Appearance
25.28 — How the Money Moves: Revenue Cycle and Medical Coding
A doctor spends twenty minutes with a patient who has poorly controlled diabetes, reviews their kidney results, adjusts two medicines and orders a blood test.
For that visit to be paid, the encounter must be translated into codes: one set describing what the patient has, another describing what the doctor did, another for the laboratory test, each with the right qualifiers, submitted in a standard electronic format to the correct payer within that payer's filing deadline, with the patient's eligibility verified and any required authorisation already obtained.
If any element is wrong, the claim is denied. The service still happened, the cost was still incurred, and now somebody has to work out why and resubmit it.
That translation and its consequences are called revenue cycle management, and it employs an enormous number of people. For a services company working with American healthcare, it is the single largest and most stable body of work in the industry.
The cycle, front to back
Revenue cycle covers everything from before the patient arrives to the moment the account balance reaches zero. It is conventionally split into three phases.
Before the service. Scheduling; registration capturing demographics and insurance; eligibility verification, confirming the coverage is active and what it pays; prior authorisation for anything requiring it; and an estimate of what the patient will owe, which price transparency rules increasingly require.
At the time of service. Clinical documentation by the clinician; charge capture, meaning every billable item is recorded; and coding, which turns the record into the codes below.
After the service. Claim creation and scrubbing; submission; the payer's adjudication; posting of payments and adjustments; denial management and appeals; patient billing; and collections.
Two numbers dominate management attention. Days in accounts receivable — how long money takes to arrive — and the clean claim rate, the proportion of claims accepted on first submission. Everything a revenue cycle project does is ultimately aimed at one of those two.
The coding systems, each with a different job
Four systems do nearly all of the work, and confusing them is the most common beginner's error.
ICD-10-CM: diagnoses. What is wrong with the patient. Codes begin with a letter followed by digits, with additional characters adding detail — which side of the body, which encounter this is, and increasingly specific anatomical detail. The system contains tens of thousands of codes precisely because that specificity is what allows payment rules, quality measurement and epidemiology to work.
ICD-10-PCS: inpatient procedures. Used by hospitals for procedures performed on admitted patients. Every code is seven characters, and each position means something fixed — the section, the body system, the root operation, the body part, the approach, any device left in place, and a qualifier. It is built rather than looked up, which is why it takes real training.
CPT: professional procedures and services. Maintained by the American Medical Association, this is what physicians and outpatient services bill: office visits, surgical procedures, imaging, laboratory tests. Five digits, and the most commercially significant code set in American medicine.
HCPCS Level II: everything else. Drugs administered in a clinic, durable medical equipment, supplies, ambulance services. The drug codes here — the J-codes — are how a physician-administered medicine gets paid for, which makes them directly relevant to pharmaceutical clients launching an infused product.
Two more concepts complete the picture.
Modifiers are two-character additions to a procedure code that change its meaning: the procedure was bilateral, it was a distinct service on the same day, it was reduced in scope, it was performed by an assistant. Modifier misuse is one of the most heavily audited areas in the whole system, because a modifier can turn a bundled service into a separately paid one.
And the National Drug Code identifies a specific drug product, package and manufacturer — the link between the pharmaceutical world of the earlier chapters and the billing world of this one.
Evaluation and management coding, and what changed
Office visits, hospital visits and consultations are billed with evaluation and management codes, and they matter disproportionately because they are the most frequently billed codes in medicine.
For decades the level of an office visit was determined by counting documentation elements: how many items of history were recorded, how many body systems were examined, and the complexity of decision making. This produced a well-known pathology — notes padded with irrelevant recorded detail purely to justify a level, which made records longer and less useful.
That changed. For office and outpatient visits from 2021, and extended to most other settings from 2023, the level is selected on either the complexity of medical decision making or the total time spent on the day of the encounter, and the history and examination are documented as clinically appropriate rather than counted.
The practical consequences are worth knowing because clients are still adapting. Medical decision making is assessed on three elements: the number and complexity of problems addressed, the amount and complexity of data reviewed, and the risk of complications from the management decisions. Time now counts non-face-to-face work on the same day — reviewing results, coordinating care, documenting — which better reflects what the work actually is.
And for anyone building tooling: this is the area where documentation quality, coding accuracy and audit exposure meet most directly, and where computer assistance has the clearest value.
How hospitals get paid: grouping
Individual codes are not usually how an inpatient stay is paid.
Under the Medicare inpatient system, a stay's diagnoses and procedures are grouped into a diagnosis-related group — an MS-DRG — that describes the type of case and its severity, and the hospital is paid a fixed amount for that group regardless of how long the patient stayed or how many tests were run. Severity is influenced by documented complications and comorbidities, which is why hospitals employ clinical documentation improvement specialists whose job is to ensure the record accurately reflects how sick the patient was.
That role sits on an ethical line worth naming plainly. Documenting a condition the patient genuinely has and which affected their care is correct and required. Prompting for documentation that inflates severity without clinical basis is upcoding, and it is fraud.
Hospital outpatient care is grouped differently, into ambulatory payment classifications, and physician services are paid on a relative value scale where each service carries values for work, practice expense and malpractice cost, adjusted geographically and multiplied by an annual conversion factor. That last mechanism is why an annual change to one number moves physician payment across the entire country.
The electronic transactions
American healthcare administration runs on a defined set of standard electronic transactions, mandated under HIPAA. You will meet them by number.
| Transaction | What it does |
|---|---|
| 270 / 271 | Eligibility enquiry and response |
| 278 | Prior authorisation request and response |
| 837 | Claim submission |
| 835 | Remittance advice: what was paid and why |
| 276 / 277 | Claim status enquiry and response |
The 837 comes in variants — professional for physician services, institutional for facilities — corresponding to the older paper forms still referenced by name, the CMS-1500 and the UB-04.
Between provider and payer usually sits a clearinghouse, which validates the claim against format rules and payer-specific requirements, routes it, and returns acknowledgements. A claim rejected by a clearinghouse never reached the payer, and this distinction — rejection versus denial — matters operationally: a rejection is a formatting failure, a denial is a payment decision.
And the 835 is where the money is explained. Each line carries adjustment codes: a claim adjustment reason code saying why the payment differs from the charge, and a remittance advice remark code adding detail. Automating the reading of these is one of the highest-return pieces of work in revenue cycle, because it turns a manual review queue into a routed, prioritised workflow.
Denials: the industry inside the industry
A meaningful share of claims are denied on first submission, and a large proportion of those denials are avoidable and, if worked, ultimately paid. That gap is what denial management exists to close.
The recurring causes are few and predictable.
Eligibility — the coverage was not active, or the patient had different coverage than recorded.
Authorisation — required approval was not obtained, or was obtained for a different service or date.
Medical necessity — the payer's policy does not consider the service appropriate for the recorded diagnosis.
Coding — invalid combinations, missing modifiers, or services the payer considers bundled together.
Timely filing — submitted after the payer's deadline, which can be as short as 90 days. This is the most infuriating denial because the money is simply gone.
And duplicates, often created by well-meant resubmission while the first claim was still processing.
Appeals follow a structured escalation, with the levels and deadlines set by the payer and, for government programmes, by regulation. The work is documentation-heavy: the clinical record, the payer's own policy, and an argument connecting them.
Two facts shape every improvement project here. Prevention is worth several times more than appeal, because working a denial costs staff time on money already earned. And denials cluster: a handful of payer-and-reason combinations usually account for most of the volume, so the analysis that finds those clusters is more valuable than any amount of general effort.
Prior authorisation, and the reform now landing
Prior authorisation is a payer requiring approval before a service is delivered. For providers it is the most disliked administrative process in American healthcare, and for patients it is a source of delay — the same delay Chapter 25.25 tries to close from the manufacturer's side.
The historical process was fax, phone and portal, with each payer's rules living in a document somebody had to find.
That is being replaced by regulation, and the dates are worth knowing precisely because they define a live market. Under the CMS Interoperability and Prior Authorization final rule, affected payers — Medicare Advantage, Medicaid and CHIP programmes and their managed care plans, and qualified health plans on the federal marketplace — must send prior authorisation decisions within 72 hours for expedited requests and 7 calendar days for standard ones, beginning in 2026, must publicly report prior authorisation metrics from 31 March 2026 covering the previous year, and must implement four programming interfaces by 1 January 2027: patient access, provider access, payer-to-payer, and prior authorisation.
Those interfaces are built on FHIR, the health data standard described in Chapter 25.31. Which means a regulatory deadline has just made a modern API standard mandatory across a large part of American healthcare — the single clearest example in this Part of regulation creating a software market with a fixed date attached.
Compliance: where revenue cycle becomes a legal risk
Billing is where healthcare fraud enforcement concentrates, and the mechanisms are covered in Chapter 25.29. Three practices are worth naming here because they arise from coding decisions.
Upcoding — billing a higher-paying code than the service supports.
Unbundling — billing separately for components that should be billed as one procedure.
And billing for services not rendered or not documented. The governing principle is simple: if it is not in the record, it did not happen, and billing for it is a false claim.
The federal False Claims Act allows recovery of multiples of the amount wrongly claimed plus penalties, and permits whistleblower suits by employees who share in the recovery. This is why compliance functions in provider organisations have real authority, and why any automation touching coding must be auditable, explainable and conservative.
Where the technology is going
Four areas are active and every one of them is a genuine engineering problem rather than a slide.
Computer-assisted coding, where software reads the clinical note and proposes codes for a coder to confirm. Mature, widely used, and effective when the coder remains in the loop.
Autonomous coding for narrow, highly structured specialties — radiology and pathology reports especially — where the input is consistent enough to code directly with sampling-based quality control.
Denial prediction, scoring claims before submission so that the ones likely to fail are corrected first. This is straightforward supervised learning on data the organisation already has, and it produces measurable money.
And prior authorisation automation, now with a regulatory deadline behind it.
One caution for all four. Any system that influences what is billed sits inside the compliance regime above. It needs its decisions recorded, its version history retained, its accuracy monitored, and a human accountable for what goes out — which is the same evidence requirement you have met in every regulated context in this Part, arriving here from fraud law rather than from drug law.
Next: Chapter 25.29, how quality is measured and increasingly paid for — HEDIS, star ratings, value-based care, and the machinery that fights fraud, waste and abuse.