A payer audit letter arrives on a Tuesday asking for 42 charts, all of them patients carrying both a heart failure diagnosis and a hypertension diagnosis. You have 30 days to produce them. Somewhere in that stack are encounters where the provider listed both conditions on the problem list, the coder assigned two separate codes, and nobody documented whether the two were related. That is the operational reality behind congestive heart failure hypertension ICD-10 questions — it is rarely a coding puzzle in isolation, and almost always a documentation, records-release, and vendor-oversight problem at the same time.

This guide is written for the administrator, billing lead, or privacy officer who owns the consequences. It covers how practices structure code selection and documentation review for these paired diagnoses, why this specific pair attracts audit attention in 2026, and exactly which HIPAA obligations get triggered when coders, risk-adjustment vendors, and auditors start pulling charts.

What the congestive heart failure hypertension ICD-10 question actually asks your team to decide

Two ICD-10-CM families are in play. Hypertensive heart disease sits in category I11, with a subdivision indicating whether heart failure is present. Heart failure itself sits in category I50, subdivided by type and acuity. Essential hypertension without a stated heart involvement sits at I10.

The decision your coding staff makes is not "which code is right for this patient" — that follows from what the clinician documented. The decision is whether the record supports a linkage between the two conditions, and whether the documentation is specific enough to support the second code that the tabular list expects.

The causal-relationship convention that trips up new coders

ICD-10-CM Official Guidelines treat hypertension differently depending on the organ system. For chronic kidney disease, a causal relationship is presumed. For heart conditions, it is not. A code from category I11 is assigned when the provider states or implies the relationship — language such as "hypertensive heart disease" or "heart failure due to hypertension." Absent that language, the conditions are coded separately.

That single convention is why your query rate on these charts matters. If your coders are guessing at linkage, you have an audit exposure. If they are querying every chart, you have a throughput problem. Most practices land on a documented internal policy: what triggers a query, who sends it, how the response is recorded, and how long the query itself is retained. Provider queries are part of the record. Treat them accordingly.

The second code that quietly gets dropped

When hypertensive heart disease with heart failure is coded, the tabular instruction directs an additional code from I50 to identify the type of heart failure. In practice, that second code is the one most likely to be missing from a claim — or defaulted to an unspecified option when the note contains enough detail to support something more specific.

Run a report. Pull every claim in the last twelve months carrying a hypertensive heart disease code and check how many carried a paired I50 code and what proportion of those were unspecified. That single query tells you more about your documentation health than any vendor scorecard. CMS maintains the current code files and guidelines on its ICD-10 resource pages, and your coding staff should be working from that year's release, not a cached PDF from three cycles ago.

Which ICD-10 codes apply to congestive heart failure with hypertension?

Short answer for the person searching at 4:45 p.m.:

  • Category I11 covers hypertensive heart disease, with separate codes for cases documented with heart failure and cases documented without it.
  • Category I50 covers heart failure itself, subdivided by type — systolic, diastolic, combined, right, biventricular, and others — and by acuity, acute versus chronic versus acute on chronic.
  • Category I13 applies when the documentation supports both hypertensive heart disease and hypertensive chronic kidney disease.
  • I10 is used for essential hypertension when no heart involvement is documented as related.

Which combination applies to a given encounter is determined by the treating clinician's documentation and your coder's application of the Official Guidelines — not by a lookup table, and not by a payer's preference. Your job as administrator is to make sure the documentation, the query trail, and the final code selection line up in the chart.

Why this diagnosis pair draws audit attention in 2026

Heart failure maps to a risk-adjustable condition category in the CMS-HCC model. Uncomplicated essential hypertension does not. That asymmetry is the whole reason these charts get pulled.

The v28 CMS-HCC model finished its multi-year phase-in for payment year 2026, so plans and the groups working under risk contracts are fully exposed to the revised category structure this year. Separately, CMS finalized its Risk Adjustment Data Validation approach in 2023, permitting extrapolation of audit findings. The combined effect: a documentation gap on a cardiovascular condition is no longer a single-claim problem.

For your practice, that translates into three concrete pressures. Risk-adjustment vendors want more chart access. Payers send larger record requests. And internal auditors start asking why a chronic condition was captured in one year and not the next. Every one of those pressures is a PHI movement problem before it is a revenue problem.

The vendor list this one diagnosis touches

Sit down and actually list who sees a chart containing a heart failure and hypertension diagnosis on its way from encounter to payment. A typical mid-size practice list looks like this:

  1. The EHR host.
  2. The transcription or ambient documentation service, if you use one.
  3. The outsourced coding firm or offshore coding partner.
  4. The clearinghouse.
  5. The billing company, if separate.
  6. The risk-adjustment or HCC analytics vendor.
  7. The release-of-information vendor handling the audit response.
  8. The document storage or scanning vendor holding legacy paper.

Every one of those is a business associate. Every one needs an executed BAA on file, dated, signed by someone with authority, and covering the actual services being performed — not a 2018 template that predates the analytics module you added last year. Subcontractors matter too: if your coding firm uses overseas contractors, the BAA chain must extend downstream.

If your BAA inventory is incomplete or the agreements are stale, fix that before the next audit request lands. HHS publishes sample business associate agreement provisions that show the required elements, and a guided business associate agreement builder will get you to a signature-ready document without a legal redline cycle for each vendor.

The question to ask every coding and HCC vendor

Ask three things in writing, and keep the answers: Where is our PHI stored geographically? Which of your personnel and subcontractors can access our charts, and how is that access logged? What is your breach notification timeline to us, in days, and does it start at discovery or at confirmation?

Vendors that answer vaguely on the third question are the ones that will cost you your 60-day reporting window.

Minimum necessary when a vendor asks for "the whole chart"

A risk-adjustment vendor asking for full chart access across your entire attributed panel is asking for more than it needs to validate a cardiovascular condition. The minimum necessary standard applies to disclosures to business associates and to the requests you make of others. It does not apply to treatment disclosures, and it does not apply to a patient exercising their right of access — but it absolutely applies here.

Build role-based limits into the request instead of granting blanket access. Date-range restriction. Encounter-type restriction. Specialty or provider restriction. Document the reasoning in a one-page disclosure memo and file it with the vendor's folder. HHS guidance on the minimum necessary requirement is the reference to hand your privacy officer.

Payer audit requests get the same scrutiny. A request for 42 charts is a request for 42 charts, not for the full longitudinal record of 42 patients. Your release-of-information workflow should default to the narrowest responsive set and require a supervisor override to send more.

The 30-day clock, and why billing records are inside it

When a patient with a heart failure diagnosis asks for their chart — often because a cardiologist, a disability determination, or a life insurance application requires it — you have 30 days to respond, with one 30-day extension available if you notify the patient in writing of the reason and the new date.

Here is the part billing staff routinely miss: the designated record set includes billing and payment records, not just clinical notes. If a patient asks for the records that show which diagnosis codes were submitted on their claims, that request is inside the right of access. So is a request to send those records to a third party they designate.

Fees are limited to a reasonable, cost-based amount. You cannot charge for search and retrieval time. OCR has pursued right-of-access enforcement steadily, and the pattern in those actions is unglamorous: small practices, ordinary requests, months of delay. Review the HHS right of access guidance with your front desk, not just your privacy officer, because the front desk is where the clock starts.

When a patient says the code is wrong

Patients reviewing an explanation of benefits sometimes dispute a diagnosis code — "I don't have heart failure" is a live example. That is an amendment request under 45 CFR 164.526. You have 60 days, extendable once by 30 days with written notice.

You may deny an amendment if the record is accurate and complete, but the denial must be written, must explain the basis, and must tell the patient they can submit a statement of disagreement. Route these to the provider who authored the note, not to the billing supervisor. Log the outcome. If the code was in fact entered in error, corrected claims and record annotation are two separate workflows, and both need to happen.

A 45-day cleanup plan you can actually assign

Days 1–10 — Billing lead. Pull the twelve-month report described above: hypertensive heart disease claims, paired heart failure codes, unspecified rate. Identify your top three providers by unspecified volume.

Days 1–10 — Privacy officer. Inventory every vendor that has touched a cardiology-related chart in the last year. Match each against a signed, current BAA. Flag gaps.

Days 11–25 — Coding supervisor. Write the query policy if you do not have one. Two pages: trigger conditions, template language, retention, and escalation when a provider does not respond within five business days.

Days 11–25 — Practice administrator. Sit with the release-of-information workflow and time an actual request end to end. Where does it stall? Who is the single named backup when that person is on PTO?

Days 26–45 — Everyone. Update the risk analysis to reflect what you found. New vendor, new data flow, new risk — that is the whole logic of the Security Rule's risk analysis requirement, and "we did one in 2022" is not a defense. Generating the risk analysis, the supporting policy set, and the vendor documentation by hand consumes weeks; automating your HIPAA risk analysis and policy documentation compresses that into a working afternoon and gives you a dated artifact to hand an auditor.

OCR's proposed Security Rule modernization, published in January 2025, would tighten expectations around asset inventories and risk analysis documentation. Whatever its final timing, the direction is clear enough to plan against.

What good looks like

A practice handling congestive heart failure hypertension ICD-10 coding well is not the practice with the highest capture rate. It is the practice where a chart pulled at random shows a clinician note that states the relationship or clearly does not, a query trail if one was needed, a code selection that follows from the note, a BAA covering every vendor that touched it, and a release log showing exactly what left the building and why.

Start with the vendor inventory. It is the piece most practices have not touched since their last EHR migration, and it is the piece that turns a coding audit into a breach investigation. Build the documentation set that backs it up — risk analysis, policies, vendor records — so the next 42-chart request is a scheduling problem instead of a scramble.