Work through the groups in order: business and terminology foundations first, then ICD-10-CM structure, selection guidelines, and setting-specific rules, followed by CPT and HCPCS application, body-system practice, compliance, privacy, and finally instructional methods. Each concept pairs a rule with a resolved example and a common mistake, so cover the example, decide for yourself, and compare. Verify every code in current official references before use, since code sets and guidelines change. This outline supports subject mastery and lesson planning; it is not an official syllabus and does not replace primary sources.
Foundations of the Coding Profession and the Business of Medicine
1. Medical Coding as Translation
Medical coding means translating provider documentation into standardized diagnosis and procedure codes; it is not the act of creating claim forms, programming records systems, or building electronic transmission files. The coder's product is accurate code assignment that others use for billing and reporting.
Example: A student lists completing a CMS-1500 as the definition of coding; correct it as translating the note into codes, because form completion is a downstream billing task.
Mistake to avoid: Teaching that medical coding equals claim form preparation or electronic transmission file creation.
Reference: AAPC CPC study guide sample
2. Hierarchy of Providers and QHP Work
Physician-level work and qualified healthcare practitioner work drive physician-based code assignment, while clinical staff contributions such as vitals or nursing notes support but never replace the provider's documentation. Distinguish who is legally accountable for the diagnosis before assigning codes.
Example: A nurse documents a pressure ulcer stage; the stage may be used, but the ulcer diagnosis itself must come from the treating provider before it is coded.
Mistake to avoid: Assigning a diagnosis from staff documentation when the provider never documented the condition.
Reference: AAPC CPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
3. Payer Types: Commercial Versus Federal
Commercial payers are private insurers such as Blue Cross Blue Shield, while Medicare and Medicaid are government programs. Rules can differ by payer type, so identify the payer before selecting payer-specific codes or policies; a rule that applies to Medicare may not apply to a commercial plan.
Example: A question asks which payer is commercial among Medicare, Medicaid, and Blue Cross Blue Shield; answer Blue Cross Blue Shield because the other two are government-sponsored programs.
Mistake to avoid: Treating Medicare and Medicaid as commercial payers or assuming all payers follow identical policies.
Reference: AAPC CPC study guide sample
4. Medicare Part Distinctions
Medicare parts divide benefit responsibilities: Part A covers inpatient hospital care, Part B covers physician and outpatient services, Part C combines benefits through private Medicare Advantage plans, and Part D covers prescription drugs dispensed by pharmacies. Match the service and setting to the correct part before billing.
Example: A pharmacy dispenses take-home pain medication during an office chemotherapy infusion; the pharmacy bills Part D because Part D covers prescription drugs, not the physician-administered infusion.
Mistake to avoid: Billing take-home prescription drugs under Part B simply because the visit occurred in a physician office.
Reference: AAPC CPC study guide sample
5. RBRVS Components and Site of Service
Medicare physician payment uses a resource-based relative value scale built from physician work, practice expense, and professional liability insurance components. Practice expense differs between facility and non-facility settings because the cost of providing the same service varies by location, producing different payment totals.
Example: An established office visit shows separate facility and non-facility totals in the fee schedule; use the column matching where the service was actually performed.
Mistake to avoid: Applying the non-facility total to a service performed in a hospital setting.
Reference: AAPC CPC study guide sample
6. Medical Necessity Links Diagnosis to Service
Medical necessity means the documented diagnosis must support the service billed; without that linkage, payers deny claims even when the procedure was performed correctly. Teach students to test every procedure against the documented reason for the encounter before releasing codes.
Example: A screening lab is billed with only a wellness diagnosis the note does not support; the claim is vulnerable to denial because necessity is not established by documentation.
Mistake to avoid: Assuming a performed and documented procedure is automatically payable regardless of the stated diagnosis.
Reference: AAPC CPC study guide sample
Medical Terminology and Anatomy for Coders
7. Word Part Translation
Break terms into prefix, combining root, and suffix to approximate meaning before looking up codes. Cardi (heart), my (muscle), and -pathy (disease) combine into cardiomyopathy, a diseased heart muscle; decoding terms this way speeds accurate index lookup.
Example: A student cannot find hepatomegaly; splitting hepato (liver) and -megaly (enlargement) points to the correct index main term for liver enlargement.
Mistake to avoid: Searching the index for a full clinical term instead of decoding its word parts first.
Reference: AAPC CPC study guide sample
8. Plural Formation Rules
Medical plurals follow predictable ending changes: a to ae, is to es, um to a, us to i, nx to ges, and on to a, among others. Recognizing that thrombi is plural and thrombus singular prevents indexing under the wrong form of a term.
Example: A note says phalanges; convert to singular phalanx before index lookup, because the classification lists main terms in singular form.
Mistake to avoid: Indexing the plural form of a term and missing the correct singular main entry.
Reference: AAPC CPC study guide sample
9. Anatomic Position and Directional Terms
The anatomic position is upright, face forward, arms at the sides with palms forward; directional terms such as lateral, medial, distal, and proximal are defined relative to it. Laterality and site terms in documentation map to code characters only when position conventions are understood.
Example: A note describes a wound on the lateral forearm; the coder identifies the outer aspect of the lower arm to select the correct site code.
Mistake to avoid: Confusing medial and lateral or right and left when selecting site-specific codes.
Reference: AAPC CPC study guide sample
10. Skin Layers and the Subcutaneous Boundary
Skin has an outer epidermis and a dermis with papillary and reticular layers; subcutaneous tissue lies beneath the dermis and is not a skin layer. Procedures and conditions described as subcutaneous are classified differently from those confined to the skin layers themselves.
Example: A lesion removal note states involvement to subcutaneous fat; the coder recognizes deeper-than-skin involvement, which affects procedure selection and depth documentation.
Mistake to avoid: Treating subcutaneous tissue as the third layer of skin when classifying depth.
Reference: AAPC CPC study guide sample
11. Eponyms and Acronyms in Documentation
Providers document with eponyms and acronyms that do not appear verbatim in code indexes, so coders must translate them into anatomic or diagnostic equivalents. Body-system chapter objectives include recognizing common eponyms and acronyms before attempting any code lookup.
Example: A note references a named eponym for a breast procedure; the coder converts it to its anatomic description to locate the correct procedure family in the index.
Mistake to avoid: Concluding no code exists because the eponym itself is absent from the index.
Reference: AAPC CPC study guide sample
12. Terminology Drives Code Specificity
Documentation vocabulary such as acute versus chronic, right versus left, and superficial versus deep directly controls code selection and sequencing. Teaching students to underline these discriminating terms in notes builds the habit of capturing the full specificity the classification supports.
Example: A note says acute on chronic bronchitis; the coder captures both descriptors because the classification provides separate acute, chronic, and combined entries.
Mistake to avoid: Coding only the chronic descriptor when documentation supports both acute and chronic states.
Reference: AAPC CPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
ICD-10-CM Structure and Conventions
13. Alphabetic Index First, Then Tabular Verification
Locate the documented term in the Alphabetic Index, then verify the code in the Tabular List, reading all instructional notes before finalizing. The index points; the tabular confirms, adds required characters, and imposes excludes and inclusion rules the index may not show.
Example: Index lookup for varicose vein with pain yields a candidate code; verification in the Tabular List confirms characters and any notes before it is reported.
Mistake to avoid: Reporting a code straight from the Alphabetic Index without Tabular List verification.
Reference: AAPC CPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
14. Only Full Codes Are Reportable
Categories are three characters and subcategories extend to four or five, but only complete codes of three to seven characters may be reported; a category or subcategory alone is never a valid submission. Codes with applicable seventh characters are invalid without them.
Example: A student stops at a four-character subcategory; the coder corrects it to the full code because reporting requires the final level of subdivision.
Mistake to avoid: Submitting a three-character category or truncated subcategory as if it were a complete code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
15. Placeholder X for Seventh Characters
When a code requiring a seventh character has fewer than six characters, placeholder X fills the empty positions so the extension lands in the seventh position. Categories such as poisoning and external cause codes commonly require this padding before the code becomes valid.
Example: A five-character injury code needs an initial-encounter extension; the coder inserts X to push the extension into the seventh position for validity.
Mistake to avoid: Appending the seventh character directly to a short code without the X placeholder.
Reference: AAPC CPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
16. NEC Versus NOS Abbreviations
NEC (not elsewhere classifiable) marks an other specified code used when the provider documented detail the classification lacks a specific code for; NOS (not otherwise specified) equals unspecified and is used only when documentation lacks the needed detail. Documentation richness, not coder preference, chooses between them.
Example: A provider documents a rare specified lesion type with no dedicated code; the NEC entry is selected because specificity exists but lacks its own code.
Mistake to avoid: Using an unspecified NOS code when the documentation supports an other-specified NEC code.
Reference: AAPC CPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
17. Brackets and Parentheses as Conventions
Parentheses enclose nonessential modifiers that may be present or absent without changing the code; brackets in the Tabular List enclose synonyms or explanatory phrases, while brackets in the Alphabetic Index signal that multiple codes are required for one condition.
Example: An index entry shows a bracketed second code after congenital syphilitic hepatitis; both codes are reported because brackets in the index mandate the combination.
Mistake to avoid: Ignoring index brackets and reporting only the first code of a required pair.
Reference: AAPC CPC study guide sample
18. Excludes1 Versus Excludes2 Notes
An Excludes1 note means the excluded code can never be reported with the code above it because the conditions cannot coexist, such as congenital versus acquired forms; an Excludes2 note means the excluded condition is not part of the code but both may be reported together when documented.
Example: A patient has both conditions named under an Excludes2 note; both codes are reported because Excludes2 permits coexisting conditions, unlike Excludes1.
Mistake to avoid: Treating every excludes note as a prohibition and dropping a documented coexisting Excludes2 condition.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Guideline Logic for Diagnosis Code Selection
19. Etiology and Manifestation Sequencing
When one underlying condition produces manifestations, the etiology is sequenced first and the manifestation follows, driven by use additional code notes at the etiology and code first notes at the manifestation. Manifestation titles reading in diseases classified elsewhere can never stand as first-listed or principal.
Example: Dementia in Parkinson's disease is indexed as the Parkinson etiology code followed by a bracketed dementia code; the etiology is sequenced first per the convention.
Mistake to avoid: Listing a manifestation code first or reporting it without its underlying etiology code.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
20. The With Presumption of Relationship
In titles, index entries, and instructional notes, with or in means associated with or due to, and the classification presumes a causal link even without explicit provider linkage, unless documentation clearly states the conditions are unrelated or a specific guideline requires documented linkage.
Example: An indexed with linkage joins two documented conditions without a provider statement connecting them; they are coded as related because the classification presumes the relationship.
Mistake to avoid: Splitting presumptively linked conditions into unrelated codes without documentation stating they are unrelated.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
21. See Versus See Also Instructions
A see instruction is mandatory: the coder must move to the referenced main term to find the code. A see also instruction is optional guidance to another main term that may add useful entries; follow it only when the original term fails to yield the needed code.
Example: An index main term shows see also for a related entry; the coder stays with the original term because it already provides the applicable code.
Mistake to avoid: Treating optional see-also notes as mandatory redirects, or ignoring a required see note.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
22. Default Codes for Undetailed Conditions
The code printed next to an index main term is the default, representing the most common presentation or the unspecified code for that term. When a condition is documented without qualifiers such as acute or chronic, assign the default code rather than guessing a subtype.
Example: Documentation states appendicitis with no acute or chronic descriptor; the coder assigns the default code listed at the main term because no qualifier was documented.
Mistake to avoid: Selecting an acute or chronic subtype when no qualifier is documented in the record.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
23. Combination Codes Over Multiple Coding
A combination code captures two diagnoses, a diagnosis with a manifestation, or a diagnosis with a complication in one code. When the classification provides a combination code that fully identifies the conditions, assign only it; multiple coding is not used to split what one code already covers.
Example: An index subterm directs the coder to a single combination code for a condition with its common manifestation; only that code is reported because it fully identifies both elements.
Mistake to avoid: Reporting separate etiology and manifestation codes when a single combination code fully describes them.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
24. And Reads as Or in Titles
In code titles and index entries, the word and should be interpreted as and or or, so a title covering bones and joints also classifies disease of bones alone or joints alone. This reading prevents students from withholding a code when only one element is documented.
Example: A patient has tuberculosis of bone only; the coder uses the tuberculosis of bones and joints subcategory because and includes either site.
Mistake to avoid: Withholding a code because only one element of an and title is documented.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
Diagnosis Selection, Documentation, and Setting Rules
25. Provider Statement Over Clinical Criteria
Code assignment rests on the provider's diagnostic statement that a condition exists, not on the clinical criteria the provider used to reach it; if the provider says the patient has the condition, it is codable. Conflicting documentation within the record requires a provider query.
Example: A note documents pneumonia although listed criteria are not all recorded; the pneumonia code is assigned because the provider's statement controls.
Mistake to avoid: Second-guessing a provider's documented diagnosis by reapplying clinical criteria from the record yourself.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
26. Other-Clinician Documentation Exceptions
Diagnosis codes come from the patient's provider, with narrow exceptions: BMI, coma scale, stroke scale, pressure ulcer stage, ulcer depth, laterality, blood alcohol level, underimmunization status, firearm injury intent, and social determinants may be taken from other clinicians' record documentation.
Example: A dietitian documents BMI in the record; the BMI code may be assigned from that entry, but the associated obesity diagnosis still requires provider documentation.
Mistake to avoid: Extending the exception list to let staff documentation establish the underlying diagnosis itself.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
27. Symptoms and Unspecified Codes Used Properly
When no definitive diagnosis is established by the end of an outpatient encounter, report the documented signs and symptoms instead; when a diagnosis exists but its type is unknown, an unspecified code is correct. Unspecified codes are wrong only when documentation supports something more specific.
Example: Pneumonia is diagnosed but the type is not documented; the unspecified pneumonia code is assigned because it accurately reflects what is known.
Mistake to avoid: Selecting a specific code unsupported by documentation, or avoiding unspecified codes entirely.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
28. Principal Versus First-Listed Diagnosis
Inpatient reporting selects a principal diagnosis after study, governed by Section II rules on interrelated conditions, comparative diagnoses, and failed treatment plans; outpatient reporting selects a first-listed condition for the visit under Section IV. The setting determines which framework applies.
Example: Two interrelated conditions each meet the inpatient principal definition; the guideline on interrelated conditions governs which is sequenced, a rule that does not apply to a routine office visit.
Mistake to avoid: Applying inpatient principal-diagnosis rules to outpatient first-listed selection, or applying outpatient rules inpatient.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
29. Acute and Chronic Sequencing
When the same condition is documented as both acute and chronic and the index provides separate subentries at the same indentation, code both and sequence the acute code first. If only one entry exists or only one state is documented, code only what is documented.
Example: A note documents acute exacerbation of a chronic condition with separate index entries; both codes are assigned with the acute code sequenced first.
Mistake to avoid: Sequencing the chronic code first when both acute and chronic codes are assigned.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
30. Borderline Diagnoses Coded as Confirmed
A provider-documented borderline diagnosis is coded as confirmed unless the classification provides a specific borderline entry, and this treatment is identical in inpatient and outpatient settings because borderline is not an uncertain diagnosis. Query the provider when the documentation is unclear.
Example: Discharge documentation says borderline hypertension with no specific index entry; the condition is coded as confirmed rather than as suspected.
Mistake to avoid: Treating borderline documentation like a probable diagnosis and refusing to code it.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
CPT, HCPCS Level II, and Procedure Reporting
31. CPT Versus HCPCS Level II Roles
CPT describes physician and clinical services across evaluation and management, anesthesia, surgery, radiology, pathology, and medicine sections; HCPCS Level II covers supplies, products, and services such as Medicare screening benefits that CPT does not. Payer identity, especially Medicare, drives the choice.
Example: A Medicare screening colonoscopy for a high-risk patient is reported with HCPCS code G0105 rather than a CPT colonoscopy code because Medicare requires its own screening code.
Mistake to avoid: Reporting a Medicare screening service with a CPT code when a HCPCS code is required.
Reference: AAPC CPC study guide sample
32. NCCI Edits and Bundling
The National Correct Coding Initiative publishes code pair edits identifying services that cannot be reported together because one is included in the other. Bundling errors are a leading denial source, so check edit status before claiming two services performed at the same session.
Example: A note describes two services at one encounter; the coder checks the NCCI pairing before reporting both, because an edit may bundle one into the other.
Mistake to avoid: Reporting code pairs without checking whether an NCCI edit bundles them together.
Reference: AAPC CPC study guide sample
33. Category II Versus Category III Codes
CPT Category II codes are optional performance-measurement codes that supplement reporting for quality tracking, while Category III codes identify emerging or experimental services, often temporary, awaiting widespread adoption. Neither substitutes for the Category I code that reports the actual service.
Example: A practice appends a performance-measurement Category II code alongside the primary service code; the Category I code still reports the service itself.
Mistake to avoid: Using a Category II or III code as the sole code for a delivered service.
Reference: AAPC CPC study guide sample
34. E/M Level Selection by Medical Decision Making
Emergency department and other E/M levels are selected using elements such as the number and complexity of problems addressed, the amount and complexity of data reviewed, and the risk of complications from patient management; documentation of each element determines the level.
Example: A pediatric ED note shows a low-complexity acute problem, history from a caregiver, and minor-procedure risk; these combine to support the mid-level ED visit code 99283.
Mistake to avoid: Selecting an E/M level from service setting or intuition instead of documented decision-making elements.
Reference: AAPC CPC study guide sample
35. Time and Separate Services: Avoiding Double Billing
When time drives an E/M level, minutes spent on a service reported separately with its own CPT or HCPCS code must be excluded from the E/M time; counting the same minutes twice bills one time period twice, which the guidelines treat as double billing.
Example: A provider performs a separately reported procedure during a timed visit; those minutes are removed from the E/M time total to avoid billing the same time twice.
Mistake to avoid: Including time spent on a separately reported procedure in the E/M time determination.
Reference: AAPC CPC study guide sample
36. Modifier Discipline
Modifiers communicate circumstances that change how a code applies without changing its definition, and HCPCS Level II supplies its own modifier set for that code system. Append a modifier only when documentation supports the circumstance it describes; modifier misuse is a common audit finding.
Example: Documentation shows a service with a qualifying circumstance distinct from the base code description; a modifier is appended because the note supports that circumstance.
Mistake to avoid: Applying modifiers as universal payment shortcuts without documentation supporting the circumstance described.
Reference: AAPC CPC study guide sample
Body-System Coding Application
37. Neoplasm Table Behavior Columns
The Table of Neoplasms organizes entries across six behavior columns: primary malignant, secondary malignant, carcinoma in situ, benign, uncertain behavior, and unspecified behavior. The documented behavior and the index entry together determine which column supplies the code.
Example: Squamous cell carcinoma of the right arm is indexed to the skin limb entry; the primary malignant column supplies the code, verified as C44.622 in the Tabular List.
Mistake to avoid: Pulling a code from the wrong behavior column, such as benign for a primary malignancy.
Reference: AAPC CPC study guide sample
38. Uncertain Versus Unspecified Behavior
Uncertain behavior is a specific pathology finding that a lesion's course cannot be predicted and it may undergo malignant transformation; unspecified behavior means no pathology report establishes the nature of the lesion at all. The pathology report, not the coder, distinguishes them.
Example: A pathology report describes an unpredictable lesion; the uncertain behavior code is used because the report supplies that specific finding, not mere absence of information.
Mistake to avoid: Assigning an unspecified behavior code when the pathology report documents uncertain behavior instead.
Reference: AAPC CPC study guide sample
39. Melanoma Bypasses the Neoplasm Table
Melanoma is not located through the Table of Neoplasms; the Alphabetic Index contains dedicated melanoma entries by site, which are then verified in the Tabular List. Teaching this exception prevents students from forcing melanoma into the skin neoplasm columns.
Example: Melanoma of the lip is found under the melanoma main term with lip subterms, yielding C43.0, rather than through the skin neoplasm table.
Mistake to avoid: Looking up melanoma in the Table of Neoplasms instead of its dedicated index entries.
Reference: AAPC CPC study guide sample
40. Postoperative Diagnosis for Reporting
For procedure reporting, the postoperative diagnosis is used rather than the preoperative diagnosis, because findings may change during the procedure; the coder reads the full note, including indications and findings, rather than coding from headings alone.
Example: A colonoscopy lists polyps in the preoperative heading but finds none; the coder uses the postoperative findings, so the polyp becomes a history code rather than current.
Mistake to avoid: Coding from preoperative or heading text without reading findings and postoperative diagnoses.
Reference: AAPC CPC study guide sample
41. History Codes Versus Active Conditions
Personal history codes report resolved or previously treated conditions that influence current care, not active disease. When a note references a past malignancy under surveillance or prior polyps no longer present, history codes such as follow-up examination after completed treatment apply.
Example: A surveillance colonoscopy after treated colon cancer is coded with the follow-up examination code plus personal history of colon cancer, because the malignancy is historical, not active.
Mistake to avoid: Coding a historical condition as current disease when the note shows treatment is completed.
Reference: AAPC CPC study guide sample
42. Screening Versus Diagnostic Encounters
Screening encounters happen without signs or symptoms, while diagnostic encounters evaluate problems; Medicare assigns distinct HCPCS screening codes with high-risk and standard-risk variants, and the diagnosis coding follows the screening purpose plus any history justifying the risk level.
Example: A Medicare patient with personal colon cancer history receives a screening colonoscopy; the high-risk screening code is reported with the follow-up and history codes supporting that risk level.
Mistake to avoid: Reporting a screening service with diagnostic procedure codes when payer policy requires screening codes.
Reference: AAPC CPC study guide sample
Compliance, Fraud, Abuse, and Program Integrity
43. Coder Role: Query, Do Not Diagnose
Coders translate documentation and query providers when documentation is ambiguous, conflicting, or incomplete; they never infer diagnoses or alter clinical judgment. A query asks the provider to clarify what is documented, keeping the clinical determination with the provider.
Example: Two clinicians document conflicting laterality; the coder queries the treating provider for clarification rather than choosing one side independently.
Mistake to avoid: Resolving ambiguous clinical documentation by coder inference instead of a provider query.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
44. Internal Audits as Ongoing Safeguards
Compliance programs use scheduled audits of coded claims to detect and correct errors before payers find them, protecting revenue and program integrity. Audit results feed education, which is where instructor roles connect: recurring error patterns become curriculum topics.
Example: An audit finds repeated unspecified codes where documentation supports specificity; the instructor builds a lesson targeting that documentation-to-code gap.
Mistake to avoid: Treating audits as one-time events rather than recurring monitoring that drives education.
Reference: AAPC CPC study guide sample
45. The OIG Work Plan as a Risk Signal
The Office of Inspector General publishes a work plan identifying areas of billing and coding scrutiny; compliance staff monitor it to focus internal review. Instructors can use it to show students how external oversight shapes audit priorities and documentation expectations.
Example: A practice sees a service area noted for scrutiny; the compliance team prioritizes auditing that service before payers raise concerns.
Mistake to avoid: Ignoring published oversight priorities when planning which service areas internal audits should target.
Reference: AAPC CPC study guide sample
46. Covered Entities and Non-Covered Programs
HIPAA covered entities are health plans, health care clearinghouses, and providers transmitting standard electronic transactions; workers' compensation programs, automobile insurers, and property or casualty insurers are not covered entities, though providers disclosing to them remain covered.
Example: A question lists Medicare, workers' compensation, dentists, and pharmacies; workers' compensation is the non-covered entity because it is a casualty-type program, not a health plan.
Mistake to avoid: Classifying workers' compensation or automobile insurance programs as HIPAA covered entities.
Reference: AAPC CPC study guide sample; HHS Summary of the HIPAA Privacy Rule
47. Business Associate Agreements
A business associate performs functions for a covered entity involving protected health information, such as claims processing, billing, or data analysis; a written agreement imposing safeguards is required before sharing. A covered entity can serve as another covered entity's business associate.
Example: A practice hires an outside billing service handling identifiable claims data; a business associate agreement with required protections is executed before any data flows.
Mistake to avoid: Sharing identifiable claims data with a billing vendor before a signed agreement exists.
Reference: HHS Summary of the HIPAA Privacy Rule
48. Fraud and Abuse Awareness in Coding Education
Improper coding practices that misrepresent services billed implicate fraud and abuse concerns, which compliance programs and audits exist to prevent and detect. Instructors should frame accuracy rules as integrity obligations rather than mere denial-avoidance techniques, so students internalize the professional duty behind every rule.
Example: A student asks why specificity rules matter if payers pay anyway; the instructor explains that misrepresentation risk exists regardless of whether payment occurs.
Mistake to avoid: Teaching coding accuracy purely as a reimbursement tactic without the compliance rationale.
Reference: AAPC CPC study guide sample
HIPAA Privacy in Coding Practice and Teaching
49. PHI Definition and Forms
Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate in any form: electronic, paper, or oral. It includes demographic identifiers tied to health, care, or payment, such as names, addresses, and record numbers.
Example: A coder discusses an identifiable patient case aloud in a public hallway; the conversation is PHI because oral disclosures are covered, not just records.
Mistake to avoid: Assuming privacy rules apply only to electronic records and not to oral or paper forms.
Reference: HHS Summary of the HIPAA Privacy Rule
50. Treatment, Payment, and Operations Uses
Covered entities may use and disclose PHI without authorization for treatment, payment, and health care operations, including the provider's own billing and the payment activities of other entities with a relationship to the patient. Coding and billing fall squarely within payment.
Example: A coder sends coded claim data to the payer; no patient authorization is needed because the disclosure is a payment activity.
Mistake to avoid: Delaying routine claim submissions to obtain patient authorization that payment activities do not require.
Reference: HHS Summary of the HIPAA Privacy Rule
51. Minimum Necessary and Its Exceptions
Uses, disclosures, and requests must be limited to the minimum PHI needed for the purpose, supported by role-based access policies; exceptions include treatment disclosures, disclosures to the individual, authorized disclosures, and disclosures required by law.
Example: A coder needs only the encounter documentation to code a claim; access to the patient's unrelated historical records exceeds minimum necessary.
Mistake to avoid: Granting coding staff blanket access to entire medical records without any role-based justification.
Reference: HHS Summary of the HIPAA Privacy Rule
52. De-Identification for Education
PHI with specified identifiers of the individual and of relatives, household members, and employers removed may be de-identified, or a qualified statistician can certify de-identification; de-identified information carries no use restrictions, making it suitable for teaching materials.
Example: An instructor strips names, dates, and identifiers from an operative note before classroom use; the de-identified note may be shared freely because it no longer identifies anyone.
Mistake to avoid: Using identifiable patient notes in classroom teaching after only changing the patient's name.
Reference: HHS Summary of the HIPAA Privacy Rule
53. Authorization Boundaries and Marketing
Uses and disclosures beyond permitted categories require written authorization specifying the information, recipients, purpose, expiration date, and revocation rights; marketing generally requires authorization, with narrow exceptions such as face-to-face communications, promotional gifts of nominal value, and treatment-related communications.
Example: A practice wants to send communications promoting a third-party product for remuneration; authorization is required because paid third-party promotion is marketing.
Mistake to avoid: Treating paid third-party promotional communications as ordinary operations that need no authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
54. Psychotherapy Notes Handling
Psychotherapy notes are a mental health professional's analysis of counseling sessions, kept separate from the rest of the record; they require authorization for most uses, including treatment, payment, and operations, with limited exceptions such as the originator's own treatment use, training, and legal defense.
Example: A payer requests psychotherapy notes for payment review; authorization from the individual is required because payment review is not an exception.
Mistake to avoid: Releasing psychotherapy notes for routine payment review without the individual's written authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
Instructional Methods for Coding Educators
55. Authentic Redacted Documentation in Teaching
Training and testing work best when materials mirror real coding settings, so educators use actual redacted office and procedure notes rather than polished fictional ones, preserving real-world imperfections such as abbreviations and inconsistent phrasing that working coders must interpret.
Example: An instructor assigns an unedited-style donated note with informal abbreviations; students practice interpreting authentic documentation instead of idealized textbook cases.
Mistake to avoid: Teaching only from polished synthetic notes that hide the challenges of real documentation.
Reference: AAPC CPC study guide sample
56. Multi-Code-Set Case Design
Real cases typically require at least two code sets plus modifiers, so exercises should combine ICD-10-CM, CPT, and HCPCS Level II in one scenario rather than drilling each set separately; this mirrors actual work and reveals integration gaps early.
Example: A single case requires a diagnosis code, a procedure code, and a supply code with a modifier; students must integrate all three, as mixed study-guide cases demonstrate.
Mistake to avoid: Building every exercise around one code set so students never practice integration.
Reference: AAPC CPC study guide sample
57. Documentation Dissection as a Teaching Method
Teach students to dissect notes systematically: identify the setting, the history source, the procedure or service performed, and the final diagnoses, then map each element to its code. Annotating a note before coding makes the reasoning visible and correctable.
Example: Students mark an ED note's problem, data, and risk elements before selecting a level; the annotations show whether each decision element was correctly identified.
Mistake to avoid: Letting students jump from reading a note straight to code selection without analysis steps.
Reference: AAPC CPC study guide sample
58. Teaching the Query Process
Students must learn when to stop and query: conflicting documentation, missing laterality, ambiguous relationships between conditions, and unclear complication linkage all warrant a provider question. Practicing respectful, non-leading query writing is as important as code lookup itself.
Example: A student case contains conflicting laterality documentation; instead of choosing a side, the student drafts a query asking the provider to clarify the affected side.
Mistake to avoid: Training students to resolve documentation conflicts by picking the most likely option.
Reference: CDC ICD-10-CM Official Guidelines, FY 2027
59. Adult Learners and Job-Connected Learning
Adult learners study coding rules most effectively when instruction connects each rule to a work task they recognize, such as denial prevention or audit response, and when feedback explains why an answer is wrong using rationale rather than answer keys alone.
Example: After a practice question, the instructor reviews the full rationale, showing the index path and verification steps, because adult learners retain rules through explained reasoning.
Mistake to avoid: Grading practice cases by marking answers right or wrong without any explanatory rationale.
Reference: AAPC CPC study guide sample
60. Error-Driven Curriculum from Audit Findings
Effective coding education targets the error patterns that actually occur, such as unspecified codes where specificity exists, missed history versus active distinctions, or bundled pairs; instructors can sequence lessons around documented weaknesses rather than a fixed chapter order.
Example: Repeated student confusion between uncertain and unspecified behavior prompts a dedicated lesson contrasting pathology-confirmed findings with missing documentation.
Mistake to avoid: Teaching every topic with equal weight regardless of demonstrated learner error patterns.
Reference: AAPC CPC study guide sample; CDC ICD-10-CM Official Guidelines, FY 2027
References and further reading
Source links checked on Oct 2, 2026.