Recent Medicare legislation seeks to improve patient care quality by financially penalizing providers for hospital-acquired infections (HAIs). However, Medicare cannot directly monitor HAI rates and instead relies on providers accurately self-reporting HAIs in claims to correctly assess penalties. Consequently, the incentives for providers to improve service quality may disappear if providers upcode, i.e., misreport HAIs (possibly unintentionally) in a manner that increases reimbursement or avoids financial penalties. Identifying upcoding in claims data is challenging because of unobservable confounders (e.g., patient risk). We leverage state-level variations in adverse event reporting regulations and instrumental variables to discover contradictions in HAI and present-on-admission (POA) infection reporting rates that are strongly suggestive of upcoding. We conservatively estimate that 10,000 out of 60,000 annual reimbursed claims for POA infections (18.5%) were upcoded HAIs, costing Medicare 200 million. Our findings suggest that self-reported quality metrics are unreliable and, thus, that recent legislation may result in unintended consequences.