Your Tuesday clinic has eleven movement-disorder follow-ups, two deep brain stimulation programming visits, a prior authorization packet due to a commercial payer, and a records request from a disability attorney that arrived nine days ago. Every one of those items runs through the same decision: which code your provider documented and your coder assigned. If your team still treats icd 10 for parkinsons disease as a single code on a favorites list, you are generating denials on the billing side and oversharing on the privacy side.

This guide covers the operational mechanics of the G20 code family, then makes the records-handling, disclosure, and vendor implications explicit. It is administrative guidance for administrators, billers, and privacy officers — not clinical guidance, and not a rule about which code fits which patient.

What Is the ICD-10 Code for Parkinson's Disease?

In ICD-10-CM, Parkinson's disease sits in category G20, which was subdivided effective October 1, 2023 (FY2024). The single unspecified G20 code no longer exists. The current codes are:

  • G20.A1 — Parkinson's disease without dyskinesia, without mention of fluctuations
  • G20.A2 — Parkinson's disease without dyskinesia, with fluctuations
  • G20.B1 — Parkinson's disease with dyskinesia, without mention of fluctuations
  • G20.B2 — Parkinson's disease with dyskinesia, with fluctuations
  • G20.C — Parkinsonism, unspecified

Adjacent categories cover different clinical entities: G21.- for secondary parkinsonism, including drug-induced and vascular forms, and G23.- for other degenerative diseases of the basal ganglia. Code selection is driven entirely by what the treating provider documents about dyskinesia and motor fluctuations — your coding staff assigns from the note, and queries the provider when the note does not support a specific choice. Nobody in billing decides the clinical picture.

The Favorites List Is Where the Denials Start

Two and a half years after the subdivision, practices are still submitting claims built from stale problem lists. The mechanism is boring and predictable: a chronic patient's diagnosis was entered under the retired code years ago, the encounter pulls it forward, and the claim edits catch it — or worse, the clearinghouse passes it and the payer denies weeks later.

Assign someone to run this specific report: all active patients with a basal-ganglia or parkinsonism diagnosis on the problem list, sorted by code, with the last date the code was reviewed. Then have your EHR administrator delete the retired entry from every provider's quick-pick list. If it is still selectable, someone will select it.

Who Owns the Code and Who Owns the Query

Write the roles down, because during an audit you will be asked. A workable split for a specialty practice:

  • Provider — documents presence or absence of dyskinesia and fluctuations in the assessment, in words, not by code number.
  • Coder or biller — assigns from the documentation and issues a compliant query when documentation is silent. Queries never suggest a specific code.
  • Practice administrator — owns the annual October 1 code-update review and the problem-list cleanup schedule.
  • Privacy officer — owns what leaves the building once the code exists.

CMS publishes the current code files and the FY update materials on its ICD-10 code page. Put the October 1 review on your calendar as a recurring task with a named owner, not a reminder to "check for updates."

Sequencing, Dementia Codes, and What They Do to a Disclosure

Parkinson's disease frequently appears in charts alongside dementia coding, and the tabular list carries instructional notes about sequencing the underlying physiological condition and the dementia code together. The dementia codes in the F01–F03 range now carry severity and behavioral-disturbance detail, which means a single claim line can communicate a great deal about a patient's cognitive status.

That is a coding fact with a privacy consequence. When your front desk faxes a "visit summary" to a referring PT clinic, or your billing service sends a claim history to a payer's appeal unit, the diagnosis string travels with it. A code set that precisely describes dyskinesia, motor fluctuations, and dementia severity is more sensitive than the old single code ever was. Your disclosure habits were built for the old code.

Re-check two templates this month: the referral packet and the appeal cover packet. If either defaults to "attach last five encounters," you have a minimum necessary problem, not a coding problem.

Prior Authorization Packets Are Where Minimum Necessary Breaks

Prior authorization for advanced therapies — device programming, infusion or pump therapy, specialty medications — invites overshare. The payer's portal has a document upload field with no size limit, the deadline is tomorrow, and the fastest thing your staff can do is export the whole chart.

Build a standard authorization packet definition for each therapy category and put it in writing: which note types, which date range, which results. Staff attach what the list says and nothing else. When a payer requests more, the request goes to the privacy officer or a designated lead, who documents what was asked for and what was sent. That log is the only thing that will help you if a patient later asks why their entire psychiatric history reached a utilization reviewer.

The Uncomfortable Middle Case: Copay and Patient-Support Programs

Manufacturer hub and copay-assistance enrollment is not treatment, payment, or health care operations. Those programs generally require a patient authorization, and the authorization form is usually the manufacturer's, not yours. Train staff to recognize the difference between a form that authorizes your practice to disclose PHI to a third party and a form that merely enrolls the patient. If your staff signs patients up by phone without a completed authorization on file, you are the party making the disclosure.

The Vendor List a Movement Disorder Clinic Actually Has

Pull your business associate inventory and compare it to reality. A practice managing Parkinson's disease patients typically touches more vendors than its BAA folder reflects:

  • Outsourced coding or billing service
  • Transcription or ambient documentation tooling
  • Remote device programming or telehealth platform used for follow-up visits
  • Wearable or app-based gait, tremor, and medication-timing monitoring
  • Patient reminder and recall texting service
  • Release-of-information or records-fulfillment vendor
  • Registry or research coordinating center
  • Fax-to-email or e-fax provider
  • Backup, storage, and IT managed services

Three distinctions decide how you paper each one. A vendor that creates, receives, maintains, or transmits PHI on your behalf needs a signed BAA. A registry or research use generally runs on authorization, waiver, or another permitted pathway — not a BAA. And a vendor the patient chose and controls, like a consumer wearable they bought themselves, may sit outside HIPAA entirely, which does not stop your staff from importing its data into the chart and making it your problem.

If you are missing agreements — and most practices find at least two gaps in this exercise — you can produce a signature-ready Business Associate Agreement through a guided six-step wizard rather than reusing a decade-old template that predates your current vendor stack.

Your Risk Analysis Has to Name These Systems

The Security Rule requires an accurate and thorough assessment of risks to electronic PHI under 45 CFR 164.308(a)(1)(ii)(A). "We use an EHR and it's encrypted" is not that assessment. Your analysis needs to name the remote programming platform, the wearable data pipeline, the e-fax account, and the coding contractor's remote access path, with the safeguards and residual risk for each. NIST's SP 800-66 Rev. 2 is the practical reference for structuring it, and it remains the right starting point while proposed Security Rule updates are still pending.

Most small and mid-size practices do not have a spare week to assemble this by hand. Tools that automate HIPAA risk analysis reports and the supporting policy set get you to a documented, dated, system-specific analysis you can actually hand to an auditor — which is the only version that counts. No product carries a government certification, and none should claim one; what matters is whether the documentation exists and matches how your clinic runs.

Caregivers, Personal Representatives, and the Note Nobody Wrote Down

Parkinson's disease care involves caregivers by design. Adult children call about medication timing. A spouse attends every visit. Someone other than the patient signs the DBS consent paperwork. Your front desk makes disclosure decisions on the fly, all day.

Two different rules govern this, and staff confuse them constantly. A personal representative under 45 CFR 164.502(g) stands in the patient's shoes and gets essentially full access, established by a health care power of attorney, guardianship order, or equivalent state-law authority. A family member involved in care may receive relevant information under 45 CFR 164.510(b), limited to what is relevant to that involvement, subject to the patient's agreement or objection.

Operationalize it: one designated field in the chart, filled in at the first visit and re-confirmed annually, recording the personal representative and the supporting document, plus any family members the patient has agreed may receive information. Scan the POA or guardianship order. When the patient's cognitive status changes, the documentation is already in place and your staff is not improvising at the front desk.

The 30-Day Clock on That Disability Attorney's Request

The individual right of access gives you 30 days from receipt to act, with one 30-day extension available if you notify the individual in writing of the reason and the new date. That clock runs regardless of whether your release-of-information vendor is behind. HHS's right of access guidance covers the fee limits, format requirements, and the rule that you send records to a third party when the individual directs it in writing.

Sort incoming requests into three buckets on arrival, because the rules differ:

  1. Patient right of access — 30-day clock, limited fees, individual's choice of form and format.
  2. Third-party request with a valid authorization — disability, life insurance, employer forms. Verify the authorization has all required elements and has not expired, and disclose only what it describes.
  3. Legal process — subpoenas and court orders, routed to counsel, never fulfilled by the front desk.

Log the receipt date on every request the day it arrives. Practices that miss the 30-day window almost always miss it because nobody wrote down day zero.

A 30-Day Cleanup You Can Actually Finish

  1. Week 1 — Run the problem-list report for parkinsonism diagnoses. Remove retired codes from provider favorites. Confirm current-year code files are loaded.
  2. Week 2 — Rewrite the referral and prior-auth packet definitions. Cap what staff attach by default.
  3. Week 3 — Reconcile the vendor list against signed BAAs. Flag every system that touches tremor, gait, device, or medication-timing data.
  4. Week 4 — Add the personal-representative field to intake and annual review. Start the request log with receipt dates.

Getting the icd 10 for parkinsons disease selection right protects your revenue. Controlling what happens to that code afterward — in packets, portals, faxes, and vendor pipelines — protects your patients and your license to operate. If your risk analysis and policy set have not been updated since the last time your vendor list changed, generate the current documentation set and give your next auditor something dated this year.