Upcoding means reporting a code that pays more than the service actually documented and furnished. Downcoding means reporting a code below what the documentation supports. Both distort the claim. Upcoding carries the larger enforcement exposure, downcoding the larger silent revenue loss, and auditors treat sustained patterns of either as a reason to look closer.
What separates a coding error from a compliance problem
Not every coding variance is fraud, and treating it that way damages both your audit program and your coders. Four different things produce the same wrong code.
| Cause | What it looks like | What it needs |
|---|---|---|
| Unintentional error | A coder misses an add-on code or applies a retired guideline | Education and a targeted re-review |
| Documentation insufficiency | The note does not establish what was performed, so no code is defensible | Provider query, CDI intervention, documentation education |
| Coder judgment | Two credentialed coders read the same ambiguous note one level apart | A written guideline that settles the ambiguity |
| Intentional misuse | Code selection driven by payment rather than documentation | Investigation, correction, repayment analysis, counsel |
The HHS Office of Inspector General defines upcoding as "the practice of using a billing code that provides a higher reimbursement rate" than the code matching the service performed, and notes it "has been a major focus of the OIG’s law enforcement efforts" ( 63 Fed. Reg. 70138 ). The same guidance names code gaming and DRG creep as related risk areas your written policies should address.
The compliance question is rarely "was this one code wrong." It is "does our process reliably produce the code the documentation supports, and can we prove it." This article is educational, not legal advice; organization-specific risk decisions belong with qualified compliance counsel.
Why downcoding is not the safe choice
Coders under audit pressure often default low, assuming underbilling cannot hurt them. It can.
It misstates the record. A claim coded below the documentation is as inaccurate as one coded above it, and quality and risk-adjustment programs consume that data.
It is measurable money. OIG’s review of 2010 Medicare evaluation and management claims found roughly 55% were incorrectly coded or insufficiently documented: about 26% upcoded and about 15% downcoded , which OIG estimated underpaid physicians by roughly $1.8 billion in one year ( OEI-04-10-00181 ). Those figures predate the current E/M guidelines, so read them as evidence that downcoding is common and material, not as a benchmark.
It does not buy protection. An auditor who finds you code below documentation has still found an unreliable process. The finding changes from overpayment to process failure, and the process failure drives the corrective action plan.
Provider downcoding vs. payer downcoding
Payers now reduce the level of high-level E/M claims automatically, before any record review. Cigna’s R49 Evaluation and Management Coding Accuracy policy, effective October 1, 2025, applies to professional claims billed with CPT 99204 to 99205, 99214 to 99215 and 99244 to 99245, with appeal by submitting the visit record. The AMA filed "strong concerns" about it (AMA letter, Aug. 28, 2025), joined by the AAO-HNS, ACR, TMA, CMA and APMA. Terms have varied by state, so confirm current policy with the payer.
Keep the two separate in your reporting. Payer downcoding is an appeal and record-retrieval workload. Provider downcoding never appears in a denial report, because the claim pays as billed. Mix them and your root-cause analysis blames coders for a payer edit, or the reverse.
Six audit triggers
Auditors start from a pattern, then pull records to test it.
- Documentation that does not support the billed level. CMS’s Comprehensive Error Rate Testing program sorts improper payments into insufficient documentation, no documentation, medical necessity and incorrect coding. The FY 2025 Medicare fee-for-service improper payment rate was 6.55%, or $28.83 billion ( CMS CERT ), most of it documentation failure rather than intentional misbilling.
- Distribution curves that shift without a clinical explanation. OIG found Medicare stays billed at the highest MS-DRG severity level rose almost 20% from FY 2014 through FY 2019 while every other level fell; nearly a third were unusually short and over half qualified on a single diagnosis ( OEI-02-18-00380 ). CMS did not concur with OIG’s call for targeted reviews, a reminder that a pattern is a reason to investigate, not a conclusion.
- High-severity diagnoses carried without support. A chronic condition coded at every encounter whether or not it was evaluated, or a payment-driving secondary diagnosis appearing exactly once in the record.
- Modifier patterns, particularly modifier 25. Medicare bundles an E/M into a minor procedure’s payment unless the physician performed a significant, separately identifiable service. Same-day E/M with minor surgery remains an active OIG Work Plan subject, and modifiers 25 and 59 drive both unbundling findings and NCCI edit failures .
- Outlier position against peers. Specialty, case mix, payer mix and acuity all legitimately move these curves, so outlier status is a reason to look rather than a finding.
- No internal audit. Without monitoring you have no evidence your coding is accurate, and OIG treats internal auditing as a core element, not an optional maturity step.
A prevention framework you can staff
OIG’s guidance for third-party medical billing companies sets out seven fundamental elements: written policies and standards of conduct; a compliance officer and committee; training and education; effective lines of communication; enforcement through well-publicized disciplinary guidelines; internal monitoring and auditing; and prompt response to detected offenses with corrective action ( 63 Fed. Reg. 70138 ). The November 2023 General Compliance Program Guidance carries the same seven forward and folds risk assessment into auditing. Both are voluntary; enforcement risk comes from the claims, and the program is what lets you find them first. In coding operations:
- Documentation-led code assignment. Code from what the note establishes, not the charge ticket or last year’s pattern. Where documentation falls short, the answer is a provider query, not a lower code chosen to stay safe.
- Audits on a written cadence. OIG recommends a valid statistical sample annually, before and after billing is submitted, plus periodic spot-checking of coding staff. Prospective review catches errors before the claim leaves; retrospective review finds the patterns.
- Focused reviews of high-risk services. Top-level E/M, modifier 25 and 59 usage, payment-driving diagnoses, new providers and procedures, and any code whose volume moved sharply.
- Defined escalation and correction. A coder who spots a pattern needs a named path to the compliance officer, who per OIG "should have full authority to stop the processing of claims." Decide in advance who turns a pattern into a repayment analysis.
- Education for coders and providers. Coder education fixes code selection; provider education fixes the documentation that constrains it. Run only the first and you repeat the second.
- Monitoring and corrective action. Track error rate by coder, specialty, provider and code family. A corrective action plan without follow-up measurement is a memo.
- Retained audit evidence. Keep the sample, methodology, findings, corrective actions and re-audit results. That file is the difference between a defensible program and an assertion.
Where technology helps, and where it does not
Automation does not resolve the judgment at the center of this problem. It can remove variance from the rule-bound parts and make the rest visible.
Consistency on routine charts. Variance between coders drives drifting distributions. A first pass applying the same guidelines the same way narrows it before anyone audits.
Edits resolved before submission. NCCI procedure-to-procedure edits, MUE unit limits and LCD/NCD coverage policy define much of what an auditor later calls unbundling, frequency violations or medical necessity failures. Applying them while the claim is built catches that class of error pre-bill rather than on a remittance.
Evidence attached to each code. If the system assigning a code also stores the documentation passage and rule it applied, an audit response becomes a lookup instead of a reconstruction.
None of this replaces coder judgment, clinical validation or an internal audit program.
Where MediCodio AI fits
Three elements above are where a coding platform either helps or gets in the way: documentation-led assignment, monitoring, and retained evidence.
On the first, CODIO AI decides per chart whether the documentation can carry a confident code. Where it can, the chart codes autonomously through AutoPilot. Where the note is thin or contradicts itself, it stops in CoPilot for a certified coder to finish. That split matters here specifically, because the chart most likely to be coded low out of caution is the chart the system holds back for a human.
On the other two, each code is stored with the passage it came from and the rule that justified it, and NCCI, MUE and LCD/NCD checks run before release. A sample pulled six months later reads as a record, not a reconstruction.
How much runs autonomously is a setting rather than a promise. It starts narrow, widens by specialty or case type as your own auditors confirm first-pass accuracy, and contracts whenever they do not. CODIO AI reports 98%+ coding accuracy, measured at code level on production charts before correction, against review by AAPC- and AHIMA-credentialed coders. Read that as a measured result across deployments, not a guarantee of accuracy, reimbursement, payer acceptance, cost savings or audit outcomes. The number that should move a decision is the one from your charts.
Scope is outpatient, emergency department, professional fee and ASC charts; the inpatient figures cited earlier illustrate audit logic that generalizes, not inpatient capability. For RCM and billing companies, this is evidence inside the seven elements, not a replacement for them.
FAQs
Is downcoding always safer than upcoding?
No. Downcoding misstates the claim, understates the clinical picture in data feeding quality and risk programs, and costs real revenue. OIG attributed roughly $1.8 billion in underpayments to downcoded E/M claims in 2010 alone. An auditor who finds systematic downcoding has still found an unreliable process, which drives a corrective action plan.
What triggers an upcoding audit?
A pattern rather than a single claim: a distribution shifting toward high-level services without a matching clinical change, payment-driving diagnoses without supporting detail, heavy modifier 25 or 59 use, outlier position against peers, and documentation that fails to support the billed level. Without internal monitoring, these surface first to an external reviewer.
How can an organization reduce coding-compliance risk?
Build the seven OIG elements into coding operations: written coding policies, a compliance officer with real authority, coder and provider education, prospective and retrospective audits on a written cadence, focused reviews of high-risk services, documented corrective action, and retained audit evidence. Measure error rate by coder, provider and code family so changes surface early.
What sample size should an internal coding audit use?
OIG recommends a valid statistical sample annually, before and after submission, without prescribing a number. The right size depends on chart volume, specialty mix, coder count, the error rate you want to detect and the confidence level you need. Set it with your compliance officer or an external auditor, document the methodology, and hold it steady so period-over-period comparisons mean something.
Sources
- OIG, Compliance Program Guidance for Third-Party Medical Billing Companies , 63 Fed. Reg. 70138 (Dec. 18, 1998)
- OIG, General Compliance Program Guidance (November 2023)
- OIG, Trend Toward More Expensive Inpatient Hospital Stays in Medicare , OEI-02-18-00380 (Feb. 19, 2021)
- OIG, Improper Payments for Evaluation and Management Services Cost Medicare Billions in 2010 , OEI-04-10-00181 (May 2014)
- OIG Work Plan , Evaluation and Management Services on Same Day as Minor Surgery With No Modifier 25
- CMS, Comprehensive Error Rate Testing (CERT) , FY 2025 improper payment rate
- AMA, Letter to Cigna on the Evaluation and Management Claim Review program (Aug. 28, 2025)