Upcoding and Undercoding: Compliance Risks and Prevention 2026
Most revenue cycle conversations treat upcoding and undercoding as opposites sitting at different ends of a risk spectrum. The assumption is familiar: upcoding is dangerous because it overbills payers, and undercoding is merely a revenue problem, perhaps even a conservative, defensible choice. That framing is wrong on both counts, and organizations that operate under it leave themselves exposed in two directions at once.
Upcoding and undercoding are not opposite risks. They are both symptoms of the same underlying problem: coding accuracy gaps driven by weak clinical documentation and insufficient internal validation. The compliance mechanisms are different, but both patterns create real exposure. Understanding how each works, and why neither is safe, is foundational to any credible compliance program heading into 2026.
What Upcoding Actually Means in Practice
Upcoding is the assignment of a code, or a combination of codes, that reflects a higher level of service, severity, or complexity than the clinical documentation actually supports.
E/M Level Upcoding
In the evaluation and management context, this means billing a 99215 or 99214 when the documentation supports a 99213. Post-2021 E/M guideline changes tied level selection to medical decision making or total provider time, which reduced some historical ambiguity. But the opportunity for unsupported coding still exists. A note that copies forward prior visit information, documents a routine follow-up for a stable chronic condition, and then bills the highest complexity level is a straightforward example. When that pattern repeats across thousands of claims, it becomes a systemic problem auditors can identify statistically.
Inpatient DRG Upcoding
On the inpatient side, DRG upcoding often involves principal diagnosis selection that moves a case to a higher-weighted DRG without clear clinical justification, or the addition of complication and comorbidity (CC) or major complication and comorbidity (MCC) codes based on documentation that does not reflect physician assessment of clinical impact. A diagnosis appearing in a nursing note or on a problem list, without physician acknowledgment of how it affected care, generally does not meet the threshold for CC/MCC coding. Coding it anyway inflates the DRG weight and creates audit exposure.
HCC Risk Adjustment Upcoding
In risk-adjusted payment models, HCC upcoding involves capturing diagnoses for conditions that were not actually evaluated, addressed, or considered in the patient's care during the measurement year. Carrying a chronic condition code forward from a prior year's problem list, without any clinical encounter evidence that the condition was managed or considered during the current year, is a well-recognized audit target.
What Undercoding Means and Why It Is Not Safe
Undercoding is the assignment of a lower-level service code than documentation supports, or the omission of diagnoses that are clearly present and documented in the clinical record. It reduces reported acuity and billed charges. Organizations sometimes tolerate it as a conservative default, reasoning that billing less than you could cannot be fraud.
That reasoning is incomplete.
The Statistical Detection Problem
Payer and regulatory audit systems do not only flag distributions that skew high. They flag distributions that are statistically unusual in either direction relative to specialty and regional peer benchmarks. A provider or facility whose E/M distribution shows an unusually high concentration of low-level codes, or whose case mix index is persistently below specialty peers without a clinical explanation, can trigger the same algorithmic flags as a high outlier. The reason is straightforward: systematic undercoding on routine claims, combined with selective upcoding on high-value claims, is a known compliance avoidance strategy. Auditors are aware of it. A persistently low coding distribution does not demonstrate caution; it demonstrates an anomalous pattern that invites scrutiny.
Revenue Integrity Is Part of Compliance
Undercoding documented diagnoses also means failing to accurately represent a patient's clinical condition to payers. In risk-adjusted payment models, this distorts the accuracy of the risk score in a way that, depending on context and contract terms, can itself carry regulatory implications. Accurate coding is not just a revenue function. It is a data integrity obligation.
The Federal Enforcement Landscape
The False Claims Act is the primary federal statute governing unsupported coding patterns. It applies to claims submitted to Medicare, Medicaid, and other federal healthcare programs, and it covers both knowingly false claims and claims submitted with reckless disregard for their accuracy. The Department of Justice and the Office of Inspector General pursue FCA cases tied to systematic coding problems across several high-risk areas: E/M level distribution, inpatient DRG assignment, and HCC risk adjustment coding in particular.
The enforcement record in these areas is publicly documented. Organizations seeking to understand real case patterns should consult the DOJ website's press release archive and the OIG's Work Plan and enforcement actions directly, rather than relying on secondhand summaries. What the public record makes clear, without needing to cite specific dollar figures here, is that systematic unsupported coding, whether it runs for months or years before detection, creates liability that can be extrapolated across the full population of affected claims. A small discovered error rate, applied across a large claim volume, produces significant exposure.
How Auditors Detect These Patterns
E/M Level Distribution Audits
CMS and commercial payers maintain benchmark data on E/M level distribution by specialty and by geographic region. When a provider's distribution skews significantly toward higher-level codes relative to peers, that statistical signal triggers chart-level review. Auditors pull a sample, assess whether the documentation actually supports the billed level under applicable E/M guidelines, and calculate an error rate. That rate is then extrapolated across the full claim population for the audit period.
Inpatient DRG Audit Red Flags
DRG audits focus on several specific patterns. Principal diagnosis changes that move cases to higher-weighted DRGs without clear clinical justification are a primary target. CC and MCC codes added based on documentation that lacks physician attestation of clinical impact are another. Query patterns that consistently produce higher-severity diagnosis confirmations, particularly when queries are sent predominantly on cases where the clarification would increase the DRG weight, are a separate red flag. Well-designed physician query management programs specifically avoid this pattern by ensuring queries are sent based on clinical indicators in the record, not on payment opportunity.
HCC and RADV Audit Standards
Risk Adjustment Data Validation audits require that each HCC-mapped diagnosis be supported by documentation showing the condition was evaluated, addressed, or considered in care planning during the measurement year. A diagnosis on a problem list alone is not sufficient. The condition must appear in the context of an actual clinical encounter, with evidence the treating provider engaged with it. Auditors reviewing HCC coding look for exactly this distinction.
Query Pattern Red Flags Auditors Recognize
The query process is a legitimate and necessary part of clinical documentation improvement. Queries sent because documentation is ambiguous, contradictory, or incomplete serve an accurate coding function. The line between appropriate querying and leading querying is one auditors are trained to identify.
Red flags include multiple-choice queries where every listed option maps to a higher-severity diagnosis than the unspecified current documentation. They include queries sent selectively on cases where a physician's clarification would move the case to a higher-paying DRG or add an MCC, but not on similar cases where no payment impact would result. A physician query management program built on compliant query design, with query tracking and outcome data, provides documentation that the process is clinically driven rather than financially driven.
Building Defenses That Cover Both Directions
Effective compliance programs address upcoding and undercoding simultaneously, because both arise from the same documentation and validation gaps.
Regular Internal Coding Audits
Internal audits stratified by coder, by code type, and by service line produce the most actionable data. A coding quality audit that only reviews high-level E/M claims, for example, will miss systematic undercoding at the mid-level range and will not detect HCC omissions. Audits need to cover the full distribution to detect both directions of inaccuracy.
Statistical Benchmarking
Monitoring your own E/M distribution, case mix index, and HCC capture rates against CMS benchmarks and specialty peer data on a rolling basis gives you the same statistical view a payer audit would use. When your internal monitoring catches a skewed distribution before a payer does, you have the opportunity to investigate and remediate proactively.
CDI Programs Built on Clinical Indicators
Clinical documentation improvement programs should be designed to support complete and accurate documentation of what is clinically present, not to guide physicians toward specific diagnosis choices that maximize reimbursement. The program's success metrics should include documentation completeness and coding accuracy, not DRG weight or HCC count as standalone targets.
Independent Secondary Review for High-Risk Lines
Inpatient DRG assignment, HCC risk adjustment coding, and surgical procedure coding for high-value procedures benefit from independent secondary review by coders who did not assign the original code. This catches both upcoding and undercoding errors before claims are submitted.
What to Do When You Receive an Audit Notice
Preserve all documentation immediately. Do not alter, delete, or reorganize records. Engage qualified healthcare legal counsel before conducting or disclosing any internal investigation, because attorney-client privilege may protect internal findings in a way that direct administrative investigation does not. Understand from the outset that a sample-based error rate finding will typically be extrapolated across your full claim population for the audit period, not just the sampled claims. The financial and compliance implications depend heavily on how the investigation is managed from the first days.
Frequently Asked Questions
What is the difference between upcoding and fraud?
Upcoding refers to the act of assigning a code that reflects a higher level of service or severity than documentation supports. Fraud, under the False Claims Act, requires that the submission be knowing or reckless, not merely mistaken. Isolated coding errors are generally not fraud. Systematic patterns of unsupported coding, particularly when internal audits or payer feedback have previously identified the problem and it continued, can support a finding of reckless disregard or knowing submission. The distinction matters enormously in enforcement proceedings.
Can undercoding create legal trouble?
Yes, in specific circumstances. In risk-adjusted or value-based contracts, systematic undercoding that distorts a patient population's recorded acuity can have contractual and regulatory implications. Separately, if undercoding is part of a pattern designed to avoid audit scrutiny while selectively coding higher elsewhere, it can factor into an FCA investigation. The safe assumption is that coding inaccuracy in either direction carries risk and should be corrected.
How often should organizations audit coding for compliance?
There is no single regulatory requirement specifying a universal audit frequency. Best practice for most organizations with active Medicare or Medicaid billing is ongoing monitoring supplemented by formal structured audits conducted at least annually, with higher-risk service lines reviewed more frequently. New coders, new service lines, and periods following major guideline changes (such as annual ICD-10-CM updates) warrant additional review cycles.
Who is liable when an outsourced coding vendor upcodes?
The billing provider or facility that submits the claim bears primary responsibility under the False Claims Act. Vendor agreements and representations do not transfer that liability to the vendor. Organizations using outsourced coding services are responsible for monitoring coding quality, maintaining oversight, and implementing corrective action when problems are identified. A documented coding quality audit process applied to vendor-coded claims is part of fulfilling that oversight obligation.
To assess where your organization stands on both upcoding and undercoding risk before a payer or regulatory audit does it for you, contact MedCodex Health through our coding quality audit services page.