ICD-10-CM coding is the work of assigning diagnosis codes from ICD-10-CM, the United States' morbidity classification, to the diagnoses and reasons for visits documented in a patient's record.
Coders find the best code in the Alphabetic Index, verify it in the Tabular List and follow the Official Guidelines HIPAA requires.
This guide covers what the code set is, who maintains it, how codes are built and how a coder assigns one.
What is ICD-10-CM and who maintains it?
ICD-10-CM is a morbidity classification published by the United States for classifying diagnoses and reasons for visits in all health care settings.
It is based on ICD-10, the statistical classification of disease published by the World Health Organization (WHO).
Within the United States, the CDC's National Center for Health Statistics (NCHS) maintains ICD-10-CM, and NCHS continues to maintain it while the U.S. evaluates ICD-11 — the successor classification WHO's World Health Assembly adopted in May 2019, effective January 1, 2022.
ICD-10-CM is the diagnosis code set U.S. claims work runs on in the meantime.
Under HIPAA, for dates of service on and after October 1, 2015, the adopted medical code sets include ICD-10-CM — with its Official Guidelines — for diagnoses, and ICD-10-PCS — with its Official Guidelines — for hospital inpatient procedures (45 CFR 162.1002(c)).
The industry transitioned from ICD-9 to ICD-10 for diagnoses and inpatient procedures on October 1, 2015, and ICD-10 applies to all HIPAA-covered parties.
The Official Guidelines are approved by four Cooperating Parties: the American Hospital Association (AHA), AHIMA, CMS and NCHS.
The FY 2027 edition runs 121 pages and applies to discharges and encounters from October 1, 2026 through September 30, 2027.
It is organized into Section I (conventions and general and chapter-specific guidelines), Section II (principal diagnosis selection, non-outpatient), Section III (additional diagnoses, non-outpatient) and Section IV (outpatient services), plus Appendix I on present-on-admission reporting.
The code set updates on a cycle coders track every year: ICD-10-CM and ICD-10-PCS both update every October 1.
CDC announced new ICD-10-CM codes effective October 1, 2026, applying to encounters and discharges from October 1, 2026 through September 30, 2027.
ICD-10-CM also receives April 1 updates — CMS posted April 1, 2026 addenda for encounters and discharges from April 1 through September 30, 2026.
HIPAA requires covered entities to use the medical data code sets valid at the time the health care is furnished (45 CFR 162.1000), which is why coders work from the edition that matches the date of service.
When a question the guidelines do not settle comes up, coders turn to Coding Clinic for ICD-10-CM and ICD-10-PCS, published quarterly by the AHA Central Office through cooperation among AHA, AHIMA, CDC/NCHS and CMS.
CMS affirmed Coding Clinic as the official source of coding information in the Federal Register (Vol. 74, No. 165, August 27, 2009), per the AHA.
Diagnosis coding is the core skill of the coder role — the medical coder career guide covers the job itself, the settings and the career path around it.
Confirm the current edition before you code
How are ICD-10-CM codes structured?
ICD-10-CM codes may be 3, 4, 5, 6 or 7 characters long, and every category in the classification is three characters.
Only full codes are reportable — never a bare category or subcategory — and a three-character code may be used only where it is not further subdivided.
A code that is not coded to the full number of characters required is invalid.
Two structural rules trip up new coders.
A code with an applicable 7th character is considered invalid without it, and where the classification uses the placeholder character 'X', the X must be included for the code to be valid.
The 7th character is where coding meets the story of the encounter.
Most Chapter 19 injury categories carry three 7th-character values — A for the initial encounter, D for subsequent encounters and S for sequela — and traumatic fracture categories have additional values.
The initial-encounter character applies while the patient receives active treatment, so the choice depends on the treatment phase, not on whether the provider is seeing the patient for the first time.
The Tabular List's conventions tell you how codes relate to each other.
An Excludes1 note means 'NOT CODED HERE' — the excluded code should never be used at the same time as the code above the note, unless the two conditions are unrelated.
An Excludes2 note means 'Not included here' — the patient may have both conditions, and both codes may be used together when appropriate.
Other conventions carry meaning too.
The abbreviation NEC ('Not elsewhere classifiable') represents other specified, while NOS ('Not otherwise specified') is the equivalent of unspecified.
Brackets enclose synonyms and alternative wording and identify manifestation codes; parentheses enclose nonessential modifiers.
And the word 'with' is interpreted as 'associated with' or 'due to' — the classification presumes a causal relationship, and the conditions are coded as related unless the documentation states they are unrelated or another guideline requires explicit linkage.
Combination codes are part of the structure: a single code can classify two diagnoses, a diagnosis with a manifestation, or a diagnosis with a complication, and multiple codes should not be used when a combination code clearly identifies all the elements.
The Alphabetic Index flags them through subterm entries, and the Tabular List flags them through inclusion and exclusion notes.
One number this page will not give you is a total.
None of the CMS and NCHS pages our research read publishes a total count of ICD-10-CM codes for the current edition, so treat any total circulating online as unverified.
Alphabetic Index and Tabular List
Every ICD-10-CM lookup runs through two tools in a fixed order.
The Official guideline is to first locate the term in the Alphabetic Index, then verify the code in the Tabular List.
The order matters enough that the guidelines warn about it: Section IV tells coders never to begin searching initially in the Tabular List, because that leads to coding errors.
The Index narrows the field; the Tabular List confirms.
The Alphabetic Index itself has four parts: the Index of Diseases and Injury, the Index of External Causes of Injury, the Table of Neoplasms and the Table of Drugs and Chemicals.
The part a lookup starts in follows what the record documents — a disease or injury, an external cause, a neoplasm, or a drug or chemical.
The Tabular List is where verification happens.
Reading the inclusion and exclusion notes, the Excludes1 and Excludes2 notes and the character requirements is the step that catches a code that is missing characters or conflicts with a note before it goes on a claim.
External cause lookups start in the Index of External Causes of Injury.
The guidelines state there is no national requirement for mandatory external cause code reporting — reporting is required only under a state-based mandate or a particular payer's requirement, and voluntary reporting is encouraged.
CMS publishes the working material free: code tables, Tabular List and Index files for each edition, downloadable from its ICD-10 page.
Steps to assign a diagnosis code
Assigning a diagnosis code follows the Official Guidelines, and the sequence below is the one they describe.
Every step runs on the documentation — the coder never codes from clinical criteria alone.
Read the provider's diagnostic statement
Code assignment is based on the provider's statement that the condition exists, not on the clinical criteria the provider used to reach it. In the guidelines, 'provider' means the physician or qualified health care practitioner legally accountable for establishing the patient's diagnosis.Locate the main term in the Alphabetic Index
Start in the part of the Index that matches the documentation — Diseases and Injury, External Causes, Neoplasms or Drugs and Chemicals — and work from the main term through its subterms.Verify the code in the Tabular List
The guideline is to verify every candidate code in the Tabular List, and never to begin there. Read the inclusion and exclusion notes and confirm the code is valid at its full length.Code to the full number of characters required
Add every applicable character, including any 7th character and any required placeholder X. A code missing an applicable 7th character — or not coded to its full required length — is invalid.Check for a combination code
When a single code clearly classifies two diagnoses, or a diagnosis with a manifestation or complication, the combination code is used instead of separate codes.Query the provider when documentation conflicts
If the medical record documentation conflicts, the guideline path is a provider query rather than a guess from clinical criteria.
The sequence changes shape by setting, and the guidelines are explicit about the difference.
In outpatient services, the term is first-listed diagnosis rather than principal diagnosis.
Diagnoses documented there as probable, suspected, questionable, rule out, compatible with, consistent with or working diagnosis are not coded.
The code assignment reflects the highest degree of certainty, which means the symptoms, signs and abnormal results documented.
Inpatient rules differ, and they are scoped: in short-term acute, long-term care and psychiatric hospital admissions, diagnoses documented at discharge as probable, suspected, likely, possible or still to be ruled out are coded as if established.
That rule belongs to those hospital settings — it does not carry into outpatient work, where the outpatient rule above governs.
Specificity is part of the discipline too.
The guidelines say an unspecified-side code should rarely be used — such as when the documentation in the record is insufficient to determine the affected side and clarification cannot be obtained.
ICD-10-CM vs ICD-10-PCS
ICD-10 is two code sets with different jobs, and HIPAA adopted each with its own Official Guidelines.
ICD-10-CM classifies diagnoses and reasons for visits in all health care settings; ICD-10-PCS is the code set for hospital inpatient procedures.
For a coder, the split maps to the settings.
In professional-fee, outpatient, emergency department and risk adjustment work, diagnoses are coded in ICD-10-CM.
ICD-10-PCS belongs to facility inpatient coding, where the procedure side of a hospital stay is coded with it alongside CM diagnosis codes.
| — | ICD-10-CM. | ICD-10-PCS. |
|---|---|---|
| Classifies. | Diagnoses and reasons for visits. | Hospital inpatient procedures. |
| Settings. | All health care settings. | Hospital inpatient stays. |
| Official Guidelines. | Adherence required under HIPAA. | Adopted with its own Official Guidelines. |
| Update cycle. | Every October 1, plus April 1 addenda. | Each October 1, with an April 1 update window as well (FY 2027: discharges October 1, 2026 – March 31, 2027). |
Both code sets update every October 1, and both have an April 1 update window, but their effective windows differ.
CDC announced new ICD-10-CM codes effective October 1, 2026, applying to encounters and discharges through September 30, 2027, and ICD-10-CM also receives April 1 updates.
CMS announced the FY 2027 ICD-10-PCS codes effective October 1, 2026, for discharges October 1, 2026 through March 31, 2027.
Both code sets carry Official Guidelines, and adherence to the ICD-10-CM guidelines when assigning diagnosis codes is required under HIPAA.
Diagnosis coding skills employers test
The skills diagnosis coding runs on are the ones the guidelines govern.
They include reading documentation for the provider's diagnostic statement, working the Alphabetic Index and the Tabular List in order, and applying conventions like Excludes1 and Excludes2.
They also include building codes to their full required length and knowing where the inpatient and outpatient rules part ways.
If you want to check your own readiness, those guideline rules are the material to test yourself against.
Credentials sit alongside that knowledge in hiring.
BLS says employers may prefer certified medical records specialists or expect them to earn certification shortly after hire.
AAPC — describing its own field — says no degree is required for medical coding, though certification and training are typically preferred by employers.
Taking an AHIMA certification exam is voluntary per AHIMA's candidate guide, and a certification is a credential, not a license.
The authoritative answers live in a fixed order: the Official Guidelines first, then Coding Clinic for ICD-10-CM and ICD-10-PCS, which CMS affirmed as the official source of coding information.
When you want to see how employers phrase these requirements, the live medical coder jobs board shows current postings for coding roles.
Career information, not coding, billing-compliance, legal or tax advice; confirm code-set, guideline and edition details with CMS and NCHS before relying on them in your work.