Recent Medicare legislation has been directed at improving patient care quality by financially penalizing providers for hospital-acquired infections (HAIs). However, Medicare cannot directly monitor HAI rates, and instead relies on providers accurately self-reporting HAIs in claims data to correctly assess penalties. Consequently, the incentives for providers to improve service quality may disappear if providers upcode, i.e. mis-report HAIs (possibly unintentionally) in a manner that increases reimbursement or avoids financial penalties. Identifying upcoding in claims data is challenging due to unobservable confounders such as patient risk. Our approach leverages state-level variations in adverse event reporting regulations and instrumental variable techniques to discover contradictions in HAI and present-on-admission (POA) infection reporting rates that are strongly suggestive of upcoding. We conservatively estimate that over 10,000 out of nearly 60,000 annual reimbursed claims for POA infections (18.5%) were upcoded HAIs, resulting in an added cost burden of $200 million to Medicare. Our findings suggest that self-reported quality metrics are unreliable and thus, recent legislation may result in unintended consequences. In particular, contrary to widely-held beliefs, increasing financial penalties may not reduce HAI incidence and may even exacerbate the problem. We make several policy recommendations based on our results, including a new measure for targeted HAI auditing and suggestions for effective adverse event reporting systems.