Work through the ten groups in order, because diagnosis conventions and E/M foundations support the later billing and compliance applications. Each concept pairs a rule with a resolved example and a common error, so quiz yourself by covering the example before reading the decision. Use current ICD-10-CM, CPT, and HCPCS Level II code books alongside this guide, since it teaches distinctions rather than listing codes. The concepts reflect family practice coding domains the CFPC exam tests, including incident-to, split/shared, and consultation rules.
ICD-10-CM Structure and Conventions
1. Verify Every Code in the Tabular List
Diagnosis selection starts with the main term in the Alphabetic Index, following every cross-reference and see-also entry, but the code is only confirmed in the Tabular List. Read footnotes, definitions, and instructional notes there completely before assigning, because the Index alone never finalizes a code.
Example: A coder locates a burn entry in the Index, follows it to the Tabular List, and finds a laterality instruction requiring clarification before the code becomes valid.
Mistake to avoid: Assigning a diagnosis code directly from the Alphabetic Index without Tabular List verification.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
2. Placeholder X Keeps Short Codes Valid
When a category requires a 7th character but the code has fewer than six characters, the placeholder X fills each empty position, as in the drug and chemical categories T36-T50. The X is mandatory; without it the code is invalid for reporting even if the other digits match.
Example: An adverse effect code with five characters and a required encounter extension needs an X inserted so the extension sits in the seventh position.
Mistake to avoid: Reporting a T-category code without the required X placeholders, producing an invalid code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
3. Seventh Characters Track Episode of Care
Certain categories, such as fractures, require a 7th character for the episode of care, and it must always occupy the seventh data-field position. Fracture coding also demands location, laterality, and displacement detail; if any element is undocumented, ask the provider rather than guessing, because specificity drives valid assignment.
Example: A wrist fracture note lacking displacement detail cannot be coded accurately, so the coder queries the provider instead of defaulting to displaced.
Mistake to avoid: Appending the episode-of-care character in the wrong position or dropping it when documentation is incomplete.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
4. Excludes1 Versus Excludes2 Notes
An Excludes1 note means the excluded code can never be reported with the code above it, typically because the conditions cannot coexist, such as congenital versus acquired forms. An Excludes2 note means the condition is not included here but may coexist, so both codes may be assigned when documented.
Example: A note barring the congenital form under an acquired-condition code directs the coder to assign only the congenital code for a birth-related case.
Mistake to avoid: Reporting both conditions together despite an Excludes1 note that prohibits the combination entirely.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
5. NEC Versus NOS Are Not Interchangeable
NEC, not elsewhere classifiable, points to an other specified code used when the provider documents a specific condition for which no unique code exists. NOS, not otherwise specified, is the equivalent of unspecified and is used only when documentation lacks the detail for anything more specific.
Example: A documented, distinctly named disorder with no dedicated code goes to the other specified entry, not to an unspecified placeholder.
Mistake to avoid: Treating NEC entries as unspecified codes and choosing them whenever documentation is vague.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
6. Includes Notes Define Category Content
An Includes note sits under a three-character category title to define or give examples of its content, while inclusion terms list conditions assignable to a code. These lists are not exhaustive; terms appearing only in the Alphabetic Index may still map to the code, so check both locations.
Example: A synonym for a skin condition appears only in the Index but still assigns to the same Tabular code as the listed inclusion term.
Mistake to avoid: Skipping Includes and inclusion terms and settling for a nearby less accurate code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Outpatient Diagnosis Selection and Sequencing
7. First-Listed Diagnosis Mirrors the Chief Complaint
In outpatient coding, the first-listed diagnosis is the condition chiefly responsible for the services, reflecting the chief complaint. Relevant coexisting diseases, related history, and family history are reported as additional diagnoses. Preexisting conditions are coded only when they identify the current reason for medical management.
Example: A visit primarily for diabetes management that also addresses stable hypertension sequences the diabetes code first, with hypertension as an additional diagnosis.
Mistake to avoid: Sequencing a chronic condition first when it was not the reason for the encounter.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
8. Uncertain Diagnoses Stay Uncoded in Outpatient
Terms like probable, suspected, possible, likely, rule out, consistent with, and compatible with do not support a diagnosis code in outpatient encounters. Code the highest certainty known: symptoms, signs, abnormal test results, or the documented reason for the visit, adding the confirmed diagnosis only after testing establishes it.
Example: A documented breast mass with suspected cancer yields a symptom code for the mass; the malignancy is coded only after confirmation.
Mistake to avoid: Reporting a suspected malignancy as if confirmed before pathology or provider establishment.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
9. Chronic Conditions Report at Every Treatment Encounter
Chronic diseases treated on an ongoing basis may be coded and reported as many times as the patient receives treatment or care for them. Report the chronic complaint only when it is treated or actively factors into the encounter's care, not merely because it appears somewhere in the history.
Example: Hypertension managed with a medication adjustment at today's visit is reported again, even though it appeared on last month's claim.
Mistake to avoid: Dropping an actively managed chronic diagnosis because it was reported on a prior claim.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
10. Code Coexisting Conditions That Affect Care
Code all documented conditions that coexist at the encounter and require or affect patient care, treatment, or management. Do not code conditions previously treated that no longer exist; history codes may serve as secondary codes when the past condition or family history influences current care.
Example: Long-resolved appendicitis from years ago is omitted, while controlled asthma that shapes today's antibiotic selection is reported as an additional diagnosis.
Mistake to avoid: Reporting historical, fully resolved conditions as though they currently exist and affect care.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
11. Interpreted Tests Drive Confirmed Diagnoses
For outpatient diagnostic tests already interpreted by a physician with the final report available at coding, report confirmed or definitive diagnoses documented in the interpretation, and do not add related signs and symptoms. When the test is normal, code the condition, symptom, or sign that necessitated the study.
Example: A positive interpreted study supports the finding code alone; a normal result keeps the symptom that prompted the test as the reason.
Mistake to avoid: Appending related symptom codes alongside a definitive diagnosis already documented in the interpretation.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
12. Postoperative Diagnosis Wins Over Preoperative
When both preoperative and postoperative diagnoses are documented and they differ, always report the postoperative diagnosis. The findings established during the procedure represent the highest certainty for that encounter, and the preoperative suspicion is superseded once the operative findings are recorded.
Example: A lesion suspected of malignancy preoperatively proves benign on excision, so the benign postoperative finding is the code reported instead.
Mistake to avoid: Sequencing the preoperative suspected diagnosis when the operative findings establish a different condition.
Reference: AAPC CFPC study guide sample
Acute, Chronic, and Special Diagnosis Rules
13. Acute-on-Chronic Sequencing Rule
When documentation describes a condition as both acute or subacute and chronic and no single code captures the combination, the ICD-10-CM instruction is to report the acute or subacute code first-listed with the chronic code secondary. The provider, not the coder, determines when a condition becomes chronic.
Example: A documented acute exacerbation superimposed on a chronic spine condition sequences the acute code first and the chronic code second.
Mistake to avoid: Sequencing the chronic code first when an acute exacerbation is separately documented.
Reference: AAPC CFPC study guide sample
14. Sequela Has No Time Limit
Sequela, or late effects, codes are usually reported as secondary diagnoses, with the current effect or reason for the visit primary. There is no time window after which late effects can or cannot occur; any residual effect documented at any point after the causal condition qualifies as a sequela.
Example: A patient seen years after an injury for a residual stiff joint reports the joint problem first and the sequela code second.
Mistake to avoid: Assuming late effects cannot be coded after an arbitrary period like ninety days or a year.
Reference: AAPC CFPC study guide sample
15. Cerebrovascular Sequela in Category I69
Neurologic deficits from cerebrovascular disease classify to category I69, indicating a condition from categories I60-I67 as the cause. Codes from I69 may accompany current I60-I67 codes when the patient has a present cerebrovascular accident plus deficits from an old one, capturing both the current event and the residuals.
Example: A patient with a new stroke and lingering weakness from a prior stroke reports both the current event code and the I69 residual code.
Mistake to avoid: Omitting the I69 residual code when an old deficit coexists with a current stroke.
Reference: AAPC CFPC study guide sample
16. Dominance Defaults for Hemiplegia Codes
Some I69 hemiplegia, hemiparesis, and monoplegia codes identify dominant or nondominant side. When dominance is unstated and the classification provides no default: ambidextrous patients default to dominant, left-side involvement defaults to nondominant, and right-side involvement defaults to dominant.
Example: Right-sided weakness in a patient whose handedness is never documented defaults to the dominant-side code per the guideline defaults.
Mistake to avoid: Leaving the code unfinished or guessing handedness when a guideline default applies.
Reference: AAPC CFPC study guide sample
17. Adverse Effect Is Not Poisoning
For an adverse reaction to a correctly administered substance, first report the manifestation caused by the drug, then a code from the Adverse Effect column of the Table of Drugs and Chemicals. An adverse effect is not a poisoning, so never select from the Poisoning column for this scenario.
Example: Nausea with vomiting after an antibiotic taken as directed sequences the manifestation code first, followed by the adverse effect code with extension.
Mistake to avoid: Selecting a poisoning code when the drug was taken exactly as prescribed.
Reference: AAPC CFPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
18. Integral Symptoms Versus Unrelated Ones
Signs and symptoms attributable to a definitive diagnosis should not be reported separately. Cite additional signs and symptoms only when they are not integral to the disease process, or when the provider documents reason to believe they arise from a separate, unrelated condition.
Example: Pneumonia with shortness of breath the physician attributes partly to a cardiac cause allows both the pneumonia and the symptom codes.
Mistake to avoid: Separately reporting symptoms that are classic, integral features of the already confirmed diagnosis.
Reference: AAPC CFPC study guide sample
Z Codes for Encounters and History
19. Z Codes as the Reason for Encounter
Z codes indicate a reason for an encounter or provide additional information about it, and they are usable in any healthcare setting. When the encounter is for a circumstance rather than a disease or injury, such as screening or counseling, the Z code serves as the first-listed diagnosis.
Example: A visit solely for contraceptive counseling lists the encounter-for-contraceptive-management code first, with no disease diagnosis at all.
Mistake to avoid: Burying a qualifying Z code in secondary positions when it is the visit reason.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
20. Routine Exams and Screening Encounters
For routine laboratory or radiology testing with no signs, symptoms, or associated diagnosis, assign the code for other specified special examinations. When routine testing accompanies a test evaluating a symptom or diagnosis, assign both the Z code and the code describing the reason for the non-routine test.
Example: A healthy patient's routine lipid panel pairs with a diabetes-related test, so both the routine encounter code and the diabetes code are reported.
Mistake to avoid: Dropping the routine encounter code when a non-routine test shares the same visit.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
21. Routine Prenatal Visits Use Supervision Codes
Codes for supervision of normal pregnancy are always first-listed on routine prenatal records and are not used with any other code from the obstetrics chapter. Weeks-of-gestation codes add detail but are not assigned for abortive outcomes, elective termination, or postpartum conditions.
Example: An uncomplicated prenatal checkup reports the normal-pregnancy supervision code first, adding a weeks-of-gestation code as supplementary information.
Mistake to avoid: Pairing a routine pregnancy supervision code with an OB chapter complication code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
22. Personal History Codes Support Monitoring
Personal history codes describe past conditions that no longer exist and receive no treatment but carry recurrence potential requiring monitoring. They may accompany follow-up codes, and any history code is acceptable on a record regardless of visit reason when it may alter the treatment ordered.
Example: A patient years past breast cancer treatment carries the personal history code secondary because surveillance shapes today's imaging decision.
Mistake to avoid: Coding a historical cancer as an active current malignancy during a surveillance encounter.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
23. Family History Pairs With Screening
Family history codes apply when a relative's disease raises the patient's own risk, and they pair naturally with screening codes to explain why a test or procedure is needed. The screening or other encounter reason is sequenced first, with the family history code as an additional diagnosis.
Example: A patient whose mother had breast cancer presents for screening; the screening reason is first-listed and family history is added.
Mistake to avoid: Sequencing the family history code ahead of the actual reason for the encounter.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
24. Genetic Carrier Versus Genetic Susceptibility
Genetic carrier status means the person carries a gene that may affect offspring without causing or risking the disease in the carrier. Genetic susceptibility means the person's own risk of developing the disease is increased; susceptibility codes generally should not lead the list, and a current condition sequences first.
Example: A patient who already has the associated disease reports the active condition first and the susceptibility gene code second.
Mistake to avoid: Confusing carrier status, which spares the patient, with susceptibility, which raises the patient's risk.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
E/M Leveling Foundations
25. Level by MDM or by Total Time
Office and other outpatient E/M levels are selected by either the level of medical decision making or the total time spent on the date of the encounter, chosen case by case. Whichever method is used, documentation must still support the medical necessity of the visit.
Example: A note showing moderate MDM but modest time is leveled by MDM, and the medical necessity is documented to support it.
Mistake to avoid: Mixing MDM elements and time elements together to manufacture a higher level.
Reference: AAPC CFPC study guide sample
26. History and Exam Do Not Set the Level
Current guidelines treat a medically appropriate history and physical examination, when performed, as included in the service. History and exam should still be documented, but they are not used in determining the code level for these E/M services; leveling rests on MDM or total time.
Example: An exhaustive review of systems cannot lift a visit to a higher code without corresponding MDM or time support.
Mistake to avoid: Leveling modern outpatient codes on exam breadth like the retired 1995 and 1997 guidelines.
Reference: AAPC CFPC study guide sample
27. Three Components Build the MDM Level
Medical decision making is measured across three components: the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications, morbidity, or mortality of patient management. Four MDM levels, straightforward through high, map to corresponding new and established patient codes.
Example: A straightforward problem with minimal data review and low risk yields straightforward MDM, mapping to the lowest detailed new-patient code.
Mistake to avoid: Deriving the MDM level from the final diagnosis alone instead of the three components.
Reference: AAPC CFPC study guide sample
28. Only Problems Addressed at the Encounter Count
For the number and complexity of problems, a problem counts only when it is addressed within that encounter. Read the entire note rather than relying on the chief complaint, because the full documentation reveals which conditions were genuinely assessed and analyzed during the visit.
Example: A note listing five chronic issues but actively managing only two counts just those two toward problem complexity.
Mistake to avoid: Counting every condition in the history section as a problem addressed today.
Reference: AAPC CFPC study guide sample
29. Acute Uncomplicated Illness Defined
An acute, uncomplicated illness or injury is a recent or newly developed short-term condition carrying low morbidity risk, little to no mortality risk with appropriate care, and expected full recovery without lasting functional impairment, such as a leg contusion or ankle sprain managed conservatively.
Example: An ankle sprain treated with rest, ice, compression, elevation, and over-the-counter analgesia fits the acute uncomplicated problem level.
Mistake to avoid: Assuming every acute injury or newly developed complaint automatically reaches moderate problem complexity.
Reference: AAPC CFPC study guide sample
30. Comorbidities Must Be Addressed to Count
Comorbidities and underlying diseases do not influence the E/M level unless they are addressed and their presence increases data complexity or management risk. A merely listed chronic illness is insufficient; documentation must show the provider addressed it or that it contributed to case severity. Multiple lower-severity problems may aggregate into higher risk through interaction.
Example: Diabetes appearing only in the past medical history adds nothing, but documented management that raises risk makes it count.
Mistake to avoid: Counting a chronic disease toward risk when the note merely lists its existence.
Reference: AAPC CFPC study guide sample
E/M Data Rules and Patient Status
31. Separately Billed Tests Do Not Count as Data
Whether a test counts toward the E/M data element depends on whether it is separately reportable. Ordering, performing, or interpreting a diagnostic test during the encounter does not count when the physician separately bills the professional interpretation; an in-office X-ray or ECG is presumed billed by the provider.
Example: A provider orders an office ECG whose interpretation is billed separately, so the order adds nothing to the data element.
Mistake to avoid: Counting every ordered or performed diagnostic test toward data regardless of separate reportability.
Reference: AAPC CFPC study guide sample
32. Results-Only Tests Can Count as Data
Tests that do not require separate interpretation, such as laboratory results-only tests like a rapid strep screen, can be counted as ordered or reviewed when they are analyzed as part of the medical decision making for the encounter.
Example: A rapid strep screen performed and analyzed during the visit counts toward the encounter's amount and complexity of data.
Mistake to avoid: Excluding results-only in-office tests from data because they lack an interpretation component.
Reference: AAPC CFPC study guide sample
33. Prior-Encounter Results Are Not New Data
During a follow-up visit, review of test results ordered at a prior encounter is not counted toward data, because that review was already included with the original order. Only tests whose ordering, performance, review, or analysis is new to this encounter contribute to the data element.
Example: Rechecking last week's imaging report at a follow-up adds nothing to today's data because it accompanied the original order.
Mistake to avoid: Counting a follow-up discussion of previously ordered test results as new data for today.
Reference: AAPC CFPC study guide sample
34. Code 99211 Sits Outside MDM Leveling
The minimal-level established patient office code is reported for services that typically do not require the presence of a provider, such as a clinical staff visit carried out under standing guidance. Because no provider presence is typical, the concept of medical decision making does not apply to this code.
Example: A nurse rechecks blood pressure per protocol without provider involvement, so the visit reports the minimal code without MDM analysis.
Mistake to avoid: Attempting to assign an MDM level or grid score to this minimal service code.
Reference: AAPC CFPC study guide sample
35. New Patient Status and the Specialty Twist
A new patient is one who has not received face-to-face services from the same physician or a same-specialty physician in the same group practice. If the patient sees a provider in the same group but a different specialty for the first time, the encounter is coded as new.
Example: A long-time patient of the group's family physician visits the group's cardiologist for the first time and is coded as new.
Mistake to avoid: Treating group practice affiliation alone as making every patient established to every provider.
Reference: AAPC CFPC study guide sample
36. Conditions Managed Elsewhere Need More Than a Mention
When a physician documents that another provider manages a condition, that condition does not count toward the visit level on the statement alone. It becomes countable only when documentation shows assessment or care coordination beyond the mere notation that it is being treated elsewhere.
Example: A note stating endocrinology manages the diabetes adds nothing, while documented coordination with that specialist counts toward leveling.
Mistake to avoid: Counting externally managed conditions toward complexity based on a one-line mention alone.
Reference: AAPC CFPC study guide sample
Physician, Practitioner, and Visit Billing Rules
37. Incident-To Requires Plan, Patient, and Presence
To bill a service incident-to a physician, the service must result from the physician's treatment plan for an established patient, and the physician must be present in the office suite providing supervision, though not necessarily in the room. The service is then billed under the physician.
Example: An established patient's planned follow-up with the physician assistant, with the physician elsewhere in the office, bills under the physician.
Mistake to avoid: Billing incident-to when the physician is out of the office seeing patients at the hospital.
Reference: AAPC CFPC study guide sample
38. Incident-To Stops at the Facility Door
Incident-to billing is not recognized in a facility setting. It applies in the office or clinic environment where direct physician supervision within the suite is possible; when the same clinical staff services occur in a facility, different rules govern and incident-to cannot be used.
Example: A physician assistant seeing a patient in a hospital outpatient department cannot have the service billed incident-to the physician.
Mistake to avoid: Applying office incident-to supervision rules to services performed in a facility setting.
Reference: AAPC CFPC study guide sample
39. Split or Shared Visits Belong to Facilities
A shared or split visit occurs when a non-physician practitioner and a physician both participate in the same patient case in a facility setting; it does not apply in the office. The service is billed by whoever performs the substantive portion: more than half the total time, or two of three MDM elements.
Example: The non-physician practitioner documents over half the visit time in a facility encounter, so the service bills under that practitioner.
Mistake to avoid: Applying split-shared rules in the office instead of switching to incident-to requirements.
Reference: AAPC CFPC study guide sample
40. Consultations Demand Three Documented Elements
Under CPT guidelines, a consultation requires a request from a physician or other qualified source, a service to recommend care for a specific problem or to determine responsibility for ongoing management, and a written report back to the requester. If any element is missing, a consultation code cannot be used.
Example: A referral evaluation with no documented report back to the requesting provider is coded as a regular office visit instead.
Mistake to avoid: Coding a consultation when the written report back to the requester is absent.
Reference: AAPC CFPC study guide sample
41. Medicare Consultation Policy Versus CPT
CMS no longer reimburses consultation codes, directing office and outpatient E/M codes or hospital care codes instead when the patient is a Medicare beneficiary. Do not assume Medicare coverage from age alone; on the exam, Medicare status appears in the case note or question, otherwise follow CPT guidelines.
Example: A case note identifying a Medicare beneficiary converts an apparent consultation into an office or hospital care E/M selection.
Mistake to avoid: Assuming every older patient carries Medicare and applying CMS consultation policy uninvited.
Reference: AAPC CFPC study guide sample
42. Billable Documentation Is Legible, Attributable, and Necessary
Before any billing question is reached, three verification principles determine whether a note can support the claim: it must be legible to someone other than the documenting provider and their staff; the date of service, the patient's name, and the provider's name must be easily demonstrated; and the documentation must support the nature of the visit and the medical necessity of the services rendered. These principles exist so that credit for the service can be thoroughly verified, and a note failing any one of them leaves the billed service unverifiable regardless of the care delivered.
Example: A nurse practitioner's encounter note is written in shorthand only she can read and omits the date of service, so the visit cannot be verified for billing until the documentation is corrected, even though the care itself was appropriate.
Mistake to avoid: Billing from a note that only its author can decipher or that fails to identify the date of service, patient, and provider of service.
Reference: AAPC CFPC study guide sample
CPT Procedures, Modifiers, and the Global Package
43. Sequence Multiple Procedures by Work Value, Yielding to Code-Specific Notes
When multiple procedures are performed in one session, the reporting convention is to sequence the most complex or labor-intensive procedure first, operationalized by comparing relative value units and listing the code with the highest value first. This is a general ordering convention rather than an absolute rule: parenthetical instructions and other code-specific directions in the CPT book govern particular code pairs and take precedence where they apply, including restrictions on codes that may only be reported with, or in addition to, another primary procedure. Compare the codes' relative values in the code book rather than listing procedures in the order performed.
Example: A note documents excision of a soft-tissue lesion from the shoulder followed by an intermediate layered repair; the repair code carries the higher relative value, so it is listed first and the excision second, after the coder confirms that no parenthetical note directs a different order or restricts separate reporting for that specific pair.
Mistake to avoid: Sequencing procedure codes in the chronological order the surgeon performed them, or letting the relative-value convention override a parenthetical or code-specific instruction that governs the pair.
Reference: AAPC CFPC study guide sample
44. Modifier 51 Flags the Additional Procedure
After sequencing the highest-RVU procedure first, append the multiple-procedure modifier to subsequent procedure codes to indicate that additional procedures were performed during the same session. The modifier attaches to the lower-valued, later-listed procedures, not the first-listed primary one.
Example: In the excision-plus-repair scenario, the multiple-procedure modifier goes on the second-listed excision code, not the leading repair code.
Mistake to avoid: Appending the multiple-procedure modifier to the first-listed highest-valued code instead of subsequent ones.
Reference: AAPC CFPC study guide sample
45. Diagnoses and Procedures Sequence by Different Logics
A claim carries two independent ordering systems. Diagnosis codes are sequenced by significance: the first-listed diagnosis describes the most significant reason for the visit, reflecting the chief complaint, with coexisting conditions reported secondarily. Procedure codes are sequenced by work: the most complex or labor-intensive procedure, operationalized as the highest Relative Value Units, is listed first. Cross-applying the two logics, ordering procedures by the reason for the visit or diagnoses by complexity, produces a wrongly ordered claim.
Example: A claim pairs a laceration repair with a foreign-body removal whose RVU value is higher; the removal is listed first even though the lacerature is what brought the patient in, and the laceration diagnosis still leads the diagnosis list.
Mistake to avoid: Sequencing procedure codes by the importance of the patient's reason for the visit instead of by relative value.
Reference: AAPC CFPC study guide sample
46. Cerumen Removal Requires Documented Impaction
Parenthetical instructions for the ear-cerumen removal codes require that the cerumen be impacted. When impaction is not documented, report an E/M service code instead of the removal procedure, because the parenthetical condition for the procedure code has not been met.
Example: A note describing simple ear wax removal without the word impacted supports only an E/M code, not the procedure code.
Mistake to avoid: Reporting the cerumen removal procedure code when impaction is absent from the note.
Reference: AAPC CFPC study guide sample
47. Specimen Collection Is Separate From the Lab's Testing
When venipuncture is performed in the office and the specimens are sent to an outside laboratory, the office's service is the collection, and it is reported with the venipuncture code; the outside laboratory performs and reports the testing itself. What is reported follows from what the documentation shows was performed and by whom. Whether any particular payer separately reimburses the collection or bundles it with the E/M service is a payment policy question, distinct from the coding decision of which services to report.
Example: A patient seen for fatigue has blood drawn in the office for panels sent to a reference laboratory; the encounter reports the office visit together with the venipuncture code for the draw, while the reference laboratory reports the laboratory panels it ran.
Mistake to avoid: Omitting the venipuncture code because a payer bundles it with the E/M, conflating payment policy with the documented services actually performed.
Reference: AAPC CFPC study guide sample
48. Same-Day Return Visits Must Stand Alone
When a patient returns to the office on the same date of service, each encounter's documentation must independently support what is billed, because individual dates of service stand on their own. The second visit is judged from its own note, not merged with the morning record.
Example: A morning upper-respiratory visit and an afternoon return for a new laceration are evaluated as two separately documented encounters.
Mistake to avoid: Merging same-day notes into one claim without distinct documentation for each service.
Reference: AAPC CFPC study guide sample
Medicare Policy, Compliance, and Ethics
49. Code Only What the Documentation States
Compliant coding selects codes only from what is apparent in the available documentation; extrapolating or assuming information is prohibited. Each code assigned must be supported by documentation linked to that claim, because individual dates of service stand alone. A condition the provider never characterized as acute cannot be coded as acute, no matter how strongly the presentation suggests it.
Example: A note documents back pain with no characterization of onset; the coder may not select an acute injury code for this encounter, even though the coder believes the injury is recent, because acuity is not documented.
Mistake to avoid: Adding acuity, severity, or another qualifying detail to a diagnosis code that the documentation never states.
Reference: AAPC CFPC study guide sample
50. Default to CPT Unless Medicare Is Stated
On the exam, individual payer rules are not a consideration unless the case note or question specifically states the patient is covered by Medicare. Absent that statement, follow CPT coding guidelines, and never infer Medicare coverage from the patient's age or the care setting.
Example: A case silent on payer type is coded purely by CPT guidelines, even when the patient happens to be elderly.
Mistake to avoid: Importing Medicare payment policy into exam cases that never identify the payer.
Reference: AAPC CFPC study guide sample
51. Business Associate Agreements Guard Outsourced PHI
A business associate is a person or organization outside the covered entity's workforce that performs functions or activities on the entity's behalf involving individually identifiable health information, such as claims processing, data analysis, utilization review, or billing. When a covered entity uses such a contractor, the Privacy Rule requires a business associate agreement imposing specified written safeguards, and the entity may not contractually authorize the associate to make any use or disclosure of protected health information that would violate the Rule.
Example: A family practice that outsources billing to a claims-processing vendor must have a business associate agreement imposing written safeguards before records flow; the contract cannot permit the vendor to use patient data for its own marketing, because that would exceed what the Privacy Rule allows.
Mistake to avoid: Sending records to an outside billing or claims-processing vendor with no business associate agreement imposing written safeguards.
Reference: HHS Summary of the HIPAA Privacy Rule
52. Deliver the Notice of Privacy Practices at First Contact
A covered provider with a direct treatment relationship must furnish its privacy practices notice no later than the first service encounter: by personal delivery at patient visits, by automatic and contemporaneous electronic response for electronic service delivery, or by prompt mailing for telephonic delivery. The notice must also be posted in a clear and prominent place at each service delivery site and supplied to anyone on request. The provider must make a good-faith effort to obtain the patient's written acknowledgement of receipt and document the reason for any failure to obtain it.
Example: A new patient receives the notice by hand at check-in and signs the acknowledgement; a second patient refuses to sign, so the practice documents that refusal rather than leaving the record silent about the attempt.
Mistake to avoid: Furnishing the notice only when a patient asks for it, or failing to document why an acknowledgement was not obtained.
Reference: HHS Summary of the HIPAA Privacy Rule
53. Accounting of Disclosures Excludes Routine Flows
Individuals have the right to an accounting of disclosures of their protected health information by the covered entity or its business associates, covering the six years immediately preceding the request. The accounting excludes disclosures for treatment, payment, and health care operations, disclosures to the individual or a personal representative, disclosures made pursuant to an authorization, and the other categories the Rule lists, so what the accounting captures is disclosures falling outside routine care and billing flows.
Example: A patient requests an accounting; the six-year lookback must include the disclosure made to a public health authority during a communicable disease investigation, while the routine claims submitted to his insurer are excluded as payment disclosures.
Mistake to avoid: Filling the accounting with routine payer claims submissions, or denying the request on the ground that nearly all disclosures were routine.
Reference: HHS Summary of the HIPAA Privacy Rule
54. Ethical Coding Practice and the Coder's Duty
The AAPC Member Code of Ethics binds members to integrity, respect, commitment, competence, fairness, and responsibility. Practically, this means coding only what documentation supports, refusing to extrapolate or assume information, and maintaining accurate reporting even under revenue pressure; violations can cost membership.
Example: Asked to upcode a visit to boost reimbursement, the coder declines and reports the level the documentation actually supports.
Mistake to avoid: Adjusting code levels toward revenue goals rather than to the documented facts.
Reference: AAPC CFPC study guide sample
HIPAA Privacy in the Family Practice
55. Who Is a Covered Entity
The Privacy Rule applies to health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard HIPAA transactions, such as claims and eligibility inquiries. Using email alone does not make a provider covered; the transmission must involve a standard transaction.
Example: A small family practice submitting electronic claims is a covered entity even though a solo paper-only practice may not be.
Mistake to avoid: Assuming only hospitals and large institutions fall under Privacy Rule coverage requirements.
Reference: HHS Summary of the HIPAA Privacy Rule
56. PHI Spans Every Medium
Protected health information is individually identifiable health information held or transmitted in any form: electronic, paper, or oral. It includes demographic data relating to health, care, or payment that identifies the individual, while employment records kept as an employer and certain education records are excluded.
Example: A hallway conversation naming a patient and diagnosis is protected information exactly like the electronic chart entry.
Mistake to avoid: Believing verbally shared patient details fall outside privacy protections because they are not written.
Reference: HHS Summary of the HIPAA Privacy Rule
57. Minimum Necessary Limits Each Disclosure
Covered entities must make reasonable efforts to use, disclose, and request only the minimum protected health information needed for the purpose, and may not send an entire medical record unless the whole record is specifically justified. The standard does not apply to treatment disclosures, individual access, authorized uses, or legally required disclosures.
Example: A payment request needing one lab result is not satisfied by transmitting the entire chart without specific justification.
Mistake to avoid: Routinely releasing entire records for routine payment requests without any specific justification.
Reference: HHS Summary of the HIPAA Privacy Rule
58. Treatment, Payment, and Operations Need No Authorization
A covered entity may use and disclose protected health information without individual authorization for its own treatment, payment, and health care operations, and may disclose for other providers' treatment, other entities' payment, and qualifying operations. Written consent for these purposes is optional under the Privacy Rule.
Example: Submitting a claim to the payer for today's visit requires no patient authorization because it is a payment activity.
Mistake to avoid: Demanding signed patient authorization before every routine claim submission or treatment coordination.
Reference: HHS Summary of the HIPAA Privacy Rule
59. Authorization Gates Marketing and Psychotherapy Notes
Written authorization is required for uses outside permitted categories, including disclosures to life insurers, employers for pre-employment physicals, and pharmaceutical marketing. Psychotherapy notes carry heightened protection, with most treatment, payment, and operations uses requiring authorization, though limited exceptions exist for the originator's own treatment and legal defense.
Example: Releasing the results of a pre-employment physical to the requesting employer requires the individual's written authorization beforehand, unlike treatment uses.
Mistake to avoid: Releasing psychotherapy notes under ordinary payment or operations rules without specific authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
60. Minors, Parents, and Personal Representatives
A personal representative is treated as the individual for privacy purposes, and parents generally serve as personal representatives for minor children. Exceptions exist where the parent may be abusing the minor or where state law limits parental access; when state law is silent, access decisions rest with professional judgment.
Example: A parent requesting a minor's records in an area governed by a state-law exception is handled under that law, not automatic access.
Mistake to avoid: Granting or denying parental record access without ever checking applicable state-law exceptions.
Reference: HHS Summary of the HIPAA Privacy Rule
References and further reading
Source links checked on Oct 2, 2026.