Coding Compliance for Medical Coders: Rules You Work Under

From the coder's seat, coding compliance means every code you assign can be traced to two things: the documentation in the health record, and a published rule that covers the code set you are using.

A code tied to neither is a compliance problem even when it was assigned in good faith.

The rules behind that test are formal, not informal.

AHIMA's Standards of Ethical Coding tell coding professionals to assign and report only codes and data clearly and consistently supported by health record documentation.

HIPAA requires covered entities to use the medical data code sets that are valid at the time the health care is furnished, and adherence to the ICD-10-CM Official Guidelines when assigning diagnosis codes is required under HIPAA.

Compliance also is not just for credentialed coders.

AHIMA wrote its standards for coding professionals whether credentialed or not — coding staff, auditors, educators, CDI professionals, managers and HIM/coding students.

This page maps the rules that bind the work covered in the medical coder career guide, the patterns that get flagged, and how audits test them.

The rules arrive in layers, and each layer has a named publisher.

• HIPAA's adopted code sets. Under the HIPAA code set rule at 45 CFR 162.1002, the standard for physician and other health care services is the combination of HCPCS, maintained and distributed by HHS, and CPT-4, maintained and distributed by the AMA. The adopted medical code sets also include ICD-10-CM, with its Official Guidelines, for diagnoses and ICD-10-PCS for hospital inpatient procedures — and the code sets must be valid at the time the care is furnished.
• The Official Guidelines. The ICD-10-CM Official Guidelines are approved by the four Cooperating Parties — AHA, AHIMA, CMS and NCHS — and adherence to them when assigning diagnosis codes is required under HIPAA. The ICD-10-PCS Official Guidelines stand alongside them: adherence is likewise required under HIPAA, and the 2027 PCS guidelines carry the same four-party approval.
• Official advice. AHIMA's Standards of Ethical Coding define the field's requirements to include ICD conventions, the Cooperating Parties' guidelines, AMA CPT rules, state and federal regulations, and official advice such as AHA Coding Clinic and AMA CPT Assistant.
• CMS's correct-coding edits. CMS owns the National Correct Coding Initiative for Medicare Part B claims. Its procedure-to-procedure edits pair a column-one and column-two code, and when both codes are reported for the same beneficiary on the same date of service, the column-two code is denied unless a clinically appropriate NCCI-associated modifier is reported. The edit files update quarterly, and under NCCI policy procedures are reported with the most comprehensive code describing the service — unbundling is not permitted. Medicaid runs its own NCCI program, mandatory for its fee-for-service claims, and it differs from Medicare's.
• Employer policy and OIG guidance. OIG's General Compliance Program Guidance, published in November 2023, is voluntary, nonbinding guidance describing seven elements of a compliance program. Starting in 2024, OIG began publishing industry segment-specific guidance to supplement it, and its Compliance Program Guidance for Third-Party Medical Billing Companies, published in the Federal Register on December 18, 1998, is OIG's guidance for that segment.

Notice which layers bind and which persuade.

The HIPAA code-set rule and the guidelines attached to the code sets are regulation.

OIG's guidance is explicitly voluntary — but the program structure and audit baselines described later in this page come from OIG's guidance, which is why it shapes a coder's working life anyway.

The error patterns OIG has named are specific, and they are worth knowing by their industry names.

• Upcoding — in OIG's definition, using a code with a higher reimbursement rate than the code that reflects the service.
• Unbundling — using separate billing codes for services that have an aggregate billing code. CMS's NCCI policy makes the same point from the edit side: providers must not fragment a procedure into its components.
• DRG creep — OIG's term for a variety of upcoding on inpatient claims — where Medicare pays per discharge at a rate that varies by the DRG assigned — billing a DRG that pays more than the DRG that reflects the service.
• Modifier misuse — CMS's NCCI policy says modifier 59 should be used only if no more descriptive modifier applies, and should not be appended to an E/M service. In a 2005 report, OIG found 35% of the modifier 25 claims Medicare allowed in 2002 did not meet program requirements, with $538 million in improper payments. Those figures are two decades old, but the modifier cautions sit in CMS's current NCCI policy, and modifier choice falls under the coding rules the CERT program checks each year.

Documentation is the other half of the red-flag list.

CMS reported that most improper payments in its FY 2025 measurement occurred where reviewers could not determine propriety because of insufficient documentation.

A code the record cannot support is a finding even when the code choice itself looked defensible at the time.

OIG has said upcoding has been a major focus of its law enforcement efforts, and HIPAA added a civil monetary penalty for upcoding.

These named patterns are what coding audits are built to find.

Compliance gets tested in two directions: inside the organization and from outside it.

Inside, OIG's compliance guidance for physician practices, published October 5, 2000, suggests a baseline audit and then periodic audits at least once a year.

As a basic guide, it points to five or more medical records per federal payer — Medicare or Medicaid — or five to ten records per physician.

OIG also publishes RAT-STATS, its free statistical software for selecting random samples and estimating improper payments; OIG does not require its use, and its page notes many providers use it for corporate integrity agreement and self-disclosure claims reviews.

From outside, CMS's CERT program reviews a statistically valid stratified random sample of Medicare fee-for-service claims every year to check payment under coverage, coding and payment rules.

Documentation requests carry a 45-calendar-day deadline.

CMS put the FY 2025 Medicare fee-for-service estimated improper payment rate at 6.55%, or $28.83 billion, down from 7.66% in FY 2024.

Read from the coder's side, every one of those reviews runs the same test: can this code be reproduced from the record, under a rule the reviewer can name?

The people who run such reviews for a living are coding auditors — the coding auditor career guide covers that role.

Pressure to stretch a code can come from anywhere: a provider who wants the higher-paying DRG, a supervisor watching output, an employer whose revenue tracks the codes.

The field's standards and guidance address the situation directly rather than leaving it to instinct.

AHIMA's Standards of Ethical Coding tell coding professionals to assign and report only codes clearly and consistently supported by health record documentation, and to query or consult the provider for clarification and additional documentation before final code assignment.

The same standards call on coding professionals to refuse to participate in, or conceal, unethical coding, data abstraction, query practices or other inappropriate coding activities.

The standards apply whether a coder is credentialed or not, so the expectation does not change with the job title.

The query step is its own discipline.

AHIMA and ACDIS published the Guidelines for Achieving a Compliant Query Practice—2026 Update in August 2026, and the standards route unclear or incomplete documentation back to the provider before the code is final.

On the employer side, OIG's guidance lists effective lines of communication and disclosure among its seven compliance-program elements — the element that covers how staff raise concerns.

Raising the question through that channel, and noting what you asked and what came back, leaves the trail an audit looks for.

Coding sits in the middle of the revenue cycle: clinical documentation goes in, coded claims come out, and payment follows the codes.

That position is why compliance failures surface downstream — as claim edits, denials, audit findings and repayments — long after the code was assigned.

Some enforcement is automated at the claim itself.

CMS incorporates its NCCI procedure-to-procedure edits into the Outpatient Code Editor that processes hospital outpatient claims, so a column-two code reported in violation of an edit can be denied before a person reviews the claim.

CMS also expects every billed service to show the specific sign, symptom or complaint that makes it reasonable and necessary — the link between the diagnosis codes and the procedure codes on the claim.

The rest surfaces later, through the audits described above.

The division of labor is practical: the coder owns the code-to-record link, and the organization owns the program around it.

The next sections sort out who holds which piece.

Coding compliance is conformity to established coding rules — the code sets and official guidelines adopted under HIPAA, the payer edit policies that process claims, federal fraud-and-abuse law, and the professional standards and employer policies layered on top.

At the organization level, a coding compliance program is the system that makes that conformity routine: written policies, training, auditing, monitoring and a channel for questions.

At the coder level it is narrower and concrete — code from the documentation, use the code set valid for the date of service, follow the Official Guidelines, resolve questions through the query process, and leave a trail a reviewer can follow.

The enforcement numbers explain the attention this layer of the job gets.

False Claims Act civil penalties assessed after July 3, 2025 start at $14,308 and cap at $28,619 for each claim, plus three times the amount of damages the government sustains.

The penalty is per claim, so it multiplies when a coding pattern repeats across a stream of claims.

OIG has called upcoding a major focus of its law enforcement efforts.

For the coder, the same discipline matters twice.

It keeps your work reproducible under audit, and it is the knowledge the field's adjacent roles are organized around — the compliance jobs section below names them.

AHIMA's standards apply to coding professionals whether credentialed or not, so the professional baseline is identical on your first day and at every stage after it.

Responsibility splits by role.

The organization owns the compliance program.

OIG's guidance describes it as compliance leadership and oversight, written policies and procedures, training and education, effective lines of communication, enforced standards, risk assessment with auditing and monitoring, and corrective action when offenses are detected.

How a company builds that structure is employer-side work — the employer compliance programs guides cover it from the hiring and operations side.

The publishers own the rules: the AMA maintains and distributes CPT, CMS maintains HCPCS Level II and the NCCI edits, and the ICD-10-CM and ICD-10-PCS Official Guidelines carry the approval of the four Cooperating Parties — AHA, AHIMA, CMS and NCHS.

The coder owns the individual assignment.

The code on the claim traces to documentation, under the guidelines, with unclear or incomplete documentation resolved through the query process before the code is final.

Audits can read both the record and the program, so both halves have to hold up.

Several roles in the field are built around this layer of the work.

Coding auditors run the record-to-code tests this page describes.

Coding managers work the program side of the same layer — the training, enforced-standards and corrective-action elements in OIG's list.

CDI specialists work the documentation side: ACDIS describes the role as communicating with providers, verbally or by query, about missing, unclear or conflicting documentation, so the record can support a code before final assignment.

Compliance also has a home outside the coding department.

OIG's guidance is built around a compliance-officer function; for small entities that cannot support one, OIG recommends a designated 'compliance contact'.

Whenever possible, that contact is not involved in billing, coding or claim submission, and reports at least quarterly to the owner or CEO.

For coders, one route into that world is auditing — coding auditor jobs draw directly on the knowledge this page covers.

Career information, not coding, billing-compliance, legal or tax advice. Rules and guidance change; confirm current requirements with the agencies and bodies named here — CMS, the HHS Office of Inspector General, AHIMA, ACDIS and the payers you bill.