Recent Medicare legislation has been directed at improving patient care quality by stopping reimbursement of hospital-acquired conditions (HACs). However, this policy may be undermined if some providers respond by upcoding, a practice where HACs are reported as present-on-admission (POA) to continue receiving full reimbursement. Identifying upcoding behavior from claims data is challenging due to unobservable confounders. Our approach leverages state-level variations in adverse event reporting regulations and instrumental variable techniques to discover contradictions between HAC and POA reporting rates that are strongly suggestive of upcoding. We find over 11,000 upcoded infections a year, resulting in an added cost burden of $200 million. Our findings suggest that, contrary to widely-held beliefs, increasing financial penalties alone may not reduce HAC incidence and may even exacerbate the problem. We make several policy recommendations based on our results, including a new measure for targeted HAC auditing and suggestions for effective adverse event reporting systems.