When Does Upcoding Become Fraud?

When Does Upcoding Become Fraud?

A Coding Error Is Not Automatically Fraud. Intent Changes Everything.

Few words make physicians and practice owners more uncomfortable than:

Fraud.

And when coding compliance comes up, one concern surfaces repeatedly:

“If we accidentally billed a higher code than the documentation supported, did we commit fraud?”

Usually, the answer is not automatically.

Coding mistakes happen. Documentation can be unclear. A modifier can be selected incorrectly. A provider may misunderstand an E/M requirement. A coder may interpret a record differently during an audit.

An incorrect code and healthcare fraud are not automatically the same thing.

But there is a line.

And when a practice discovers that claims are being over-coded and knowingly continues the behavior—or deliberately manipulates coding to obtain reimbursement it isn't entitled to—the compliance risk changes dramatically.

So where is that line?

First, What Is Upcoding?

Upcoding generally means reporting a code that represents a higher-paying or more extensive service than the service actually performed or supported.

That might involve:

• Reporting a higher E/M level than supported
• Billing a more complex procedure than was performed
• Reporting services that weren't performed
• Inflating units
• Misrepresenting the complexity of a procedure
• Using modifiers improperly to obtain separate payment
• Reporting a more highly reimbursed service when documentation supports something less

The key issue is whether the claim accurately represents the care provided and documented.

A Coding Mistake Can Be Just That: A Mistake

Suppose a physician reports a Level 5 office visit.

During an internal audit, the coding team determines the documentation actually supports a Level 4.

That's a coding error.

It needs to be addressed.

Depending on the circumstances, the claim may need to be corrected and any identified overpayment handled appropriately.

But discovering one incorrectly coded claim does not, by itself, establish that the physician committed fraud.

Healthcare coding is complicated.

People make mistakes.

The bigger compliance question is:

What happened—and what did you do once you knew there was a problem?

Fraud Introduces the Question of Knowledge and Intent

Federal healthcare fraud laws are more nuanced than simply:

Wrong code = fraud.

For example, the federal False Claims Act can create liability when someone knowingly submits, or causes the submission of, a false claim. Importantly, its definition of “knowingly” includes actual knowledge, deliberate ignorance, and reckless disregard; the statute does not require proof of a specific intent to defraud.

That means practices shouldn't assume:

“Nobody intended to steal money, so we're fine.”

Ignoring obvious compliance problems can itself create serious exposure.

Here's Where the Situation Starts Changing

Imagine an internal audit identifies that a physician routinely reports Level 5 E/M services when the documentation frequently supports lower levels.

The compliance team educates the physician.

The physician understands the findings.

Nothing changes.

Another audit finds the same pattern.

Leadership knows about it.

Nobody intervenes because:

“Dr. Smith generates a lot of revenue.”

Now we're no longer talking about an isolated coding mistake.

We're talking about a known pattern that the organization has allowed to continue.

That's a very different compliance situation.

“Everyone Else Bills It That Way” Is Not a Defense

This is one of the most dangerous sentences in healthcare billing.

A provider asks why a service is being coded a particular way.

Someone responds:

“That's how we've always billed it.”

Or:

“Other practices bill it.”

Neither answers the coding question.

The correct questions are:

What service was actually performed?

What does the documentation support?

What do the applicable coding and payer rules require?

Coding should never be based primarily on what generates the highest reimbursement.

Upcoding Isn't Limited to E/M Levels

When people hear “upcoding,” they often think:

99213 versus 99214.

But inappropriate coding can occur throughout the revenue cycle.

Consider:

Procedure Complexity

Documentation supports a simple procedure, but a more complex procedure code is reported.

Units

One unit was administered, but multiple units are knowingly reported.

Critical Care

Critical care is reported even though the patient's condition, physician work, or qualifying time doesn't support it.

Modifier 25

An E/M service is automatically appended to every minor procedure even when no significant, separately identifiable E/M service occurred.

Modifier 59

A modifier is added simply to bypass an edit despite the services not meeting the requirements for distinct reporting.

Diagnostic Services

A global service is reported even though the practice only performed the professional or technical component.

The specific code changes.

The compliance principle doesn't:

The claim needs to accurately represent what happened.

What About Templates and EHRs?

Technology creates another risk.

An EHR may suggest a code.

A template may populate documentation.

An AI tool may recommend an E/M level.

An encoder may identify a modifier.

But software doesn't transfer responsibility away from the provider or organization submitting the claim.

If your EHR routinely suggests Level 5 visits, someone should be asking:

Why?

If cloned documentation repeatedly produces higher coding recommendations, that deserves review.

Technology can assist coding.

It shouldn't become an excuse for inaccurate claims.

The Difference Between an Error and a Pattern Matters

Consider two situations.

Scenario A

A coder accidentally selects the wrong code.

The mistake is discovered.

The practice investigates it, corrects the claim as appropriate, evaluates whether repayment is required, and provides education to prevent recurrence.

Scenario B

Leadership discovers that a coding workflow systematically produces unsupported higher-level claims.

The practice continues using the workflow because it increases reimbursement.

Those aren't remotely the same compliance situations.

One demonstrates a functioning compliance process.

The other should raise serious concerns.

What If Your Billing Company Is Doing It?

Outsourcing billing doesn't outsource your compliance risk.

If your billing company routinely:

• Changes codes without documentation
• Adds modifiers simply to obtain payment
• Automatically increases E/M levels
• Resubmits unsupported codes after denials
• Encourages providers to document solely to reach predetermined code levels

you need to investigate.

A billing company's desire to increase collections should never override coding accuracy.

Practice owners should understand how claims are being coded before they're submitted under their providers' names and identifiers.

Watch Out for “Code to This Level”

Provider education matters.

But there is an enormous difference between:

“Here are the documentation requirements and coding principles for the services you provide.”

and:

“You need to document Level 4s because they pay more.”

The first is education.

The second is a compliance red flag.

Providers shouldn't begin an encounter with a predetermined billing level and then construct documentation to reach it.

The code should follow the care.

The care should never be manufactured to reach the code.

Your Coding Distribution Can Tell You Something

Analytics can help practices identify potential problems.

Suppose most physicians in a specialty have a relatively varied E/M distribution.

One provider reports Level 5 services on nearly every patient.

Does that prove upcoding?

No.

Maybe that physician treats unusually complex patients.

Maybe they're a tertiary referral specialist.

Maybe their patient population legitimately requires greater medical decision making.

Data identifies the outlier.

The medical record tells you whether there's a problem.

That's why benchmarking should trigger review—not automatic accusations.

Under-Coding Isn't the Solution Either

This is important.

Some physicians become so afraid of being accused of upcoding that they intentionally report lower levels than their documentation supports.

That's not the goal.

Compliance doesn't mean:

Bill less.

It means:

Bill accurately.

If the documentation appropriately supports a higher-level service, reporting that service isn't upcoding simply because reimbursement is higher.

Providers should be appropriately compensated for medically necessary work they actually perform.

What Should You Do If You Find a Problem?

Don't ignore it.

A strong compliance response may involve:

1. Determine the scope.
Is this one claim or a recurring pattern?

2. Review the documentation.
What services were actually supported?

3. Identify the cause.
Provider education? Coding workflow? EHR configuration? Billing-company behavior?

4. Stop the problematic process.
Don't knowingly allow the same error to continue.

5. Determine whether claims need correction or overpayments need to be returned.
Federal and payer-specific overpayment rules can apply, so significant findings may warrant involvement from qualified healthcare counsel or compliance professionals.

6. Educate the people involved.

7. Re-audit.
Make sure the corrective action actually worked.

The goal isn't merely identifying the problem.

It's proving that you corrected it.

Your Compliance Program Should Be Able to Find Bad News

This may sound strange, but a healthy compliance program should occasionally uncover problems.

Why?

Because healthcare billing is complicated.

If an organization submits thousands of claims and its internal audits never identify a single coding issue, that doesn't necessarily mean the organization is perfect.

It may mean nobody is looking closely enough.

Compliance isn't about pretending errors don't happen.

It's about having a process to:

Find them.

Investigate them.

Correct them.

Educate.

Monitor.

Five Questions Every Practice Owner Should Ask

When you're evaluating potential upcoding, don't immediately ask:

“Are we committing fraud?”

Start with better questions:

Does the medical record support what we billed?

Is this an isolated error or a pattern?

Who knew about the problem and when?

What happened after the problem was identified?

Did we correct the process and address any affected claims or overpayments?

Those answers tell you much more about your compliance risk.

The Most Dangerous Phrase May Be: “Leave It Alone”

An auditor identifies a pattern.

A coder raises a concern.

A billing employee notices something unusual.

Then someone says:

“Leave it alone. The payer is paying it.”

Payment doesn't prove a claim was correct.

A payer can pay an improperly coded claim.

That payment can still be subject to later review, recoupment, or other consequences.

Getting paid is not the same thing as being compliant.

The Bottom Line

So when does upcoding become fraud?

There isn't a magic number of incorrect claims that suddenly turns a coding error into fraud.

The legal analysis depends on the facts, including what was submitted, what was supported, what the organization knew, and how it responded.

But the practical compliance lesson is straightforward:

An honest mistake should be identified and corrected. A known or recklessly ignored pattern of false billing is something entirely different.

Don't code based on reimbursement.

Don't use modifiers simply to make claims pay.

Don't ignore audit findings because collections look good.

And don't intentionally undercode out of fear either.

Instead:

Document accurately.
Code accurately.
Audit regularly.
Correct mistakes.
Respond to patterns.

Because the goal of a strong compliance program isn't to make sure you never discover an error.

It's to make sure that when you discover one, you don't choose to ignore it.