Few terms make a practice owner uneasy like “upcoding.” It shows up in compliance training, payer newsletters, and audit letters — usually with the implication that somebody did it on purpose. But upcoding is not always intentional. Sometimes it is a coding shortcut, a misunderstood rule, or a documentation gap that quietly turns a legitimate visit into a claim that pays more than it should.
Whether accidental or deliberate, a coding discrepancy needs review: if it turns out the claim overstates the service, the resulting overpayment generally has to be returned. But a suspected coding issue is not the same as a confirmed overpayment — the record must be reviewed first to determine what was actually documented and billed. The further consequences depend heavily on the facts: an isolated error that is promptly corrected is a very different matter from systematic upcoding, which can draw penalties and, in serious cases, exclusion from federal programs. This article explains what upcoding is, how it differs from undercoding, the patterns auditors look for, and how a practice keeps its coding defensible.
What Upcoding Means, in Plain Language
Upcoding is reporting a service at a higher level — or with a more intensive code — than the service that was actually provided and documented. The result is a claim that pays more than the work performed supports.
The key idea is the gap between the code and the reality. If the medical record supports a mid-level office visit but the claim goes out as the highest-level visit, that is upcoding. It does not matter whether someone typed the wrong code in a hurry or deliberately chose the higher one; on an audit, the claim is wrong either way.
Upcoding can involve evaluation and management (E/M) levels, procedure codes, diagnosis codes, or time-based units. The common thread is that the code overstates what happened.
Upcoding vs. Undercoding: The Two Directions of Coding Error
Upcoding has a mirror image called undercoding — reporting a service at a lower level than what was actually provided and documented. Undercoding leaves money on the table. A practice that routinely undercodes is essentially donating revenue to payers, and the losses compound quietly month after month.
Here is why the two are treated so differently. Undercoding is primarily a business problem: the practice absorbs the loss. That said, systematic undercoding is not harmless from a compliance perspective either — consistently reporting services below what was documented is still inaccurate coding, and it can distort quality reporting and medical-necessity profiles that payers and programs rely on. Upcoding is a compliance problem with sharper edges: the payer — often a federal program — overpays, and federal law treats knowing overbilling as fraud. That asymmetry is why compliance programs focus so heavily on upcoding even though undercoding costs the practice real money too.
The safest position is neither direction. Code exactly what the documentation supports — no higher, no lower. That principle is at the heart of every defensible coding operation, and it is one of the common billing mistakes practices can fix with better habits.
Common Upcoding Examples by Setting
Upcoding takes different forms depending on the type of service. These are the patterns auditors and payers see most often.
E/M Leveling
Evaluation and management visits have multiple levels, and the difference between levels often comes down to the complexity of medical decision-making and the documented history and examination. Billing a level 5 office visit for an encounter that documents a straightforward problem — or carrying forward exam templates that do not reflect what actually happened — is one of the most frequently cited upcoding patterns.
Procedure Codes
Billing a more extensive procedure than the one performed is straightforward upcoding — for example, reporting a code for an open procedure when a less invasive technique was used. In therapy settings, billing a 60-minute timed session code when the session lasted 40 minutes is the same kind of error. The code must match the procedure actually performed.
Diagnosis Coding
Diagnosis codes drive medical necessity. Coding a diagnosis more severe than the documented condition — or adding diagnosis codes with no support in the medical record — can inflate the apparent complexity of the visit and support higher payment. Diagnoses on the claim must be supported by the medical record and consistent with applicable coding guidelines (for example, ICD-10-CM guidelines address when chronic or historical conditions may be coded). When the record does not support a diagnosis at the coded level of specificity, the claim overstates the case.
Time-Based Units
Many services, particularly in therapy, are billed in timed units with rules about how many units a session supports. Rounding up units, or billing for time the patient was not actually receiving treatment, produces overpayment the same way a higher-level code does.
The Consequences: Financial, Legal, and Ethical
Upcoding that is identified and corrected is generally resolved through repayment and improved processes. The federal False Claims Act, however, imposes civil penalties for each false claim submitted “knowingly” to a federal program, with penalties adjusted for inflation annually. Under the Department of Justice’s 2025 inflation-adjustment rule, those penalties run from $14,308 to $28,619 per claim for penalties assessed after July 3, 2025 (the current penalty table is published at 28 CFR Part 85, § 85.5; the Department adjusts these figures every year, so the table should be rechecked immediately before publication). The government can also seek treble damages — three times the amount of the loss — in cases it pursues.
The HHS Office of Inspector General (OIG) has the authority to exclude individuals and entities from participation in federal health care programs. Exclusion is among the most serious administrative sanctions available and can severely affect a provider who depends on Medicare and Medicaid revenue; it is imposed according to statutory and regulatory criteria, not automatically for every violation.
Even when the government does not bring a False Claims Act case, payers run their own audits. A payer audit that finds systematic upcoding typically demands repayment of the overpaid amounts, often extrapolated across a statistical sample of claims — so a small number of audited claims can turn into a large repayment demand. Payers may also place the practice on prepayment review, where future claims are scrutinized before payment, slowing cash flow.
Providers generally remain responsible for claims submitted under their national provider identifier, including claims prepared by employed coders or a billing company — though the allocation of responsibility in any specific case depends on the facts, contracts, and applicable law.
Coding Errors vs. False Claims: Where the Legal Line Is
Not every coding mistake is a legal violation, and understanding the difference matters — both for peace of mind and for knowing when a problem is serious.
Innocent coding errors happen. A typo in a procedure code, a misunderstood guideline, a one-off data-entry mistake — these are ordinary errors. When a practice finds them, the standard response is straightforward: correct the claim, refund any overpayment, retrain the staff involved, and move on. An error does not automatically establish False Claims Act liability; whether liability exists depends on the applicable legal standard — including the statutory “knowingly” standard described below — applied to the specific facts.
The legal line is drawn at “knowingly.” The False Claims Act applies to claims submitted “knowingly” — and the law defines that term broadly. Under 31 U.S.C. § 3729, “knowingly” includes actual knowledge (you knew the claim was wrong), deliberate ignorance (you avoided learning whether it was wrong), and reckless disregard for the truth (you submitted claims without caring whether they were right). It does not require specific intent to defraud. In plain terms: systematically billing high-level visits you never documented, or ignoring repeated warnings from your own billing staff, can meet this standard even if nobody set out to commit fraud.
The 60-day rule turns identified overpayments into a deadline. Federal law requires that an identified overpayment be reported and returned within 60 days of identification (42 U.S.C. § 1320a-7k(d)). Identification occurs when a person has actual knowledge of the overpayment, or acts with reckless disregard or deliberate ignorance toward it. Whether a particular audit finding starts the 60-day clock depends on the facts — a preliminary flag or statistical estimate is not necessarily identification, and not every audit finding establishes an FCA violation. FCA liability turns on the statutory “knowingly” standard applied to the specific facts, not on the mere existence of an overpayment. Retaining an identified overpayment past the deadline can create separate FCA liability. Because the identification question is fact-specific, practices facing significant findings should consult healthcare legal counsel promptly — and a documented correction process remains the best evidence of good faith.
Patterns draw enforcement attention; isolated errors draw corrections. Enforcement resources tend to focus on conduct that appears systematic — repeated upcoding across many claims, ignored audit findings, coding practices that consistently maximize payment rather than reflect services. A practice with documented compliance habits (regular self-audits, training records, a process for correcting errors) is in a fundamentally different position than one with no controls at all. This is a general observation about enforcement priorities, not a legal rule — any single claim can be examined, and the outcome always depends on the facts.
The practical takeaway: honest mistakes get fixed with refunds and better processes. What creates legal exposure is knowing about a problem — or recklessly avoiding knowing — and letting it continue.
How Audits Catch Upcoding
Payers and government auditors do not read every claim. They use data analytics to find patterns that suggest upcoding, then audit the outliers.
One widely used analytic approach is a bell-curve comparison. Each provider’s distribution of E/M levels is compared against peers in the same specialty. If most family physicians in a region bill level 4 for 20 percent of visits and one practice bills level 4 for 80 percent — a hypothetical example, not industry statistics — that outlier pattern is an indicator that may prompt a records request — it is a signal for review, not proof of wrongdoing, since legitimate practices can differ from peers for valid clinical reasons. Other indicators payers use include sudden shifts in coding patterns, high use of modifier 25 without supporting documentation, and time-based units that consistently hit the maximum allowed. Whistleblower reports can also start investigations.
When an audit arrives, the record either supports the code or it does not. What a billing audit actually looks at is the same thing every time: whether the documentation justifies the codes on the claim.
How Practices Prevent Upcoding
Preventing upcoding is a process, not a one-time fix. The practices that stay out of trouble share a few habits:
Document first, code second. Coding should describe the documentation, never the other way around. Copy-paste and template carry-forward are the fastest ways to create upcoding exposure; every note should reflect the actual encounter.
Run internal audits on a schedule. As a suggested practice — not a legal requirement — a quarterly review of a random sample of claims against their documentation catches patterns before a payer does, and creates a record of good-faith compliance effort. The right cadence depends on practice size and risk; the key is consistency.
Train on the rules that change. E/M guidelines, modifier rules, and payer policies shift regularly. Coders and providers need ongoing education. Understanding how coding fits into the billing process helps the whole team see where coding errors turn into claim errors.
Use pre-submission claim review. Checking claims against documentation before they go out is the last line of defense — automated edits catch mismatched codes and missing modifiers, while a trained reviewer catches the judgment calls.
Have a response plan. If an internal audit finds past upcoding, quantify the exposure, correct the claims, refund overpayments, and fix the root cause. Voluntary disclosure programs exist for a reason — discovering and correcting a problem is always better than having a payer discover it.
Frequently Asked Questions
What exactly counts as upcoding? Upcoding is billing a higher-level or more intensive code than the service actually provided and documented. The test is simple: does the medical record support the code on the claim? If the record supports a lower level, the higher code is upcoding — regardless of intent.
What are the penalties for upcoding? Penalties depend on the payer and the circumstances. For federal programs, the False Claims Act carries per-claim civil penalties (adjusted annually for inflation) plus potential treble damages. Under the Department of Justice’s 2025 inflation-adjustment rule, those penalties run from $14,308 to $28,619 per claim for penalties assessed after July 3, 2025 — the current table is published at 28 CFR Part 85, § 85.5, and the figures change every year. The HHS Office of Inspector General can also exclude providers from federal health care programs. Commercial payers typically demand repayment and may impose prepayment review or terminate contracts.
How is upcoding different from undercoding? Upcoding reports a higher level than documented; undercoding reports a lower level than documented. Upcoding overpays the practice and creates legal exposure. Undercoding underpays the practice and is a business loss. Both are corrected the same way: code exactly what the documentation supports.
How do auditors catch upcoding? Through data analysis. Payers compare each provider’s coding patterns against specialty peers, flag outliers (such as an unusually high percentage of top-level visits), and request records for a sample of claims. The documentation then either supports the codes or it does not. Whistleblower complaints and patient reports can also trigger investigations.
What should a practice do if it finds past upcoding? Quantify the scope with a focused internal review, correct and refund the affected claims, fix the root cause, and document everything. For significant exposure involving federal programs, consult healthcare legal counsel about voluntary disclosure options. Do not ignore it — undiscovered problems get worse, not better.
The Bottom Line
Upcoding is one of the few billing errors that is simultaneously a revenue problem, a compliance problem, and a legal problem. It is also one of the most preventable: document honestly, code what the documentation supports, audit yourself regularly, and review claims before they go out.
If you are not sure your practice’s coding would hold up under an audit, a structured outside review is the fastest way to find out. Fastora’s free billing assessment covers coding patterns, documentation alignment, and denial trends — the same areas a payer auditor would examine, found before the payer finds them.
2 comments