What Is Medical Coding? ICD-10, CPT and HCPCS Explained

Medical Coding Defined

Medical coding is the process of translating the diagnoses, procedures, services, and supplies documented during a patient encounter into standardized alphanumeric codes that payers, registries, and researchers can process. A physician writes that a 58 year old patient presented with chest pain and received an electrocardiogram. A medical coder turns that note into ICD-10-CM code R07.9 for the chest pain and CPT code 93000 for the ECG with interpretation and report. Those codes, not the free text, are what travel on the claim.

In the United States the code sets are not a matter of convention. HIPAA gave HHS the authority to name them, and under 45 CFR Part 162 the adopted standards are ICD-10-CM for diagnoses, ICD-10-PCS for hospital inpatient procedures, CPT and HCPCS Level II for other procedures, services, and supplies, CDT for dental procedures, and NDC for drugs. Medicare, Medicaid, and every commercial payer read the same codes, which is what makes electronic claims possible at national scale.

The job is more judgment than lookup. A coder reads the full record, picks the most specific code the documentation supports, sequences the codes in the right order, applies modifiers, and follows the ICD-10-CM Official Guidelines for Coding and Reporting, the CPT guidelines, AHA Coding Clinic advice, and payer policy. When documentation is ambiguous, the coder does not guess. They send a compliant physician query and wait for an answer. Coding sits at the point in revenue cycle management where clinical work becomes a financial record, and errors made here surface later as denials, audits, or underpayment.

Why Medical Codes Exist

Codes exist because free text does not scale. A payer adjudicating millions of claims a month cannot read narrative notes, a public health agency cannot count causes of death from prose, and a researcher cannot query a registry of paragraphs. Codes compress clinical meaning into a shared vocabulary that software can price, count, and compare.

• Billing and reimbursement. Under fee for service, the CPT or HCPCS code maps to a fee schedule amount, and the ICD-10-CM code proves the service was medically necessary. For a hospital stay, the diagnosis and procedure codes feed the grouper that assigns a DRG and a single payment. No code, no payment.
• Public health reporting. The CDC compiles national morbidity and mortality statistics from coded data, and the WHO uses the ICD family to compare disease burden across countries. Coded diagnoses are how a new outbreak becomes visible in surveillance data.
• Research and analytics. Claims databases, cancer and trauma registries, and health system data warehouses are indexed by code. A cohort study on heart failure readmissions starts with a list of ICD-10-CM codes in the I50 category.
• Quality measurement. HEDIS measures, the CMS Merit based Incentive Payment System (MIPS), and hospital star ratings are computed from codes. CPT Category II codes exist only to report that a quality action, such as a documented blood pressure reading, took place.
• Risk adjustment. Medicare Advantage and ACA marketplace plans are paid according to the documented disease burden of their members. The CMS HCC model maps ICD-10-CM codes to hierarchical condition categories, which is why risk adjustment coding has become its own specialty.

Each of these uses pulls on the same code, which is why coding accuracy matters beyond the invoice. A missed secondary diagnosis understates the patient in a risk model, drops a quality measure denominator, and can lower a DRG payment in a single stroke.

The Code Sets: ICD-10, CPT and HCPCS

Four code sets carry almost every US claim, and each has a different owner, structure, and update cycle. The table below is the map most people are looking for when they ask about the types of medical codes.

ICD-10-CM: diagnosis codes

ICD-10-CM is the US clinical modification of the WHO International Classification of Diseases, Tenth Revision. The CDC National Center for Health Statistics maintains it under the ICD-10 Coordination and Maintenance Committee, which it shares with CMS. Codes run from three to seven characters. The first three identify the category (E11 is type 2 diabetes), characters four through six add etiology, anatomic site, and severity (E11.65 is type 2 diabetes with hyperglycemia), and a seventh character extension appears on injury and some other chapters to mark the encounter type. S52.501A is an unspecified fracture of the lower end of the right radius, initial encounter for closed fracture. The letter A is doing real work there.

The United States moved from ICD-9-CM to ICD-10-CM and ICD-10-PCS on October 1, 2015, after two federal delays. The jump from roughly 14,000 to more than 70,000 diagnosis codes is the reason specificity, laterality, and encounter type became coding vocabulary overnight.

ICD-10-PCS: inpatient procedure codes

ICD-10-PCS is a US only system built by CMS for hospital inpatient procedure reporting. Every code is seven characters, and each position answers a question: section, body system, root operation, body part, approach, device, qualifier. Because it is built from a table rather than a list, it has no unspecified codes and no eponyms. A physician who documents a laparoscopic cholecystectomy gets 0FT44ZZ: resection of gallbladder, percutaneous endoscopic approach. Physicians do not use ICD-10-PCS. They report their own work in CPT even when the patient is an inpatient.

CPT: procedures and services

Current Procedural Terminology has been published by the AMA since 1966 and is copyrighted by it, which is why software vendors license it. Category I codes are the five digit codes across six sections: Evaluation and Management, Anesthesia, Surgery, Radiology, Pathology and Laboratory, and Medicine. Category II codes end in F and report performance measures. Category III codes end in T and cover emerging technology for up to five years while the AMA gathers evidence before promoting or retiring them. The evaluation and management codes 99202 to 99215 for office visits are the most billed codes in the country and get their own section below.

HCPCS Level II: what CPT does not name

CMS created the Healthcare Common Procedure Coding System so Medicare could pay for things that are not physician procedures. CPT is Level I. Level II is the alphanumeric set: J codes for injectable and infused drugs (J1885 is ketorolac), A codes for supplies and ambulance, E codes for durable medical equipment, L codes for orthotics and prosthetics, and G codes for procedures and professional services that CMS needs to pay for before a CPT code exists. G0463 is the hospital outpatient clinic visit code CMS uses instead of the CPT E/M levels. Level II is updated quarterly, so a drug launched in March can have a code by July.

Modifiers

A modifier is a two character suffix that changes how a code is read without changing its definition. Modifier 25 says a significant, separately identifiable E/M service happened on the same day as a procedure. Modifier 59 says two procedures that normally bundle were distinct. Modifier 26 bills the professional component of a radiology study and TC the technical component. Modifier 50 marks a bilateral procedure, LT and RT mark a side, and GA says an Advance Beneficiary Notice is on file. In 2015 CMS introduced XE, XS, XP, and XU as more specific alternatives to 59 because 59 was being used so loosely. Modifiers 25 and 59 remain among the most audited two digits in medicine.

E/M Leveling After the 2021 and 2023 AMA Changes

Evaluation and management codes describe the cognitive work of a visit rather than a procedure, and they are where the level of service and the level of documentation collide. For two decades coders leveled office visits by counting history elements, exam bullets, and decision making under the 1995 and 1997 CMS documentation guidelines. That system rewarded long templated notes and punished concise ones.

The AMA CPT Editorial Panel and CMS replaced it. Effective January 1, 2021, office and outpatient visits (99202 to 99215) are leveled by one of two things only: the level of medical decision making, or the total time the physician or qualified health professional spent on the date of the encounter. History and exam must still be documented as medically appropriate, but they no longer determine the code. Code 99201 was deleted. Effective January 1, 2023, the same framework was extended to hospital inpatient and observation care (99221 to 99233), emergency department visits (99281 to 99285, MDM only, since time is not a factor in the ED), nursing facility, and home or residence services. The separate observation codes were deleted and folded into the inpatient set.

Medical decision making has three elements: the number and complexity of problems addressed, the amount and complexity of data reviewed and analyzed, and the risk of complications or morbidity from patient management. A visit meets a given level when two of the three elements reach it. Time counts all of the qualified professional's work on the date of service, face to face and not, including chart review, ordering, documenting, and care coordination, but not staff time or separately billed procedures. Time beyond 99205 or 99215 is reported with prolonged service code 99417 under CPT or G2212 under Medicare rules.

For coders the shift moved the risk. The question is no longer whether the note has enough bullets. It is whether the documented problems, data, and risk actually support moderate or high MDM, which is a clinical judgment call and the most common finding in an E/M audit.

The Coding Workflow From Documentation to Claim

Coding is one stage in a pipeline, and most coding problems are documentation or charge capture problems that arrive at the coder already broken. The sequence below is how an encounter travels in a well run organization.

• 1. The encounter is documented. The clinician records the visit in the EHR: history, exam, assessment, plan, orders, and procedures performed. Everything downstream depends on what is written here, which is why clinical documentation integrity (CDI) programs review inpatient records concurrently and query physicians before the coder ever sees the chart.
• 2. Charges are captured. Procedures, supplies, and drugs are recorded against the account, either by the clinician on a charge screen or by the chargemaster for facility items. Missed charges here are pure revenue leakage, and finding them from the documentation itself is what an AI charge capture agent is built to do.
• 3. The coder abstracts and assigns codes. Working in an encoder or directly in the EHR, the coder reads the record, assigns ICD-10-CM diagnoses in the correct sequence, assigns CPT or HCPCS (or ICD-10-PCS for inpatient facility) procedure codes, and adds modifiers. If the documentation does not support a code or conflicts with itself, the coder issues a physician query rather than infer.
• 4. Edits run. The coded account passes through NCCI procedure to procedure edits, medically unlikely edits, medical necessity checks against LCD and NCD lists, and payer specific rules in a claim scrubber. Failures return to the coder as work queue items.
• 5. The claim is built and sent. Codes, charges, provider identifiers, and patient data become an X12 837P (professional, the electronic CMS-1500) or 837I (institutional, the electronic UB-04) and go to a clearinghouse and then the payer. This is where medical billing software takes over from coding.
• 6. The payer adjudicates. An X12 835 remittance comes back with payment or denial reasons expressed as CARC and RARC codes. Coding related denials, such as a diagnosis that does not support the procedure or a missing modifier, route back for correction and appeal, which is the work of an AI denial management agent in an automated shop.

In an integrated RCM platform these steps share one record and one work queue, so a coder can see the denial that came back on a code they assigned three weeks earlier. In a fragmented stack, the same information lives in five systems and the feedback loop never closes.

Medical Billing and Coding: Coder vs Biller

The two roles are often confused because in a small practice one person does both. They are different disciplines with different credentials, different systems, and different failure modes. The coder converts clinical documentation into codes. The biller converts codes into money.

The division matters for automation too. Coding automation is a reading problem: understand a narrative and map it to a controlled vocabulary. Billing automation is a workflow problem: track state across payers, deadlines, and remittances. They call for different tooling, which is why the broader discipline of revenue cycle management treats them as separate stages even when the same team owns both.

Inpatient, Outpatient, Professional and Facility Coding

The same clinical event can be coded twice by two different people using two different code sets. A surgeon who removes a gallbladder in a hospital reports CPT 47562 on a professional claim for their own work. The hospital reports ICD-10-PCS 0FT44ZZ on a facility claim for the operating room, nursing, supplies, and bed. Which code set, which claim form, and which payment system apply depends on who is billing and where the care took place.

DRGs in one paragraph

Under the Inpatient Prospective Payment System, Medicare does not pay a hospital for each service during a stay. A grouper takes the principal diagnosis, secondary diagnoses, procedures, age, sex, and discharge status and assigns one Medicare Severity Diagnosis Related Group. Each MS-DRG carries a relative weight, and the hospital receives that weight times its base rate, regardless of actual cost. Secondary diagnoses flagged as complications or comorbidities (CC) or major complications or comorbidities (MCC) move the stay into a higher paying DRG, which is why capturing a documented acute kidney injury or sepsis matters so much and why CDI programs exist. Most commercial and Medicaid inpatient contracts use MS-DRGs or the 3M APR-DRG variant.

APCs in one paragraph

The Outpatient Prospective Payment System pays hospitals for outpatient services by Ambulatory Payment Classification. Each CPT or HCPCS code on the facility claim carries a status indicator that says whether it is paid separately under its own APC, packaged into another service, or not paid under OPPS at all. Since CMS expanded comprehensive APCs, a primary procedure often absorbs almost everything else on the claim into a single payment. Facility outpatient coders therefore spend as much time on packaging logic and status indicators as on code selection.

NCCI Edits, Medical Necessity and Audit Risk

A code that is technically correct can still be unpayable or, worse, a compliance liability. Three layers of rules sit between an accurate code and a clean claim.

National Correct Coding Initiative

CMS launched the NCCI in 1996 to stop improper payment when services are reported together. Procedure to procedure (PTP) edits list pairs of codes that should not be billed on the same date for the same patient, with a modifier indicator of 0 (never separately payable), 1 (separately payable with an appropriate modifier such as 59 or an X modifier when documentation supports it), or 9 (edit not applicable). Medically unlikely edits (MUEs) cap the units of a code per day. State Medicaid programs run their own NCCI edits, and most commercial payers license them. Every serious coding tool and claim scrubber applies these edits before submission, and the NCCI policy manual is updated annually.

Medical necessity: NCDs and LCDs

Medicare pays only for services that are reasonable and necessary. CMS publishes National Coverage Determinations that apply everywhere, and the Medicare Administrative Contractors publish Local Coverage Determinations for their jurisdictions. An LCD for a lab test or imaging study typically lists the ICD-10-CM codes that justify it. If the diagnosis on the claim is not on the list, the claim denies for medical necessity. When a provider expects that outcome, the patient signs an Advance Beneficiary Notice and the claim carries modifier GA, which shifts liability to the patient. Commercial payers publish their own medical policies that play the same role.

Compliance risk and the False Claims Act

The patterns that draw enforcement are consistent from year to year in the HHS Office of Inspector General work plan and in settlements announced by the Department of Justice.

• Upcoding. Reporting a higher level of service than the documentation supports, most often 99214 or 99215 where MDM is low, or a higher paying DRG through an unsupported MCC.
• Unbundling. Billing the components of a procedure separately when a single comprehensive code exists, or using modifier 59 to bypass an NCCI edit without a distinct service.
• Cloned documentation. Copy forward notes that make every visit look identical and cannot support the level billed.
• Unsupported risk adjustment diagnoses. Reporting chronic conditions that were not assessed or treated in the encounter to inflate HCC scores.
• Modifier abuse. Routine use of modifier 25 on every procedure day, or 26 and TC applied incorrectly.

The federal False Claims Act (31 U.S.C. 3729 through 3733) makes knowingly submitting a false claim to a federal program a civil offense carrying treble damages plus a per claim penalty that is adjusted for inflation each year. Knowing includes reckless disregard, so a provider who never audits its own coding is exposed. Whistleblowers can file qui tam suits and share in the recovery, which is how most large coding cases begin. Medicare also audits directly through Recovery Audit Contractors, the Comprehensive Error Rate Testing program, and Targeted Probe and Educate reviews by the MACs. The defense is unglamorous: a written compliance program built on the OIG guidance, routine internal and external coding audits with a documented sample, coder education on each October and January code update, and a query process that never leads the physician toward a more lucrative answer.

Related Guides

These guides cover the neighboring concepts this article refers to, each written in the same answer first format.

• What Is Revenue Cycle Management? The 2026 Guide to Healthcare RCM: the full revenue cycle, its 12 steps and the KPIs that measure it.
• What Is Prior Authorization? Process, Timelines and the 2026 Rules: the prior authorization process, turnaround rules and electronic PA standards.
• What Is Agentic AI? Definition, Architecture, Examples and Risks: what makes AI agentic, the autonomy levels and the controls that keep agents safe.

Medical Coding Certifications: AAPC and AHIMA

There is no state license for medical coders. Two professional bodies set the recognized credentials, and employers write them into job requirements.

The AAPC, founded in 1988, is the largest body and is oriented toward physician and outpatient coding. Its flagship is the Certified Professional Coder (CPC), which tests CPT, HCPCS Level II, ICD-10-CM, and guideline application. New coders who pass without two years of experience hold a CPC-A apprentice designation until they document experience. Specialty credentials include the Certified Outpatient Coder (COC) for hospital outpatient facility coding, the Certified Inpatient Coder (CIC), the Certified Risk Adjustment Coder (CRC), the Certified Professional Biller (CPB), and the Certified Professional Medical Auditor (CPMA).

AHIMA, the American Health Information Management Association, dates to 1928 and is rooted in hospital health information management. Its Certified Coding Specialist (CCS) covers both inpatient ICD-10-PCS and outpatient coding and is the credential inpatient hospital coding departments most often ask for. The CCS-P is the physician based variant, and the Certified Coding Associate (CCA) is the entry credential. AHIMA also awards the RHIT and RHIA health information credentials that HIM directors typically hold. Both bodies require continuing education units to keep a credential active, and both publish the annual code updates their members are expected to learn.

Where ICD-11 Stands in the United States

The WHO adopted ICD-11 at the World Health Assembly in May 2019, and it came into effect for member state reporting on January 1, 2022. It is a different kind of classification: fully digital, built on a foundation of roughly 17,000 core categories, with extension codes and postcoordination that let a coder combine a stem code with laterality, severity, and anatomy rather than search for one precombined code. Several countries have begun using it for mortality reporting.

The United States has not adopted ICD-11 and has set no date. Adoption would require HHS rulemaking under HIPAA to name a new standard code set, and the US would almost certainly build a clinical modification the way it did with ICD-10-CM, since the WHO base classification lacks the specificity US payers require. The National Committee on Vital and Health Statistics has held hearings and research is under way, but the ICD-10 transition is the cautionary precedent: the final rule was published in 2009, the compliance date was pushed twice, and go live came on October 1, 2015. Coders and vendors should expect a multi year runway with public notice, not a surprise. For now, ICD-10-CM remains the diagnosis standard and gets a new batch of codes every October.

How NLP and AI Change Medical Coding

Coding is a reading task with a controlled vocabulary and a written rulebook, which makes it one of the most natural fits for natural language processing in healthcare. What has changed in the last few years is not that software can suggest codes. It is how far the suggestion can be trusted without a person looking.

Computer assisted coding

Computer assisted coding (CAC) has been in hospitals since the 2000s. An NLP engine reads the documentation, identifies clinical concepts, and proposes ICD-10-CM, ICD-10-PCS, and CPT codes with links back to the sentence that supports each one. A coder then accepts, edits, or rejects every suggestion. CAC raises coder productivity and consistency, but a human still touches every chart, so it changes the speed of the work more than the cost structure.

Autonomous coding

Autonomous coding goes a step further. The system assigns codes and releases the encounter to billing without human review when its confidence exceeds a threshold, and routes everything else to a coder. It started in high volume, low variability specialties such as radiology, pathology, emergency medicine, and urgent care, where the documentation is structured and the code set in play is narrow. Large language models widened the range because they read narrative, handle negation and uncertainty (rule out pneumonia is not pneumonia), and can cite the evidence for each code, which is what an auditor asks for. The design choices behind such a system, including evidence linking, confidence scoring, and cross coding across code sets, are laid out in our article on building an NLP pipeline for medical coding. If you are evaluating vendors, the criteria for choosing AI coding software live on that page rather than here.

Where humans stay

• Complex inpatient and surgical coding, where principal diagnosis selection and MCC capture depend on clinical reasoning across a long record.
• Physician queries, which require judgment about what is missing and how to ask without leading.
• Audit, appeal, and compliance, where a credentialed person has to stand behind the code and explain it to a payer or an investigator.
• Rule changes, including the October ICD-10-CM update, the January CPT update, quarterly HCPCS changes, and every payer policy revision, all of which need to be validated in the model before it codes against them.
• The low confidence queue, which is where autonomous systems send the encounters they cannot resolve and where coder expertise is now concentrated.

Bonami builds this class of system. Our AI medical coding agent reads clinical documentation, proposes ICD-10-CM and CPT codes with the supporting text, validates the result against NCCI and payer edits, and hands uncertain encounters to a coder inside the same work queue as charge capture and denials on the RCM platform. The goal is not to remove the coder. It is to move the coder from the first read of every chart to the review of the charts that need one.