ICD-10 code mapping testing requirements

Which ICD-10 does your software store?

Three separate artefacts share the name. They have different maintainers and different release calendars, and their code structures do not match. WHO's ICD-10 is an international classification. ICD-10-CM and ICD-10-PCS are two United States code sets, maintained and released apart from each other, and they are the ones a US health product actually holds.

WHO ICD-10, ICD-10-CM and ICD-10-PCS compared by maintainer, what each codes, and the release described, including FY2027 code counts.

Code set	Maintained by	What it codes	The release described here
WHO ICD-10	World Health Organization	Diseases and related health problems, for international reporting	Sixth Edition 2019, the newest version WHO's own browser offers
ICD-10-CM	CDC's National Center for Health Statistics	Diagnoses, in every US health care setting	FY2027, 74,879 codes valid for submission, effective 1 October 2026
ICD-10-PCS	Centers for Medicare & Medicaid Services	Procedures on hospital inpatients, reported by hospitals	FY2027, 79,256 codes, effective 1 October 2026

NCHS states that WHO owns and publishes ICD-10, that WHO authorised NCHS to develop ICD-10-CM, and that all modifications to ICD-10 must conform to WHO's established structure and conventions. ICD-10-PCS has no WHO counterpart at all. CMS funded it as a replacement for Volume 3 of ICD-9-CM, awarded 3M Health Information Systems a three-year development contract in 1995, and released the final version in Spring 1998, with annual updates since. The split shows in the announcements: CMS announces the new procedure codes and CDC the new diagnosis codes, and both lines sit in the What's New block of the CMS ICD-10 page.

WHO ICD-11 came into effect on 1 January 2022, following adoption by the World Health Assembly in 2019, and its current release is 2026-01. It displaces neither US code set. Read in full, 45 CFR 162.1002 adopts ICD-10-CM and ICD-10-PCS and names no ICD-11 code set anywhere. For a product that stores coded diagnoses for a US customer, such as an EHR or EMR system, the code set under test is ICD-10-CM, and WHO ICD-10 is a different document with a different structure.

What does the regulation actually require?

The code sets are adopted by name, so a wrong verdict on a code is a regulatory defect rather than a product preference. section 162.1002, Medical data code sets opens with "The Secretary adopts the following maintaining organization's code sets as the standard medical data code sets". Paragraph (c), for the period on and after 1 October 2015, adopts ICD-10-CM for diseases, injuries, impairments, other health problems and their manifestations, and the causes of any of those. The same paragraph adopts ICD-10-PCS for prevention, diagnosis, treatment and management on hospital inpatients reported by hospitals.

Four readings of that paragraph change what a test has to cover.

• The adoption is of the code set "including The Official ICD-10-CM Guidelines for Coding and Reporting", and the same phrasing covers the PCS guidelines. The guidelines are inside the adopted standard.
• ICD-10-PCS is adopted only for procedures on hospital inpatients reported by hospitals. It is not the procedure code set for outpatient or professional billing, which matters when the product is a medical billing system.
• ICD-10-CM carries no setting restriction in the regulation text.
• The paragraph reads "as maintained and distributed by HHS". It names no version, no fiscal year and no file.

The version rule sits in the neighbouring section, and it is the sentence a test can be written against. 45 CFR 162.1000(a) requires a covered entity to use the medical data code sets "that are valid at the time the health care is furnished". Paragraph (b) pins nonmedical data code sets to the time the transaction is initiated instead. Those are two different clocks, and a system that runs one of them for both is wrong on one.

Both guideline documents state the obligation in their own opening pages: adherence to the guidelines when assigning codes is required under HIPAA. CMS states the reach of the code sets in the same terms, saying that ICD-10 applies to all parties covered by the Health Insurance Portability and Accountability Act. Billing Medicare or Medicaid is not the trigger. The safeguard side of the same statute, which governs the data these codes describe, is covered in HIPAA testing requirements for software.

The regulation text quoted above was read from the Government Publishing Office's official XML of the CFR annual edition dated 1 October 2024, because eCFR redirects automated clients. Any amendment made after that date is not reflected here, and the citation has not been checked against the live eCFR.

Which structural rules does a validator have to encode?

The ICD-10-CM guidelines carry the construction rules in Section I.A, and each one has a direct machine equivalent.

ICD-10-CM Section I.A code construction rules, with where each rule is stated and what a code validator does with it.

Rule	Where it is stated	What the validator does with it
Categories are 3 characters. Subcategories are 4 or 5. Codes are 3, 4, 5, 6 or 7 characters	Section I.A.2	Accepts all five lengths. 215 of the FY2027 codes are 3 characters and valid on their own
A code with an applicable seventh character is invalid without it	Section I.A.2	Rejects the stem S72001 and accepts S72001A
Only codes may be reported. Categories and subcategories may not	Section I.A.3	Rejects the 23,524 header rows the order file marks as invalid for submission
Where a placeholder exists, the X must be used for the code to be valid	Section I.A.4	Applies inside the poisoning, adverse effect and underdosing categories T36-T50
The seventh character must sit in position 7, padded with X when the code is shorter	Section I.A.5	Accepts E0837X1, where the X pads position 6 and the final 1 is the laterality character

Categories T36-T50 are where a medication error is recorded, so the placeholder rule is reached most often by products that prescribe or dispense; the rest of that path is covered in testing pharmacy software and e-prescribing.

The lengths are not evenly spread. Across the 74,879 valid FY2027 codes there are 215 of three characters, 5,397 of four, 7,179 of five, 10,501 of six and 51,587 of seven, and 14,411 codes carry an X in position 5 or position 6. A suite built from familiar four character codes exercises 5,397 of the 74,879.

Each diagnosis code has two written forms. The tabular XML writes A00.0 with the decimal point; the flat distribution files write A000 without it, and the CMS field layout for those files says dots are not included. Both are the same code. A comparison between two services that disagree on the form fails on every row.

Ranges need the order file too, for a different reason. CMS states that the way to read an expression such as C43-C449 is to take the order number of the lower code and of the higher code and keep every code whose order number falls between them, and it warns in the same document that the lower code comes first by order number regardless of the characters used in forming the codes, and that the order numbers are likely to change with each update. A range implemented as an alphanumeric string comparison returns the wrong members, and an order number cached across a release returns wrong members of a second kind, visible only after the next update lands.

Deriving a chapter from a code does not work either, and the chapter count itself is reported inconsistently by its own publisher. WHO's Volume 2 instruction manual says twice that the classification is divided into 21 chapters. The WHO 2019 browser, queried through its own root concepts endpoint, returns 22, the twenty-second being "Codes for special purposes". Both readings come from WHO. The FY2027 ICD-10-CM tabular list has 22 chapters of its own, numbered 1 to 22 in Arabic numerals where WHO uses Roman, and the titles differ: chapter 5 is "Mental, Behavioral and Neurodevelopmental disorders" against WHO's "Mental and behavioural disorders". Inside a single code set the first letter does not settle the chapter, because WHO's manual records that D appears in both Chapter II and Chapter III, that H appears in both Chapter VII and Chapter VIII, and that four chapters use more than one letter in the first position.

Two more traps sit in the ranges themselves. A pattern written to WHO's stated A00.0 to Z99.9 range mis-handles two ICD-10-CM chapters, because chapter 15 runs O00-O9A and chapter 17 runs Q00-QA1. Chapter 22 spans U00-U85 while holding three valid codes in FY2027: U070 vaping-related disorder, U071 COVID-19, and U099 post COVID-19 condition, unspecified. A validator that accepts a declared range accepts codes that do not exist.

What is different about ICD-10-PCS?

Every one of the 79,256 FY2027 procedure codes is exactly seven characters, and none carries a decimal point, so the question of written form does not arise. Each character is an axis of classification. Convention A2 allows 34 values per axis, the digits 0 through 9 and the alphabet without I and O, which are dropped because they are easily confused with 1 and 0. Convention A8 requires all seven characters to be specified for the code to be valid. The first character is the section, FY2027 has 17 of them, and 68,493 of the codes sit in section 0, Medical and Surgical.

What a position means is fixed only within a section. The example in the guidelines is the fifth axis, which specifies the approach in sections 0 through 4 and 7 through 9. Convention A4 goes further inside a single section: body part value 0 is Brain in the Central Nervous body system and Cervical Plexus in the Peripheral Nervous one.

Convention A9 is the rule a per character validator cannot express. Valid codes are all the combinations of characters 4 through 7 that appear in the same row of a PCS table. The example CMS prints is in section 0, body system J, operation H, where 0JHT3VZ is valid and 0JHW3VZ is not, although every character in the second code is individually permitted in that same table. The implementation that gets this right loads the PCS tables rather than a list of allowed characters.

What happens on 1 October?

The FY2027 releases take effect on 1 October 2026, and the scope is stated on the release rather than inferred. CMS says the FY2027 ICD-10-CM files are for discharges and patient encounters occurring from 1 October 2026 through 30 September 2027. NCHS says the same on its own file page, and the FY2027 guidelines carry the date range in their header.

The FY2027 changeover is small and still breaks things. ICD-10-CM moves from 74,719 codes to 74,879, through 190 additions, 30 deletions and 4 revisions, per the trailer of CMS's own addenda file. ICD-10-PCS moves from 79,193 to 79,256, through 101 new codes, 3 revised titles and 38 deletions.

The 4 revisions carry more weight than the count suggests, because they are what a code comparison misses and a description comparison catches. L02232, L03312 and L03322 gain "and flank" in their titles, and Z2914 changes from "Encounter for prophylactic rabies immune globin" to "immune globulin", a spelling fix. The code is unchanged in all four cases, and any stored copy of the description is now stale.

October is not the only date the code sets move on. The FY2027 conversion table carries an explicit effective date on every row that is not a 1 October one, and those dates are 1 April 2020 for 2 codes, 1 January 2021 for 6 codes, 1 April 2022 for 3 codes, and 1 April 2023 for 42 codes. CMS describes the same events in prose, naming Z28.310, Z28.311 and Z28.39 for the April 2022 set and 42 new codes for health-related social needs in the April 2023 set. On the procedure side CMS records 34 new codes effective 1 April 2023 and 41 effective 1 April 2024. CMS states that it adopted an April 1 implementation date in addition to the annual October 1 update, beginning with 1 April 2022, citing the FY 2022 IPPS/LTCH PPS final rule at 86 FR 44950 through 44956.

The asymmetry between the two code sets is on the CMS page today. The FY2027 ICD-10-PCS files are scoped to discharges from 1 October 2026 to 31 March 2027, while the FY2027 ICD-10-CM files run the full twelve months. FY2026 and FY2025 were split the same way, with a complete April 1 file set for both code sets, including reissued guidelines. A build that pins one procedure file per fiscal year is following a calendar CMS does not use.

The opposite case is the one a code-list regression suite reports as nothing. The 1 April 2026 ICD-10-CM update added, deleted and revised no codes at all. Its tabular addenda holds 48 Add, 46 Delete and 14 Revise entries, 108 in all, and every one of them is an instructional note or an index term, such as the Excludes1 note at D18 for benign neoplasm of glomus jugulare becoming an Excludes2. An Excludes1 to Excludes2 change alters which code pairs may lawfully be reported together while every individual code stays valid. The conversion table agrees, carrying no row with an effective date of 1 April 2026. The same has happened before, and CMS wrote it down for the 1 April 2024 update, saying it addressed typographical errors and implemented no new diagnosis codes.

Two publication habits set the timing of the work. Errata arrive after a release is live: the FY2027 ICD-10-PCS file list opens with a 2027 ERRATA document, and the FY2024 list carries an errata for the 1 April 2024 update posted on 29 April 2024, four weeks after that update took effect. Guidelines can also arrive later than the code files. On 2 September 2026 the CMS page still listed the FY 2027 ICD-10-CM coding guidelines as not yet available while all five FY2027 code files were posted, and those guidelines were already on the NCHS file server, dated 8 June 2026. The two publishers do not post the same artefact at the same time.

The changes themselves are decided by the ICD-10 Coordination and Maintenance Committee, which CMS describes as a federal interdepartmental committee of CMS and CDC's NCHS providing a public forum to review requests bi-annually. CMS does not name the months on that page. One documented cycle gives the lead time: diagnosis proposals were presented on 17 and 18 March 2026, and the deadline for comments on procedure topics being considered for the 1 October 2026 implementation was 17 April 2026. Under six months separated the public comment from the effective date.

A product on a release train meets this event mid-sprint every year, and the wider pattern is covered in regression testing for regulated software.

What maps an old code to a new one?

For year to year continuity inside ICD-10-CM, the current artefact is the Conversion Table, published by NCHS with each release. Its columns are "Current code assignment", "Effective" and "Previous Code(s) Assignment", and its preamble says it shows, for each new code, the effective date and its previously assigned code equivalent. The FY2027 table has 6,083 data rows and is cumulative back to 2016, so it reaches every code introduced since the US transition. Its own trailer row gives 190 new codes for 2026, which matches the addenda count. An equivalent table is published for ICD-10-PCS each cycle.

A row is not a one-to-one crosswalk. U07.0 in the FY2027 table maps back to eight previous codes: J68.0, J68.9, J69.1, J80, J82, J84.114, J84.89 and Z72.0. A mapping implementation that assumes a single predecessor drops the other seven without raising anything. That behaviour surfaces in a re-coded historical dataset long after the load, so it is checked during healthcare data migration testing instead.

The General Equivalence Mappings are a finished artefact. CMS repeats a note against FY2019, FY2020, FY2023 and FY2024 saying that, as stated in the FY 2016 IPPS/LTCH PPS final rule at 80 FR 49388, the GEMs were updated annually through the Coordination and Maintenance Committee process and would continue to be updated for approximately 3 years after ICD-10 was implemented. The last GEMs files CMS lists are the FY2018 pair, one for ICD-10-CM and one for ICD-10-PCS. CMS says on the same page that it is no longer updating and posting the Reimbursement Mappings or the ICD-10-PCS Reference Manual, both last posted for FY2016.

Mapping to ICD-11 is a separate exercise with a separate file. WHO publishes mapping tables with each ICD-11 release, and the 2026-01 archive holds 11 files dated 16 February 2026, including one map to a single category and one to multiple categories, because the correspondence is not always one to one. The columns are keyed to WHO's own vocabulary, with an ICD10ClassKind that WHO defines as chapter, block or category. Nothing in the file is keyed to the US clinical modification, so it will not resolve an ICD-10-CM code that has no WHO ICD-10 counterpart. WHO also states in the ICD-10 front matter that mappings between other classifications and ICD-10 fall outside the ICD-10 licence and need a separate written agreement.

Which records show the code handling was tested?

Every release is a named file with a stated effective date, so the evidence can name exactly what was under test. The FY2027 ICD-10-CM set is the code descriptions in tabular order, the addendum, the code tables with the tabular list and index, the conversion table, the POA exempt codes and the guidelines. The FY2027 ICD-10-PCS set adds an errata, a version update summary, an order file, an addendum, a conversion table and its own guidelines. A test report that says "FY2027" without the file names cannot be reproduced once the next update replaces the page.

The formats let a harness read the code sets without scraping anything. ICD-10-CM ships as fixed length text in icd10cm_codes_2027.txt and icd10cm_order_2027.txt, as five XML files including icd10cm_tabular_2027.xml with three schemas covering them, and as PDF. ICD-10-PCS ships as icd10pcs_codes_2027.txt and icd10pcs_order_2027.txt, as icd10pcs_tables_2027.xml, icd10pcs_index_2027.xml and icd10pcs_definitions_2027.xml with matching schemas, and as PDF. Conversion tables ship as CSV and XLSX. Both order files are capped at 400 characters per line.

Fixtures are the one place this work touches patient data. A test set built from real claims carries diagnoses and is therefore PHI, so code set work runs on synthetic records, or on real ones under terms settled first at how we work with protected health information. A code structure test needs no real patient in it, because the boundary cases are properties of the code.

Where does ICD-10 handling go wrong?

• The order file is loaded whole, so 23,524 category and subcategory stems pass validation and reach a payer.
• One code table is loaded for the whole system, so a September date of service is judged against the October release.
• Releases are compared by code alone, so the four FY2027 description revisions pass unnoticed until a report prints a title that no longer exists.
• The code set is modelled as changing once a year, so the 6 codes effective on 1 January 2021 and the 42 effective on 1 April 2023 arrive as data the parser has never seen.
• The regression suite watches the code list only, so the 1 April 2026 update reads as no change although 108 instructional entries moved, several of them Excludes1 notes that decide which codes may be reported together.
• The ICD-10-PCS validator checks each character against its axis, so 0JHW3VZ passes although its values come from two different rows of one table.
• The procedure file is pinned once per fiscal year, while CMS scopes the FY2027 release to 31 March 2027.
• Ranges are evaluated by string comparison, so codes that sort between the endpoints alphabetically join a range they are not in.
• One service stores A00.0 and another A000, and the reconciliation between them reports every row as a mismatch.
• The guidelines are treated as reference material, although 45 CFR 162.1002(c) adopts them as part of the code set.
• A release is downloaded once on its effective date, so the errata posted weeks later never reach the environment.

What do we run against ICD-10?

The first artefact is the version inventory, because no verdict on a code means anything until it is known which release produced it. From there the suite is built in two halves: the structural rules, which are fixed for a release and testable against the code and order files directly, and the date of service behaviour, which needs at least two releases loaded at once and is exercised across every effective date the system can be asked about.

The measurable claim is the one 45 CFR 162.1000(a) supplies. Given a date of service and a code, does the system reach the verdict the code set in force on that date would reach. Every release since 1 October 2015 is retrievable from the CMS archive and the NCHS file server, so that question has a right answer for any date the product accepts, and whoever reads the report can reproduce it. Where the annual changeover has to run without a manual regression cycle, healthcare test automation covers keeping that suite executable against a code set that moves.

Code counts, file names and structural rules on this page were taken from the FY2027 releases themselves, downloaded from the CMS ICD-10 page and the NCHS ICD-10-CM file server on 2 September 2026, and counted rather than quoted. The WHO statements come from ICD-10 Volume 2, Instruction Manual, Sixth Edition 2019 and the WHO ICD-10 2019 browser. The regulation text comes from GPO's govinfo XML of 45 CFR 162.1002 and 45 CFR 162.1000 in the annual edition dated 1 October 2024.