
Mistake to avoid: Coding the suspected condition as confirmed in an outpatient record.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
52. Outpatient surgery first-listed rule
For outpatient surgery, the reason for the surgery is coded as the first-listed diagnosis even when the surgery is not performed due to a contraindication. When complications after outpatient surgery lead to observation, the surgical reason is still reported first, followed by the complications as secondary diagnoses.
Example: Same-day surgery is cancelled because of uncontrolled hypertension; the condition that prompted the surgery is still sequenced first, with the cancelling condition secondary.
Mistake to avoid: Dropping the surgical reason when the operation is cancelled.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
53. Laterality from other clinicians' documentation
When the patient's provider does not document laterality, code assignment for the affected side may be based on documentation from other clinicians involved in the care. If documentation conflicts about the side, the provider is queried. Unspecified-side codes should rarely be used, only when clarification is impossible.
Example: The provider documents knee pain without a side, but the therapy note clearly records the right knee; the right knee code is assigned from that supporting documentation.
Mistake to avoid: Defaulting to unspecified side when another clinician documented it.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
54. The with convention presumes linkage
The words with or in, appearing in a code title, index entry, or tabular note, mean associated with or due to, and the classification presumes a causal relationship between the linked conditions. They are coded as related even without explicit provider linkage, unless the documentation clearly states they are unrelated or a specific guideline requires documented linkage.
Example: The index links a documented condition pair with the word with; the coder assigns the combination as related even though the provider never wrote an explicit causal statement.
Mistake to avoid: Requiring the provider to write due to when the classification already presumes the link.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Clinical Conditions and Chapter-Specific Coding
55. Neoplasm behavior and histology-first lookup
Neoplasm coding requires the record to state whether the lesion is benign, in situ, malignant, or of uncertain behavior, and to identify any metastatic site. When histology is documented, reference that cell type first in the main index rather than going straight to the Neoplasm Table, then select the correct column.
Example: A biopsy confirms basal cell carcinoma of the nasal tip in a patient with a prior thigh lesion; the current site-specific carcinoma code is assigned along with the personal history code for the earlier skin cancer.
Mistake to avoid: Picking a Neoplasm Table column without documented histologic behavior.
Reference: AAPC CDEO study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
56. Active malignancy versus personal history
A primary malignancy still present or still being treated is coded as existing. A personal history code replaces it only when the malignancy was excised or eradicated, no further treatment is directed to that site, and no evidence of existing primary malignancy remains. Whether a drug is prophylactic versus treatment affects the decision.
Example: A patient previously excised malignancy is still receiving treatment directed at that site; the current malignancy code applies, not the personal history code, because treatment continues.
Mistake to avoid: Switching to history status while treatment is still directed to the site.
Reference: AAPC CDEO study guide sample
57. HIV disease versus asymptomatic status
Only confirmed HIV cases are coded, and confirmation means the provider's diagnostic statement, not necessarily serology. Documented HIV disease, AIDS, or any related illness is coded as HIV disease and remains so forever after. Asymptomatic positive status gets the status code, and inconclusive serology gets its own code; the three are never interchangeable.
Example: The record states HIV positive, asymptomatic, managed on antiretroviral medication; the asymptomatic status code is assigned with a long-term drug therapy code, not the HIV disease code.
Mistake to avoid: Assigning the HIV disease code to an asymptomatic positive-status patient.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
58. Urosepsis and severe sepsis documentation
The term urosepsis is nonspecific, is not considered synonymous with sepsis, and has no default code, so the provider must be queried. Severe sepsis coding requires the underlying infection code, the severe sepsis code, and codes for associated acute organ dysfunction; dysfunction not clearly associated with the sepsis means the severe code is not assigned and the provider is queried.
Example: A provider documents urosepsis with no further detail; the coder queries for the intended meaning rather than assigning a sepsis code from the nonspecific term.
Mistake to avoid: Treating urosepsis as synonymous with sepsis.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
59. Sequencing pain codes against site codes
When the encounter is for pain control or pain management, the category G89 pain code is sequenced first, followed by the site code. For encounters with other purposes and no confirmed related diagnosis, the site code comes first, then the pain code. Routine expected postoperative pain immediately after surgery is not coded, and unspecified postoperative pain defaults to acute.
Example: The visit is solely for managing chronic low back pain; the chronic pain code from the pain category is sequenced first, followed by the code identifying the pain site.
Mistake to avoid: Sequencing the site code first during a pain-management encounter.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
60. Acceptable use of sign, symptom, and unspecified codes
Sign, symptom, and unspecified codes have acceptable and even necessary uses. Each encounter is coded to the level of certainty known at that encounter; when clinical information is insufficient for a specific code, the unspecified code best reflects what is known. Selecting unsupported specific codes or ordering unnecessary testing to force specificity is inappropriate.
Example: Pneumonia is diagnosed but the type is not established; the unspecified pneumonia code is assigned rather than guessing a bacterial organism the record never documents.
Mistake to avoid: Selecting a specific code the record does not support.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
References and further reading
Source links checked on Oct 2, 2026.