Professional Ethics: AAPC and AHIMA Codes of Ethics in Practice

Why Professional Ethics Matter in Medical Billing and Coding

Medical coders occupy a position of significant trust. Every code submitted on a claim affects patient records, insurance payments, and the financial health of a practice. Mistakes can harm patients, expose providers to legal liability, and damage public trust in the healthcare system. Two credentialing organizations — AAPC and AHIMA — each publish a Code of Ethics that guides members and credentialed coders on how to handle these responsibilities. Understanding both codes, recognizing where they align, and knowing how to apply them when you face pressure in the workplace are essential professional skills.

The AAPC Code of Ethics

The AAPC Code of Ethics applies to all AAPC members and credentialed professionals, including those holding the CPC credential. It sets out several core obligations:

• Accuracy and honesty: Coders must report services accurately and honestly. This means assigning codes that are supported by clinical documentation — nothing more, nothing less.
• Compliance with laws and regulations: Members must follow applicable federal and state laws, including those governing fraud and abuse such as the False Claims Act and anti-kickback rules.
• Confidentiality: Coders must protect patient information and refrain from unauthorized disclosure.
• Continuing education: Members are expected to maintain competency through ongoing education.
• Professionalism: Coders must avoid actions that bring discredit to the profession and must not misrepresent their credentials or qualifications.
• Reporting misconduct: The code expects members to report unethical or illegal conduct through appropriate channels.

The AAPC Code of Ethics is publicly available at aapc.com and is a living document that members agree to uphold when they join or renew membership.

The AHIMA Code of Ethics

The AHIMA Code of Ethics applies to all AHIMA members and credentialed professionals, including those holding the CCA credential. AHIMA's code is grounded in a broader health information management context but carries strong obligations that apply directly to coding practice:

• Data integrity and accuracy: Health information professionals must ensure that data and information are accurate, complete, and trustworthy.
• Patient privacy and confidentiality: Protecting individually identifiable health information is a foundational duty. This aligns with HIPAA requirements but goes further as an ethical obligation independent of legal mandates.
• Professional competency: Members must practice within their scope of knowledge and seek guidance when uncertain.
• Avoiding harm: AHIMA's code explicitly calls on members to refuse to participate in or conceal unethical practices.
• Advocacy and truth: Members should advocate for accurate and complete health information and must not alter records or codes to misrepresent patient care or financial claims.
• Reporting obligations: Like AAPC, AHIMA expects members to report misconduct through appropriate internal and external channels.

The AHIMA Code of Ethics is publicly available at ahima.org.

Shared Principles and Unique Emphases

Both codes share a core commitment to accuracy, honesty, patient confidentiality, legal compliance, and the duty to report misconduct. A coder credentialed by either or both organizations is expected to place the integrity of the health record and the patient's interest above financial pressure from any source.

Where they differ in emphasis: AAPC's code has a strong focus on the business and reimbursement side of coding practice, reflecting its roots in physician practice billing. AHIMA's code situates coding within the broader health information management field and places particular emphasis on data stewardship and patient advocacy across all care settings.

Applying the Codes to Workplace Pressure

One of the most common and serious ethical challenges a coder will face is being pressured by a supervisor or employer to upcode — that is, to assign a code for a higher-level or more complex service than the documentation supports, in order to receive a larger reimbursement. Both codes are unambiguous on this point.

Under both the AAPC and AHIMA Codes of Ethics, a coder must:

1. Refuse to assign a code not supported by documentation. No supervisory authority overrides this duty. A credential belongs to the individual coder, and that individual is professionally and potentially legally responsible for codes submitted under their work.

2. Communicate the concern clearly. The coder should explain, in writing if possible, that the documentation does not support the higher-level code and cite the relevant coding guidelines.

3. Use available reporting channels. If the supervisor persists, the coder should escalate through the internal compliance chain of command (compliance officer, compliance hotline). If internal channels fail or are compromised, external reporting options exist, including the Office of Inspector General (OIG) fraud hotline.

4. Document actions taken. Keeping a record of communications protects the coder professionally.

Submitting a claim with an upcoded service can constitute fraud under federal law, including the False Claims Act. Patient safety is also implicated: inaccurate diagnosis or procedure codes affect future care decisions, insurance coverage determinations, and public health data.

Confidentiality: A Standing Obligation

Both codes require protection of patient information at all times — not only when a formal HIPAA policy is being discussed. If a colleague shares a patient's protected health information (PHI) verbally and without a legitimate work purpose, a coder has an ethical obligation to address it: decline to participate, remind the colleague of the confidentiality obligation, and report if the disclosure was inappropriate.

Discovering a Pattern of Misconduct

If a coder discovers a pattern of overbilling or systematic upcoding, the ethical obligation is clear under both codes: report it. Silence is not a neutral act — it can be interpreted as participation. Internal compliance channels should be the first step. If those channels are unresponsive or complicit, external reporting to the OIG or other appropriate authorities is both ethically required and legally protected under whistleblower provisions.

Safety and Scope of Practice

Coders do not diagnose, prescribe, or treat. When a patient asks a coder to omit a diagnosis from a claim, the coder must decline: omitting a documented diagnosis is both a coding error and potentially fraudulent. The coder should explain their role clearly and refer the patient to the provider to discuss documentation concerns. Altering health information at a patient's request falls outside the coder's scope and could compromise patient safety in future care encounters.