CorePulse Coding Run

Capturing documented secondary diagnoses without leaking PHI

The short answer: CorePulse reads the full chart, surfaces the coexisting diagnoses a rushed manual pass left on the table, and does it behind a fail-closed de-identification boundary so no PHI ever leaves the machine. The coder still decides. The chart still governs. Nothing is invented, and nothing walks out the door.

ICD-10-CM Official Guidelines FY2026 HIPAA Safe Harbor 45 CFR 164.514(b) CMS Medical-Necessity Documentation

PHI Egress

Bytes of protected health information that leave the local boundary. The de-id layer fails closed, so an incomplete scrub blocks the run rather than shipping raw text.

Safe Harbor

Identifier categories stripped before any model call, per the HIPAA Safe Harbor method at 45 CFR 164.514(b)(2).

Section III

Clinical-significance tests the ICD-10-CM FY2026 Guidelines set for reporting an additional diagnosis. CorePulse checks the note against each one.

Source Of Truth

The medical record. Every surfaced secondary diagnosis points back to the documenting line so the coder can confirm it, not guess at it.

The Problem

Documented diagnoses get missed, not because they are hidden, but because there is no time to read the whole chart

A manual first pass under production quotas tends to code the reason for the visit and stop. The comorbidity noted in the assessment, the status condition in the history, the finding buried three pages into a consult note: all documented, all reportable, all skipped. Section IV.J of the ICD-10-CM FY2026 Guidelines is explicit for outpatient encounters. Code every documented condition that coexists at the time of the visit and requires or affects patient care or treatment. Section III sets the parallel rule for inpatient additional diagnoses. The diagnoses were never missing from the record. They were missing from the claim.

The instinct is to hand the whole chart to a model and let it read. The problem is obvious: that chart is PHI, and shipping it raw is exactly the exposure a compliance team exists to prevent. CorePulse takes the other path. It reads the whole chart, but the model only ever sees a scrubbed version.

The Run

One chart, one boundary, one reviewer

Input

Full chart, local

The complete note stays on the machine. Nothing is uploaded to read it.

➞

De-ID Boundary

Safe Harbor scrub

18 identifier classes removed. If the scrub cannot verify a clean pass, the run stops. It never ships raw.

➞

Output

Coder review queue

Surfaced secondary diagnoses, each tied to the line that documents it, for a human to accept or reject.

Fail-closed, not fail-open. A best-effort scrubber that leaks on the edge case is worse than no scrubber, because it feels safe. CorePulse treats an unverified de-identification as a hard stop, the same posture CMS and OCR expect around protected data.

The Test It Applies

A secondary diagnosis is only reportable when the chart earns it

CorePulse does not surface a code because a word appeared. It checks the note against the additional-diagnosis criteria in Section III of the ICD-10-CM FY2026 Guidelines. A condition qualifies when the documentation shows it drove at least one of these.

Clinical evaluation

The condition was assessed or worked up during the encounter.

Therapeutic treatment

It was actively managed or treated, not just mentioned in passing.

Diagnostic workup

Tests or procedures were ordered to evaluate it.

Extended stay

It lengthened the encounter or the inpatient length of stay.

Added care

It increased nursing care or monitoring for the patient.

Manual Pass vs CorePulse-Assisted

Same chart, same guidelines, different reach

What happens	Manual first pass	CorePulse-assisted
How much of the chart gets read	Reason for visit, then time runs out	The full note, every section
Secondary diagnoses surfaced	Whatever the coder happened to catch	Every documented, Section III qualifying condition
Where a suggested code comes from	Memory and search	The exact documenting line, shown for review
Who makes the final call	The coder	The coder, on a shorter, evidence-linked list
What the model sees	Not applicable	Only the Safe Harbor de-identified text
PHI leaving the machine	None	None, enforced by a fail-closed boundary

Note what does not change. The coder still owns the disposition, and the record still governs. CorePulse never fabricates a diagnosis and never applies one on its own authority. It reads what a human did not have time to read, and hands back a checkable list.

The Boundary, In Detail

How no PHI leaves the machine

Fail-Closed Pipeline

De-identify before the model, verify before the send

The scrub runs on the local copy first. Only its output is eligible to be reasoned over, and only after the boundary confirms the removal.

Step 01 / IngestThe full chart is read locally. Nothing is transmitted to open it.
Step 02 / StripThe 18 HIPAA Safe Harbor identifier classes are removed from the working copy.
Step 03 / VerifyThe boundary checks the scrub. An unverified pass is a hard stop, not a warning.
Step 04 / ReasonOnly the de-identified text is used to find qualifying secondary diagnoses.
Step 05 / Re-linkFindings are mapped back to the original documenting lines, on the machine, for the coder.

PHI bytes egressed

NamesGeoDatesPhoneFaxEmailSSNMRNHealth plan #Account #LicenseVehicle IDDevice IDURLIPBiometricPhotoOther unique

What This Is Grounded In

Real rules, cited by name

Coding Authority

ICD-10-CM Official Guidelines for Coding and Reporting, FY2026

Section III sets the additional-diagnosis criteria for inpatient reporting; Section IV.J requires coding all coexisting outpatient conditions that affect care. These are the tests CorePulse applies before surfacing a secondary diagnosis.

Privacy Method

HIPAA Safe Harbor De-Identification

The 45 CFR 164.514(b)(2) Safe Harbor method defines the 18 identifier categories removed at the boundary before any diagnosis reasoning takes place.

Payment Standard

CMS Documentation and Medical-Necessity Requirements

A reported diagnosis has to be supported in the record. Because every surfaced code is tied to its documenting line, the capture stays inside CMS medical-necessity expectations rather than adding unsupported codes.

Where This Pays Off

Capture what the chart already documents, without moving PHI to do it

The revenue is often already earned inside the note. The exposure is in how you go looking for it. CorePulse closes both gaps at once: fuller, guideline-checked secondary diagnosis capture, behind a de-identification boundary that fails closed. If your coders are leaving documented conditions on the chart, we should talk about what a run on your records looks like.

Book a CorePulse walkthrough ➞

ASP-RCM Solutions · CorePulse · Documented capture, zero PHI egress