CO-224 is one of the few denial codes that is about a crime. The payer has reason to think someone used the member’s identity to get care, so it will not pay this claim, or any future claim for that member, until identity is verified. For a practice, that means two jobs: prove who you actually treated, and keep the real member’s record clean. (Primary source: X12 Claim Adjustment Reason Codes)
In brief: CARC 224 reads “Patient identification compromised by identity theft. Identity verification required for processing this and future claims.” Check the ID you collected at the visit, call the payer’s fraud or special investigations unit, send the verification it asks for, and, if your patient was not the real member, stop billing that member and fix the chart.
Part of our denial codes library. Written by Manikandan J, CPC, CRCR, who has handled identity-flagged claims for urgent care and imaging front desks. Published 23 October 2026. Last updated: 23 October 2026. Code wording quoted word for word from X12.
Official definition
| Field | Value |
|---|---|
| Code | 224 |
| Description | “Patient identification compromised by identity theft. Identity verification required for processing this and future claims.” |
| Start | 06/01/2008 |
Source: X12 Claim Adjustment Reason Codes, checked 23 October 2026.
The words “and future claims” matter. Until the flag is cleared, every new claim for that member ID can deny the same way.
Medical identity theft is the use of another person’s name or insurance to get care or drugs, or to bill for them. The HHS Office of Inspector General explains the risks on its medical identity theft page. A special investigations unit (SIU) is the payer’s fraud team, and it usually owns the flag. Identity verification means proof, such as a photo ID and insurance card copy, that the person treated is the member.
Two very different situations
| Situation | What it looks like | What to do |
|---|---|---|
| Your patient is the real member | Photo ID matches; long history at your practice | Send verification; ask the SIU to clear the flag |
| Your patient was an impostor | ID missing or mismatched; new patient; inconsistent details | Stop billing the member; separate the chart; report as the payer directs |
Example scenario (fictional names), part 1
CO-224 Denial Example: What Happened
Priya Natarajan manages billing at Harbor Point Urgent Care. A claim for a walk-in visit and an X-ray came back CAS*CO*224. The member was a 52-year-old man from another county.
The visit note described a man in his twenties. The front desk had scanned an insurance card but no photo ID, and the phone number on file did not answer.
What should Priya do before anything else? Keep reading, or jump to how the CO-224 denial was resolved.
Steps to work CO-224
- Pull the registration record. Check the ID scan, insurance card, signature and contact details from the visit.
- Compare against the chart. For example, age, sex or medical history that does not fit the member is a strong sign.
- Call the payer’s SIU. Ask what verification it needs and how to send it securely.
- If verified, send proof. Ask the payer to clear the flag so future claims process.
- If not verified, stop. Do not send a statement to the real member. Separate the impostor’s visit from the member’s record so wrong allergies or diagnoses do not follow the real person.
- Tighten intake. Require photo ID with the insurance card at every new visit.
There is nothing to change on the claim form, and you should not edit patient details to get the claim to pay.
Example scenario (fictional names), part 2
How the CO-224 Denial Was Resolved
Priya compared the visit note with the member’s age and found the mismatch. She called the plan’s SIU, which confirmed the member had reported a stolen card.
Fix: Priya voided the claim, wrote off the visit internally, and separated the visit into an unidentified-patient record so it would not merge with the real member’s history. She sent the SIU a copy of the card scan and visit date at its request.
Outcome: The real member received no bill. Harbor Point added a photo ID check at registration and a prompt when the card’s age and the patient’s stated age do not match.
Names and details are illustrative; no real patient data.
Related codes
| Code | Meaning | First step |
|---|---|---|
| CO-224 | Identity compromised | Verify identity with the SIU |
| CO-31 | Patient not identified as insured | Check eligibility and ID |
| CO-16 | Missing information | Supply the missing data |
| CO-4 | Procedure and modifier mismatch | Fix the modifier |
Our OIG audit triggers guide covers other fraud-related risks for billing teams.
FAQ
What does CO-224 mean?
The payer believes the patient’s identity was compromised by identity theft and needs verification before it pays this or future claims.
Can I bill the patient?
Not the real member if they were not treated. If your patient was the real member, send verification and rebill once the flag clears.
Who do I contact?
The payer’s special investigations unit or fraud team, using the contact on the remit or provider portal.
Should I correct the patient details on the claim?
No. Do not change data to force payment. Verify identity first.
Does CO-224 affect future visits?
Yes. Until the flag clears, other claims for that member can deny too.
Sources
How we checked: each code quote on this page was matched word for word with the X12 CARC list on 23 October 2026.
- X12, Claim Adjustment Reason Codes (CARC 224). Accessed 23 Oct 2026.
- HHS OIG, Medical Identity Theft. Accessed 23 Oct 2026.
- FTC, IdentityTheft.gov. Accessed 23 Oct 2026.
- NUCC, 1500 Claim Form Instructions. Accessed 23 Oct 2026.
Last updated: 23 October 2026 ยท Educational content; not legal advice.
Related denial codes
- PR-238: Coverage Ended Partway Through the Claim
- CO-239: Rebill Separate Claims by Coverage Period
- PR-204: Not Covered Under the Patient's Current Benefit Plan
- PR-200: Expenses During Lapse in Coverage
- CO-254: Send It to the Medical Plan
- OA-257: Claim Pended in the Grace Period
- CO-258: Patient in Custody or Incarcerated
- PR-180: Patient Has Not Met the Required Residency Requirements