A Medicare Administrative Contractor asked an internal medicine practice for 30 records in a targeted probe. The practice sent them with confidence; the physician was careful, the visits were real and the coding matched the notes. The results letter downcoded 19 of the 30 from 99214 to 99213 or 99212 and asked for repayment. The reason in almost every case was the same sentence: the documentation was identical or nearly identical to the previous encounter and did not reflect the work performed on the date of service.
The physician had not invented anything. He had used the EHR's copy-forward function the way it was designed to be used: pull the last note in, edit what changed. The problem was what did not get edited. The history of present illness still said "presents for follow-up two weeks after hospital discharge" nine months after the discharge. The review of systems was fourteen systems negative on a patient who had come in with chest pain. The exam said "no acute distress, lungs clear" on a visit where the assessment was an acute bronchitis with wheezing. A reviewer reading three consecutive notes could see that the words were carried, and once that is visible, nothing in the note is believed.
This article covers cloned documentation from the auditor's side: how reviewers detect it, the patterns that trigger downcoding and repayment, what the OIG, CMS and the contractors have said, and the practical response: EHR configuration, a written policy and a small monthly audit.
Key takeaways
- Cloned documentation is text carried from a previous encounter or generated by a template default that does not reflect what happened at the visit; the words are not the problem, the failure to edit them is.
- Reviewers detect cloning by reading consecutive notes side by side and by looking for internal contradictions (a negative review of systems beside an acute complaint, a normal exam beside an abnormal assessment), and once found, the note no longer supports medical necessity or the level billed.
- The OIG reported in January 2014 that CMS and its contractors had adopted few safeguards against EHR copy-paste, and contractors have since published notices that cloned notes will be treated as not supporting the service.
- The fix is technical and procedural together: turn off copy-forward for the history, review of systems and exam, disable pre-populated normal defaults, make copied text visible, and audit five notes per clinician each month against the prior visit.
- Since the 2021 and 2023 E/M changes, history and exam no longer drive the code, so there is no coding reason to carry them forward at all; medical decision making and time must be specific to the day.
How reviewers find it
Auditors do not need software to detect cloning, though many now have it. They request several consecutive notes for the same patient and read them in sequence. Identical paragraphs stand out immediately, and so do time-anchored phrases that no longer make sense ("two weeks after discharge," "started metformin last month," "will recheck in three days") repeated across months. They then read within a single note for contradictions: a chief complaint of new knee pain with a musculoskeletal review of systems marked negative; an assessment of pneumonia under a lung exam documented as clear; a plan that references a medication the medication list shows was stopped; a female patient with a normal prostate exam. Each contradiction is evidence that the note was not written for this visit.
The consequence is not that the copied sections are ignored. It is that the reviewer concludes the note as a whole cannot be relied on to show what was done, and therefore cannot support medical necessity or the level billed. Contractors have said this plainly. Medicare Administrative Contractors including Novitas and First Coast have published articles stating that documentation identical or nearly identical across encounters will be considered cloned and will not be accepted as supporting medical necessity, and that cloning may be treated as a misrepresentation. In the 2014 report titled "CMS and Its Contractors Have Adopted Few Program Integrity Practices to Address Vulnerabilities in EHRs," the OIG found that only about a quarter of hospitals it surveyed had a copy-paste policy and recommended that contractors use audit logs to detect copied text. CMS followed with a documentation integrity fact sheet in 2016 that named copy-paste, templates with default normals and auto-population as the three EHR features that create the risk.
The patterns that turn a 99214 into a 99212
| Pattern | What the reviewer sees | Typical result |
|---|---|---|
| Carried history of present illness | Same HPI text across three or more visits, stale time references | HPI disregarded; problem complexity unsupported |
| Default-negative review of systems | Fourteen systems negative on every visit, including the system of the chief complaint | Note credibility lost; may trigger broader review |
| Template exam with unchanged normals | Exam findings contradicting the assessment or the HPI | Exam disregarded; internal inconsistency cited |
| Carried assessment and plan | "Continue current management" on a visit with a new problem or medication change documented elsewhere | Medical decision making unsupported; downcoded to the level the visit-specific text supports |
| Templated time statement | "Spent 45 minutes" on every visit regardless of content | Time-based leveling rejected; possible referral for pattern review |
| Copied procedure or counseling documentation | Identical procedure note or smoking counseling text on visits where it was not performed | Service denied; overpayment; potential false claim exposure |
The last row is the one that moves a case from a repayment to a referral. A carried exam is sloppy. A carried procedure note that produces a charge for a service that did not happen is a false claim, and the fact that the EHR made it easy is not a defense. The same applies to counseling and screening codes (tobacco cessation, depression screening, advance care planning) whose documentation is often a template checkbox that carries forward.
A worked example: the probe results
Go back to the 30-record probe. Nineteen downcodes from 99214 to a lower level, plus two visits where a 99406 tobacco counseling charge was denied because the counseling text was identical on every visit including one where the patient was documented elsewhere as a never-smoker. The contractor extrapolated nothing in a probe, so the repayment was limited to the sampled claims, but the practice was moved to the next round of review with 40 more records. When we reviewed the physician's notes, the copy-forward setting was carrying the entire previous note, including the assessment and plan, and the exam template defaulted every system to normal unless a finding was clicked.
The visits were legitimately 99214 in most cases: two or more chronic conditions with a medication change is moderate medical decision making. The physician lost them because the note showed last month's decision making, not the day's. The fix took an afternoon with the EHR vendor and a month of habit change, and the second round came back with three downcodes instead of nineteen, all visits where the physician had genuinely done less than 99214 work.
Configuring the EHR
Most EHRs allow copy-forward to be controlled by note section and by role. Our recommended configuration for an office practice: copy-forward off for the history of present illness, review of systems, exam, assessment and plan; copy-forward or "pull from chart" on for the problem list, medication list, allergies, social history and family history, each followed by a required "reviewed and updated" attestation with a date. Disable pre-populated normal defaults in exam and review of systems templates so that a normal finding requires a click, not a non-click. If the EHR can mark copied or template-generated text in a different color or with an attribution tag in the signed note, turn that on; it makes the physician see what a reviewer will see. And confirm the audit log records copy events, because that log is what you will use to monitor.
Since the 2021 office visit and 2023 facility visit E/M changes, history and exam are documented "as medically appropriate" and no longer count toward the level. That removes the only coding reason clinicians ever had for a fourteen-system review of systems. A four-line HPI written fresh, a focused exam, and a medical decision making section that states the problems addressed today, the data reviewed today and the risk of today's management is a stronger 99214 note than three pages of carried text. Ambient AI scribes, which several practices we work with adopted in 2025 and 2026, produce new text each visit and largely avoid carry-forward, but they introduce their own review requirement, because the clinician still signs what the tool wrote.
Policy and the monthly audit
The OIG's finding was that most organizations had no policy. Write one: two pages that say which sections may be copied, which may not, that the author is responsible for the accuracy of everything in the signed note regardless of its source, that time statements must reflect actual time, and that the practice audits for it. The Joint Commission's 2015 Quick Safety advisory on copy-paste and the ECRI Partnership for Health IT Patient Safety's 2016 toolkit both frame the same four controls: make copied material identifiable, keep its provenance, train staff, and monitor.
The monthly audit is small. Five notes per clinician, chosen at random, each compared to the same patient's previous note. Score four items: is the HPI specific to this visit; does the exam agree with the assessment; is the assessment and plan specific to this visit; is any time statement plausible against the schedule. Report the score to the clinician the same week, unblinded within the group. Over three months the scores converge because clinicians do not enjoy being the outlier. This is the same audit our RCM audit team runs on E/M samples, and it is one we teach coders to run in our training programs, because a coder who can spot a cloned note before it is billed prevents the probe rather than responding to it.
Questions we hear
Is copy-forward itself prohibited?
No. CMS and the contractors object to documentation that does not reflect the encounter, not to the feature. Pulling forward a problem list and editing it is appropriate. Pulling forward the exam and not editing it is the problem. The policy should draw that line by note section.
The physician says the patient really is the same every month. Why is that cloning?
Because the note has to show what was evaluated on that date, not that nothing changed since last time. A stable patient still had a history taken and a decision made today, and a brief HPI written fresh ("reports no chest pain since last visit, taking medications as prescribed, no new complaints") documents it in one line. The identical paragraph does not, and a reviewer cannot tell it from a note that was never read.
Can we go back and fix notes that were cloned?
Not by editing signed notes; that is alteration, and it makes everything worse. If a signed note is wrong, the correction is a dated addendum that states what it corrects and why. If claims were billed at levels the notes cannot support, the answer is a voluntary refund under the 60-day overpayment rule, with counsel involved if the volume is significant. Then fix the configuration so the next probe reads differently.
What to do this week
- Pull three consecutive notes for five patients per clinician and read them side by side; mark every carried paragraph and every internal contradiction.
- Ask the EHR vendor to turn off copy-forward for the HPI, review of systems, exam, assessment and plan, and to disable default-normal exam templates.
- Turn on visual marking or attribution for copied and template-generated text if the system supports it.
- Write a two-page copy-paste policy that assigns responsibility for the signed note to its author and names the sections that may be pulled forward.
- Schedule the five-note monthly audit per clinician with the four-item score and a same-week feedback loop.
- Review any templated counseling or screening documentation (tobacco, depression, advance care planning) for charges that carried forward without the service being performed, and refund where they did.
