By the VerifyDoc patient advocacy team
Upcoding — when a hospital or physician bills for a more expensive service than was actually provided — is one of the most common and costly billing errors patients face, and you can catch it yourself by reading your itemized bill line by line against your medical records.
This post explains what upcoding is, how it shows up on CPT and ICD-10 coded bills, what federal rules give you the right to scrutinize those codes, and how to dispute charges you believe are wrong. We cover both outpatient visit codes (E&M codes) and inpatient DRG-based billing, where the stakes are highest.
Your 8-Step Checklist for Spotting Upcoding and Billing Code Errors
Before diving into the details, here's the action list. Work through these steps in order — each one builds on the last.
- Request a fully itemized bill — not just a summary statement — with every CPT and ICD-10 code listed.
- Pull your medical records for the same visit or stay, using your federal right under HIPAA (45 CFR § 164.524).
- Look up each CPT code using the AMA's CPT code lookup or the CMS Physician Fee Schedule to see its official description.
- Compare the billed E&M level to what actually happened — how long was the visit, how complex was the decision-making?
- Check for unbundling — procedures that should be billed together under one code charged separately at higher rates.
- Verify DRG severity level if you had an inpatient stay — confirm that any "complication" or "comorbidity" codes in your ICD-10 list reflect conditions you actually have.
- Cross-reference hospital charges against the price transparency file that every U.S. hospital must publish under 45 CFR § 180.50.
- Submit a written dispute to the hospital's billing department and, if unresolved, escalate to your insurer and the HHS-OIG hotline.
What Upcoding Actually Means — and Why It Costs You Money
Upcoding occurs when a provider submits billing codes for a higher level of service, more complex diagnosis, or more expensive procedure than was actually performed or documented. It's not always intentional fraud — it can result from copy-pasted EHR notes, outdated billing templates, or a coder who selects a higher-paying code by habit. But whether the error is deliberate or accidental, you pay for it through higher cost-sharing, exhausted deductibles, and inflated out-of-pocket costs.
CMS's 2025 Medicare Fee-for-Service Supplemental Improper Payment Data, which covered a review of 37,651 Medicare claims from July 2023 through June 2024, found an overall improper payment rate of 6.55%, involving more than $28 billion in improperly paid claims. Among Part B claims — mainly from primary care physicians — CMS improperly paid approximately $1.8 billion due to upcoding issues. That's a federal program figure; private insurer overbilling adds further to this total.
Unbundling — a closely related practice — involves fragmenting billing codes for procedures typically charged under a single comprehensive code. Billing multiple claims for what should be a bundled service exploits loopholes in the billing system. For example, billing each step of a surgical procedure separately when a single code should encompass all steps constitutes unbundling. Both upcoding and unbundling inflate your bill, and both appear as individual line items on an itemized statement.
The CPT and ICD-10 Codes Most Likely to Be Wrong
Two coding systems drive most of what appears on your bill. CPT (Current Procedural Terminology) codes are five-digit numbers assigned by the American Medical Association that describe the specific service performed — an office visit, a lab test, a surgical procedure. ICD-10-CM codes are alphanumeric diagnosis codes that describe what condition was treated. Both types can be wrong, and both types of errors cost patients money.
The two biggest upcoding offenders identified by CMS are CPT 99233 (subsequent hospital inpatient or observation care requiring high-level medical decision-making, or at least 50 minutes) and CPT 99214 (outpatient visit for an established patient requiring moderate-level decision-making, or at least 30 minutes). CPT 99233 generated over $490 million in overpayments, and CPT 99214 accounted for another $459 million.
On the inpatient side, hospital inpatient costs are paid using pre-determined rates that vary according to the Diagnosis-Related Group (DRG) assigned to the patient stay and the severity of the diagnosis. The DRG and severity level are determined by ICD codes. One type of upcoding occurs when hospitals bill for inpatient stays at the highest severity level even though the patient's care was actually more routine. A high severity level requires that there be at least one secondary diagnosis considered a major complication or comorbidity, such as acute respiratory failure or sepsis. If you had a routine hospitalization and see a diagnosis code for a severe complication you don't recall being told about, that's a red flag worth investigating.
HHS-OIG found that hospitals billing Medicare for inpatient stays at the highest severity codes increased by 20% from fiscal years 2014 through 2019, while the average length of those stays actually decreased. HHS-OIG said this pattern is strongly indicative of upcoding, because patients with severe conditions typically require longer, more intensive treatment, and Medicare reimburses hospitals more for such patients.
Common Billing Code Error Patterns — Reference Table
| Error Type | What It Looks Like on Your Bill | How to Spot It | Relevant Code System |
|---|---|---|---|
| E&M Upcoding | High-complexity office visit code (e.g., 99215) billed for a routine follow-up | Compare visit notes: does the documentation support the time or complexity billed? | CPT (99202–99215) |
| DRG Severity Upcoding | Inpatient stay coded at highest severity level with a "major complication" you weren't told about | Request discharge summary; verify all secondary diagnosis codes against your actual conditions | ICD-10-CM + MS-DRG |
| Unbundling | Surgical procedure billed as multiple separate codes when one code covers the whole procedure | Look for multiple line items on the same date for related steps; check CMS NCCI edits | CPT |
| Modifier Abuse | Modifier code appended to a standard visit to claim an additional distinct service was provided | Ask: was a truly separate service performed, or is this a modifier added to avoid bundling rules? | CPT Modifier |
| Diagnosis Upcoding | A more severe diagnosis code assigned than your actual condition (e.g., coding pneumonia J18.9 for an unconfirmed respiratory complaint) | Compare ICD-10 codes on your bill to your discharge paperwork and physician notes | ICD-10-CM |
| Phantom Service Billing | CPT code for a procedure or test that was never performed | Cross-check every line item against your own recollection and medical records | CPT / HCPCS |
Your Federal Rights: How to Get the Documents You Need
You can't audit codes you can't see. Two federal rules give you the access you need. Under HIPAA (45 CFR § 164.524), you have a federally protected right to access your medical records and billing information. Request your complete records — including the physician's visit notes, discharge summary, and operative reports — for the same dates that appear on your bill. These records are the ground truth against which every code should be measured.
On pricing, Section 2718(e) of the Public Health Service Act requires each hospital operating within the United States, for each year, to establish, update, and make public a list of the hospital's standard charges for items and services provided by the hospital, including for Diagnosis-Related Groups. In the CY 2020 OPPS/ASC final rule, CMS adopted requirements for hospitals to make public their standard charges in two ways: as a comprehensive machine-readable file and in a consumer-friendly format. CMS codified these requirements at 45 CFR Part 180.
The most recent update matters for 2026 patients. On November 21, 2025, CMS finalized changes to the hospital price transparency regulations consistent with Executive Order 14221, "Making America Healthy Again by Empowering Patients with Clear, Accurate, and Actionable Healthcare Pricing Information," to ensure that hospitals provide meaningful, accurate information about what they charge for healthcare items and services. CMS is finalizing regulations at 45 CFR § 180.50 which require hospitals to attest in the machine-readable file that, to the best of their knowledge and belief, they have included all applicable standard charge information and that the information encoded is true, accurate, and complete. You can use that public file — linked directly from a hospital's website under a "Price Transparency" footer — to compare what the hospital charges against what appeared on your bill.
How to Read an E&M Code and Decide If It Fits Your Visit
Evaluation and Management (E&M) codes are the most frequently upcoded codes in outpatient billing, and they're also the easiest for a patient to evaluate without medical training. The reimbursement for E&M codes depends on several factors, including the time spent with a patient, whether the patient is new or established, and how many body systems a provider evaluates in a visit. The higher the level (99211 is the lowest; 99215 is the highest for established outpatients), the longer and more complex the visit must have been.
Here's the practical test: What do you remember about the visit? Did you see the doctor for 10 minutes for a prescription refill, or did you spend 40 minutes discussing a complex set of conditions? Documentation alone would not support a high level of medical decision-making if the time spent or the complexity of decisions doesn't meet the threshold for the billed code. If your visit notes describe a brief, straightforward encounter but the code billed is 99215 (requiring either high-complexity decision-making or 40+ minutes of total time), that discrepancy is worth disputing.
Electronic health record (EHR) software can facilitate upcoding: providers can copy and paste notes from a patient's previous visit into current treatment notes, making it appear that every condition on a prior list was diagnosed and treated at the current visit. If you receive records that look identical across two visits for very different reasons, that's a potential red flag for a copied note supporting an upcoded bill.
How to Dispute a Billing Code Error — Step by Step
Once you've identified a code that doesn't match your actual care, act in writing. A phone call creates no paper trail; a letter or email does. Address your dispute to the hospital's billing department and copy the patient advocate's office. State specifically which CPT or ICD-10 code you're challenging, why you believe it's incorrect based on your records, and what correction you're requesting. Set a deadline — 30 days is reasonable — for a written response.
If the hospital doesn't correct the error, escalate to your insurer. Your insurer has a financial interest in not overpaying and may conduct its own audit. CMS and private payers establish bundling policies through the National Correct Coding Initiative (NCCI), and claims that fragment bundled services attract audit attention. Citing NCCI edits in your dispute letter signals that you understand the rules.
For billing errors on Medicare claims, you can contact your Medicare Administrative Contractor directly. For suspected fraud — not just an error — you can report it to the HHS-OIG Hotline at 1-800-HHS-TIPS. You are not required to have absolute proof of intentional fraud to make a report; the OIG investigates patterns, and your report may be one of several about the same provider.
About VerifyDoc: We help patients identify errors and overcharges on medical bills. We publish guides on hospital billing, the No Surprises Act, and disputing medical charges, updated as federal and state rules change.
Verify your hospital bill in 60 seconds
We help patients identify errors and overcharges on medical bills. We publish guides on hospital billing, the No Surprises Act, and disputing medical charges, updated as federal and state rules change.
Get started →Frequently asked questions
What's the difference between a CPT code and an ICD-10 code on my bill?
CPT (Current Procedural Terminology) codes are five-digit numbers assigned by the American Medical Association that describe the specific service or procedure performed — for example, an office visit, a blood draw, or a surgical operation. ICD-10-CM codes are alphanumeric diagnosis codes that describe the medical condition or reason for the visit. Both types appear on your itemized bill and your Explanation of Benefits (EOB). A billing error in either system can increase your charges — a wrong CPT code can inflate the cost of a procedure, while a wrong ICD-10 code can misclassify your condition as more severe than it was and push your inpatient stay into a higher-paying DRG category. Always ask to see both sets of codes on your itemized statement.
Can I dispute a billing code even if I'm not a medical professional?
Yes. You don't need to be a coder to catch a upcoding error — you just need your records and some patience. Compare the level of the E&M code billed against how long your visit actually lasted and how complex the discussion was. Compare the ICD-10 diagnosis codes against your discharge summary and doctor's notes. If a code describes a condition or severity you were never told about, that's a legitimate basis for a dispute in writing. The hospital's billing department must respond to written disputes. Under HIPAA (45 CFR § 164.524), you have a federal right to your medical records, and under 45 CFR Part 180 every hospital must make its standard charges publicly available so you can compare what you were charged against the posted price.
What is unbundling, and how is it different from upcoding?
Upcoding means billing a higher-level code than the service performed — picking a Level 5 E&M code for a Level 2 visit, for example. Unbundling means splitting a procedure that should be billed under one comprehensive code into multiple separate codes to generate higher total reimbursement. CMS and private payers have established bundling rules through the National Correct Coding Initiative (NCCI), which specifies which procedure codes must be billed together. If you had a single surgical procedure and your bill lists multiple separate CPT codes for what appear to be individual steps of that procedure, that's a potential unbundling error. Both practices inflate your bill and are considered improper under federal billing standards.
If I find a likely billing code error, what's the most effective way to get it corrected?
Put everything in writing. Send a letter or email to the hospital's billing department identifying the specific CPT or ICD-10 code you believe is wrong, citing the documentation (your visit notes, discharge summary, or operative report) that contradicts it, and requesting a corrected claim within 30 days. Keep copies of everything. If the hospital doesn't respond or refuses to correct the error, escalate to your health insurer — insurers have their own audit processes and a financial interest in accurate coding. For Medicare patients, contact your Medicare Administrative Contractor. If you suspect intentional fraud rather than a clerical error, you can file a report with the HHS-OIG hotline at 1-800-HHS-TIPS. Disputing in writing creates the paper trail you'll need if the matter escalates.