Assault ICD-10 codes: Y09 and the X92-Y09 range

Key Takeaways

The ICD-10 code for assault by unspecified means is Y09, a billable diagnosis code valid for 2026, used when the method of assault is unknown or not documented.

Assault ICD-10 codes span the X92-Y09 range: 18 categories covering drowning, firearms, sharp and blunt objects, bodily force, sexual force, and more. Y09 is the fallback when no mechanism is recorded.

Specificity always wins. Use Y09 only after ruling out a specific code from X92-Y08, and never sequence an external cause code as the principal diagnosis: the injury code leads.

Pabau’s structured intake forms and claims management software help practices capture mechanism, intent, and perpetrator details at the point of care, so the right assault code reaches the claim.

There is no single assault ICD-10 code. Assault ICD-10 codes run across the X92-Y09 range, one for each documented mechanism of intentional harm by another person. When the record confirms an assault but names no weapon or method, the code is Y09 (assault by unspecified means). This guide gives you the full range in one table, the rule for choosing between Y09 and a specific code, and the documentation that supports a clean claim.

The full X92-Y09 assault ICD-10 code range

The assault subrange sits in Chapter 20 of ICD-10-CM (External causes of morbidity, V00-Y99). It holds 18 code categories, ordered by mechanism. The table below pairs each code with the documentation trigger that tells you to use it, so you can match the encounter note to the code without paging through the tabular list.

Most of these categories need a 7th character to become billable (A for initial encounter, D for subsequent, S for sequela), often with placeholder X’s, as in X99.9XXA. Y09 is a complete code and is billable as written. Verify the current-year form against the CDC/NCHS ICD-10-CM web tool after each October 1 update cycle.

ICD-10 code Y09: definition and clinical description

ICD-10 code Y09 (assault by unspecified means) applies when injuries result from intentional harm by another person but the mechanism is not documented or remains unknown at the time of coding.

Y09 falls within the Assault subrange X92-Y09. The Centers for Medicare and Medicaid Services (CMS) and the National Center for Health Statistics (NCHS) maintain it for US clinical use as part of ICD-10-CM. The code carries the designation NOS (Not Otherwise Specified), signaling it is a last-resort code when no more specific classification exists.

Coders working in emergency medicine, forensic health, primary care, and mental health practices reach for Y09 when patients present with injuries attributed to another person but documentation does not identify a weapon, body part used, or specific assault mechanism. The situational anxiety ICD-10 code is a common co-occurring code when assault victims develop acute stress responses alongside their physical injuries.

Applicable-to terms and synonyms

The ICD-10-CM tabular listing for Y09 includes four official applicable-to terms. These are not separate codes. They are clinical scenarios that map to Y09 when the record leaves the means unspecified.

Synonyms also associated with Y09 in clinical databases include assault, assault and battery, assault by person, and battery. These terms appear in the code’s index entries and may surface in provider notes, police reports attached to records, or emergency department documentation. When any of these terms appear without a specific mechanism, Y09 is the correct external cause code to apply.

When to use Y09 vs a specific assault code

Y09 sits at the end of the X92-Y09 range as the residual NOS option. Use it only after ruling out a more specific code from the table above. If the clinical notes, imaging report, or police documentation identifies a mechanism, the specific code applies. Y09 is not a default for assault. Reach for it only when the record genuinely provides no mechanism detail.

ICD-10 code for assault by another person

When documentation confirms injury from another person but names no weapon or method, Y09 is the code for assault by another person. The perpetrator’s identity does not change the selection, so an assault by an unknown person still codes to Y09 as long as the mechanism is unrecorded. Once a mechanism appears in the note (a punch, a knife, a firearm), move to the matching X92-Y08 code instead.

Physical assault ICD-10 codes

Physical assault ICD-10 codes usually resolve to Y04 (assault by bodily force) when the injuries come from hands, fists, or feet with no weapon involved. Use Y09 only when the encounter confirms a physical assault but records no mechanism at all. When a weapon is documented, the specific code takes over: X99 for a sharp object, Y00 for a blunt object.

Reviewing traumatic injury diagnosis coding alongside external cause coding helps ensure the injury code and the assault mechanism code are sequenced correctly on the claim.

Documentation requirements for accurate Y09 coding

CMS and the AHA Coding Clinic both require that the treating provider’s documentation support external cause codes directly. Coders cannot infer them from police reports alone. For Y09, the record must establish three things.

1. Intentionality: The injury was inflicted by another person, not accidental. The provider note must describe the mechanism as assault or use equivalent clinical language (attacked, beaten, battered).
2. Unspecified means: No weapon, body part, or method appears anywhere in the encounter record.
3. Perpetrator not identified as self: Y09 cannot coexist with self-harm codes. The Type 1 Excludes note for the X92-Y09 range bars coding assault alongside intentional self-harm.

Robust client record management tools make this documentation requirement manageable in busy practices. When structured encounter templates prompt providers to record mechanism, intent, and perpetrator relationship, staff capture the notes needed for Y09 coding accuracy at the point of care rather than reconstructing them during billing review.

Supporting documentation elements that strengthen the Y09 record include injury diagrams, body charts or digital intake forms completed at triage, social work notes confirming the interpersonal violence context, and any mandatory reporting forms filed with local authorities.

Streamline assault encounter documentation

Pabau helps clinics capture structured encounter data, manage compliance documentation, and submit clean claims for complex external cause codes like Y09.

Book a demo

Coding guidelines and billing considerations for Y09

External cause codes, including Y09, are supplementary codes in ICD-10-CM. Coders never sequence them as the principal diagnosis. The injury code (fracture, laceration, contusion, or internal injury) always leads as the principal diagnosis, and Y09 follows as an additional external cause code.

Sequencing and pairing rules

• Principal diagnosis: The specific injury (e.g., S01.0 for scalp laceration, S09.90 for unspecified head injury)
• Additional code Y09: Follows the injury code to describe the external cause
• Place of occurrence (Y92.x): Pair with Y09 to report where the assault occurred
• Activity code (Y93.x): Add when the patient’s activity at the time is documented
• Abuse codes (T74.x): When confirmed adult or child physical abuse accompanies the assault, T74.1x (physical abuse) is added separately. The T74.x code requires confirmed abuse, not mere suspicion.

For insurance billing, Y09 typically routes to DRG assignments based on the principal injury diagnosis rather than the external cause code itself. Payers with specialized trauma or violence-related benefit carve-outs may flag Y09 for coordination of benefits review. Practices using claims management software can set up claim scrubbing rules to catch sequencing errors before submission.

Maintaining HIPAA compliance for medical offices is especially important when handling assault-related records, given that these encounters often involve law enforcement, attorneys, or child protective services requesting documentation.

ICD-9-CM crosswalk

Practices transitioning legacy data or working with historical claims will encounter two ICD-9-CM predecessor codes for Y09.

The CDC/NCHS ICD-10-CM web tool provides the official current-year tabular and index entries for Y09, including any annual updates from CMS. Verifying against this tool before coding is good practice, particularly after each October 1 code update cycle.

Medicolegal and mandatory reporting context

Y09 encounters carry documentation weight beyond reimbursement. Many states require healthcare providers to report certain assault injuries to law enforcement or public health departments, particularly when the victim is a minor, an elderly person, or when injuries suggest domestic violence.

The external cause code itself does not trigger reporting, but it does signal to compliance officers and billers that the encounter may have mandatory reporting obligations attached. Practices with compliance management workflows should configure alert flags for Y09-coded encounters to prompt a mandatory reporting review during or after the visit.

Strong patient data security in clinical workflows is equally critical for assault records. These encounters are high-sensitivity files: courts may subpoena them, attorneys may review them in criminal proceedings, or insurers may request them for coverage disputes. Access controls, audit logs, and encrypted storage are not optional for this category of encounter.

For practices managing patient information and HIPAA obligations related to assault cases, understanding the limits of permissible disclosure to law enforcement (45 CFR 164.512(f)) is fundamental before responding to any external request for Y09-coded records.

Pabau and external cause code documentation

Practices that see assault or trauma patients can reduce documentation errors with structured encounter workflows. Pabau, practice management software built for busy clinics, offers digital intake forms that let practices capture injury mechanism, location of occurrence, and relationship to perpetrator at the point of care. These fields map directly to the elements needed to assign a specific X92-Y08 code or, where necessary, confirm Y09 as the correct choice.

When combined with Pabau’s structured diagnostic coding workflows, practices can maintain complete clinical records that hold up to payer review and legal scrutiny alike. The compliance management module adds a further layer by logging documentation completeness checks against configurable standards.

For practices managing similar sensitive external cause encounters, the HIPAA security rule requirements article outlines the technical safeguard obligations that apply to records involving assault, domestic violence, and mandatory reporting scenarios. See also our guidance on handling HIPAA violations if an inadvertent disclosure has already occurred in connection with an assault case.

The bottom line on assault ICD-10 codes

Assault ICD-10 codes reward specificity. Work down the X92-Y09 range to the code that matches the documented mechanism, and reach Y09 only when the record genuinely leaves the assault means unspecified. Most encounters have enough detail in the notes, triage forms, or attached reports to support a code from X92-Y08. When Y09 is the correct choice, accurate sequencing with the injury code, place of occurrence, and any applicable abuse code ensures the claim reflects the full clinical picture.

Pabau’s structured documentation tools, compliance workflows, and claims management capabilities help practices handle these sensitive encounters with the accuracy and audit-readiness they require. Book a demo to see how Pabau supports accurate external cause coding across your clinical workflows.

Continue your research

List Item #1

List Item #2

Frequently asked questions