On a Tuesday morning your billing lead exports a rejected-claims worklist — 340 rows, each with a patient name, date of birth, member ID, diagnosis code, and procedure code — and emails it to the outside coder your practice hired in November. That spreadsheet is protected health information. The coder is a business associate. If you have no signed agreement on file, you have a problem that has nothing to do with coding accuracy.

This guide covers how medical billing codes actually move through a practice: who selects them, who documents the selection, which vendors touch them, and where the privacy exposure sits. It is written for administrators, billing managers, and privacy officers — not for clinicians deciding what to code. Coding decisions belong to the people trained and credentialed to make them. Your job is the workflow, the record, and the contract.

Medical Billing Codes Sit Inside Four Systems, Not One

Staff talk about "the code" as if a claim carries one. A single professional claim line typically carries several, drawn from separate code sets maintained by separate bodies on separate schedules.

  • Diagnosis codes (ICD-10-CM) — what the encounter was about. Maintained through CMS and the National Center for Health Statistics.
  • Procedure and service codes (CPT and HCPCS Level II) — what was done or supplied. CPT is maintained by the American Medical Association; HCPCS Level II by CMS.
  • Modifiers — two-character appendages that alter the meaning of a procedure code for payment purposes.
  • Place of service and, for institutional claims, revenue codes — where the service happened and how the facility bucket is reported.

Drug claims add NDC numbers. Dental practices work from CDT. Institutional billers work the UB-04 side with its own field conventions. If your practice bills across settings, your billing manual needs a section per setting, not one generic page.

The Update Calendar That Breaks Claims Every Year

ICD-10-CM updates take effect October 1. CPT updates take effect January 1. HCPCS Level II changes land quarterly. Payer policy bulletins arrive on no schedule at all.

Build a recurring calendar item for each of those dates with a named owner. The owner's job is not to memorize changes — it is to confirm that your practice management system received the code file update, that superbills and encounter templates were reviewed, and that the review was documented with a date and a signature. CMS publishes the current ICD-10 files and transition materials at cms.gov/medicare/coding-billing/icd-10-codes. Put that link in your billing manual so nobody hunts for it in September.

The failure mode is predictable: a code retires, claims reject in bulk, and someone starts emailing spreadsheets around to triage the backlog. The coding problem creates the privacy problem.

What Are Medical Billing Codes on a Claim?

Medical billing codes are the standardized identifiers a practice submits so a payer can adjudicate a claim. Diagnosis codes (ICD-10-CM) describe the condition addressed. Procedure codes (CPT/HCPCS) describe the services rendered. Modifiers refine those procedure codes. Place-of-service codes identify the setting. Together with patient demographics and insurance identifiers, they travel inside a HIPAA-standard electronic transaction — the 837 — from your practice to a clearinghouse to the payer. Every field in that transaction is protected health information, and the entire chain of parties handling it falls under HIPAA's Privacy and Security Rules.

Who Selects the Code, Who Documents It, Who Never Touches It

Write these roles down. Ambiguity here produces both compliance findings and payer audits.

The Selector

Code selection derives from the clinical documentation. Whether that is the rendering provider, a credentialed coder, or a hybrid workflow, name the role in writing. In most practices the provider selects, and a coder reviews.

The Reviewer

Your reviewer checks internal consistency — does the submitted code set match what the note supports, are required modifiers present, does the place of service match the schedule. A reviewer who believes documentation does not support the submitted codes raises a query. A reviewer does not silently change codes.

The Query Trail

Every coder-to-provider query is a record. Keep them in a system that timestamps, attributes, and retains. Queries sent as instant messages in an unmanaged chat tool are a records-retention gap and, depending on the tool, a vendor gap. Your query log is one of the first things an auditor asks for.

Who Never Touches It

Front-desk staff should not be adjusting medical billing codes to clear a rejection. If your denial workflow lets a scheduler change a diagnosis code to get a claim paid, you have a training issue and an integrity issue at the same time. Route rejections back to the reviewer role.

Every Claim Line Is PHI — Treat Your Worklists That Way

Practices apply careful controls to the chart and almost none to the billing extract. That is backwards, because billing data is highly structured, easily exported, and routinely handled by staff outside clinical areas.

A denial worklist contains identifiers plus a diagnosis code. That combination is often more sensitive in aggregate than a single chart note — a spreadsheet of 340 rows discloses conditions for 340 people in one file. Apply minimum necessary at the field level:

  • Pull worklists with the smallest field set that supports the task. An A/R follow-up call usually needs an account number, a payer, a claim number, and a balance — not a full diagnosis roster.
  • Prohibit exports to personal drives and personal email. Enforce it technically, not just in policy.
  • Set a deletion rule for working files. Denial worklists accumulate for years in shared folders because nobody owns their disposal.
  • Log who exports billing data and how often. Unusual export volume is one of the few early signals of insider misuse you can actually detect.

Screenshots deserve their own rule. Billing staff paste claim screens into support tickets constantly. If that ticketing system belongs to a vendor without a signed agreement, you just disclosed PHI to an unauthorized recipient. Browse the breach portal at ocrportal.hhs.gov and note how many reported incidents involve business associates rather than the provider organization itself.

The Vendor List Behind a Single Claim

Trace one claim from encounter to payment and count the outside parties. A typical practice finds more than it expected:

  1. Practice management or EHR host
  2. Clearinghouse
  3. Outsourced billing or full revenue cycle vendor
  4. Contract coder or coding-audit firm
  5. Coding-assistance or claim-scrubbing software, increasingly with automated code suggestion
  6. Statement printing and mailing service
  7. Patient payment processor and text/email reminder platform
  8. Collections agency
  9. Document scanning or release-of-information vendor
  10. Backup, archive, and IT support providers with database access

Each of those needs a business associate agreement, and each BAA needs to address subcontractors. Revenue cycle vendors frequently subcontract offshore. That is permissible under HIPAA, but only if the chain of agreements holds and your contract says what happens to your data at termination. Ask the direct question in writing: name every subcontractor with access to our claim data and the country where the work is performed.

The other question worth asking of any coding-assistance or scrubbing tool: is our data used to train the vendor's models, and can we opt out? Get the answer in the contract, not the sales deck.

If a vendor sends you their paper and it is thin — no subcontractor flow-down, no breach notification timeline, no return-or-destroy provision — you do not have to accept it. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX, one-time purchase, and send it back as your paper. That is a faster path than a redline cycle with a vendor's legal team, and it puts your terms in front of them first.

Billing Records and the 30-Day Right-of-Access Clock

Patients ask for billing records more often than administrators expect — usually during a dispute, an appeal, or a divorce. Billing and payment records maintained by a covered entity are generally part of the designated record set, which means the right of access applies.

Operationally, that means three things. First, your 30-day clock starts when the request arrives, not when your billing vendor gets around to it. Second, if your outsourced biller holds the only copy of claim histories, your BAA must obligate them to produce records on your timeline. Third, your fee schedule for copies must comply with the access rule's cost limits — you cannot charge search and retrieval time. HHS guidance on all of this lives at hhs.gov's individuals' right to access page.

Test this. Send a mock records request to your billing vendor on a Friday afternoon and see how long production takes. If the answer is "we'd have to open a ticket," fix the contract before a real request arrives.

Retention, Audits, and the Documents That Prove Your Process

Keep two retention clocks straight. HIPAA requires six years of retention for required documentation — policies, BAAs, risk analyses, training logs, sanction records. Medical record retention is set by state law and payer contract, and it is frequently longer. Payer audit lookback periods are their own thing again.

When a payer opens a coding audit, they ask for documentation supporting the submitted codes, your coding policy, your query log, and evidence of internal review. Practices that treat coding compliance as a filing exercise produce those in an afternoon. Practices that do not spend three weeks reconstructing them.

The same documentation set supports your HIPAA posture. Your risk analysis should specifically account for billing data flows — where claim extracts live, who exports them, and which vendors receive them. If your current analysis stops at "the EHR," it is incomplete. Tools that automate risk analysis and the supporting policy set can shorten that work, but the data-flow inventory has to reflect your actual billing workflow, not a template.

A 30-Day Cleanup Plan for Billing Operations

Week 1. Inventory every outside party that touches claim data. Include software you pay for with a credit card. Match each against your BAA file and list the gaps.

Week 2. Close the gaps. Issue your own agreement where a vendor's paper is inadequate or missing. Set a hard response deadline and escalate to contract termination for non-responders.

Week 3. Audit exports. Pull a list of billing-data exports from the last 90 days. Find the shared folders holding old worklists and set a disposal schedule with an owner.

Week 4. Document roles. One page: who selects codes, who reviews, who queries, who may never modify a submitted code, and where the query log lives. Have every billing staff member sign it. Add the four annual code-update dates to the practice calendar with named owners.

Handled well, medical billing codes are just structured data moving through a controlled pipeline. Handled casually, they are the single largest volume of identifiable health information your practice sends outside its walls every single day.

Start with the vendor list. If a billing partner, coding contractor, or scrubbing tool is missing an agreement, build a signature-ready BAA and send it this week — before the next denial backlog turns into an email thread you cannot take back.