By: Christopher Parrella, Esq., CPC, CHC, CPCO
Parrella Health Law, Boston, MA.
A Health Care Provider Defense and Compliance Firm

Hospitals across the country should be paying close attention to this one.

In what appears to be the first-ever False Claims Act settlement targeting hospital billing for emergency department (ED) facility-level resource use, UCHealth in Colorado has agreed to pay $23 million to resolve allegations of fraud involving overcoding ED visits. This case is a warning shot from the Department of Justice—and a new chapter in enforcement.

The Allegations: Inflating E/M Levels with an Algorithm

Between 2017 and 2021, UCHealth allegedly used an automated billing system that defaulted to CPT code 99285—the highest-paying ED evaluation and management (E/M) level—for certain patients based on how frequently their vital signs were recorded. It didn’t matter whether those patients were severely ill or only mildly concerned. It didn’t matter what level of care or resources the hospital actually used. If vitals were recorded more times than the number of hours the patient was in the ED, the system coded it as a level 5.

This is not how 99285 works. According to CMS and CPT guidance, E/M level assignment must reflect clinical complexity and actual hospital resource use. Coding based solely on the frequency of vitals, without tying that activity to medically necessary services, violates that principle.

The Whistleblower and Fallout

The case was initiated by Timothy Sanders, a certified coder and former UCHealth auditor, who filed a qui tam lawsuit under the False Claims Act. He alleged that the health system knowingly programmed its billing software to override the industry-standard ACEP guidelines and pushed false claims to Medicare and TRICARE.

Importantly, UCHealth declined to enter into a corporate integrity agreement, leading HHS-OIG to place the system under “heightened scrutiny.” That’s a big deal—and a reputational risk for any provider.

The Broader Context: ED Facility Billing Is a Known Risk

Hospitals have long struggled with ED E/M coding compliance. Unlike physicians, hospitals must develop their own methodologies for assigning CPT codes 99281–99285 on the facility side. CMS never issued formal guidance, leaving hospitals to adopt point systems, severity models, or time-based tools.

The problem? Complexity. Overcoding is easier than many think, especially when systems rely on automated logic rather than clinical judgment. And that’s precisely what tripped up UCHealth.

Compliance Takeaways

1. Automated systems are not a compliance shield. If they’re built on flawed assumptions or misaligned with CPT requirements, they’re a liability, not a convenience.
2. Vital signs alone don’t justify higher E/M levels. Frequent vitals may reflect clinical vigilance, but without accompanying documentation of acuity, interventions, and actual resource use, they don’t meet 99285’s bar.
3. Monitor your E/M distribution. High percentages of level 4 or 5 claims should trigger internal reviews, especially when matched against diagnoses like sprains, lacerations, or tonsillitis.
4. Dashboards and trending are your best defense. Build systems that flag anomalies. Examine codes linked to patients discharged home or leaving AMA. Ask: Does the level make sense?
5. Glossaries and education matter. Define exactly what services count toward your scoring model. Are glucoscans separate from point-of-care testing? Is there a cap on how many times vitals can be counted? Get clear and train staff consistently.

The Bottom Line

The UCHealth case isn’t just a one-off—it’s a precedent. The DOJ has now shown a willingness to prosecute hospitals for how they calculate ED facility fees. Expect more scrutiny. Expect more audits. And if your billing logic hasn’t been reviewed recently, it’s time.

Call to Action

If you need support assessing or defending your hospital’s E/M coding practices, or want help building a compliant E&M Plan, contact Parrella Health Law at 857-328-0382 or email me directly at cparrella@parrellahealthlaw.com.