What Is Upcoding and Downcoding? How Coding Errors Are Costing Healthcare Practices Today

What Is Upcoding and Downcoding? How Coding Errors Are Costing Healthcare Practices Today

Author Nicole Statley at Healthcare Compliance Pros

Upcoding and downcoding are two sides of the same coin: both distort medical claims from what the documentation actually supports, and both can put a practice's revenue and legal standing at risk. Upcoding invites federal fraud liability, while downcoding quietly erodes income that a practice has legitimately earned.

Upcoding vs. Downcoding: The Core Definitions

Upcoding happens when a provider bills a more complex, higher-paying code than the medical record supports, for example, billing a high-level evaluation and management (E/M) visit when documentation only supports a lower level of care. Downcoding is the opposite: billing a lower-complexity code than what the documentation actually justifies, which means the practice gets underpaid for the work performed. A related concept, unbundling (or fragmentation), involves billing separately for services that should be reported under a single comprehensive code, and it carries similar compliance risk.

Why This Matters More in 2026 Than Ever

The Department of Justice reported that False Claims Act (FCA) settlements and judgments exceeded $6.8 billion in fiscal year 2025, the highest annual total in the statute's history, with more than $5.7 billion tied to healthcare matters, roughly 83% of the total. CMS's own data shows the Medicare Fee-for-Service improper payment rate was 6.55% in FY2025, translating to an estimated $28.83 billion in improper payments, with incorrect coding and insufficient documentation among the leading causes. At the same time, major payers including Aetna and Cigna are increasingly using algorithm-driven claim-editing software to flag and automatically downcode E/M claims without first reviewing the medical record.

The Legal and Financial Risk of Upcoding

For a private practice, upcoding liability comes from the same source as the DOJ's headline numbers, but the exposure lands on the provider, not the payer. If a practice's claims are found to knowingly reflect a higher-complexity code than the documentation supports, the practice itself is the party subject to False Claims Act penalties, which as of July 2025 range from $14,308 to $28,619 per false claim, plus treble damages equal to three times the government's actual loss. Because penalties are assessed per claim, a pattern of upcoding across even a modest patient volume can escalate into a six- or seven-figure liability quickly, and DOJ recovered a record $5.7 billion from healthcare-related FCA matters in FY2025 alone, underscoring how actively these cases are being pursued.

Beyond civil penalties, a practice found to have engaged in a pattern of upcoding faces exclusion from Medicare and Medicaid, state medical board or licensure action, and, in cases involving clear intent, criminal referral. Many of these cases originate from whistleblower (qui tam) complaints filed by a practice's own current or former billing staff, coders, or clinicians, which means internal culture and documentation habits are often the first line of defense or the first point of failure. This is why proactive internal audits matter more than reactive damage control: a practice that catches and corrects upcoding patterns internally is in a fundamentally different legal position than one that gets flagged by a payer or investigator first.

The Hidden Cost of Downcoding

While upcoding creates legal exposure, downcoding creates a quieter but very real revenue problem, and it's one a practice can often trace back to its own internal habits, not just external payer behavior. Downcoding happens when a claim is submitted (or ultimately adjudicated) at a lower-complexity code than the documentation actually supports, meaning the practice collects less than it earned for the visit. Because a downcoded claim still pays, it's not denied, it rarely triggers the kind of alert or appeal workflow that a denial does; the shortfall simply sits inside the remittance advice, unnoticed unless someone is actively comparing billed codes to paid amounts.

Two forces inside a practice tend to drive this pattern. First, defensive coding: staff who are anxious about audit risk or unclear on documentation requirements for medical decision-making (MDM) or time may default to a safer, lower code even when the note supports a higher one. Second, documentation gaps: if the record itself doesn't clearly capture the complexity of the visit, coders have no basis to bill the higher, correct level, regardless of what actually happened clinically. The fix is largely internal: regular chart audits, MDM/time documentation training, and benchmarking a practice's own E/M distribution against specialty peers can surface systematic undercoding before it compounds into meaningful lost revenue over a year. This is distinct from external payer-side downcoding algorithms, which are a separate issue outside a practice's direct control and are already facing pushback from the AMA and several state legislatures.

Common Root Causes

Most coding errors trace back to a handful of preventable habits rather than intentional fraud:

• EHR note-cloning or copy-paste documentation that doesn't reflect the actual encounter
• Insufficient documentation of medical decision-making (MDM) or time spent, the two factors that determine E/M code level
• Staff pressure to maximize collections (leading to upcoding) or to code defensively low out of fear of audit (leading to downcoding)

How to Catch Coding Errors Before Regulators or Payers Do

Routine internal audits are one of the most effective defenses available to a practice. The HHS Office of Inspector General (OIG) has emphasized that proactive, regular auditing and monitoring are core elements of an effective compliance program and directly help reduce improper payment risk. Practical steps include:

• Conducting routine internal chart audits rather than waiting for a payer or DOJ inquiry
• Benchmarking E/M utilization, RVU levels, and modifier use against same-specialty peers to spot outlier patterns
• Tying staff education directly to real audit findings rather than generic training

How HCP's SENTRY Coding Intelligence Helps

SENTRY Coding Intelligence gives practices the specialty-benchmarked visibility that manual, chart-by-chart review can't provide at scale. It analyzes E/M distribution, RVU trends, and modifier density against national specialty norms, then generates a revenue-at-risk score to help compliance teams prioritize which charts to audit first. Backed by Healthcare Compliance Pros' coding and compliance experts, SENTRY is designed to surface both upcoding exposure and downcoding revenue loss before either becomes a six- or seven-figure liability.

Quick Self-Check Questions

• Are your E/M code levels within the national range for your specialty?
• Have you compared your modifier usage to peer benchmarks in the past 12 months?
• Could your team explain, chart by chart, why each code level was selected?

If any of these questions is hard to answer confidently, a specialty-benchmarked review is worth requesting. Contact Healthcare Compliance Pros to request a SENTRY coding analysis for your practice.

FAQ

Is upcoding always intentional fraud?

Not necessarily. Some upcoding results from documentation gaps or EHR templating rather than intent, but the False Claims Act can still apply if a claim is knowingly false or submitted with reckless disregard for its accuracy.

Can a payer downcode my claim without reviewing the medical record?

The AMA maintains that payers should not automatically downcode without first reviewing supporting documentation, and several states have begun restricting this practice in law.

What triggers a False Claims Act investigation related to coding?

Investigations often start from whistleblower (qui tam) complaints filed by current or former employees.

How often should a practice conduct internal coding audits?

OIG guidance recommends regular, ongoing auditing and monitoring as part of an effective compliance program, rather than one-time or reactive reviews.

Does this article provide legal or coding advice?

No. This content is educational only and does not constitute legal or specific coding advice for individual claims; practices should consult qualified legal and coding professionals for case-specific guidance.