Work through the ten groups in order, because later application concepts assume the foundations built earlier. Each concept pairs a rule with a worked example and a common error: read the explanation, resolve the example yourself before checking its decision, and use the mistake line for focused review. This guide is a teaching supplement organized around the credential's subject matter, not an official syllabus or a replacement for current official code sets, payer manuals, and guidelines, which should always be consulted alongside it.
Healthcare Regulations and Compliance Foundations
1. Fraud Versus Abuse in Billing
CMS defines fraud as making false statements or misrepresenting facts to obtain an undeserved benefit or payment from a federal healthcare program. Abuse is defined by CMS as an action that results in unnecessary costs to a federal healthcare program, either directly or indirectly. The distinguishing element is intent: fraud requires deliberate misrepresentation, while abuse describes costly practices without proven deception. A biller who recognizes this distinction can correctly classify a billing problem before deciding how it must be addressed.
Example: A clinic bills Medicare for sample drugs received free from a manufacturer. This is fraud because payment was sought for something that cost nothing and was not payable. By contrast, a practice whose billing habits generate unnecessary program costs without deliberate misrepresentation falls under abuse.
Mistake to avoid: Treating intentional misrepresentation as a mere billing error, or classifying deliberate false claims as simple abuse.
Reference: AAPC CPB study guide sample
2. False Claims Act Reverse Liability
The False Claims Act imposes liability not only for submitting false payment claims but also for reverse false claims, meaning improperly avoiding payment of money owed to the government, such as retaining an identified overpayment. Billers must treat discovered overpayments as obligations to resolve rather than windfalls.
Example: A practice notices a payer overpayment from last quarter but plans to keep it. Under reverse false claims principles, the money must be repaid because it is owed to the government.
Mistake to avoid: Assuming liability attaches only to submitted claims and never to money improperly retained from payers.
Reference: AAPC CPB study guide sample
3. Qui Tam Whistleblower Actions
A qui tam action is a civil lawsuit filed on behalf of both a private relator and the United States government under the False Claims Act. If the action produces a recovery, the relator who reported the wrongdoing may be awarded a percentage of the dollar amount recovered through the action.
Example: A billing employee reports systematic upcoding and a qui tam suit recovers funds; the employee shares in the recovery because the action was brought for the government.
Mistake to avoid: Confusing qui tam civil actions with criminal prosecutions handled solely by the Department of Justice.
Reference: AAPC CPB study guide sample
4. Truth in Lending Act in Collections
The Truth in Lending Act protects consumers in dealings with lenders and creditors. A medical practice that charges finance charges on outstanding patient balances is acting as a creditor and becomes subject to the Act, which imposes disclosure requirements before financed or installment payment arrangements are established.
Example: A practice proposes charging interest on a payment plan. Because finance charges make it a creditor, Truth in Lending disclosures must be provided before the arrangement starts.
Mistake to avoid: Setting up interest-bearing payment plans without recognizing creditor status and required consumer disclosures.
Reference: AAPC CPB study guide sample
5. Origins of Employer-Sponsored Coverage
Until the 1940s, healthcare insurance was not commonplace for Americans. During World War II, the 1942 Stabilization Act placed wage and price controls on employers: Congress limited the wages that could be offered but allowed the adoption of employee insurance plans. The 1954 Internal Revenue Code then stated that employer contributions to employee health plans were exempt from employee taxable income, making the demand for health insurance even more appealing. These two measures explain why employment remains the dominant channel through which Americans obtain private group coverage, which in turn drives the eligibility, group numbers, and coordination-of-benefit questions billers handle daily.
Example: An employer wants to attract workers during a wartime wage freeze. Offering an employee health insurance plan is a permissible way to compete because the Stabilization Act capped wages but allowed the adoption of employee insurance plans, and later tax treatment made such contributions exempt from employee taxable income.
Mistake to avoid: Assuming group health coverage through employers was always the norm, rather than a product of wartime wage controls and subsequent tax treatment.
Reference: AAPC CPB study guide sample
6. Payer, Geographic, and Setting Variation
Healthcare regulations are not always definitive and may vary by payer, geographic area, and the setting in which care is provided. Effective billers identify which precise regulatory requirement applies to a specific circumstance before submitting a claim, rather than assuming one national rule covers every situation.
Example: Two claims for the same service follow different rules because one payer and one state apply distinct requirements. Resolve by checking each payer's specific policy for that setting.
Mistake to avoid: Applying one payer's rule universally to every claim regardless of payer, state, or setting.
Reference: AAPC CPB study guide sample
HIPAA Privacy and Transaction Standards
7. Covered Entity Definition
Under HIPAA, covered entities are health plans, healthcare clearinghouses, and any healthcare provider that transmits health information electronically in connection with standard transactions such as claims or eligibility inquiries. A provider that merely uses email but never transmits standard transactions is not covered on that basis alone.
Example: A small practice bills only on paper and sends no electronic standard transactions. It does not become a covered entity merely by using email for scheduling.
Mistake to avoid: Assuming any use of email or computers automatically makes a provider a covered entity.
Reference: HHS Summary of the HIPAA Privacy Rule; AAPC CPB study guide sample
8. Business Associate Relationships
A business associate is a person or organization outside a covered entity's workforce that performs functions involving protected health information on its behalf, such as claims processing, billing, repricing, or utilization review. A written business associate agreement imposing safeguards is required before protected information is shared for these services.
Example: A practice hires a billing company to submit claims. The company is a business associate, so a signed agreement with privacy safeguards must precede any record sharing.
Mistake to avoid: Sending patient data to a billing vendor before a business associate agreement is executed.
Reference: HHS Summary of the HIPAA Privacy Rule; AAPC CPB study guide sample
9. Protected Health Information Scope
Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate in any form, whether electronic, paper, or oral. It includes demographic data tied to health, care, or payment, but excludes employment records a covered entity maintains in its role as an employer.
Example: A biller discusses a patient's outstanding balance aloud in a waiting room. The oral disclosure involves protected health information because payment information is covered in any medium.
Mistake to avoid: Treating spoken or handwritten patient details as outside privacy protections because they are not electronic.
Reference: HHS Summary of the HIPAA Privacy Rule
10. Minimum Necessary Standard
Covered entities must make reasonable efforts to limit uses, disclosures, and requests of protected health information to the minimum needed to accomplish the intended purpose. Sending an entire record when only specific dates of service were requested violates the standard unless the whole record can be specifically justified.
Example: A payer requests records for three dates of service. Send only those encounters; copying the complete chart is unnecessary and exceeds the minimum necessary.
Mistake to avoid: Routinely releasing entire charts when a request covers only specific encounters or services.
Reference: HHS Summary of the HIPAA Privacy Rule; AAPC CPB study guide sample
11. Treatment, Payment, and Operations Uses
A covered entity may use or disclose protected health information without individual authorization for its own treatment, payment, and healthcare operations activities. Payment includes obtaining premiums, determining coverage responsibilities, and furnishing or obtaining reimbursement, so routine claim submission requires no signed patient authorization.
Example: A biller submits a claim with diagnosis codes to the patient's insurer. No patient authorization is required because this is a payment activity permitted by the Privacy Rule.
Mistake to avoid: Delaying claim submission while waiting for a patient's written authorization that the rule does not require.
Reference: HHS Summary of the HIPAA Privacy Rule
12. Standard Transactions and Code Sets
HIPAA adopted standard code sets, including CPT, HCPCS, ICD-10-CM, ICD-10-PCS, NDC, and CDT, for covered transactions. Entities conducting transactions electronically must use the adopted ASC X12 Version 5010 standards, or NCPDP standards for certain pharmacy transactions, for each transaction performed.
Example: A practice submits electronic professional claims. It must use the adopted X12 5010 format and standard code sets rather than a proprietary format the payer prefers.
Mistake to avoid: Using a payer's custom electronic format for a transaction covered by the adopted national standards.
Reference: AAPC CPB study guide sample; HHS Summary of the HIPAA Privacy Rule
HIPAA Authorizations and Patient Rights
13. Valid Authorization Requirements
Uses and disclosures not permitted by the Privacy Rule require a written authorization in plain language specifying the information involved, who discloses and receives it, an expiration, and the right to revoke in writing. Practices should keep authorization forms current, updating them no less than once a year.
Example: A patient requests records be sent to an attorney. Release only with a signed authorization listing the attorney, the records, and an expiration date.
Mistake to avoid: Releasing records on a verbal request or on an outdated authorization form missing required elements.
Reference: HHS Summary of the HIPAA Privacy Rule; AAPC CPB study guide sample
14. Psychotherapy Notes Protection
Psychotherapy notes, which are separated from the rest of the medical record, receive heightened protection. Most uses for treatment, payment, and operations require an authorization, unlike ordinary record content. The notes exclude medication monitoring, session times, and treatment summaries, which follow standard rules.
Example: An insurer requests psychotherapy notes during claim review. Deny the release without a patient authorization, since payment review does not override the special protection.
Mistake to avoid: Releasing psychotherapy notes under the general payment permission that applies to the rest of the record.
Reference: HHS Summary of the HIPAA Privacy Rule
15. Marketing Communication Rules
Marketing means communications encouraging purchase or use of a product or service, and it generally requires an authorization, especially when remuneration is involved, which must be revealed in the authorization. Exceptions include treatment communications, face-to-face communications, and promotional gifts of nominal value.
Example: A practice wants to send patients a letter promoting a pharmacy's product for payment. Authorization is required because remuneration is involved; a treatment reminder would not need one.
Mistake to avoid: Sending paid third-party promotional communications to patients without an authorization disclosing the remuneration.
Reference: HHS Summary of the HIPAA Privacy Rule
16. Right of Access and the Designated Record Set
Individuals may review and obtain copies of protected health information in the designated record set, which includes a provider's medical and billing records. Reasonable, cost-based fees for copying and postage are permitted, while psychotherapy notes and information compiled for legal proceedings fall outside the right.
Example: A patient requests a copy of her billing records. Provide them, charging only reasonable copying costs, because billing records are within the designated record set.
Mistake to avoid: Denying access to billing records or charging fees unrelated to actual copying and postage costs.
Reference: HHS Summary of the HIPAA Privacy Rule
17. Accounting of Disclosures
Individuals may request an accounting of disclosures covering the six years preceding the request. Disclosures for treatment, payment, operations, to the individual, under an authorization, or of a limited data set are excluded, so most routine billing activity does not appear on an accounting.
Example: A patient asks what disclosures occurred in six years. The list excludes claim submissions to his insurer because those are payment disclosures not subject to accounting.
Mistake to avoid: Including routine payment disclosures on an accounting or refusing the request entirely out of confusion.
Reference: HHS Summary of the HIPAA Privacy Rule
18. De-identification Versus Limited Data Sets
De-identified information, created by removing specified identifiers with no actual knowledge that it could re-identify anyone, carries no use restrictions. A limited data set removes fewer direct identifiers and may be used only for research, public health, or healthcare operations under a data use agreement promising safeguards.
Example: A researcher needs town-level data. Provide a limited data set with a signed data use agreement; full de-identification is unnecessary because the purpose qualifies.
Mistake to avoid: Sharing a limited data set without a data use agreement as if it were fully de-identified.
Reference: HHS Summary of the HIPAA Privacy Rule
Insurance Models and Cost Sharing
19. HMO Gatekeeping Structure
A health maintenance organization typically requires members to select a primary care physician who coordinates care and issues referrals to specialists. In a group model, the HMO contracts with a multi-specialty group paid an established rate that is distributed to individual physicians as part of their salaries.
Example: A member wants to see a dermatologist. The visit must be coordinated through the primary care physician because the HMO plan requires referrals for specialist access.
Mistake to avoid: Submitting a specialist claim without the referral the HMO model requires, inviting denial.
Reference: AAPC CPB study guide sample
20. PPO Network Flexibility
Preferred provider organizations set up networks of doctors, hospitals, and other providers that negotiate predetermined fees with a given carrier. Unlike HMOs, PPO members do not maintain a primary care physician and need no referrals, giving them broader direct access to network specialists.
Example: A PPO member self-refers to a network cardiologist. The claim is payable without primary care coordination because PPO design does not require referrals.
Mistake to avoid: Applying HMO referral requirements to a PPO member's self-referred specialist visit.
Reference: AAPC CPB study guide sample
21. MCO Integrated Functions
A managed care organization combines the functions of health insurance, delivery of care, and administration within one structure. This distinguishes it from a standalone insurer that merely pays claims, because the MCO also influences how and where members receive their care.
Example: A plan both finances care and runs its own clinics with utilization controls. Classify it as an MCO because insurance, delivery, and administration are combined.
Mistake to avoid: Labeling any paying insurer an MCO without the combined insurance, care delivery, and administration functions.
Reference: AAPC CPB study guide sample
22. FSA Versus HSA Consumer Accounts
A flexible spending account holds individual contributions used to pay out-of-pocket healthcare costs, but for the most part unused money is forfeited at plan year end. A health savings account pairs high-deductible insurance with a tax-advantaged account, may be funded by employers or employees, earns interest, and is portable.
Example: A patient asks which account survives a job change. The HSA is portable; the FSA balance is typically forfeited if unused during the plan year.
Mistake to avoid: Telling a patient an FSA carries over like an HSA when unused funds are generally forfeited.
Reference: AAPC CPB study guide sample
23. Participating Versus Non-Participating Providers
A participating Medicare provider accepts assignment and writes off the difference between the billed charge and the approved amount. A non-participating provider may balance bill the patient only up to a limiting charge, which is set at 115 percent of the non-participating Medicare Physician Fee Schedule amount.
Example: A non-participating physician treats a Medicare patient. Charges above the limiting charge cannot be collected from the patient, capping balance billing.
Mistake to avoid: Balance billing a Medicare patient beyond the limiting charge because the provider does not participate.
Reference: AAPC CPB study guide sample
24. Medigap Supplemental Coverage
Medigap policies were designed by the federal government but are marketed by private commercial insurers to supplement Original Medicare, filling gaps in deductibles, copayments, and coinsurance. They supplement rather than replace Medicare, so claims still adjudicate under Medicare rules before the supplement pays remaining cost shares.
Example: A patient with Medicare and a Medigap plan owes Part B coinsurance. Bill Medicare first; the supplement is designed to cover the remaining patient share.
Mistake to avoid: Billing a Medigap plan as primary coverage before Medicare adjudicates the underlying claim.
Reference: AAPC CPB study guide sample
Government Payer Rules
25. Medicare Part A Versus Part B
Medicare Part A covers hospital care, skilled nursing facility care, nursing home care, hospice, and home health services. Part B covers medically necessary services such as physician visits, ambulance services, durable medical equipment, and mental health services, and has greatly expanded preventive coverage. Correct part selection directs the claim properly.
Example: An inpatient hospital stay bills under Part A while the surgeon's professional services bill under Part B, because coverage splits by service type.
Mistake to avoid: Routing a physician's professional service to Part A because the patient was hospitalized.
Reference: AAPC CPB study guide sample
26. Medicare Eligibility Before Age 65
Medicare Part A coverage is available below age 65 for individuals who have received Social Security or Railroad Retirement disability benefits for 24 months, or who have End-Stage Renal Disease and meet certain requirements. Verification should confirm which qualifying pathway applies before assuming ineligibility.
Example: A 52-year-old on dialysis applies for Medicare coverage. Confirm ESRD-related eligibility rather than assuming Medicare is unavailable before age 65.
Mistake to avoid: Denying Medicare billing for a patient under 65 who qualifies through disability or ESRD.
Reference: AAPC CPB study guide sample
27. Assignment, Allowed Amounts, and Coinsurance
When a provider accepts assignment, the Medicare approved amount becomes the payment ceiling and the provider writes off the difference between the billed charge and the approved amount. Medicare pays 80 percent of the approved amount once the deductible is met, and the patient owes the 20 percent coinsurance.
Example: A visit approved at a set amount with the deductible met results in Medicare paying 80 percent and the patient owing 20 percent; the billed excess is written off.
Mistake to avoid: Billing the patient for the write-off difference between the charge and the approved amount.
Reference: AAPC CPB study guide sample
28. Medicare Preventive Service Policy Requirements
Medicare screening services often carry specific diagnosis requirements set by policy. For example, screening Pap smear coverage depends on frequency conditions or documented high-risk factors such as early onset sexual activity, multiple partners, or DES exposure. The biller must match the diagnosis to Medicare policy, which is payer policy rather than CPT guidance.
Example: A screening Pap claim denies. Review whether the diagnosis supports coverage under frequency or high-risk criteria rather than resubmitting unchanged.
Mistake to avoid: Attaching a routine diagnosis to a screening claim without checking the service's Medicare coverage policy.
Reference: AAPC CPB study guide sample
29. Medicare Secondary Payer Determination
When a Medicare patient has other insurance, Medicare may be the secondary payer. Medicare provides a Medicare Secondary Payer form that providers use to gather the information needed to determine whether Medicare is secondary for a patient with Medicare and another insurance, preventing incorrect primary billing.
Example: A Medicare patient presents an employer group card. Complete the MSP form before billing to establish whether Medicare pays primary or secondary.
Mistake to avoid: Automatically billing Medicare primary when another coverage exists without MSP screening.
Reference: AAPC CPB study guide sample
30. Medicaid Federal-State Structure
Medicaid is federally overseen but state-administered: each state sets eligibility standards, service scope, and payment rates. States receive matching federal funds, known as FMAP, only if mandatory services such as inpatient and outpatient hospital, physician, laboratory, and prenatal care are provided to eligible individuals.
Example: A state declines to cover an optional service. It may do so, but dropping a mandatory service would jeopardize federal matching funds.
Mistake to avoid: Assuming Medicaid benefits are identical across states or entirely optional for each state.
Reference: AAPC CPB study guide sample
Patient Registration and Coverage Verification
31. Reading the Insurance ID Card
Insurance cards carry the identification or policy number, policyholder name, benefit types, deductible, copayments by service setting, and pharmacy copays, while the back lists contact numbers and the claims submission address. Card data drives accurate claim entry, so every field should be captured at registration.
Example: A card shows separate copays for office, urgent care, and hospital visits. Collect the office copay amount, not the urgent care figure, for a clinic visit.
Mistake to avoid: Keying the group number where the policy identification number belongs on the claim.
Reference: AAPC CPB study guide sample
32. Card and Identification Copies on File
Practices should photocopy or scan the front and back of the patient's insurance cards and keep the copies in the patient's financial record, along with the completed registration form and photo identification. These copies support identification purposes and resolve disputes over card-based information.
Example: A payer disputes the subscriber ID submitted. The scanned card copy confirms the correct number and supports a corrected rebill of the claim.
Mistake to avoid: Discarding card images after initial entry, leaving no evidence when eligibility or ID disputes arise.
Reference: AAPC CPB study guide sample
33. Handling Ineligible Verification Results
When eligibility verification shows the patient is not eligible, contact the patient for updated insurance information. If the patient believes the information is correct and coverage should apply, the patient must contact the insurer to update eligibility files, then chooses either to reschedule or be treated as self-pay.
Example: Verification returns not eligible but the patient insists coverage is active. Let the patient decide between rescheduling and self-pay rather than billing the inactive plan.
Mistake to avoid: Submitting claims to a plan showing ineligibility instead of letting the patient resolve it or self-pay.
Reference: AAPC CPB study guide sample
34. Verification of Benefits Content
Beyond eligibility, verification of benefits confirms effective dates, patient copay, coinsurance, and deductible amounts, and plan benefits as they pertain to specialty and place of service. Effective and termination dates should be recorded in the practice management system so automated billing follows them.
Example: Benefits show a specialist copay and unmet deductible. Collect both at check-in because verification revealed the amounts applicable to that visit.
Mistake to avoid: Verifying only active eligibility while ignoring deductible status and service-specific benefit limits.
Reference: AAPC CPB study guide sample
35. Birthday Rule for Dependent Children
When a child is covered under insurance plans from both parents, the birthday rule designates the plan of the parent whose birthday comes first in the calendar year as primary. Only the month and day are considered; the year of birth is not a factor in the determination.
Example: The father's birthday is October 8 and the mother's is June 1. The mother's plan is primary because June precedes October, regardless of birth years.
Mistake to avoid: Choosing primary coverage by the parent's age or birth year instead of month and day order.
Reference: AAPC CPB study guide sample
36. Adult Primary and Secondary Coverage
When a patient is the subscriber on one plan and is also covered under another, such as a spouse's plan, the plan on which the patient is the subscriber is primary and the other coverage is secondary. Claim submission order follows this hierarchy, with the secondary plan billed after the primary adjudicates.
Example: A patient subscribes to her own employer plan and is a dependent on her husband's. Bill her own plan first because subscriber status makes it primary.
Mistake to avoid: Billing the spouse's plan first because it was presented at registration before the patient's own card.
Reference: AAPC CPB study guide sample
ICD-10-CM Conventions and Code Structure
37. Alphabetic Index Then Tabular Verification
To select a code matching a documented diagnosis, first locate the term in the Alphabetic Index, then verify the code in the Tabular List, reading and being guided by all instructional notes. Assigning from the Index alone risks missing excludes notes, sequencing instructions, or required additional characters.
Example: An index entry leads to a code that the Tabular List shows requires a seventh character. Only the Tabular verification reveals the complete, valid code.
Mistake to avoid: Assigning the alphabetic index code without verifying it against the Tabular List instructions.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
38. Placeholder Character X
The placeholder character X fills empty character positions when a code requiring a seventh character has fewer than six characters. It exists solely as a filler so the seventh character occupies its correct position within the code, and the resulting code is invalid without the placeholder.
Example: A three-character category with an applicable seventh character needs X placeholders in the fourth through sixth positions before appending the seventh character extension.
Mistake to avoid: Appending the seventh character directly to a short code, omitting required X filler positions.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
39. Seventh Character Requirement
Codes with an applicable seventh character are considered invalid without it, even when all other characters are correct. The seventh character often distinguishes encounter context such as initial, subsequent, or sequela, so the documentation must support whichever extension is selected.
Example: A fracture code submitted without its seventh character rejects as invalid. Add the extension matching the encounter, such as initial active treatment, to complete the code.
Mistake to avoid: Submitting a six-character code when the classification requires a seventh character extension.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
40. Excludes1 Versus Excludes2 Notes
An Excludes1 note means the excluded code should never be used at the same time as the code above the note, typically for mutually exclusive conditions such as congenital versus acquired forms. An Excludes2 note means the excluded condition is not part of the code, but both may be reported together when documented.
Example: A note under one code excludes another with Excludes2. Both codes may be billed together because the patient truly has both unrelated conditions.
Mistake to avoid: Treating an Excludes2 note as a prohibition and dropping a documented coexisting condition from the claim.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
41. With Convention Causal Presumption
When the word with or in links two conditions in a code title, the Alphabetic Index, or an instructional note, the classification presumes a causal relationship between them. Code the conditions as related even without explicit provider linkage, unless the documentation clearly states the conditions are unrelated.
Example: An index entry links a condition with a manifestation. Code them as related despite no explicit linkage note, because the classification presumes the relationship.
Mistake to avoid: Separating conditions the classification links with with just because the provider did not explicitly connect them.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
42. Default Codes
The default code is the code listed next to a main term in the Alphabetic Index, representing the condition most commonly associated with that term or the unspecified code for it. When a condition is documented without additional information, such as acute or chronic, the default code should be assigned.
Example: Appendicitis is documented with no acuity qualifier. Assign the default code listed at the main term rather than selecting an acute or chronic alternative.
Mistake to avoid: Choosing an acute or chronic code when documentation lacks the detail supporting either.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Diagnosis Selection Rules Across Settings
43. Etiology and Manifestation Sequencing
When a condition has an underlying etiology and body system manifestations, the underlying condition is sequenced first, followed by the manifestation code, which often carries in diseases classified elsewhere in its title. In the Alphabetic Index, the bracketed manifestation code is always sequenced second, never first.
Example: Dementia due to Parkinson's disease is documented. Sequence the Parkinson's etiology code first, then the bracketed dementia manifestation code second, per the convention.
Mistake to avoid: Listing a manifestation code first when the convention requires the underlying etiology to precede it.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
44. Provider Statement Over Clinical Criteria
Code assignment is based on the provider's diagnostic statement that the condition exists, not on the clinical criteria the provider used to establish the diagnosis. If medical record documentation conflicts, the correct response is to query the provider rather than independently judging which diagnosis the evidence supports.
Example: A note documents a diagnosis despite atypical findings. Code the stated diagnosis; do not second-guess the clinical reasoning behind the provider's conclusion.
Mistake to avoid: Assigning or removing a diagnosis based on your own review of lab values or clinical criteria.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
45. Non-Provider Documentation Exceptions
Code assignment is based on the patient's provider's documentation, with limited exceptions: BMI, laterality, coma scale, pressure ulcer stage, blood alcohol level, and similar data may be taken from other clinicians' documentation. The associated diagnosis itself, however, must still be documented by the patient's provider.
Example: A nurse documents a pressure ulcer stage but the provider documents the ulcer diagnosis. Use both: the nurse's stage detail with the provider's diagnostic statement.
Mistake to avoid: Coding a diagnosis itself from a nurse's or technician's note when only the data element, not the diagnosis, is permitted.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
46. Uncertain Diagnosis by Setting
Inpatient guidelines permit coding conditions documented as probable or uncertain at discharge as if established, with HIV as a notable exception requiring confirmation. Outpatient rules differ: when no definitive diagnosis has been established by the end of the encounter, codes for the signs and symptoms are reported instead.
Example: An outpatient note ends with suspected pneumonia. Code the documented symptom, such as cough, because outpatient rules bar coding the unconfirmed diagnosis.
Mistake to avoid: Coding a suspected condition as confirmed on an outpatient claim using inpatient uncertainty rules.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
47. Signs, Symptoms, and Unspecified Codes
Sign, symptom, and unspecified codes have acceptable and even necessary uses when they best reflect what is known about the encounter. If no definitive diagnosis exists by visit end, report symptoms; when a diagnosis lacks detail, an unspecified code is acceptable. Never select specificity unsupported by the documentation.
Example: Pneumonia is diagnosed but the type is undocumented. Assign the unspecified pneumonia code rather than guessing a specific organism or type.
Mistake to avoid: Choosing a specific code the record does not support just to avoid an unspecified code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
48. Acute and Chronic Condition Sequencing
When the same condition is documented as both acute and chronic, and separate subentries exist in the Alphabetic Index at the same indentation level, code both and sequence the acute code first. This ordering applies whenever both phases of the condition are documented for the encounter.
Example: A note documents acute exacerbation of a chronic condition with separate index subentries. Report both codes, sequencing the acute one first and the chronic second.
Mistake to avoid: Coding only the chronic form when the acute exacerbation is separately documented with its own subentry.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Condition-Specific Coding Rules
49. HIV Coding by Confirmation Status
Only confirmed cases of HIV infection or illness are coded, and confirmation does not require positive serology, because the provider's statement suffices. Asymptomatic HIV-positive status codes to Z21, HIV disease codes to B20, and inconclusive serology codes to R75. Once B20 is assigned, later encounters never revert to R75 or Z21.
Example: A note states HIV positive with no symptoms or related illness. Assign Z21, the asymptomatic status code, rather than the B20 disease code.
Mistake to avoid: Coding B20 for an asymptomatic patient whose only documentation is a positive test status.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
50. HIV Sequencing by Reason for Encounter
When a patient with HIV disease is admitted or seen for an HIV-related condition, B20 is the principal or first-listed diagnosis, followed by codes for the related conditions. When the encounter is for an unrelated condition, such as a traumatic injury, the unrelated condition is principal and B20 is reported as a secondary diagnosis.
Example: A patient with HIV is treated for a fracture. Sequence the injury first and report B20 as an additional diagnosis because the encounter is unrelated.
Mistake to avoid: Automatically sequencing B20 first when the visit is clearly for an unrelated injury.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
51. Z Codes as Encounter Reasons
Z codes may be used in any healthcare setting to indicate the reason for an encounter or to provide additional information about a patient encounter, including encounters for circumstances other than a disease or injury. They can serve as first-listed diagnoses when they represent the encounter's purpose.
Example: A healthy patient presents for a routine health screening with no complaint. Assign the screening Z code as the first-listed reason for the encounter.
Mistake to avoid: Reserving Z codes for hospital use only when the guidelines permit them in any setting.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
52. Social Determinants of Health Coding
For social determinants of health in categories Z55-Z65, code assignment may be based on documentation from clinicians involved in the patient's care, such as social workers, community health workers, or nurses, and on patient self-reported information signed off and incorporated into the record by a clinician or provider. These codes are reported only as secondary diagnoses.
Example: A signed note records food insecurity expressed by the patient. Assign the food insecurity Z code as a secondary diagnosis, supported by the clinician-signed documentation.
Mistake to avoid: Assigning a social determinants code as first-listed, or from unsigned patient-reported information.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
53. External Cause Code Placement
External cause of morbidity codes capture how an injury happened, the intent, the place, the activity, and the person's status. They are never recorded as a principal diagnosis or first-listed code; the injury code is sequenced first. They should be assigned for each encounter for care and treatment of the injury.
Example: A laceration from a fall at home is treated. Sequence the injury code first, then the external cause codes for the fall, place, and activity.
Mistake to avoid: Listing the external cause code as the first-listed diagnosis ahead of the injury being treated.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
54. Borderline Diagnosis Handling
A provider-documented borderline diagnosis is coded as confirmed, unless the classification provides a specific entry for that borderline condition, such as borderline diabetes. No distinction is made between care settings for borderline conditions, and unclear documentation warrants a query to the provider for clarification.
Example: A discharge note lists borderline hypertension with no specific index entry. Code it as the confirmed condition because borderline documentation is treated as established.
Mistake to avoid: Treating a borderline diagnosis as uncertain and omitting it under outpatient symptom-only rules.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Claims Lifecycle, Denials, and Special Payers
55. Clean Claim Standard
A clean claim is one submitted with all the information necessary for the payer to process it, including complete patient, provider, insurance, and service data. Clean claims move directly into adjudication, while incomplete submissions stall or reject, delaying payment and creating rework for the billing team.
Example: A claim includes all required fields and documentation. It processes as a clean claim without additional information requests because nothing necessary was missing.
Mistake to avoid: Submitting claims missing policy numbers or service details and expecting the payer to request them.
Reference: AAPC CPB study guide sample
56. Chargemaster Versus Superbill
The chargemaster is the hospital-specific master list of all procedures, services, supplies, and medications billed to payers, each with its code, charge, and revenue code. Physician offices instead use an encounter form or superbill capturing the visit's services. Revenue codes are four-digit NUBC codes classifying each chargemaster line item.
Example: A hospital bills a thyroid sonogram from its chargemaster, which pairs the CPT code with a revenue code and set charge; an office superbill lists only the visit services.
Mistake to avoid: Using the office superbill term for a hospital's chargemaster or omitting revenue codes on facility line items.
Reference: AAPC CPB study guide sample
57. Clearinghouses and EDI Rejections
A clearinghouse is an entity that processes or facilitates the processing of claims for providers and healthcare plans, converting nonstandard data into standard format. On EDI reports, ACK means the claim was acknowledged and forwarded to the payer, while REJ means rejected, requiring corrections and a rebill.
Example: A report shows REJ for invalid subscriber ID. Pull the insurance card, correct the ID, and rebill rather than waiting for payer action.
Mistake to avoid: Ignoring a rejected claim assuming the payer will eventually process it like an acknowledged one.
Reference: AAPC CPB study guide sample; HHS Summary of the HIPAA Privacy Rule
58. Denial Versus Rejection Response Paths
A rejection stops a claim before payer adjudication and is resolved by correcting the error and rebilling. A denial is an adverse determination after adjudication and is addressed through the payer's appeal process supported by documentation. The Affordable Care Act added appeal protections for consumers facing adverse decisions.
Example: A claim denies as not medically necessary. File an appeal with supporting documentation rather than simply correcting data and resubmitting as if rejected.
Mistake to avoid: Rebilling a denied claim unchanged instead of following the appeal process with supporting records.
Reference: AAPC CPB study guide sample
59. Inpatient Versus Outpatient Payment Basis
Billing an inpatient stay as an outpatient stay in error changes the payment basis: inpatient claims are paid based on the diagnoses reported, while outpatient claims are paid based on the procedures reported. Correct patient status designation is therefore a payment-critical decision rather than a clerical detail.
Example: An admission is mistakenly billed as outpatient. Payment would be computed from procedures rather than diagnoses, so correct the status before resubmission.
Mistake to avoid: Treating patient status as a minor field and overlooking its effect on the entire payment methodology.
Reference: AAPC CPB study guide sample
60. Workers' Compensation and Subrogation
Workers' compensation covers work-related injuries and illnesses and is billed to the employer's program or carrier rather than the patient's health plan; HIPAA permits disclosures needed to comply with these laws. With liability situations, the health insurance plan is billed first, and subrogation later determines whether a liability payer should have been primary.
Example: A patient is injured on the job. Bill the workers' compensation carrier with injury and employment details, not the patient's commercial plan.
Mistake to avoid: Billing the patient's regular health insurance for a documented work-related injury.
Reference: AAPC CPB study guide sample; HHS Summary of the HIPAA Privacy Rule
References and further reading
Source links checked on Oct 2, 2026.