Healthcare Codes#
Reference of medical / pharmaceutical / billing classification systems an operator may meet, ICD, SNOMED, LOINC, ATC, CPT, HL7. Useful for healthcare-data forensics, breach response, and biomedical OSINT.
For broader breach context, see Data Breaches. For biosafety / biological-research context, see Hazardous Materials.
Diagnosis classification#
System |
Notes |
|---|---|
ICD-10 |
International Classification of Diseases v10; WHO; widely used outside US. |
ICD-10-CM |
US Clinical Modification (CMS). |
ICD-10-PCS |
US Procedure Coding System (inpatient). |
ICD-11 |
WHO; effective Jan 2022; multilingual; granular. |
DSM-5-TR |
mental-health manual (APA, US-centric); 2022 text rev. |
SNOMED CT |
comprehensive clinical terminology; IHTSDO; used in EHR. |
ICPC-2 |
International Classification of Primary Care; family medicine. |
Lab / observations#
System |
Notes |
|---|---|
LOINC |
Logical Observation Identifiers Names and Codes; labs + radiology + clinical observations; Regenstrief Institute. |
UCUM |
Unified Code for Units of Measure; pairs with LOINC. |
RadLex |
radiology terminology. |
Procedures (US billing)#
System |
Notes |
|---|---|
CPT |
Current Procedural Terminology; AMA; physician procedures. |
HCPCS Level II |
DME, supplies, drugs not in CPT. |
DRG / MS-DRG |
Diagnosis-Related Groups; CMS inpatient bundling. |
APC |
Ambulatory Payment Classification; outpatient. |
Drugs / pharmacy#
System |
Notes |
|---|---|
ATC |
Anatomical Therapeutic Chemical; WHO; the international standard. |
INN |
International Nonproprietary Names; generic drug names (paracetamol, ibuprofen, etc.). |
RxNorm |
US standardized drug nomenclature; NLM. |
NDC |
National Drug Code; FDA; US-specific manufacturer + product + package. |
SNOMED CT drug |
SNOMED’s pharmaceutical hierarchy. |
EU EMC / dm+d |
EU + UK equivalents. |
DEA Schedule I-V |
US controlled-substance schedule. |
Devices#
System |
Notes |
|---|---|
GMDN |
Global Medical Device Nomenclature. |
UDI |
Unique Device Identification (FDA, EU MDR). |
GUDID |
US Global UDI Database. |
EUDAMED |
EU equivalent. |
Interoperability#
Standard |
Notes |
|---|---|
HL7 v2.x |
message-based EHR integration; widespread legacy. |
HL7 v3 |
ill-fated XML revision. |
HL7 FHIR R4 / R5 |
REST + JSON / XML resource model; the modern standard. |
CDA |
Clinical Document Architecture; HL7-based. |
DICOM |
imaging interchange standard (radiology, pathology). |
IHE profiles |
Integrating the Healthcare Enterprise; cross-vendor workflows. |
HL7 v2.5+ ADT |
admission / discharge / transfer messages. |
HL7 v2.5+ ORM/ORU |
order / result. |
NCPDP |
US pharmacy / e-prescribing. |
X12 270/271/278/ 837/835 |
US claims + eligibility + auth (HIPAA EDI). |
HL7 SMART on FHIR |
OAuth2-based EHR app launch. |
TEFCA / QHIN |
US national health-information exchange (2024+). |
ePrivacy / GDPR |
EU data protection in health. |
US regulatory codes#
Code |
Notes |
|---|---|
HIPAA Privacy Rule |
PHI handling. |
HIPAA Security Rule |
technical / admin / physical safeguards. |
HIPAA Breach Rule |
notification within 60 days. |
HITECH |
electronic-records incentives; expanded HIPAA. |
21 CFR Part 11 |
FDA electronic-records integrity. |
21 CFR Part 820 |
QSR (quality-system regulation) for devices. |
DEA CSOS |
controlled-substances ordering. |
PDMP |
state prescription-drug monitoring programmes. |
GINA |
Genetic Information Nondiscrimination Act. |
42 CFR Part 2 |
substance-use disorder confidentiality. |
EU / international regulatory#
Code |
Notes |
|---|---|
EU MDR 2017/745 |
Medical Device Regulation. |
EU IVDR 2017/746 |
in-vitro diagnostics. |
GDPR Art 9 |
health-data processing rules. |
GMP / GLP / GCP |
Good Manufacturing / Lab / Clinical Practice. |
ICH guidelines |
international harmonisation. |
WHO IHR |
International Health Regulations 2005. |
PIC/S |
pharmaceutical inspection co-operation. |
EMA / EC procedures |
EU pharma + device approval. |
NHS Digital Code of |
Practice (UK). |
Disease / outbreak surveillance#
Source |
Notes |
|---|---|
WHO disease outbreak news |
per-disease reporting (cholera, polio, MERS, H5N1). |
WHO Health Emerg. Dashboard |
PHEIC determinations (above). |
ProMED-mail |
crowd-sourced infectious-disease alerts. |
ECDC TESSy |
EU surveillance. |
US CDC MMWR |
Morbidity and Mortality Weekly Report. |
WOAH WAHIS |
animal-disease global database. |
GISAID |
flu / SARS-CoV-2 genome sharing. |
GenBank / SRA |
NIH genetic-data archives. |
Operator notes#
PHI sensitivity, US HIPAA, EU GDPR Article 9 health- data, similar regimes elsewhere classify clinical data as high-sensitive; breach response governed by these rules.
De-identification, Safe Harbor (HIPAA) lists 18 identifiers to strip; Expert Determination is the alternative.
Code-set licensing, SNOMED CT free for IHTSDO members (most countries); LOINC + RxNorm + ICD-11 free; CPT requires AMA license; AMA EBR also handles intersection codes.
EHR vendors, Epic, Oracle Cerner, Meditech, Allscripts, Athena, NextGen dominate US; SAP, GE, Philips elsewhere.
Outbreak analysis, ProMED + WHO + national health ministries; correlate with GISAID for pathogen genome.