On the first Monday of every month, your billing coordinator uploads a batch of encounters to a coding vendor's SFTP folder. Nobody in your office has read that vendor's subcontractor list in three years. That upload is the part of coding medical procedures that most risk analyses miss entirely. This guide walks the chart-to-claim path from the administrator's chair, then makes the privacy, records-handling, and vendor obligations explicit at every handoff. It is operations guidance, not clinical guidance — you will find no advice here about which code fits which encounter.

The Chart-to-Claim Path Most Practices Have Never Mapped

Ask your billing lead to draw the route a single encounter takes from exam room to remittance advice. Most people can name four steps. There are usually nine or ten, and each one is a place where protected health information changes hands.

  1. Provider documents the encounter in the EHR and selects or suggests codes at the point of care.
  2. Charge capture pulls the encounter into a work queue — sometimes inside the EHR, sometimes in a separate billing platform with its own login list.
  3. A certified coder, in-house or contracted, reviews documentation and finalizes CPT, HCPCS Level II, and ICD-10-CM assignments.
  4. A coder query goes back to the provider when documentation does not support what was suggested. That query is part of the record.
  5. A claim scrubber applies payer edits and flags rejections before submission.
  6. The clearinghouse transmits the 837 to the payer.
  7. Denials route to an appeals worker, who often pulls the full chart note as an attachment.
  8. An external auditor — payer, RAC, or your own compliance consultant — samples charts on a schedule you may not control.
  9. Data lands in a reporting or analytics tool that someone in leadership logs into monthly.

Steps three through nine each involve either a workforce member with a role-based access assignment or a business associate with a signed agreement. If you cannot name which is which for every step, your access controls and your vendor inventory are both out of date.

How Practices Determine and Document Code Selection

Code selection belongs to the clinician's documentation and the coder's application of published rules. Your job as an administrator is to make sure the process is consistent, reviewable, and defensible — not to influence the outcome.

The provider attests, the coder queries, and both leave a trail

A defensible workflow has three artifacts for every claim: the clinical note, the final code set, and any query exchanged between coder and provider. Practices that let coders "fix" codes without a documented query lose the ability to explain, two years later, why a code changed.

Write the query rules down. Who may issue a query, what a non-leading query looks like, how long the provider has to respond, and where the query lives. If your query threads sit in ordinary email, you have PHI in an unmanaged mailbox with no retention schedule.

Edits, coverage policies, and version control

Coders work against published edit sets and coverage determinations, and those change on a calendar. CMS publishes correct coding edits and quarterly update files through its coding and billing resources; commercial payers publish their own policies, usually with less warning. Assign one person to check for quarterly updates and to record the date the practice adopted each version.

That version log matters in an audit. When a payer questions a claim from eighteen months ago, you want to show which edit set and which payer policy were in effect, not reconstruct it from memory.

Internal review cadence

Set a sampling rhythm and stick to it: a fixed number of encounters per provider per quarter, reviewed against documentation, with results returned to the provider in writing. Document the sample size, the selection method, the error rate, and the corrective action. A review program you run inconsistently is worse than none — it produces findings you never closed.

Minimum Necessary and Coding Medical Procedures

Coding medical procedures requires the clinical note. It rarely requires the entire longitudinal chart. Yet the default in most billing platforms is to give the coding role read access to everything, because that was easier to configure on day one.

The minimum necessary standard applies to internal uses as well as external disclosures, and HHS's guidance on the requirement expects you to define role-based access classes rather than grant blanket access. For coding roles, that usually means:

  • Encounter notes for the date of service under review, plus prior notes when medically necessary documentation depends on history.
  • Orders, procedure reports, and pathology tied to the encounter.
  • No standing access to psychotherapy notes, substance use treatment records subject to 42 CFR Part 2, or unrelated specialty episodes.

Run an access review twice a year. Pull the list of every account with the coding or billing role, match it against your current roster, and terminate the ones that belong to a coder who left in November. Terminated-account cleanup is one of the most common findings in breach investigations, and it is entirely preventable with a recurring calendar item.

Is a Medical Coding Company a Business Associate?

Yes. A coding company receives, reviews, and transmits protected health information to perform a function on your behalf, which places it squarely within the business associate definition. You need a signed business associate agreement before the first chart moves, and the agreement must require the vendor to bind its own subcontractors — including offshore coders and any AI-assisted coding tool it uses — to equivalent terms.

HHS's business associate guidance covers the definition and the flowdown obligation. Note the practical asymmetry: your patients hold you responsible, and a vendor's breach becomes your notification event.

The Six Vendor Categories Behind Every Claim

Build the inventory by category, not by invoice. Vendors that never send you a bill — because they are bundled into your EHR contract — are the ones that go missing.

  • Outsourced coding firms. Chart-level PHI access. BAA required, subcontractor list required.
  • Clearinghouses. Full claim content in transit and often at rest. BAA required.
  • Claim scrubbers and edit engines. Sometimes embedded in the practice management system, sometimes a separate contract you inherited.
  • Computer-assisted coding and NLP tools. These ingest full notes. Ask in writing whether your data trains shared models, and get the answer in the contract, not in an email from a sales rep.
  • Full-service revenue cycle management. The broadest access of the group, frequently with credentials into your EHR under named accounts you should be able to audit.
  • Audit and appeals consultants. Often engaged for a single project, often never offboarded, often still holding a chart export on a laptop.

Once the list exists, you need documentation that ties each vendor to a risk determination and a control. That is the security risk analysis, and it is the single most-cited deficiency in OCR enforcement. If yours is a spreadsheet someone started in 2021, tools that automate the risk analysis and generate the matching policy set will get you to a current, dated, defensible document faster than another round of internal meetings. For vendors onboarding this quarter, a signature-ready business associate agreement closes the gap before the first data transfer rather than after.

Offshore coding: four contract terms that matter more than price

Offshore coding is lawful under HIPAA. It is also harder to enforce against, because OCR's jurisdiction does not follow the data across a border. Negotiate for:

  1. Named country and named facility. "Global delivery centers" is not an answer.
  2. No-download workstations. Virtual desktop access with USB, print, and screenshot controls disabled, verified by the vendor's own logging.
  3. Breach notification within a defined window that leaves you time to meet your own 60-day patient notification deadline. Ten calendar days is a reasonable ask.
  4. Audit rights with teeth — the right to receive current SOC 2 Type II reports and to require remediation evidence, not just a certificate image on a web page.

When a Payer Audit Asks for 40 Charts in 45 Days

Payer and government audits are disclosures for payment or health care operations, permitted without patient authorization. That does not make them casual. Three operational rules:

Send only what the request covers. If the letter names ten dates of service, send ten dates of service. Shipping a full chart export because it was easier to run is an over-disclosure you will have to explain.

Use a tracked transfer method. Secure portal upload, encrypted media with separately transmitted keys, or the payer's own submission tool. Not a courier with a thumb drive, and not an unencrypted email attachment because the deadline was Friday.

Log the disclosure. Date, requester, patient count, records included, transmission method, and the staff member who sent it. Payment and operations disclosures do not populate a patient's accounting of disclosures, but you will want the log the next time someone asks where a record went.

The Patient Who Wants a Diagnosis Code Removed

Billing records are part of the designated record set. A patient who asks for their coding and claims history is exercising the right of access, and your clock is 30 days with one 30-day extension available if you notify them in writing. HHS's right of access guidance is explicit that billing and payment records count.

Amendment requests are the harder call. A patient who says a diagnosis code on a claim is wrong is making a request under the amendment right, and your practice must either amend or issue a written denial with the reason and the patient's right to submit a statement of disagreement — within 60 days. Route these to the provider of record, not to billing. Billing staff should never change a diagnosis code in response to patient pressure without clinical review; document that rule in your policies so front-desk staff have something to point to.

A 60-Day Cleanup Plan With Names Attached

Days 1–14 — Practice administrator. Map the chart-to-claim path on one page. Name every system and every vendor at every step. Circle the ones without a BAA on file.

Days 15–30 — Privacy officer. Pull the access list for coding and billing roles. Terminate stale accounts. Narrow the default access class to what coding medical procedures actually requires, and document the rationale.

Days 31–45 — Billing lead. Write the coder query policy, move query threads out of general email, and set the quarterly edit-update check with a named owner.

Days 46–60 — Compliance lead. Update the risk analysis with the vendor inventory, request current subcontractor lists from every coding and RCM vendor, and calendar the next semiannual access review before you close the project.

HHS's proposed Security Rule overhaul, published for comment in January 2025, would push asset inventories and vendor verification from good practice toward explicit requirement. Whatever the final rule looks like, an accurate inventory of who touches your claims data is work you will not regret doing early.

Start With the Inventory, Not the Policy Binder

Coding medical procedures is a revenue function that runs on protected health information, and it is the workflow most likely to have a vendor nobody documented. Map it, narrow the access, get the agreements signed, and record the whole thing in a risk analysis with a date on it. If your current documentation is older than your current vendor list, generate a current risk analysis and policy set and give your next auditor something to read.