At 8:40 on a Tuesday, your front desk takes two calls about the same patient encounter. The first is the imaging center asking which diagnosis code went on the MRI order. The second is the patient, asking that nothing about the visit reach the address on her insurance card. Both calls involve the same adenomyosis ICD 10 documentation, and only one of them is a billing question.

This guide is written for the administrator, biller, or privacy officer who has to make both calls end well. It covers how practices determine and document code selection in the N80.0- family, where that record travels, and the three HIPAA requests that show up most often around gynecologic diagnoses — confidential communications, self-pay restrictions, and right-of-access requests for pathology reports.

What ICD-10 code is used for adenomyosis?

ICD-10-CM classifies adenomyosis within the endometriosis of the uterus subcategory, N80.0-. That subcategory was expanded in the FY2023 update to distinguish superficial endometriosis of the uterus, deep endometriosis of the uterus, adenomyosis of the uterus (N80.03), other endometriosis of the uterus, and an unspecified option. Code selection is a coding function, not a front-desk guess: your coders read the provider's documentation, apply the current Official Guidelines for Coding and Reporting, and verify the entry in the tabular list of the fiscal-year code set in effect on the date of service. Confirm every character against the official files CMS publishes for the current fiscal year rather than a cheat sheet someone printed in 2021.

The FY2023 expansion your coders inherited, and why it still causes rework

Before the expansion, adenomyosis and several other uterine endometriosis presentations landed in one broad code. Practices that never updated their favorites list, order sets, or charge-capture templates are still routing everything to the unspecified option out of habit.

That habit produces two operational problems. Payer medical-necessity policies for imaging, ablation, embolization, and hysterectomy often reference specificity, so unspecified codes generate avoidable denials and appeal work. And unspecified codes hide the clinical picture from your own denial analytics, which means you cannot tell whether a payer is rejecting a diagnosis or rejecting your documentation.

Where the documentation actually comes from

Adenomyosis documentation reaches your coders from three directions: the clinician's assessment, imaging interpretations from an outside radiology group, and — after a hysterectomy — a surgical pathology report from a reference lab. Two of those three usually originate outside your walls.

Write down which source your coders are permitted to code from and which requires the treating provider to adopt the finding in the chart. Practices that leave this informal end up with billers inferring diagnoses from radiology impressions, which is both a coding integrity problem and an audit finding waiting to happen.

Coexisting conditions and the query workflow

Documentation frequently supports additional separately reportable conditions — abnormal uterine bleeding, dysmenorrhea, leiomyoma, anemia. Whether those are reported, and in what order, depends entirely on what the provider documented and on the guidelines and payer rules in effect.

Build a written provider-query template and a turnaround expectation. Ours is 48 business hours, tracked in the billing worklist, with a named coder and a named clinician on each query. If your queries live in unlogged chat messages, you have no audit trail and no way to defend the code choice later.

The confidential communications request that arrives before the claim

Under the Privacy Rule, a patient may request that you communicate with her by alternative means or at an alternative location, and for treatment communications you must accommodate reasonable requests. That request often arrives at the front desk verbally, minutes before a claim generates an explanation of benefits addressed to a policyholder who is not the patient.

Your workflow has to move faster than your billing cycle. Practically:

  • Capture the request on a standard form, date-stamped, with the specific channel the patient wants used (mobile number, personal email, a different mailing address).
  • Flag the account in the practice management system and in the statement/collections queue, because those are frequently two different vendors.
  • Tell the patient plainly what you can and cannot control. You control your statements, calls, portal messages, and mail. You do not control the health plan's EOB.
  • Route the plan-side question to a named staff member who helps the patient contact her insurer directly about the plan's own confidential communications process.

Assign one owner for this workflow. In small practices it is the office manager; in larger ones, the privacy officer with a billing lead as backup. Unassigned requests get lost between the clinical schedule and the revenue cycle.

The restriction request you cannot refuse

When a patient pays out of pocket in full for a service and asks you not to disclose the related PHI to her health plan for payment or operations purposes, the Privacy Rule requires you to agree. This comes up constantly with pelvic imaging and gynecologic office visits.

The operational mechanics matter more than the rule. Your team needs a way to (1) accept payment in full before the claim drops, (2) suppress the claim rather than merely note the restriction, (3) prevent the encounter from being swept into an eligibility or risk-adjustment file, and (4) keep the restricted encounter out of a bundled record that later goes to the plan with a different claim. HHS maintains plain-language guidance on the minimum necessary standard that your billing staff should read alongside your own policy.

Test this quarterly with a dummy account. If your billing platform's restriction flag does not actually stop a claim, you have a policy that exists only on paper.

Reproductive health PHI in 2026: what changed and what did not

HHS finalized a rule in 2024 adding heightened protections and an attestation requirement for certain requests for reproductive health care information. A federal district court decision in 2025 vacated the bulk of that rule, and the attestation framework is not something you should build workflows around today without confirming its current status with counsel and with the material HHS publishes on its HIPAA for Professionals pages.

What did not change: the general Privacy Rule still governs every disclosure of an adenomyosis ICD 10 record. Requests from law enforcement, attorneys, and third parties still require you to identify a permitted basis or obtain a valid authorization. State law — including confidentiality statutes for minors and, in some states, reproductive health shield laws — still applies where it is more protective. Keep a one-page internal reference naming who in your organization decides on non-routine disclosure requests, and forbid anyone else from answering them.

Where the adenomyosis ICD 10 record leaves your building

Sit down with your vendor list and trace one encounter end to end. For a typical gynecology practice, a single adenomyosis ICD 10 claim touches:

  1. The EHR and practice management host
  2. An outsourced coding or RCM firm
  3. A clearinghouse
  4. The radiology group and its report-delivery portal
  5. A reference pathology lab
  6. A statement-printing or e-statement vendor
  7. A patient-engagement or reminder platform
  8. An ambient documentation or transcription tool, if your clinicians use one
  9. An analytics or denial-management dashboard
  10. A release-of-information or records-request service

Every one of those is a business associate, and each needs an executed BAA that you can produce on demand. Two failure patterns dominate: a signed agreement nobody can locate, and a subcontractor the vendor added after signing. Ask each vendor annually, in writing, which subcontractors handle your PHI. If you are missing an agreement or working from a template that predates the Omnibus Rule, you can generate a signature-ready Business Associate Agreement and get it into circulation this week rather than next quarter.

The analytics and marketing edge case

Diagnosis-level data in a dashboard is still PHI. So is a patient list pulled by diagnosis for a "minimally invasive treatment options" email campaign. Before your marketing coordinator exports anything from the EHR, route the request through your privacy officer, and document the decision. Tracking technologies on the pages patients visit to research symptoms deserve the same scrutiny; both HHS and the FTC have addressed health data collected through web tools, and FTC health privacy guidance is worth putting in front of whoever manages your website.

The 30-day clock on a pathology report request

A patient who had a hysterectomy in November calls in January asking for the full surgical pathology report to bring to a second-opinion consult. That is a right-of-access request, and the clock is 30 days from receipt, with one 30-day extension available if you notify her in writing with a reason.

Three things trip practices up here. First, staff treat a report authored by an outside lab as "not our record" — but if it is in your designated record set, the access right applies. Second, staff route the request to the surgeon for approval and it sits. Third, staff quote a fee that exceeds the reasonable, cost-based limits described in OCR's individual right of access guidance.

Log every request with a received date, a due date, the format requested, and the delivery method. If your log is a paper folder, you cannot answer an OCR inquiry about timeliness. Right-of-access complaints remain one of the most common enforcement paths for small practices, and the fix is clerical, not technical.

Five assignments to close this quarter

Give each of these a name and a date:

  • Coding lead: reconcile your EHR diagnosis favorites and order templates against the current fiscal-year ICD-10-CM tabular list, including the N80.0- subcategory. Document the review date.
  • Billing manager: run a self-pay restriction test on a dummy account and confirm no claim, eligibility file, or statement escapes.
  • Front-desk supervisor: retrain on capturing confidential communications requests, including the script explaining plan-issued EOBs.
  • Privacy officer: confirm an executed BAA and current subcontractor disclosure for every vendor in the ten-item trace above.
  • Administrator: update the risk analysis to reflect any vendor, portal, or documentation tool added in the last twelve months.

That last item is where most practices stall, because a defensible security risk analysis is a document set, not a checkbox — and the same vendor changes that affect your adenomyosis ICD 10 workflow are the ones your analysis needs to reflect. If yours is a spreadsheet from two audits ago, automating your risk analysis, policies, and supporting compliance documents gets you a current, dated record you can hand to a payer, an auditor, or OCR without a scramble.

Pick one assignment above, put a name and a date on it before Friday, and work down the list. The coding accuracy protects your revenue; the privacy mechanics protect the patient who asked you, quietly, to be careful with her chart.