Upcoding: the patterns payers mine for

What counts as upcoding

Upcoding is reporting a service at a higher-paying code than the work you actually performed and documented supports. It rarely arrives as one dramatic act. It arrives as drift — the longer psychotherapy code chosen by habit, the add-on billed on a visit where it did not happen, the evaluation-and-management level nudged up because the day was full. The claim says one thing and the chart says another, and that gap is what a reviewer reads first.

The mirror image is downcoding — billing lower than the work supports — which payers rarely chase but which quietly costs you. The target is neither: the code that matches the documented service. Common forms a solo practice drifts into:

• Level creep on E/M visits — more 99214s and 99215s than the encounters support.
• Time-code defaulting — the longer psychotherapy code billed when most sessions ran shorter.
• Add-on inflation — interactive-complexity or prolonged-service add-ons on claims the note does not substantiate.
• Cloned notes — copy-forward text that makes every visit look identical and equally complex.

The E/M level pattern payers watch

On evaluation-and-management visits, payers watch how your claims spread across the levels. A normal panel produces a bell of codes — mostly mid-level visits, fewer at the extremes. A profile that clusters at 99214 and 99215, or that never bills a low-level visit at all, stands out against the specialty curve and invites a closer read. Each payer publishes the reimbursement and coding-edit policies it applies to these claims — UnitedHealthcare's published policies and protocols 1Ref 1UnitedHealthcare (2026).UnitedHealthcare Policies and Protocols.That payers publish their own reimbursement and coding-edit policies, used here as one named example of where a solo practice can read the rules applied to its claims (your contract controls)., for one — and your contract controls which edits reach you.

The level is set by the documented medical decision-making or the total time, not by how the day felt. When a busy afternoon becomes a run of top-level codes, the record has to carry the weight — the problems addressed, the data reviewed, the risk assumed. If it cannot, the distribution is the first thing a reviewer notices and the chart is the second.

Time-based psychotherapy codes: 90837 by default

Psychotherapy has a short code and a long code — 90834 for a session around the 45-minute mark and 90837 for one near the 60-minute mark — and the pay difference is real. Upcoding here looks like billing 90837 on nearly every claim regardless of the time actually spent and documented. Payers know the pattern, and outlier rates on the longer code are a recognized review trigger.

Billing the longer code is legitimate when your sessions genuinely run that long and the note records the start-and-stop or total time that supports it. The problem is the default — the long code chosen because it pays more, on a panel of sessions that did not run that long. Record the time you actually spent, and let the code follow the record rather than the fee.

When the note does not support the code

The code is only as good as the note behind it, and in an audit the note is what gets pulled. Medicare requires every service to be authenticated by a legible handwritten or electronic signature; an unsigned or illegibly signed note can be treated as not rendered even when the care happened, and a signature attestation is the narrow way to cure a missing one in review 2Ref 2Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.Medicare's signature and authentication requirement and the attestation cure — used to explain why an unsigned or unsupported note cannot carry the billed code.. A record that does not establish the elements the code requires cannot support the code, however good the care was.

For a solo practice this is the cheapest fix on the list. Sign and lock notes promptly. Make the documented decision-making or time actually match the level billed. Avoid copy-forward text that makes a follow-up read like an initial evaluation. A cloned note — identical language visit after visit — draws scrutiny precisely because real visits differ.

Why it is the False Claims Act, not a slip

Upcoding matters because a claim to a federal payer is a legal representation, and a knowingly false one triggers the False Claims Act — treble damages plus a per-claim civil penalty adjusted annually for inflation, on every affected line 3Ref 3U.S. Department of Justice (2026).The False Claims Act.That the FCA imposes treble damages and per-claim penalties for knowingly false claims, that reckless disregard satisfies the knowledge standard, and that qui tam relators can sue — the legal exposure of upcoding.. Knowing does not require intent to defraud: reckless disregard or deliberate ignorance of whether your codes were right is enough, and a whistleblower — often a biller or former employee — can bring a qui tam case on the government's behalf 3Ref 3U.S. Department of Justice (2026).The False Claims Act.That the FCA imposes treble damages and per-claim penalties for knowingly false claims, that reckless disregard satisfies the knowledge standard, and that qui tam relators can sue — the legal exposure of upcoding.. That is why documentation discipline is financial self-defense, not paperwork.

This is the fraud-abuse exposure the fca and the solo practice share with any large group; a small panel is no shield. It is also why an outlier profile can escalate. Providers ask how serious is a upic investigation — serious enough that a contractor can sample your claims, find an error rate, and use extrapolation to project it across years of billing. A commercial plan's version begins with the siu call. Clean, documented coding is what keeps a payer audit from becoming any of that.

Audit your own coding before a payer does

You do not need a compliance department to catch upcoding — you need the habit of looking. The OIG's General Compliance Program Guidance scales the seven elements of an effective compliance program down to a practice of one, and periodic self-auditing of your own coding is the element that catches level-creep before a payer's data-mining does 4Ref 4HHS Office of Inspector General (2023).General Compliance Program Guidance.That OIG's General Compliance Program Guidance scales the seven compliance elements to a solo practice, including periodic self-auditing of coding.. Pull a small random sample of your own claims each quarter and ask, chart in hand, whether the note supports the code.

A workable solo routine:

• Sample and recode. Recode a handful of your recent visits blind, then compare to what you billed.
• Watch your distribution. If your E/M or long-code mix has crept toward the top, find out why before someone else does.
• Fix forward and back. Correct the template or habit causing it, and address the claims already out the door.
• Know the counsel threshold. A stray error you can refund yourself; a pattern that looks systemic is when the counsel threshold is reached and outside advice earns its cost.

If you find a pattern in your own claims

Finding upcoding in your own history is not the emergency; ignoring it is. A one-off overpayment you can usually refund to the payer through its normal process. But a systemic pattern that has produced overpayments across many claims may call for OIG's Health Care Fraud Self-Disclosure Protocol, which lets a provider report conduct implicating the federal fraud laws on defined terms rather than waiting to be found 5Ref 5HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That OIG maintains a self-disclosure protocol for conduct implicating the federal fraud laws — the escalation path beyond a simple overpayment refund.. Which path fits is a legal judgment, not a billing one.

Before anything else, stop the drift — correct the template, habit, or default code so the next claim is clean. Then quantify the exposure: how many claims, over what period. When a commercial payer initiates recovery, the takeback letter and its overpayments demand run on their own deadlines — calendar them the day they arrive. Whether a refund, a self-disclosure, or counsel is the right response turns on scale and intent, the facts you now have to gather.