Work through the ten groups in order, because later concepts assume the conventions and anatomy covered earlier. Each concept pairs a rule with a short resolved example and a common error, so read the explanation, predict the example's outcome, and check yourself. Verify every code in current official references before use, since code sets and guidelines change annually. Treat the examples as hypothetical teaching cases, not real records, and use the group structure to locate weak areas for focused review.
Coding Foundations and the Business of Medicine
1. What Medical Coding Actually Is
Coding means translating provider documentation into standardized diagnosis and procedure codes for reporting to commercial and federal payers. It is not claim form preparation, EHR programming, or creation of the electronic transmission file. The coder's deliverable is accurate code assignment derived from the record itself.
Example: A practice asks a coder to build the electronic claim transmission file for claims; she declines because that is a file-creation task, not code assignment from the provider's note.
Mistake to avoid: Confusing coding with submitting the CMS-1500 form or programming the EHR system.
Reference: AAPC CPC study guide sample
2. Provider Hierarchy and Who May Establish a Diagnosis
Physicians and other qualified practitioners are legally accountable for establishing diagnoses, while clinical staff document supporting data. Diagnosis code assignment rests on the provider's diagnostic statement, not on measurements or observations recorded by nursing or technical personnel.
Example: A nurse records a pressure ulcer stage; the coder uses it only because the provider documented the ulcer itself, since the associated diagnosis must come from the accountable provider.
Mistake to avoid: Assigning a diagnosis based solely on clinical staff documentation without provider confirmation.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
3. Commercial Payers Versus Federal Payers
Payers divide into commercial insurers, such as Blue Cross Blue Shield, and government programs like Medicare and Medicaid. Coverage rules, coding requirements, and claim handling differ between these types, so the coder must identify the payer before selecting codes and any payer-specific reporting rules.
Example: A claim routes to Blue Cross Blue Shield, a commercial payer, while the same practice's Medicare claims follow federal program rules; the coder applies the correct payer logic to each.
Mistake to avoid: Treating Medicaid or Medicare as though they were commercial insurance payers.
Reference: AAPC CPC study guide sample
4. Medicare Parts and Where Services Belong
Medicare Part A covers hospital insurance, Part B covers physician and outpatient services, Part C combines benefits through private Medicare-approved plans, and Part D is the prescription drug program. Knowing which part covers which service determines where a given claim belongs.
Example: A pharmacy dispenses a take-home pain medication to a chemotherapy patient at the oncologist's office; the pharmacy bills the prescription drug part, not the physician services part.
Mistake to avoid: Billing Part B for prescription drugs dispensed for the patient to take home.
Reference: AAPC CPC study guide sample
5. Medicaid and State-Level Program Variation
Medicaid is a federal and state program for some low-income individuals, administered state by state under federal guidelines. State-funded programs may also cover children up to age twenty-one. Because administration varies, the coder verifies the specific state program's rules rather than assuming uniform national policy.
Example: A claim denies under one state's Medicaid policy for a service covered elsewhere; the coder learns to check the state manual because rules are not nationally uniform.
Mistake to avoid: Assuming Medicaid rules are identical across all states.
Reference: AAPC CPC study guide sample
6. How Relative Values Build Physician Payment
Medicare physician payment uses a resource-based relative value scale with three components: physician work, practice expense, and professional liability insurance. Practice expense values differ by site of service because providing a service in a hospital costs differently than in an office.
Example: The same service shows one total in the facility column and a different total in the non-facility column of the fee schedule because practice expense differs by location.
Mistake to avoid: Expecting identical reimbursement for a service regardless of where it is performed.
Reference: AAPC CPC study guide sample
Medical Terminology and Anatomy for Pathology Coding
7. Decoding Terms from Word Parts
Medical terms combine word parts: roots identify the body part or substance, combining vowels join parts, and suffixes describe conditions. Dividing an unfamiliar term into its components yields the approximate meaning, which the coder needs before assigning any diagnosis or procedure code.
Example: A report contains the term for diseased heart muscle; the coder separates the heart root, muscle root, and disease suffix to confirm meaning before coding.
Mistake to avoid: Guessing at unfamiliar term meanings instead of dividing them into word parts.
Reference: AAPC CPC study guide sample
8. Plural Endings in Medical Terminology
Plural formation in medical terminology follows a dictated set of endings rather than simply adding s. Examples include is becoming es, us becoming i, um becoming a, nx becoming ges, and on becoming a. Recognizing these patterns prevents misreading plural and singular forms in reports.
Example: A pathology report references several bones of the fingers; the coder recognizes the irregular plural form and matches the documented anatomy correctly.
Mistake to avoid: Adding s to singular medical terms and misreading the resulting forms.
Reference: AAPC CPC study guide sample
9. Anatomic Position as the Reference Standard
The anatomic position is the standard reference: upright, face forward, arms at the sides with palms facing forward, and feet parallel and slightly apart. Directional and positional terms in documentation are defined relative to this position, so the coder interprets them accordingly.
Example: An operative note describes a lesion on a specific side relative to the patient; the coder orients laterality using the standard anatomic reference, not the observer's viewpoint.
Mistake to avoid: Applying layperson left-right orientation instead of standard anatomic directional terms.
Reference: AAPC CPC study guide sample
10. Skin Layers and What Counts as Skin
The epidermis is the outermost layer containing squamous cells, basal cells, and melanocytes. The dermis, with papillary and reticular layers, performs most skin functions. Subcutaneous tissue lies beneath the dermis and is fat, not a layer of the skin itself, despite common misuse of that phrase.
Example: A pathology description notes extension into subcutaneous fat; the coder recognizes involvement beyond the two true skin layers, which affects how the lesion is characterized.
Mistake to avoid: Counting subcutaneous tissue as a third layer of the skin.
Reference: AAPC CPC study guide sample
11. Neoplasm Vocabulary That Drives Code Selection
Carcinoma indicates malignancy. Metastasis means the cancer has spread to a secondary location, distinguishing a secondary malignancy from the original primary. Encapsulated disease that has not spread is described as in situ. These behavioral terms map directly to columns in the neoplasm classification.
Example: A report describes a metastatic focus in a lymph node; the coder knows the secondary malignancy column applies rather than coding a new primary at the nodal site.
Mistake to avoid: Coding a metastatic lesion as a new primary malignancy at the secondary site.
Reference: AAPC CPC study guide sample
12. Reading the Parts of a Pathology Report
Surgical pathology reports contain distinct parts: the gross description of what was received and measured, the microscopic description of examined sections, the tissues submitted, and the clinical diagnosis. Each part serves a purpose, and the coder must know which parts support code assignment.
Example: A gallbladder arrives in formalin; the coder reads the gross and microscopic descriptions to confirm the specimen and the clinical diagnosis, not just the container label.
Mistake to avoid: Coding from the container label or report headings instead of the described specimen.
Reference: AAPC CPC study guide sample
ICD-10-CM Structure and Conventions
13. Alphabetic Index First, Then Tabular Verification
To locate a diagnosis code, first find the term in the Alphabetic Index, then verify the code in the Tabular List, reading and following all instructional notes. Beginning the search in the Tabular List instead of the Index leads directly to coding errors and is expressly discouraged.
Example: For documented abdominal pain, the coder locates the main term in the Alphabetic Index, follows subterms for location and type, then verifies the code in the Tabular List before reporting.
Mistake to avoid: Looking up codes directly in the Tabular List without starting in the Index.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
14. Only Full Codes Are Reportable
Only complete codes are permissible for reporting, never categories or subcategories. Codes run three to seven characters, and a code with an applicable seventh character is invalid without it. The final level of subdivision is the code, and that is what must appear on the claim.
Example: A coder finds a three-character category that matches a condition; she continues to the full code because the category alone cannot be reported on the claim.
Mistake to avoid: Submitting a category or subcategory as though it were a complete valid code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
15. The Placeholder X Rule
The placeholder character X fills empty positions when a code shorter than six characters requires a seventh-character extension. Without the X, the extension would sit in the wrong position and the code would be invalid. The Tabular List symbols identify where the placeholder applies.
Example: A five-character code in a category requiring a seventh character gets the placeholder inserted before the extension so the seventh character occupies the seventh position.
Mistake to avoid: Appending a seventh character directly to a short code without inserting the X.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
16. Seventh Characters Apply Category-Wide
Certain categories carry an applicable seventh character required for all codes within the category, or as the Tabular List notes instruct. The seventh character must always occupy the seventh position of the data field, which is why shorter codes need the placeholder X to fill the gap.
Example: A fracture category requires an extension for every code within it, including codes that would otherwise seem complete at fewer characters.
Mistake to avoid: Assuming some codes in a seventh-character category are exempt from the extension.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
17. NEC Versus NOS: Other Specified Versus Unspecified
NEC, meaning not elsewhere classifiable, represents other specified conditions and applies when the provider documented specific information but no specific code exists. NOS, meaning not otherwise specified, is the equivalent of unspecified and applies only when the coder lacks the information needed for a more specific code.
Example: A provider documents a specific rare lesion with no unique code; the coder assigns the other specified code, not the unspecified code, because the documentation is specific.
Mistake to avoid: Using an unspecified code when the documentation actually supports a specific condition.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
18. Excludes1 Versus Excludes2 Notes
An Excludes1 note means the excluded code is never used with the code above it, typically because the conditions cannot coexist, such as congenital versus acquired forms; an exception applies when the conditions are clearly unrelated. An Excludes2 note means not included here, but the patient may have both, so both codes may be reported when appropriate.
Example: Two conditions appear together under an Excludes2 note and both are treated; the coder reports both codes because the note permits coexistence.
Mistake to avoid: Dropping a legitimately coexisting code because an Excludes2 note was misread as a prohibition.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Neoplasm Coding and the Pathology Report
19. The Six Columns of the Table of Neoplasms
The Table of Neoplasms is organized into six columns: malignant primary, malignant secondary, carcinoma in situ, benign, uncertain behavior, and unspecified behavior. The coder locates the site and histologic type in the Alphabetic Index first, then selects the column matching the documented behavior before verifying in the Tabular List.
Example: For squamous cell carcinoma of the right arm, the coder moves from carcinoma of skin to the malignant neoplasm entry, selects the upper limb row, takes the primary column code, then verifies laterality in the Tabular List.
Mistake to avoid: Choosing a column based on the word tumor rather than the documented behavior.
Reference: AAPC CPC study guide sample
20. Primary Versus Secondary Malignancy
A primary malignancy is the original location of the cancer, while a secondary malignancy has spread to another location through metastasis. The Table of Neoplasms provides separate columns for these, and the correct column depends on whether the site being coded is the origin or a spread.
Example: An eyebrow lesion is documented as metastasis from a lung primary; the coder selects the secondary column for the skin site and sequences the underlying primary appropriately.
Mistake to avoid: Coding a metastatic skin lesion as a primary malignancy of the skin.
Reference: AAPC CPC study guide sample
21. Carcinoma In Situ Versus Benign
Carcinoma in situ means the cancer is encapsulated and has not spread, while benign means the pathology report indicates no cancer or precancerous cells. These occupy different columns in the Table of Neoplasms, and the distinction rests entirely on the pathology report's characterization.
Example: Pathology describes malignant cells that remain encapsulated without invasion; the coder selects the in situ column rather than the benign column because malignancy is present.
Mistake to avoid: Treating in situ disease as benign merely because it has not spread.
Reference: AAPC CPC study guide sample
22. Uncertain Behavior Versus Unspecified Behavior
Uncertain behavior is a specific pathologic diagnosis: the lesion is currently benign but could undergo malignant transformation, and a pathology report must exist to support it. Unspecified behavior means there is no pathology report indicating the nature of the lesion. These are distinct documentation states, not interchangeable labels.
Example: A pathology report describes a lesion whose behavior cannot be predicted; the coder assigns the uncertain behavior code because the report exists, not the unspecified code.
Mistake to avoid: Using an unspecified behavior code when a pathology report documents uncertain behavior.
Reference: AAPC CPC study guide sample
23. Melanoma Has Its Own Lookup Path
Melanoma is not approached through the Table of Neoplasms first. Instead, the coder begins in the Alphabetic Index under melanoma, follows the skin and site subterms to the directed code, and then verifies that code in the Tabular List. Starting in the table leads to the wrong code family.
Example: For melanoma of the lip, the coder looks under melanoma, then skin, then lip in the Alphabetic Index, is directed to the lip melanoma code, and verifies it in the Tabular List.
Mistake to avoid: Going straight to the Table of Neoplasms for melanoma and selecting a wrong column.
Reference: AAPC CPC study guide sample
24. Code from the Report Body, Not the Headings
When coding from operative and pathology reports, do not code from the preoperative diagnosis, postoperative diagnosis, or procedure headings alone. The indications and the description of the procedure often supply information lacking in those headings, and the final clinical or postoperative diagnosis governs reporting.
Example: A gallbladder report lists abdominal pain in the heading but documents mild chronic cholecystitis as the clinical diagnosis; the coder reports the cholecystitis because the body of the report is definitive.
Mistake to avoid: Reporting the heading diagnosis when the report body documents a different definitive diagnosis.
Reference: AAPC CPC study guide sample
Outpatient Diagnosis Reporting Rules
25. First-Listed Diagnosis in Outpatient Settings
In the outpatient setting, the term first-listed diagnosis replaces principal diagnosis, because the inpatient principal diagnosis definition does not apply to hospital-based outpatient services or provider-based office visits. Conventions and general guidelines still take precedence when determining which condition is listed first.
Example: A hospital-based outpatient surgery coder selects the first-listed reason for the encounter rather than applying the inpatient principal diagnosis definition to the claim.
Mistake to avoid: Applying inpatient principal-diagnosis selection rules to office visits.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
26. Uncertain Diagnoses Are Not Coded Outpatient
Outpatient guidelines prohibit coding diagnoses documented as probable, suspected, questionable, rule out, compatible with, consistent with, or working diagnosis. Instead, code the condition to the highest degree of certainty for that encounter, such as symptoms, signs, or abnormal test results. This deliberately differs from inpatient practice.
Example: An outpatient note says suspected pneumonia pending culture results; the coder reports the documented cough or abnormal finding instead of the unconfirmed pneumonia.
Mistake to avoid: Reporting an unconfirmed suspected diagnosis in the outpatient setting.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
27. Outpatient Surgery and Cancelled Procedures
When a patient presents for outpatient same-day surgery, code the reason for the surgery as the first-listed diagnosis, which is the reason for the encounter, even if the surgery is not performed because of a contraindication. The planned encounter's purpose drives the first-listed position, not what ultimately occurred.
Example: A patient presents for a scheduled excision that is cancelled for a contraindication; the coder still reports the condition prompting the surgery as the first-listed diagnosis.
Mistake to avoid: Leaving the first-listed position empty or coding only the contraindication.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
28. Observation Stay Sequencing
For observation stays, assign the medical condition as the first-listed diagnosis. When a patient presents for outpatient surgery and develops complications requiring observation, code the reason for the surgery as the first reported diagnosis, followed by codes for the complications as secondary diagnoses.
Example: A post-surgical patient is held in observation for a complication; the coder sequences the surgical reason first and the complication as a secondary diagnosis.
Mistake to avoid: Sequencing the observation complication ahead of the reason for the surgery.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
29. Chronic Diseases May Be Reported Repeatedly
Chronic diseases treated on an ongoing basis may be coded and reported as many times as the patient receives treatment and care for the condition. Recurrent reporting is appropriate for managed chronic illness, distinguishing it from conditions previously treated that no longer exist and therefore should not be coded.
Example: A patient with psoriasis receives ongoing management at each visit; the coder reports the psoriasis at every encounter where treatment occurs.
Mistake to avoid: Coding a chronic condition only at its initial diagnosis.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
30. History Codes as Secondary Diagnoses
Do not code conditions that were previously treated and no longer exist. However, history codes in categories Z80 through Z87 may be used as secondary codes when the historical condition or family history has an impact on current care or influences treatment. They are never substitutes for active conditions.
Example: A patient with current varicose vein pain has a documented history of deep vein thrombosis; the coder reports the history code second because it influences management decisions.
Mistake to avoid: Reporting a resolved condition as current, or omitting a care-relevant history code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
CPT, HCPCS Level II, and Modifier Use
31. CPT Organization Across Service Sections
CPT is organized by body system and service type, including evaluation and management, anesthesia, surgery, radiology, pathology, and medicine sections. Real encounters typically require at least two code sets plus modifiers, so the coder must navigate across sections and code sets rather than treating each in isolation.
Example: A single encounter requires a procedure code, a diagnosis code, and a modifier; the coder moves between code sets rather than relying on one book section.
Mistake to avoid: Assuming a single code set suffices for a typical encounter.
Reference: AAPC CPC study guide sample
32. NCCI Edits and Bundled Code Pairs
The National Correct Coding Initiative establishes edits that identify code pairs that cannot be reported together, the basis of bundling. Before submitting multiple procedure codes for one encounter, the coder checks applicable edits to determine whether the combination is permitted or whether one code encompasses the other.
Example: Two procedure codes appear on one claim but the pair is bundled under the edits; the coder reports only the appropriate code rather than both.
Mistake to avoid: Billing code pairs that NCCI edits prohibit without checking the edits.
Reference: AAPC CPC study guide sample
33. Sequencing CPT Codes by Rule, Not Preference
The order in which CPT codes are reported follows sequencing rules within the code set and its guidelines. Sequence is determined by the applicable instructions for the services performed, not by the relative value of the codes, the order of documentation, or the coder's preference.
Example: Multiple procedures occur in one session; the coder sequences them according to the guideline instructions rather than by charge amount or personal preference.
Mistake to avoid: Ordering procedure codes by dollar value instead of guideline sequence.
Reference: AAPC CPC study guide sample
34. Category II and Category III Codes
Category II codes are optional supplemental codes used for performance measurement, while Category III codes are temporary codes for emerging technology and services. Neither replaces a Category I procedure code: Category II tracks performance data and Category III captures new procedures awaiting established codes.
Example: A performance measurement code documents that a care standard was met; the coder reports it alongside, never instead of, the Category I procedure code.
Mistake to avoid: Substituting a Category II tracking code for the billed procedure code.
Reference: AAPC CPC study guide sample
35. HCPCS Level II for Medicare Screening Services
Medicare screening services may require HCPCS Level II codes instead of CPT. For colorectal cancer screening, the patient's history determines the code: a personal history of malignancy or polyps qualifies the patient as high risk, and the Level II Index directs the coder to the corresponding screening code.
Example: A Medicare patient with treated colon cancer returns for surveillance colonoscopy; the coder reports the Level II screening code for the high-risk patient along with the follow-up and history diagnosis codes.
Mistake to avoid: Using a CPT code for a Medicare screening service that requires a Level II code.
Reference: AAPC CPC study guide sample
36. Modifiers: CPT Definitions Versus Payer Policy
Modifiers alter the circumstances of a code without changing its definition, and HCPCS Level II maintains its own modifier set. Payer policy can diverge from CPT guidance on modifier use, so the coder distinguishes what the code set permits from what a specific payer accepts on its claims.
Example: A payer's policy on a modifier's use differs from the CPT guidance; the coder follows the payer rule for that claim while preserving the CPT definition for reference.
Mistake to avoid: Assuming one modifier rule applies identically across CPT and every payer.
Reference: AAPC CPC study guide sample
E/M and Diagnostic Service Reporting
37. E/M Levels from Medical Decision Making
Emergency department visit levels are selected using the elements of medical decision making: the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications or morbidity from patient management. The level reflects the aggregate of these elements.
Example: An emergency department child with a nasal foreign body shows an acute uncomplicated problem, secondhand history, and minor procedure risk; the low complexity across elements yields the low-level visit code.
Mistake to avoid: Selecting the E/M level from history and exam elements when decision making drives it.
Reference: AAPC CPC study guide sample
38. Excluding Separately Reported Services from E/M Time
When a provider performs a service that is separately reported with another code, the time spent on that service is excluded from the time used to determine the level of the visit. Including separately billed time counts the same minutes twice, which constitutes double billing.
Example: A provider performs and separately bills a procedure the same day; those procedure minutes are excluded when totaling the time that determines the visit level.
Mistake to avoid: Counting minutes of a separately billed procedure toward the E/M time.
Reference: AAPC CPC study guide sample
39. Diagnostic-Only Encounters and Routine Testing
For patients receiving diagnostic services only, sequence first the diagnosis chiefly responsible for the services provided. For routine laboratory or radiology testing performed without any signs, symptoms, or associated diagnosis, assign the code for other specified special examinations. When routine testing accompanies a test evaluating a symptom, both codes apply.
Example: A patient is sent for screening laboratory work only, with no symptoms documented; the coder assigns the specified examination code as the first-listed diagnosis.
Mistake to avoid: Inventing a symptom code to justify routine testing done without documented indication.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
40. Coding from the Physician's Final Interpretation
For outpatient diagnostic tests interpreted by a physician whose final report is available at the time of coding, code any confirmed or definitive diagnoses documented in the interpretation. Related signs and symptoms should not be coded as additional diagnoses, because the definitive finding supersedes the presenting complaint.
Example: A radiologist's final report confirms a fracture; the coder reports the fracture code and drops the presenting pain symptom from the claim.
Mistake to avoid: Adding symptom codes alongside the confirmed diagnosis from the final interpretation.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
41. Postoperative Diagnosis Governs Reporting
When preoperative and postoperative diagnoses differ, the postoperative diagnosis is used for reporting because it represents the confirmed finding after the procedure. The coder compares both statements and reports the final diagnosis, which also drives the correct diagnosis code specificity.
Example: The preoperative diagnosis is a cyst but the postoperative diagnosis confirms malignancy; the coder reports the postoperative diagnosis because it reflects the final finding.
Mistake to avoid: Coding the preoperative diagnosis when a differing postoperative diagnosis is documented.
Reference: AAPC CPC study guide sample
42. High-Risk Screening and Required History Codes
A screening encounter's code depends on risk status. Personal history of treated colon malignancy qualifies the patient for the high-risk screening code, and instructional notes require an additional code identifying the personal history of malignancy. History of polyps is likewise reported with its own history code.
Example: A patient with personal histories of colon cancer and polyps presents for follow-up screening; the coder reports the high-risk screening code with the follow-up and both history codes per the instructional notes.
Mistake to avoid: Using the average-risk screening code for a patient with qualifying personal history.
Reference: AAPC CPC study guide sample
Compliance, Fraud, and Privacy Foundations
43. Medical Necessity and the Diagnosis Link
Medical necessity links the service performed to the diagnosis reported. Payers evaluate whether the documented condition justifies the service, so a missing, mismatched, or unsupported diagnosis code produces denials. The coder's job is to report the diagnosis that genuinely supports the service described in the record.
Example: A claim for a diagnostic test is denied because the reported diagnosis did not establish necessity; the coder corrects the linked diagnosis based on the documentation.
Mistake to avoid: Reporting a diagnosis that does not support the service performed.
Reference: AAPC CPC study guide sample
44. Fraud Versus Abuse
Fraud involves intentional false representation in claims, while abuse reflects improper practices that impose costs without proven fraudulent intent. Both expose the practice to penalties, but the response differs. Coders support compliance by reporting documentation accurately and flagging patterns for review.
Example: An audit reveals a pattern of inflated code selection; the compliance officer evaluates intent, because deliberate miscoding is fraud rather than a simple billing error.
Mistake to avoid: Treating deliberate miscoding as a harmless billing error.
Reference: AAPC CPC study guide sample
45. Compliance Programs, Audits, and the OIG Work Plan
Compliance rules and internal audits exist to detect and correct coding and billing errors before payers or regulators do. The OIG Work Plan identifies areas under government scrutiny, giving practices a roadmap for self-audit priorities. Coders participate by maintaining accurate, documentation-based reporting.
Example: A type of claim appears on the OIG Work Plan; the practice proactively audits its own submissions for that service before an external audit finds problems.
Mistake to avoid: Ignoring audit findings or waiting for payer audits to reveal problems.
Reference: AAPC CPC study guide sample
46. Who Is a HIPAA Covered Entity
The Privacy Rule covers health plans, health care clearinghouses, and providers who transmit health information electronically in connection with standard transactions. Workers' compensation insurers, automobile insurers, and property casualty insurers are not covered entities, a distinction tested by whether the entity transmits standard electronic transactions.
Example: A laboratory transmitting standard electronic claims is a covered provider, while a state workers' compensation program is not a covered entity under the rule.
Mistake to avoid: Assuming every payer or government agency is a HIPAA covered entity.
Reference: HHS Summary of the HIPAA Privacy Rule; AAPC CPC study guide sample
47. Business Associates Require Written Agreements
A business associate is a non-workforce person or organization performing functions for a covered entity that involve protected health information, such as claims processing, billing, or data analysis. The covered entity must impose written safeguards through a business associate agreement and cannot authorize any use the Rule itself would prohibit.
Example: A billing service processes claims using identifiable information; a signed business associate agreement with the required protections must be in place before the work proceeds.
Mistake to avoid: Sharing identifiable information with a contractor without a business associate agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
48. Required Disclosures Versus Permitted Uses
A covered entity must disclose protected health information in only two situations: to individuals or their personal representatives requesting access or an accounting of disclosures, and to HHS for compliance review or enforcement. Treatment, payment, and health care operations uses are permitted without authorization but are not mandatory disclosures.
Example: A patient requests an accounting of disclosures; the entity must honor it, whereas a marketing disclosure to an outside firm remains optional only with valid authorization.
Mistake to avoid: Believing treatment, payment, or operations disclosures require individual authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
PHI Uses, Disclosures, and Individual Rights
49. What Counts as Protected Health Information
Protected health information is individually identifiable information relating to health, care, or payment for care, held or transmitted in any form: electronic, paper, or oral. Common identifiers such as name, address, birth date, and Social Security number make information identifiable. Employment records and certain education records are excluded.
Example: Two staff members discuss a patient's results in a hallway; the oral exchange is protected information subject to the same privacy standards as the written record.
Mistake to avoid: Assuming only electronic records count as protected health information.
Reference: HHS Summary of the HIPAA Privacy Rule
50. The Minimum Necessary Standard and Its Exceptions
Covered entities must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed for the intended purpose. The standard does not apply to treatment disclosures, individual access, authorization-based uses, HHS requests, or disclosures required by law. Whole-record disclosure requires specific justification.
Example: A coder requests only the pathology report needed for coding rather than the entire record, unless the whole record is specifically justified for the purpose.
Mistake to avoid: Routinely disclosing the entire medical record when a narrower set suffices.
Reference: HHS Summary of the HIPAA Privacy Rule
51. Two Ways to De-Identify Information
De-identified information carries no use or disclosure restrictions. De-identification occurs either through a formal determination by a qualified statistician or by removing the specified identifiers of the individual and of relatives, household members, and employers, which is adequate only when the entity has no actual knowledge that the remainder could identify the person.
Example: A research dataset strips names, geographic details, dates, and the other listed identifiers; with no actual knowledge of re-identifiability, it is no longer protected information.
Mistake to avoid: Removing only the patient's name and calling the record de-identified.
Reference: HHS Summary of the HIPAA Privacy Rule
52. When Authorization Is Required
Written authorization is required for uses and disclosures beyond permitted purposes, including most uses of psychotherapy notes and marketing arrangements where a covered entity receives remuneration for disclosing information to a third party for its marketing. Authorizations must be in plain language, specific, and revocable in writing.
Example: A pharmaceutical firm wants identifiable information for its own marketing; the entity must obtain a written authorization that reveals any remuneration involved before any disclosure.
Mistake to avoid: Disclosing identifiable information for a third party's marketing without authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
53. Notice of Privacy Practices and Acknowledgement
Each covered entity must provide a notice of privacy practices describing uses and disclosures, duties, individual rights, and the complaint process. Direct treatment providers must deliver it no later than the first service encounter, post it prominently, and make a good faith effort to obtain written acknowledgement, documenting any failure.
Example: A new patient receives the notice at the first service encounter; the provider attempts to obtain the signed acknowledgement and documents the reason when it is not obtained.
Mistake to avoid: Skipping the acknowledgement effort or failing to document why it was not obtained.
Reference: HHS Summary of the HIPAA Privacy Rule
54. Personal Representatives and Minors
A personal representative is a person legally authorized to make health care decisions for an individual, or to act for a deceased person or estate, and must be treated as the individual. Parents are generally personal representatives for minor children, but exceptions defer to state law, and professional judgment may govern access discretion.
Example: A parent requests a minor's records; the entity generally grants access as to the individual, unless an exception applies or state law directs otherwise.
Mistake to avoid: Automatically granting or denying parental access without checking exceptions and state law.
Reference: HHS Summary of the HIPAA Privacy Rule
Advanced Integration: Documentation, Payer Policy, and Edge Rules
55. Etiology/Manifestation Sequencing and Bracket Codes
Certain conditions have both an underlying etiology and body-system manifestations. The etiology/manifestation convention requires the underlying condition to be sequenced first, followed by the manifestation: a 'use additional code' note appears at the etiology code and a 'code first' note at the manifestation code. Codes titled 'in diseases classified elsewhere' are never permitted as first-listed or principal diagnosis codes and must follow the underlying condition. In the Alphabetic Index, both conditions appear together with the etiology code first and the manifestation code in brackets, and the bracketed code is always sequenced second.
Example: For congenital syphilitic hepatitis, the Alphabetic Index lists A50.08 followed by K77 in brackets, so the coder reports A50.08 first and K77 second; likewise dementia with Parkinson's disease sequences the G20 category code before the bracketed F02.80/F02.81- manifestation code.
Mistake to avoid: Sequencing the bracketed manifestation code first, or reporting an 'in diseases classified elsewhere' code as the first-listed or principal diagnosis.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027; AAPC CPC study guide sample
56. Clinician Data Versus Provider Diagnosis
Certain data, such as body mass index, coma scale, and pressure ulcer stages, may be documented by clinicians other than the provider. However, the associated diagnosis must be documented by the patient's provider, and these data codes are reported only as secondary diagnoses, never as the primary reason for the encounter.
Example: A dietitian documents the body mass index; the coder reports the index code only as a secondary code paired with the provider's documented obesity diagnosis.
Mistake to avoid: Reporting data codes without the provider's associated diagnosis, or listing them first.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
57. The Provider's Statement Governs Code Assignment
Code assignment is based on the provider's diagnostic statement that the condition exists; that statement is sufficient. Assignment is not based on the clinical criteria the provider used to establish the diagnosis. If the record contains conflicting documentation, the correct response is to query the provider, not to adjudicate the conflict independently.
Example: A provider states the patient has a particular condition; the coder assigns that code based on the statement rather than re-deriving the diagnosis from the criteria discussed in the note.
Mistake to avoid: Second-guessing a provider's diagnosis by re-deriving it from clinical criteria.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
58. Querying to Resolve Conflicting Documentation
When medical record documentation conflicts, whether within a single clinician's notes or between different clinicians, the coder must query the provider for clarification rather than selecting whichever version appears more specific, more recent, or more convenient. The query resolves the conflict at its source.
Example: One note calls a lesion benign while the final pathology report says malignant; the coder queries the provider for clarification before assigning either behavior code.
Mistake to avoid: Silently picking whichever conflicting documentation seems more specific or recent.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
59. Combination Codes Replace Multiple Coding
A combination code is a single code classifying two diagnoses, a diagnosis with an associated secondary process, or a diagnosis with a complication. When a combination code fully identifies the diagnostic conditions, assign only that code; multiple coding should not be used where the classification already provides the combination.
Example: The Alphabetic Index directs to a single combination code covering the condition and its manifestation; the coder reports only that code instead of splitting it into two.
Mistake to avoid: Splitting a fully described condition into separate codes when a combination code exists.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
60. Exposure Codes Versus Confirmed Illness
Contact and exposure codes apply to patients suspected of exposure through close personal contact with an infected individual or presence in an epidemic area, without confirmed illness. Confirmed conditions are coded as the condition; for example, only confirmed cases of certain infectious diseases are coded as the disease. Exposure and illness are distinct documentation states.
Example: A patient reports close contact with a sick individual but has no symptoms or confirmed illness; the coder assigns the contact code rather than coding the disease itself.
Mistake to avoid: Coding the disease itself for a patient with only documented exposure.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
References and further reading
Source links checked on Oct 2, 2026.