Copy-Paste and Cloned Documentation: Why Auditors Deny Claims and How to Fix Your EHR Templates

Introduction

Electronic health records (EHRs) have made documentation faster and more legible. They have also made it easy to copy yesterday's note into today's visit, carry forward an exam that never changed, or click a single button that fills a page with "normal" findings. When those shortcuts produce notes that look the same from visit to visit or from patient to patient, auditors notice.

Cloned documentation is one of the most common reasons auditors question medical necessity. Notes that do not reflect what actually happened at a specific encounter make it hard for a reviewer to conclude that a service was reasonable and necessary, was provided as billed, or supported the level of service billed. In more serious cases, cloned or auto-populated documentation can raise concerns about overdocumentation, upcoding, and authenticity.

This article explains what cloned and copy-paste documentation is, why it leads to denials, what CMS and the HHS Office of Inspector General (OIG) have said about it, which EHR features create the most risk, and how to fix your templates, policies, and workflows. It is educational and does not replace professional advice.

What Is Cloned Documentation?

"Cloning" generally refers to documentation that is worded exactly like or very similar to previous entries, either in the same patient's record or across different patients' records. It can occur in paper records with preprinted forms, but it is most common in EHRs that offer copy and paste, copy forward, auto-population, macros, and templates.

CMS's June 2016 decision table, "Ensuring Proper Use of Electronic Health Record Features and Capabilities," notes that copy and paste is also referred to as cloning or "cookie cutter" documentation.

Examples of cloned documentation include:

• The same history of present illness copied into every visit for months.

• An identical review of systems and physical exam in every note, regardless of the patient's complaint.

• The same assessment and plan for many different patients with different conditions.

• Therapy notes that describe the same treatment and the same patient response session after session.

• Home health or hospice visit notes that are word-for-word identical across visits.

• A note that includes findings from a previous visit that are no longer accurate.

Why Auditors Deny Claims With Cloned Documentation

The Record Must Support This Encounter

Medicare pays for services that are reasonable and necessary, and Section 1833(e) of the Social Security Act prevents payment unless the provider furnishes the information necessary to determine the amount due. Reviewers look for documentation showing what was done at a specific encounter and why it was needed. When notes are identical, reviewers may not be able to tell what actually happened at the visit under review.

CMS's EHR provider fact sheet explains that the medical record should show the patient's specific needs and the differences between visits, and that simply changing the date on a previous note without reflecting what occurred during the actual visit is not acceptable.

Medical Necessity Is the Overarching Criterion

For evaluation and management (E/M) services, the Medicare Claims Processing Manual, Chapter 12, Section 30.6.1, states that medical necessity is the overarching criterion for payment in addition to the individual requirements of a CPT code. It adds that it would not be medically necessary or appropriate to bill a higher level of service when a lower level is warranted, and that the volume of documentation should not be the primary influence upon which a specific level of service is billed.

Cloned and auto-populated notes often contain large volumes of text. Volume alone does not support a higher level of service, and auditors may discount content that appears to have been carried forward without relevance to the current visit.

Overdocumentation and Upcoding Risk

CMS's decision table explains that copy and paste can lead to redundant and inaccurate information, can make authorship difficult to determine, and can give a false impression of services provided. It warns that coding from outdated or copied information can lead to upcoding. Default population and macros can encourage overdocumentation, including documentation of services that were never performed.

Authenticity and Authorship Concerns

When content is copied from another provider's note without attribution, or when an EHR automatically changes the author of a note, it becomes difficult to determine who actually performed the service. CMS's decision table identifies automated changes of note author as a program integrity issue and recommends preserving the attribution of each entry.

Inaccurate Information and Patient Safety

Cloned documentation can carry forward findings that are no longer true, such as resolved symptoms, discontinued medications, or outdated exam findings. Inaccurate records undermine patient care as well as billing compliance.

What CMS and OIG Have Said

OIG Reports on EHR Vulnerabilities

In January 2014, OIG issued a report titled "CMS and Its Contractors Have Adopted Few Program Integrity Practices To Address Vulnerabilities in EHRs" (OEI-01-11-00571). OIG described copy-pasting, also known as cloning, as a practice that, when used inappropriately, can result in poor data quality or fraud. OIG found that few contractors reviewed EHRs differently from paper records and that not all contractors reported being able to determine whether a provider had copied language or overdocumented. OIG recommended that CMS provide guidance to its contractors on detecting fraud associated with EHRs and direct its contractors to use providers' audit logs. CMS concurred with the first recommendation and partially concurred with the second.

A companion December 2013 OIG report examined fraud safeguards in hospital EHR technology and recommended that CMS develop guidance on the use of the copy-paste feature in EHRs.

CMS's EHR Decision Table

In June 2016, CMS published "Ensuring Proper Use of Electronic Health Record Features and Capabilities: A Decision Table," which identifies program integrity issues and recommendations for common EHR features. Its key recommendations are summarized below.

CMS's Program Integrity Manual on Templates

CMS's Medicare Program Integrity Manual, Chapter 3, Section 3.3.2.1.1, addresses progress notes and templates. CMS states that it does not prohibit the use of templates and does not endorse any specific template. However, CMS discourages templates that provide limited options or check boxes without space for detailed information, because they often fail to capture the clinical information needed to show that coverage and coding requirements are met. CMS also notes that templates designed mainly for reimbursement often lack the information needed to demonstrate medical necessity, and it encourages providers to choose templates that allow full and complete documentation.

The EHR Features That Create the Most Risk

CMS's 2016 decision table addresses each of the following features.

Copy and Paste

• Risk: Redundant and inaccurate information, authorship problems, and a false impression of services provided.

• CMS recommendations: Establish a policy that balances efficiency with accuracy, require providers to tailor copied content to the specific patient and visit, clearly attribute copied information to its source, and monitor use through the audit log.

• Best practice: Treat each encounter as a standalone record, and validate any entry not written by the current user by identifying its source, author, date, and time.

Copy Forward

• Risk: Information from a previous note is carried into the current note, so the record may not reflect the current visit.

• CMS recommendation: Apply the same controls as copy and paste.

Cut and Paste

• Risk: Text is removed from its original location, altering the source record.

• CMS best practice: Do not allow it.

Populating via Default

• Risk: Content is generated automatically without the provider selecting or typing anything, such as a negative review of systems for every body system. This can lead to overdocumentation, documentation of services not performed, and upcoding.

• CMS recommendations: Avoid features that generate notes without provider action, require providers to review and edit defaulted data, delete irrelevant entries, add free text, and confirm the note matches the services provided.

Macros

• Risk: Short keystrokes expand into lengthy text, sometimes called "charting by exception," which can produce documentation for services not rendered.

• CMS recommendations: Require verification of macro-generated text, add free text, and limit which users can use macros.

Templates

• Risk: Predefined text and options can lead to upcoding, and templates that do not fit the clinical situation make accurate documentation difficult.

• CMS recommendations: Use open-ended templates that allow providers to add specific descriptions of the patient's condition, and require providers to modify templates to reflect the specific service and condition.

Automated Change of Note Author

• Risk: A note written by one person is attributed to another, making it impossible to verify who provided the service.

• CMS recommendations: Preserve the attribution of each entry, retain all signatures, and disable automatic author changes.

Audit Logs

• Risk: Turning off audit logs creates incomplete records and can hide alterations.

• CMS recommendations: Keep the audit log operational at all times, consistent with HIPAA Security Rule requirements, except for authorized maintenance.

Dictation and Voice-to-Text

• Risk: Unvalidated dictated or transcribed entries may not accurately support the services provided.

• CMS recommendations: Require providers to review, edit, and sign entries made on their behalf in a timely manner.

When Copying Is Acceptable

Not all reuse of information is a problem. Some information legitimately stays the same over time, such as past medical history, surgical history, family history, allergies, and stable chronic conditions. Reusing this information can be appropriate when:

• It is reviewed and confirmed as accurate at the current visit.

• It is clearly identified as historical information.

• It is not used to support the level of service for the current visit unless it was actually reviewed and relevant.

• The current note clearly documents what is new: the reason for the visit, the current findings, the provider's assessment, and the plan for this encounter.

The key question is whether the note, read on its own, accurately tells the story of this patient on this date.

How Auditors Spot Cloned Documentation

Reviewers often identify cloning by:

• Comparing notes across multiple dates of service for the same patient.

• Comparing notes across different patients seen by the same provider.

• Finding identical spelling errors, phrasing, or unusual wording in many notes.

• Noticing findings that contradict other parts of the record, such as a normal exam documented for a body part that was amputated or a symptom documented as present after it resolved.

• Seeing extensive review of systems and exam documentation that is unrelated to the presenting problem.

• Finding notes with the same time stamps or that appear to have been created in bulk.

• Reviewing EHR audit logs, when available, to see how and when entries were created.

How to Fix Your EHR Templates

Step 1: Inventory Your Templates

List all templates used across your organization, by specialty and service line. Identify which ones are used for high-volume or frequently audited services.

Step 2: Review Defaults

Identify fields that auto-populate without provider action, especially "normal" or "negative" defaults in review of systems and exam sections. Turn off defaults that generate content without provider input, or require active confirmation.

Step 3: Build in Required Free Text

Add required free-text fields for the elements that make each encounter unique, such as:

• Chief complaint and reason for the visit.

• Interval history since the last visit.

• Current, patient-specific findings.

• Assessment of each problem addressed.

• Medical decision making, including the provider's reasoning.

• Plan specific to this visit.

• For therapy, home health, and hospice, the patient's response to treatment and progress toward goals.

Step 4: Align Templates With Coverage Requirements

Make sure templates prompt for the elements required by applicable National Coverage Determinations, Local Coverage Determinations, and Medicare manuals. For example, home health templates should prompt for homebound status and skilled need, and therapy templates should prompt for progress toward goals.

Step 5: Label Copied and Historical Information

Configure the EHR to visually distinguish copied or carried-forward text, or to identify its source, author, and date.

Step 6: Restrict High-Risk Functions

Disable cut and paste where possible, restrict copy forward for exam and assessment sections, limit macros to approved content, and disable automatic changes of note author.

Step 7: Protect the Audit Log

Confirm that the audit log is always on and that only authorized administrators can change its settings.

Step 8: Test Templates With Real Scenarios

Before rolling out changes, test templates with sample cases to make sure they produce accurate, individualized notes.

Step 9: Involve Clinicians

Clinicians are more likely to use templates correctly when they help design them and understand why changes are needed.

Building a Copy-Paste Policy

A written policy helps set clear expectations. It should address:

• When copying or carrying forward information is permitted and when it is not.

• Requirements to review, update, and personalize any copied content.

• Attribution requirements for content copied from another author.

• Prohibition on copying from one patient's record to another patient's record.

• Prohibition on altering or backdating records.

• Use of defaults, macros, and templates.

• Responsibility for review and signature of entries made by scribes, residents, or voice-to-text tools.

• Audit log requirements.

• Monitoring, auditing, and consequences for noncompliance.

Training Clinicians and Staff

Effective training explains both the rules and the reasons behind them:

• Why each note must stand on its own.

• How reviewers evaluate medical necessity and level of service.

• What CMS says about templates, copy and paste, and defaults.

• How to document efficiently without cloning, such as using brief interval updates and focused exams.

• How to identify and correct inaccurate carried-forward information.

• Real examples of compliant and noncompliant notes.

Auditing for Cloned Documentation

Include cloning in your internal audit program:

• Select samples of notes for the same patient across several dates and compare them.

• Compare notes for different patients seen by the same provider on the same day.

• Look for identical text blocks, inaccurate carried-forward findings, and documentation unrelated to the presenting problem.

• Review audit logs for patterns, such as bulk note creation.

• Share findings with providers individually and provide targeted education.

• Track improvement over time.

What to Do If an Auditor Questions Cloned Documentation

If an ADR response or audit finding raises cloning concerns:

• Review the records carefully to determine whether each note reflects the actual encounter.

• Identify any patient-specific information that supports the service, such as vital signs, test results, medication changes, and clinician reasoning.

• Gather other records that corroborate the service, such as orders, test results, and nursing notes.

• Never alter or add to past notes to make them look less cloned. Amendments must follow Medicare rules and clearly show the date and author.

• Consider whether the issue affects other claims and whether there are overpayment obligations under the 60-day rule at 42 CFR 401.305.

• Fix the root cause in templates and workflows.

• Involve legal counsel if the concerns are serious or involve a UPIC or law enforcement.

Common Myths About Cloned Documentation

• "More documentation is always better." Volume does not support medical necessity or a higher level of service by itself.

• "Templates are prohibited." CMS does not prohibit templates, but it discourages templates with limited options that fail to capture patient-specific details.

• "Copying is fine if the patient's condition did not change." Even if the condition is stable, the note must reflect what was done and found at the current visit.

• "If the EHR allows it, it must be compliant." EHR features are tools. Providers are responsible for the accuracy of what they sign.

• "Auditors cannot tell." Reviewers routinely compare notes across dates and patients.

Frequently Asked Questions

Is copy and paste prohibited by Medicare?

There is no blanket prohibition, but CMS recommends policies that require copied content to be tailored to the specific patient and visit and clearly attributed. Notes must accurately reflect the services provided.

Does CMS prohibit templates?

No. CMS states that it does not prohibit templates, but it discourages templates with limited options or check boxes that do not allow detailed clinical information.

Can I carry forward past medical history?

Generally yes, if it is reviewed, updated as needed, and accurate. The current note must still document the specific encounter.

Why does an auditor care about EHR audit logs?

Audit logs show who created or changed entries and when. OIG recommended that CMS direct its contractors to use audit logs, and CMS's decision table recommends keeping the audit log operational at all times.

What is the biggest risk of default normal findings?

Defaults can create documentation of exams or review of systems that were not actually performed, which may lead to overdocumentation and upcoding concerns.

Conclusion

Copy-paste and cloned documentation are among the most common reasons auditors question Medicare claims. CMS and OIG have identified copy and paste, copy forward, default population, macros, templates, and automated author changes as program integrity risks when used inappropriately. The solution is not to abandon EHR efficiencies, but to use them responsibly: design templates that require patient-specific information, restrict high-risk functions, label copied content, protect audit logs, adopt a clear policy, train clinicians, and audit regularly. When every note tells the story of a specific patient on a specific date, documentation supports both quality care and compliant billing.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that helps providers assess EHR templates for cloning risk, develop copy-paste and documentation policies, train clinicians, audit records for cloned documentation, and respond to auditor findings. If you would like help strengthening your EHR documentation practices, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Ensuring Proper Use of Electronic Health Record Features and Capabilities: A Decision Table (June 2016). https://www.cms.gov/files/document/ehrdecisiontable062816pdf

• Centers for Medicare & Medicaid Services. Electronic Health Records Provider Fact Sheet. https://www.cms.gov/sites/default/files/repo-new/56/EHRProviderFS121115.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. CMS and Its Contractors Have Adopted Few Program Integrity Practices To Address Vulnerabilities in EHRs (OEI-01-11-00571, January 2014). https://oig.hhs.gov/reports/all/2014/cms-and-its-contractors-have-adopted-few-program-integrity-practices-to-address-vulnerabilities-in-ehrs/

• U.S. Department of Health and Human Services, Office of Inspector General. Not All Recommended Fraud Safeguards Have Been Implemented in Hospital EHR Technology (OEI-01-11-00570, December 2013). https://oig.hhs.gov/oei/reports/oei-01-11-00570.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3, Section 3.3.2.1.1, Progress Notes and Templates. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-08, Transmittal 455 (Progress Notes and Templates). https://www.cms.gov/regulations-and-guidance/guidance/transmittals/downloads/r455pi.pdf

• Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 12, Physicians/Nonphysician Practitioners. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/clm104c12.pdf

• Centers for Medicare & Medicaid Services. Complying with Medical Record Documentation Requirements (MLN909160, December 2024). https://www.hhs.gov/guidance/sites/default/files/hhs-guidance-documents/CMS/certmedrecdoc_factsheet_icn909160.pdf

• U.S. Department of Health and Human Services. HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/index.html

• U.S. Social Security Administration. Social Security Act, Section 1833, Payment of Benefits. https://www.ssa.gov/OP_Home/ssact/title18/1833.htm

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305