This guide organizes 60 teaching concepts into ten ordered topics, moving from ICD-10-CM conventions through E/M leveling, modifiers, orthopedic procedure coding, and HIPAA privacy. Work through the groups in sequence, because later application assumes earlier foundations. Each concept pairs a rule with a short resolved example and a common error so you can self-check as you go. Use it alongside your current-year code books and the official guidelines; it supplements, and does not replace, official study materials or hands-on coding experience.
ICD-10-CM Structure and Conventions
1. Index-First, Tabular-Verified Workflow
Begin every diagnosis search with the main term in the Alphabetic Index, following all cross-references, then verify in the Tabular List where laterality, notes, and seventh-character requirements live. Never finalize a code from the Index alone, because the Tabular List carries instructions the Index omits.
Example: A coder locates a femur fracture in the Index, then finds a required episode-of-care seventh character in the Tabular List before finalizing the code.
Mistake to avoid: Assigning a code directly from the Alphabetic Index without Tabular List verification.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
2. Placeholder X for Seventh-Character Codes
When a code that requires a seventh character has fewer than six characters, placeholder X characters fill the empty positions so the seventh character stays in position seven. Omitting the placeholder makes the code invalid for reporting purposes.
Example: A short injury category code needing an episode character is reported with X placeholders filling the empty middle positions so the seventh character lands correctly.
Mistake to avoid: Omitting required X placeholders and submitting an invalid code string.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
3. NEC Versus NOS Abbreviations
NEC in the Alphabetic Index directs you to an other-specified code when no unique code exists for a documented condition; NOS is the equivalent of unspecified. Choose other-specified when documentation contains detail lacking a dedicated code, and unspecified only when detail is genuinely absent.
Example: A documented atypical tear pattern with no exact code maps to an other-specified code rather than an unspecified one, because the provider documented detail.
Mistake to avoid: Defaulting to unspecified codes when an other-specified code matches documented detail.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
4. Acute Versus Chronic Default
Acute means sudden onset or short term; chronic means long duration and possibly recurring. The provider determines when a condition becomes chronic. If documentation does not specify acuity, the default diagnosis is chronic, and coders must not assume otherwise.
Example: A rotator cuff tear documented without acuity is coded as chronic even when the coder suspects recent injury, because acuity was never documented.
Mistake to avoid: Assigning an acute code by inferring acuity from the injury narrative.
Reference: AAPC COSC study guide sample
5. Guideline Sections and Their Settings
Section I holds conventions and chapter-specific rules, Section II defines principal diagnosis for non-outpatient settings, Section III governs additional diagnoses, and Section IV covers outpatient reporting. Knowing which section applies prevents mixing inpatient and outpatient rules on the same encounter.
Example: Choosing a first-listed diagnosis for a clinic visit follows Section IV outpatient rules, not the principal-diagnosis definition used for hospital inpatients.
Mistake to avoid: Applying inpatient principal-diagnosis rules to an office encounter.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
6. Highest Specificity and Full Characters
Assign every code to the highest level of specificity documentation supports, using the full number of required characters. Wrist and hand fractures, for example, need characters for site, laterality with displacement status, and episode of care; missing elements make proper selection impossible and warrant provider education.
Example: A documented displaced right distal radius fracture at initial encounter is coded to full specificity rather than a generic forearm fracture code.
Mistake to avoid: Stopping at a shorter code when documentation supports additional characters.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
Musculoskeletal and Injury Diagnosis Coding
7. Traumatic Versus Nontraumatic Fractures
Sudden injury or accident causes a traumatic fracture, while repetitive stress over time produces nontraumatic fractures, including pathologic and stress fractures. The two families follow different index paths and codes, so the documented mechanism drives selection.
Example: A runner with gradually worsening tibial pain and a documented stress fracture is coded nontraumatically, not as a fall-related injury, because onset was repetitive.
Mistake to avoid: Coding every fracture as traumatic simply because an injury visit occurred.
Reference: AAPC COSC study guide sample
8. Episode-of-Care Seventh Character
Orthopedic injury codes carry a seventh character for episode of care. Routine healing follow-up and rehabilitation after active treatment use the subsequent-encounter character rather than the initial one, reflecting the stage of management documented for that date.
Example: A patient returns for routine follow-up of a closed left distal radius fracture that is healing normally after casting; the encounter takes the subsequent-encounter routine-healing character rather than the initial-encounter character.
Mistake to avoid: Reporting initial-encounter characters for routine healing or rehab visits.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
9. Laterality Completed Only in the Tabular List
Complete laterality and any applicable seventh character can only be selected in the Tabular List. A dash after an Index entry signals that more characters are required, but even without a dash you must check the Tabular List to confirm no additional character applies.
Example: An Index entry for a knee condition lacking a dash still reveals a required laterality character once the Tabular List entry is opened.
Mistake to avoid: Assuming no dash in the Index means the code is complete as printed.
Reference: AAPC COSC study guide sample
10. Pain Encounters: G89 Sequencing Depends on Visit Purpose
When the encounter is for pain control or pain management, assign the category G89 pain code first, followed by the code identifying the specific site of pain. When the encounter is for any other reason and no related definitive diagnosis has been established by the provider, assign the specific site-of-pain code first, followed by the appropriate G89 code. The stated purpose of the encounter, not the mere presence of pain, sets the sequence.
Example: A visit held specifically to manage chronic knee pain from a documented prior injury sequences the category G89 pain code first, followed by the knee-pain site code; a general knee encounter with no confirmed diagnosis sequences the site-of-pain code first, followed by the G89 code.
Mistake to avoid: Sequencing the site-of-pain code first on a visit held specifically for pain management.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
11. Aftercare Codes Versus Active Injury Codes
When the condition treated no longer exists, an aftercare code, such as following joint replacement, is sequenced first for rehabilitation encounters. When rehabilitation follows active treatment of an injury, the injury code with the appropriate subsequent seventh character is sequenced first instead.
Example: Rehabilitation after a knee replacement for osteoarthritis sequences the joint-replacement aftercare code first; rehabilitation after operative treatment of a tibial shaft fracture sequences the fracture code with its subsequent-encounter character first.
Mistake to avoid: Using aftercare codes for rehabilitation following an injury.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
12. Device-Related Pain Versus Routine Postoperative Pain
Pain attributed to an orthopedic implant or graft follows the guideline for pain due to devices, distinguishing it from routine postoperative pain. Expected postoperative pain immediately after surgery should not be coded at all; only documented device-related or complication-linked pain is reportable.
Example: Documented persistent pain from fracture hardware is coded as pain due to a device, while expected incisional pain immediately after surgery is not coded.
Mistake to avoid: Coding routine expected postoperative pain as a device complication.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Outpatient Diagnosis Selection and Sequencing
13. First-Listed Diagnosis Selection
In outpatient coding, the first-listed diagnosis describes the most significant reason for the visit or procedure, reflecting the chief complaint. Relevant coexisting diseases, related history, and family history conditions are reported as secondary diagnoses, and resolved conditions are dropped.
Example: A visit for knee pain evaluation lists knee pain first, with long-standing hypertension managed elsewhere reported second.
Mistake to avoid: Sequencing a chronic background condition ahead of today's reason for the encounter.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
14. Uncertain Diagnoses in Outpatient Claims
In outpatient settings, diagnoses described as probable, possible, suspected, likely, rule out, consistent with, or compatible with are not coded. Report the highest level of certainty known, using codes for documented signs, symptoms, and abnormal test results instead.
Example: A shoulder mass suspected of being a tumor before biopsy is coded as the mass, not as a neoplasm, until pathology confirms the diagnosis.
Mistake to avoid: Reporting a suspected diagnosis as confirmed on an outpatient claim.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
15. Inpatient Uncertain-Diagnosis Contrast
For inpatient admissions to short-term, acute, long-term, or psychiatric hospitals, uncertain discharge diagnoses qualified as probable, suspected, or questionable are coded as if established, based on the workup and treatment given. This rule never applies to outpatient encounters, where uncertainty stays uncoded.
Example: A hospitalized patient discharged with suspected septic arthritis has it coded as confirmed, while the same suspicion in clinic would yield symptoms only.
Mistake to avoid: Applying the inpatient uncertain-diagnosis rule to outpatient visits.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
16. Postoperative Diagnosis Preference
When preoperative and postoperative diagnoses differ, report the postoperative diagnosis because it is the most definitive. For ambulatory surgery, code the diagnosis for which the surgery was performed, updating to the confirmed postoperative finding when it is known at coding.
Example: A shoulder arthroscopy preoperatively listed as a rotator cuff tear but postoperatively documented as a tear plus a superior labral tear is coded from the postoperative findings.
Mistake to avoid: Coding the preoperative diagnosis when the operative note documents different postoperative findings.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
17. Test Interpretation Replaces Symptoms
For outpatient diagnostic tests interpreted by a physician with the final report available at coding, report the confirmed or definitive diagnoses documented in the interpretation and do not add related signs and symptoms. When a test is normal, code the condition, sign, or symptom that necessitated the study.
Example: An elbow MRI confirming a full-thickness distal biceps tendon tear is coded as the tear; the presenting elbow pain and weakness are not separately reported.
Mistake to avoid: Reporting both the confirmed imaging finding and its integral presenting symptoms.
Reference: AAPC COSC study guide sample
18. Chronic Conditions Reported Only When Active
Report a chronic condition only when it is treated at the encounter or becomes an active factor in the patient's care. Do not report conditions that no longer exist or that do not pertain to the current visit, even when they appear in the historical record.
Example: A patient's long-resolved ankle sprain is not reported at a shoulder visit, while diabetes requiring medication review is reported.
Mistake to avoid: Listing every historical condition regardless of relevance to today's encounter.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
E/M Documentation Foundations
19. History and Exam Do Not Set the Level
Under the current AMA guidelines, a medically appropriate history and examination are performed and documented but are not used to determine the office visit level. Leveling rests on medical decision making or total time, so exam breadth alone cannot raise a code.
Example: An extensive history and full exam supporting only a straightforward decision process yields a straightforward-level code, not a higher one.
Mistake to avoid: Leveling office visits by exam breadth under retired 1995 or 1997 documentation rules.
Reference: AAPC COSC study guide sample
20. Two Leveling Methods: MDM or Total Time
Select the E/M level using either the level of medical decision making defined for the service or the total time for services performed on the encounter date. The provider may choose the method case-by-case, and documentation must support whichever element is used.
Example: A visit with modest decision making but substantial same-day record review and care coordination may qualify by total time instead of MDM.
Mistake to avoid: Mixing elements of both methods to inflate a single level.
Reference: AAPC COSC study guide sample
21. Medical Necessity Governs Every Level
Regardless of whether MDM or total time supports the level, documentation must support the medical necessity of the visit. Payers may also regulate when MDM or total time may be used, so the supporting element and the necessity story must both hold up.
Example: A time-supported high-level visit lacking any documented reason for that intensity is vulnerable on review despite meeting the time threshold.
Mistake to avoid: Assuming a met time or MDM threshold alone justifies the billed level.
Reference: AAPC COSC study guide sample
22. Code 99211 Has No MDM Concept
Code 99211 describes services that typically do not require the presence of a provider, so the concept of medical decision making does not apply to it. This separates clinical-staff-driven minimal visits from physician or qualified-health-professional decision making.
Example: A nurse removing sutures per established orders with no provider assessment is reported with 99211, which carries no MDM level.
Mistake to avoid: Attempting to assign an MDM level to code 99211.
Reference: AAPC COSC study guide sample
23. Legibility and Identification Requirements
Documentation must be legible to someone other than the documenting provider and staff, and must readily demonstrate the date of service, the patient's name, and the provider's name. It must also support the nature of the visit and the medical necessity of services rendered.
Example: An unsigned, undated progress note fails basic verification even when its clinical content would otherwise support the billed service.
Mistake to avoid: Accepting notes lacking date, patient, or provider identification.
Reference: AAPC COSC study guide sample
24. New Versus Established Patient Code Mapping
Office visit codes divide by patient status: new patients map to 99202 through 99205 and established patients to 99212 through 99215. Each MDM level pairs across the two families, so patient status must be resolved before applying the leveling grid.
Example: A moderate-complexity decision for an established patient maps to 99214, while the same MDM for a new patient maps to 99204.
Mistake to avoid: Using the new-patient code family for a returning patient.
Reference: AAPC COSC study guide sample
Medical Decision Making Leveling
25. Problems Must Be Addressed to Count
A problem counts toward the number and complexity of problems addressed only when it is addressed within that encounter. Reading the entire note, not just the chief complaint, reveals which conditions were truly evaluated and managed for leveling purposes.
Example: A note listing three complaints but assessing only knee pain counts one addressed problem, limiting that element's contribution to the level.
Mistake to avoid: Counting every listed problem without evidence it was addressed.
Reference: AAPC COSC study guide sample
26. Amount and Complexity of Data Reviewed
The second MDM element measures the amount and complexity of data reviewed and analyzed, using definitions supplied in the CPT E/M guidelines. Test results, outside records, and discussions with external providers contribute only when the note documents the review or analysis.
Example: Reviewing an outside MRI and ordering new imaging raises the data element beyond a visit that reviewed nothing external.
Mistake to avoid: Counting data the note never documents as reviewed or analyzed.
Reference: AAPC COSC study guide sample
27. Risk Requires Addressed Comorbidities
Comorbidities and underlying diseases raise the risk element only when documentation shows the provider addressed them or that they contributed to the severity of the case. Simply listing a chronic illness in the documentation is not sufficient to increase risk.
Example: Diabetes noted in the history but never discussed does not raise risk; the same diabetes complicating surgical decision making does.
Mistake to avoid: Counting listed-but-unaddressed comorbidities toward risk.
Reference: AAPC COSC study guide sample
28. Final Diagnosis Does Not Fix the Risk
The final diagnosis alone does not determine complexity or risk, because extensive evaluation may be required to conclude that symptoms do not represent a highly morbid condition. Multiple lower-severity problems may also aggregate into higher risk through their interaction.
Example: Ruling out a joint infection with urgent workup supports higher risk even when the final diagnosis is a mild sprain.
Mistake to avoid: Leveling risk downward because the eventual diagnosis proved minor.
Reference: AAPC COSC study guide sample
29. Conditions Managed Elsewhere
When documentation only states that a condition exists and is being treated by another provider, it does not count toward leveling. If additional documentation shows assessment or care coordination regarding that diagnosis beyond the bare statement, it then counts toward the level.
Example: A note saying a cardiologist manages atrial fibrillation adds nothing, but documented coordination with that cardiologist about surgical clearance does count.
Mistake to avoid: Counting externally managed conditions mentioned only in passing.
Reference: AAPC COSC study guide sample
30. The Four MDM Levels and Code Mapping
Four MDM levels exist: straightforward, low, moderate, and high. Each maps to specific new and established patient codes, and leveling requires applying the CPT MDM table definitions to the problems, data, and risk elements together rather than picking the strongest one.
Example: High-level problems, data, and risk for an established patient support 99215 rather than 99214 on the leveling grid.
Mistake to avoid: Leveling from a single strongest element while ignoring the others.
Reference: AAPC COSC study guide sample
Special E/M Scenarios and Medicare Rules
31. Modifier 25: Significant Separate E/M
Modifier 25 identifies a significant, separately identifiable E/M above and beyond the usual pre- and postoperative work on the same day as another service or procedure. Medical necessity for both must be appropriately and sufficiently documented and available upon request.
Example: At the first visit establishing the need for a series of steroid injections into an arthritic shoulder, both the injection and a modifier-25 E/M are reported; at later injection visits in the series, no E/M is reported unless a new or worsened condition requires a separate, significant service.
Mistake to avoid: Appending modifier 25 to every same-day procedure visit regardless of separate content.
Reference: AAPC COSC study guide sample
32. Modifier 57 Versus 25 by Global Period
Modifier 57 goes on the E/M code when the visit occurs the day of or day before a major procedure with a 90-day global period and directly leads to the decision for surgery. For minor procedures with zero or 10-day globals, append modifier 25 instead, and never put 57 on the surgery code.
Example: A consultation that directly produces the decision to proceed with total hip replacement the next day takes modifier 57 on the E/M code.
Mistake to avoid: Appending modifier 57 to the surgical code or to minor-procedure decisions.
Reference: AAPC COSC study guide sample
33. Modifier 24 and the Complication Return-to-OR Rule
Modifier 24 reports an unrelated E/M by the same provider during a postoperative period. Many private payers also allow it for office-treated complications, while Medicare pays for complication treatment during a global period only when the complication results in a return to the operating room.
Example: A patient who underwent shoulder arthroplasty returns during the global period after falling and fracturing a forearm; because the forearm fracture is unrelated to the arthroplasty, the E/M for it takes modifier 24.
Mistake to avoid: Billing complication visits without modifier 24, or assuming Medicare covers office complication care.
Reference: AAPC COSC study guide sample
34. Modifier 25 Documentation and Audit Exposure
CMS Transmittal 954 limits modifier 25 to a significant, separately identifiable E/M above and beyond the usual pre- and postoperative work, and requires that medical necessity be appropriately and sufficiently documented for both the E/M and the other service. The documentation need not be submitted with the claim but must be available upon request, and the OIG has identified improper modifier 25 application as a major source of coding mistakes, fraud, and abuse. Before appending modifier 25, confirm the note independently supports both services and retain the documentation for audit.
Example: A same-day minor-procedure claim with modifier 25 survives review because the note separately documents evaluation of a new or worsened condition; the same claim supported only by the procedure note is the improper application the OIG targets.
Mistake to avoid: Appending modifier 25 without documentation that independently establishes medical necessity for both the E/M and the procedure.
Reference: AAPC COSC study guide sample
35. Same-Provider Requirement for E/M Modifiers
Modifiers 24, 25, and 57 each describe services by the same physician or other qualified health care professional, and modifier 57's conditions expressly require that the same provider, or one sharing the same tax ID, performs both the E/M and the surgical procedure. When the E/M and the procedure were performed by different providers or practices, these modifiers do not link the services and the coding analysis changes.
Example: A surgeon who decides at her own visit to proceed with a 90-day-global procedure appends modifier 57 to her E/M; the patient's separate same-day visit with an outside physician for the same problem cannot carry modifier 57 because a different provider performed it.
Mistake to avoid: Linking an E/M and a procedure with modifier 24, 25, or 57 when different providers or tax IDs performed the two services.
Reference: AAPC COSC study guide sample
36. One Current Guideline Set for Every E/M Category
In 2021 the AMA revised the office and other outpatient E/M codes 99202-99215 and their guidelines; in 2023 it expanded those same guidelines to the other E/M categories, eliminating the 1995 and 1997 Documentation Guidelines. Every E/M category, not just office visits, is now leveled under the current AMA guidelines using medical decision making or total time, so documentation tools built on the retired grids no longer control level selection anywhere.
Example: A hospital follow-up visit leveled by counting organ systems examined under a 1997-style grid is misleveled; the current guidelines apply MDM or total time to that category as well.
Mistake to avoid: Applying retired 1995 or 1997 documentation grids to non-office E/M categories.
Reference: AAPC COSC study guide sample
Procedural Modifiers in Orthopedics
37. Modifier 22: Increased Procedural Services
Append modifier 22 when the service performed is greater than usually required for the listed procedure. Recognized circumstances include excessive blood loss, extensive trauma complicating the case, interfering pathology not billed separately, morbid obesity, and significant scarring or adhesions.
Example: A routine arthroplasty complicated by documented extensive adhesions materially increasing operative effort takes modifier 22 with supporting documentation.
Mistake to avoid: Using modifier 22 for ordinary difficulty or merely lengthy routine cases.
Reference: AAPC COSC study guide sample
38. Modifier 26: Professional Component Setting Rule
Modifier 26 identifies the professional component when the provider performs only the administration or interpretation of a service using equipment he or she does not own. Office X-rays are typically billed globally, but facility-setting radiology requires modifier 26 so the facility bills the technical portion.
Example: A surgeon interpreting hospital knee radiographs appends modifier 26; the hospital separately collects for equipment and staff time.
Mistake to avoid: Billing the global radiology code for hospital-setting interpretations.
Reference: AAPC COSC study guide sample
39. Modifier 50 and the Add-On Exception
Modifier 50 marks a procedure performed bilaterally when the best available code descriptor does not already describe a bilateral procedure. Parenthetical notes may instead instruct you not to append modifier 50 to certain add-on codes but to report the add-on code twice.
Example: Identical procedures on both knees use modifier 50 on the unilateral code, unless a parenthetical directs reporting the add-on code on each side instead.
Mistake to avoid: Appending modifier 50 to add-on codes against parenthetical instruction.
Reference: AAPC COSC study guide sample
40. Modifier 51: Often Unnecessary
Modifier 51 indicates more than one non-E/M surgical procedure in the same session, but many payers, including most Medicare carriers, use software that automatically detects and adjusts second and subsequent procedures. Check the individual payer's written guidelines before appending it.
Example: A claim with three surgical codes may need no modifier 51 because the payer's software applies multiple-procedure reductions automatically.
Mistake to avoid: Routinely stacking modifier 51 without checking payer instructions.
Reference: AAPC COSC study guide sample
41. Modifier 52: Reduced Services
Modifier 52 reports reduced services when the provider plans or expects a reduction, or electively cancels before completion, such as performing a one-view X-ray under a code describing additional views. The full-service code alone would misrepresent what was done.
Example: The provider obtains a single knee view instead of the standard views the code describes, so modifier 52 accompanies the radiology code.
Mistake to avoid: Reporting the full-service code unchanged when less was performed.
Reference: AAPC COSC study guide sample
42. LT and RT for Paired Extremities
Use LT and RT to identify the side when the provider performs a procedure on one of paired structures, most often paired extremities in orthopedic practice. These modifiers give the payer a clearer picture for adjudication of unilateral work.
Example: A right shoulder injection carries RT, while injections in both shoulders during one session instead raise the bilateral modifier question.
Mistake to avoid: Omitting side modifiers on unilateral paired-extremity procedures.
Reference: AAPC COSC study guide sample
Orthopedic CPT and HCPCS Procedure Coding
43. Sequence Procedures by Highest RVU
When multiple procedures are performed, CPT codes are sequenced with the most complex or labor-intensive first, meaning the codes with the highest relative value units lead the claim. This convention is tested directly and overrides narrative or anatomic ordering from the operative report.
Example: A same-session total knee arthroplasty and removal of fracture hardware lists the arthroplasty code first because it carries the greater work value.
Mistake to avoid: Sequencing procedure codes by anatomic order or the note's narrative order.
Reference: AAPC COSC study guide sample
44. Decoding Surgical Suffixes
Orthopedic CPT terms follow suffix patterns: -ectomy means excision, -otomy means incision, -plasty means reconstruction or repair, -lysis means loosening or destruction, and -desis means fusion or binding. Decoding the suffix correctly narrows the code family before you verify the site.
Example: A note describing capsular release is matched to the lysis code family rather than the incision family, changing the code selected.
Mistake to avoid: Confusing excision and incision code families from similar-sounding terms.
Reference: AAPC COSC study guide sample
45. Arthrodesis, Arthroplasty, Arthrotomy, Arthrocentesis
Arthrodesis fuses a joint, arthroplasty restores or reconstructs it, arthrotomy surgically opens it, and arthrocentesis punctures it for aspiration. These four terms are frequently confused, and choosing the wrong one sends you to the wrong code family entirely.
Example: A total knee replacement is an arthroplasty, while a diagnostic needle withdrawal of joint fluid is an arthrocentesis, each in a different code family.
Mistake to avoid: Interchanging fusion and reconstruction terms when reading operative notes.
Reference: AAPC COSC study guide sample
46. HCPCS Level II for Drugs and Casting Supplies
In orthopedic practice, HCPCS Level II codes are most commonly reported for drugs such as anti-inflammatories and steroids and for casting and splinting supplies. These supply and drug codes ride alongside CPT procedure codes rather than replacing them.
Example: The supply code for a cast applied after fracture reduction accompanies the CPT fracture care code on the same claim.
Mistake to avoid: Reporting cast and splint supplies with CPT procedure codes instead of HCPCS Level II.
Reference: AAPC COSC study guide sample
47. Chondromalacia and Osteophytes Are Different Findings
Chondromalacia is abnormal softness of cartilage, while osteophytes are bony projections from joints. Operative and imaging notes describing softened cartilage surfaces versus bony spur formation document different conditions, so the documented term, not a generic arthritis label, should be the diagnosis supporting the procedure's medical necessity.
Example: A knee arthroscopy note describing a softened patellar undersurface documents chondromalacia, while a note describing bony projections at the joint margins documents osteophytes; replacing either with a generic degenerative-joint-disease label reports less than the record supports.
Mistake to avoid: Collapsing distinct documented findings into a generic arthritis diagnosis.
Reference: AAPC COSC study guide sample
48. Every Procedure Includes an Inherent E/M Component
CMS guidelines treat all procedures, from simple injections and common diagnostic tests to the most complicated surgeries, as including an inherent E/M component. The routine evaluation that normally accompanies a procedure is therefore not separately billable; a same-day E/M qualifies for separate reporting only when it is above and beyond that minimal, inherent evaluation.
Example: A patient scheduled for a therapeutic injection whose visit consists only of the usual pre- and post-injection evaluation has no separate E/M; a same-day visit that also evaluates a new injury beyond that routine work does.
Mistake to avoid: Reporting a separate E/M for the routine evaluation inherent in every procedure.
Reference: AAPC COSC study guide sample
HIPAA Privacy Rule Essentials
49. Who Is a Covered Entity
The Privacy Rule covers health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with standard HIPAA transactions. Merely using email does not make a provider covered; the transmission must involve a standard transaction such as a claim.
Example: A small orthopedic practice submitting electronic claims is a covered entity; a provider filing no electronic standard transactions may not be.
Mistake to avoid: Assuming every healthcare business is automatically a covered entity.
Reference: HHS Summary of the HIPAA Privacy Rule
50. PHI Spans Every Medium
Protected health information is individually identifiable health data, including demographic identifiers, relating to health, care, or payment, held or transmitted by a covered entity or its business associate in any form. Electronic, paper, and oral formats all fall within the protection.
Example: A verbal hallway discussion identifying a patient's surgical result is PHI just as much as an electronic chart entry.
Mistake to avoid: Treating oral or paper information as outside privacy protections.
Reference: HHS Summary of the HIPAA Privacy Rule
51. Treatment, Payment, and Operations Uses
Covered entities may use and disclose PHI without individual authorization for treatment, payment, and health care operations. Obtaining written consent for these purposes is optional, and entities may rely on professional ethics and best judgment in deciding which permitted uses to make.
Example: Sending operative notes to the referring physician for ongoing care is a treatment use requiring no signed patient authorization.
Mistake to avoid: Delaying treatment communications while awaiting unnecessary authorizations.
Reference: HHS Summary of the HIPAA Privacy Rule
52. Minimum Necessary Standard and Its Exceptions
Entities must make reasonable efforts to use, disclose, and request only the minimum PHI needed for the purpose, and may not send an entire record unless specifically justified. The standard does not apply to treatment disclosures, individual access, authorized uses, or HHS enforcement requests.
Example: A payer requesting records for one procedure date receives that encounter's documentation, not the entire chart, unless the full record is justified.
Mistake to avoid: Releasing entire medical records for routine payment requests without justification.
Reference: HHS Summary of the HIPAA Privacy Rule
53. Business Associates Need Written Agreements
A business associate is a non-workforce person or organization performing functions for a covered entity that involve PHI, such as claims processing, billing, or data analysis. A written business associate agreement must impose specified safeguards, and the entity cannot authorize any use the Rule would forbid.
Example: An outside billing company handling the practice's claims signs a business associate agreement before receiving any patient data.
Mistake to avoid: Sharing PHI with vendors without a signed business associate agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
54. De-Identification Versus Limited Data Sets
De-identified information, created by removing specified identifiers with no actual knowledge it could re-identify anyone, carries no Privacy Rule restrictions. A limited data set removes fewer direct identifiers and may be used for research, operations, or public health only under a data use agreement.
Example: A research project receiving service dates without names uses a limited data set under a data use agreement, not full de-identification.
Mistake to avoid: Confusing limited data sets with de-identified information and skipping the agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
Exam-Ready Coding Judgment
55. Default to CPT Guidelines Unless Medicare Is Stated
The COSC exam tests coding concepts, anatomy, and guidelines rather than payer policy: unless a case note or question specifically states the patient is covered by Medicare, follow CPT coding guidelines. Individual payer rules are not a consideration when choosing the right answer.
Example: A question silent on payer is answered by CPT global-period conventions, not a particular carrier's complication-coverage policy.
Mistake to avoid: Importing a specific payer's billing policy into unmarked exam questions.
Reference: AAPC COSC study guide sample
56. Diagnoses Establish Medical Necessity
Proper diagnostic coding reports the medical necessity of procedures performed and feeds data that shapes health policy. Because physicians were traditionally paid by CPT code values, coders have sometimes undervalued diagnosis accuracy, making it a recurring exam weakness.
Example: A shoulder arthroscopy claim supported only by a generic pain code, rather than the documented tear, fails medical necessity review.
Mistake to avoid: Treating diagnosis coding as secondary to procedure coding.
Reference: AAPC COSC study guide sample
57. Read the Entire Note, Not the Chief Complaint
The chief complaint alone does not accurately reveal the number and complexity of problems addressed. Read the entire note, especially the assessment and plan, to identify what was evaluated, managed, and coordinated before leveling a visit or selecting diagnoses.
Example: A visit booked for knee pain whose plan also addresses a work injury and a medication reaction yields more problems than the complaint suggests.
Mistake to avoid: Coding from the chief complaint without reviewing the full note.
Reference: AAPC COSC study guide sample
58. Never Extrapolate Beyond Documentation
Each date of service must stand alone on its own documentation, and coders may not assume or extrapolate information from the record, such as coding a condition as acute when acuity is undocumented. When documentation is unclear or conflicting, query the provider for clarification.
Example: A coder who suspects a fall caused a fracture but finds no documented mechanism queries the provider rather than assigning an external cause code.
Mistake to avoid: Filling documentation gaps with clinical assumptions.
Reference: AAPC COSC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
59. Complication Coding Requires Cause and Effect
A condition qualifies as a complication of care only when documentation shows a cause-and-effect relationship with the care provided and clinical significance. The provider need not use the word complication, and unclear relationships between a condition and care warrant a query.
Example: A condition that alters the documented surgical course supports a complication code even though the operative report never uses the word complication.
Mistake to avoid: Coding every post-surgical condition as a complication.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
60. Annual Updates With No Grace Period
Providers must begin using the most recent ICD-10-CM revisions on October 1 of each year with no grace period for transition. Coding from current-year ICD-10-CM, CPT, and HCPCS Level II books is therefore required, since prior-year codes can become invalid immediately.
Example: A fracture code revised in the new October edition is reported in its updated form the same week the revision takes effect.
Mistake to avoid: Coding from last year's code book after October 1.
Reference: AAPC COSC study guide sample
References and further reading
Source links checked on Oct 2, 2026.