Upcoding Medical Bills Cost Billions: How to Fight Back

Some of the most common medical overbilling in America is deliberate — and hidden in codes patients never see. Peer-reviewed research estimates that upcoding costs Medicare Advantage alone $10 to $15 billion a year. Providers bill a higher level of service than what happened in the room because the higher code pays more, and your coinsurance and deductible follow that inflated number straight into your pocket. This guide shows you how to spot it, pull the records that prove it, and push back.

What Upcoding Is

Upcoding is billing for a higher-level service, more complex procedure, or more severe diagnosis than what the clinical record actually supports. (Source: HHS OIG) It is a documentation-to-code mismatch. Not a clinical judgment call — a paperwork one.

Providers get paid under fee-for-service and risk-adjusted systems where the code determines the dollars. A Level 4 office visit pays more than a Level 3. A high-severity inpatient stay pays more than a moderate one. When billing drifts upward faster than patients actually get sicker, someone is capturing revenue the documentation does not justify.

Patients pay for it twice. Coinsurance and deductibles scale with the billed amount, so an inflated code inflates your out-of-pocket cost even when insurance "covers" the visit. And inflated codes can trigger downstream denials — insurers sometimes reject claims they think are overbilled, leaving the balance for you to fight over while the provider sits on the sidelines. A peer-reviewed analysis of Comprehensive Error Rate Testing data estimated physician-service (Part B) upcoding at roughly $2.38 billion a year, and Medicare Advantage (Part C) upcoding between $10 and $15 billion a year. (Source: Joiner, Lin, Pantano, Health Economics Review, 2023)

Where Upcoding Shows Up on Bills

Upcoding shows up in three places on almost every bill: office-visit codes, hospital-stay severity levels, and modifiers (small add-ons that unlock extra payment). Knowing what each one is supposed to mean is the first move.

Office and outpatient visit codes. These are the five-digit CPT codes — starting with 992 — that describe how complex an office visit was. Since the AMA changed the rules on January 1, 2021, the code level is set by one of two things: how complicated the medical decision-making was, or how much total time the clinician spent on your visit that day (including chart review and writing notes, not just the minutes in the room with you). (Source: AMA CPT E/M Revisions FAQ)

If you've been to this doctor before, here's what each code level means:

If this is your first visit to this doctor, here's the equivalent table for new patients:

Hospital stay codes (DRGs). If you're admitted as an inpatient, your whole stay gets grouped into a single billing code called a Diagnosis Related Group. Medicare's version sorts stays into three severity levels — low, medium, and high — and the higher the level, the more the hospital gets paid. Adding or upgrading a secondary diagnosis (a second condition noted alongside the main reason for admission) can bump a stay from a lower level into a higher one. (Source: HHS OIG, OEI-02-18-00380)

Modifiers. These are two-character add-ons tacked onto the end of a CPT code. Two are worth watching for. Modifier 25 gets attached to an office-visit code to say the visit was separate from a procedure done the same day — so the provider can bill for both. A 2005 OIG review found modifier 25 was being misused widely. (Source: HHS OIG, OEI-07-03-00470) Modifier 59 is used to split procedures that would normally be paid together into separate line items — turning one billable event into several.

Why It's Rising Now

The short answer: the incentives have been pointing this direction for a decade, and a new technology has made acting on them easier.

The anchor is the OIG's 2021 analysis of every paid Medicare Part A inpatient claim from FY 2014 through FY 2019. Stays billed at the highest severity level rose almost 20 percent over that span and accounted for nearly half of all Medicare inpatient spending by the end of the period. (Source: HHS OIG, OEI-02-18-00380) The OIG's own words describe these stays as "vulnerable to" and "susceptible to" upcoding — not as a quantified upcoding rate. That is the important caveat. The 20 percent figure is a high-severity billing rise that the government's auditors think is susceptible to upcoding, not a direct measure of upcoding itself. A few supporting details from the same report sharpen the picture: average length of stay for these highest-severity billings actually decreased by half a day over the period, and more than half of them had only one secondary diagnosis qualifying them for the top tier.

The newest accelerant is AI ambient scribes — software that transcribes the clinical encounter and drafts documentation. In April 2026, STAT News reported that insurers, hospitals, and investors had converged on a private consensus that ambient scribes are raising coding intensity. (Source: STAT News, April 8, 2026) The Peterson Health Technology Institute (PHTI) published a think-tank analysis on April 13, 2026, based on health-system interviews and roundtable input, that described the same dynamic. (Source: PHTI, April 13, 2026) PHTI is not a peer-reviewed study. And a disclosure worth making explicit: PHTI's AI Taskforce includes AI-scribe vendors — Abridge, Commure, DeepScribe, Microsoft, Nabla, Oracle, and Suki — whose products are directly the subject of the analysis. PHTI reported that one unnamed health system saw a 5 percent increase in Level 5 encounters after deploying AI scribes. That figure is one health system, not an industry rate. Treat it accordingly.

AI is real fuel on an old fire. It is not the fire.

How to Detect Upcoding on Your Own Bill

Detection is a four-step compare: get the codes, understand what each level is supposed to represent, get the clinical record that is supposed to support those codes, and match them up.

Step 1: Get the itemized bill with codes. Call the provider billing office and request an itemized statement that shows every CPT, HCPCS, and DRG code billed. If you are uninsured or self-pay and received a Good Faith Estimate that the final bill now exceeds by $400 or more, you also have a Patient-Provider Dispute Resolution right under the No Surprises Act within 120 days. (Source: CMS, No Surprises Act)

Step 2: Look up what each code is supposed to mean. For an office visit, use the E&M tables above. A 99214 requires moderate decision-making or at least 30 minutes of clinician time on the date of service; a 99215 requires high decision-making or at least 40. For inpatient stays, severity tier should be supported by actual documented secondary diagnoses with clinical evidence, not a single borderline mention. For modifier 25, the E&M service should be genuinely separate from the procedure — not just the pre-procedure conversation.

Step 3: Invoke your HIPAA Right of Access. This is the step almost no patient takes, and it is the one with the most leverage. Under 45 CFR 164.524, any patient can request their records from a covered entity, including the progress notes, history and physical, discharge summary, and billing records that sit in the designated record set. (Source: HHS OCR, HIPAA Right of Access) The provider has 30 calendar days to act, with one 30-day extension allowed only if they send you a written reason for delay inside the original 30 days. Fees are capped at reasonable, cost-based copying, supplies, and postage — search-and-retrieval labor is not allowed, and inspection is free.

Step 4: Compare documentation to billed level. Put the bill next to the record. Red flags that deserve a second look: a 99215 for a short, uncomplicated visit where the note does not reflect high-complexity decision-making or 40+ minutes; a top-tier DRG where the chart shows a short stay and one thin secondary diagnosis; repeated modifier 25s where the E&M portion of the visit is indistinguishable from the procedure work; and new-patient codes billed for patients the practice has seen in the past three years.

Keep in mind the opposite pressure also exists: insurers sometimes downcode claims to pay less. (Source: AMA payer E/M downcoding resource) Your job is to match documentation to billed code, not to take either side at face value.

How to Dispute — The Full Escalation Ladder

The dispute path has more rungs than most patients realize. Start low, escalate in order, and keep every step in writing.

1. Provider billing office. Send a written dispute that names each code you are challenging and asks for a coding review and re-bill. Reference the documentation you have pulled. There is no federal statutory right to demand recoding, but internal review is standard industry practice and is a prerequisite for most insurer appeals. Keep the letter, the date, and any response.

2. Internal insurer appeal. If your insurer paid the inflated code, you have an ACA-mandated right to appeal within 180 days of the denial or explanation of benefits. Insurers must decide urgent appeals within 72 hours, pre-service appeals within 30 days, and post-service appeals within 60 days. (Source: healthcare.gov internal appeals) Include the records and your code-to-documentation comparison.

3. External review. If the internal appeal fails, you have a right to external review by an independent third party. Standard external reviews are decided within 45 days of request; expedited reviews within 72 hours. (Source: healthcare.gov external review) External review overturns roughly 40 percent of denials on average across all categories, though upcoding is not separately tracked.

4. HHS OIG Hotline (Medicare or Medicaid). Suspected fraud against federal healthcare programs can be reported online at tips.oig.hhs.gov, by phone at 1-800-HHS-TIPS (1-800-447-8477), or by mail. Be honest with yourself about what this channel is: it is a pattern-reporting tool, not a per-patient remedy. OIG explicitly states the hotline will not confirm receipt and does not provide complaint status. (Source: HHS OIG, Report Fraud) You are feeding the aggregate signal, not opening a case file on your bill.

5. Senior Medicare Patrol (Medicare beneficiaries only). ACL-funded SMP programs operate in every state, DC, Guam, Puerto Rico, and the USVI. Volunteers help Medicare beneficiaries review their Medicare Summary Notices, identify errors, and escalate fraud. (Source: ACL Senior Medicare Patrol; locator at smpresource.org) SMP serves Medicare beneficiaries only — not commercial insurance.

6. State insurance commissioner (commercial, fully insured plans). Directory at NAIC. Important limit: state commissioners do not have jurisdiction over self-funded ERISA plans, which cover roughly two-thirds of employer-sponsored insurance. If your plan says "self-funded" or "ASO" or your employer administers it directly, route complaints instead to the U.S. Department of Labor's Employee Benefits Security Administration (EBSA). (Source: DOL EBSA)

7. State attorney general. Most state AGs have consumer protection divisions that investigate healthcare billing fraud, and most states also have Medicaid Fraud Control Units. This is the right channel for patterns — a provider or system that seems to be doing this repeatedly, not a single dispute.

For the actual language to use when sending a records request, a billing-office dispute, or an insurer appeal, see our catalog of patient-facing scripts and templates in What to Do When You Get a Medical Bill: Immediate Actions.

When to Escalate to a Billing Advocate

DIY works for a single office visit and a clear documentation mismatch. It stops working when the numbers and the complexity scale. Consider hiring a medical billing advocate when the disputed amount is large enough to justify their fee; when the pattern spans multiple encounters or providers; when the bill is a hospital stay with complex DRG shifts and layered modifiers; or when the billing office has stonewalled your written disputes for more than a single response cycle. An advocate who knows coding can often resolve what a patient-submitted appeal cannot.