RPM Compliance: Frequently Asked Questions

Last updated: April 2026

Direct answers to the questions practitioners, compliance officers, and digital health leaders ask most about Remote Patient Monitoring billing, OIG enforcement, and the 2026 CPT code changes.

Definitions and Basics

What is Remote Patient Monitoring (RPM) under Medicare?

Remote Patient Monitoring (RPM) under Medicare is the collection and interpretation of physiologic data generated by a patient in their home or another location outside of a clinical setting. CMS requires that the data be generated by an FDA-cleared medical device capable of automatic electronic transmission — manual patient entry of data into an app does not qualify.

RPM is billed under the Medicare Physician Fee Schedule using CPT codes 99453, 99454 (or 99445 for shorter transmission periods), 99457, 99458, and 99470 (new in 2026). A physician, nurse practitioner, or physician assistant must order the monitoring, and the practice must have a prior established medical relationship with the patient for Medicare billing.

What is the difference between RPM and Remote Therapeutic Monitoring (RTM)?

RPM captures physiologic data — vital signs, blood pressure, blood glucose, weight, oxygen saturation — using FDA-cleared medical devices with automated data transmission. RTM captures non-physiologic data — medication adherence, therapy compliance, pain levels, and respiratory system status — and is billed under a separate CPT code set (98975-98981).

Key differences:

  • RPM requires a physician or qualified healthcare professional to order and supervise; RTM permits physical therapists, occupational therapists, and speech-language pathologists to bill independently.
  • RPM devices must meet FDA medical device standards and auto-transmit data; RTM devices have lower technical requirements.
  • Both can be billed in the same calendar month for the same patient if they monitor different conditions and the time is not double-counted.

See our RPM vs. RTM vs. CCM comparison for a full side-by-side analysis.

What types of devices qualify for RPM under CMS?

Qualifying RPM devices must meet the FDA's definition of a medical device or Software as a Medical Device (SaMD) and must automatically and electronically transmit physiologic data without patient manual input. Common qualifying device categories:

  • Blood pressure monitors with cellular or Bluetooth auto-transmission
  • Continuous glucose monitors (CGMs)
  • Pulse oximeters
  • Cardiac monitors and ECG patches
  • Weight scales with automatic data upload
  • Spirometers

Consumer wellness devices — including most fitness trackers and smartwatches — do not qualify unless they carry FDA medical device clearance and support automatic data transmission. The practice must document the device's FDA clearance status in the medical record.

CPT Codes and Billing

What CPT codes are used for RPM billing in 2025 and 2026?

The complete RPM CPT code set as of 2026:

  • CPT 99453 — Initial setup and patient education on device use. One-time, billed once per patient per device. 2025 rate: $19.73.
  • CPT 99454 — Device supply and daily recording for 16 to 30 days in a 30-day period. Monthly. Mutually exclusive with 99445. 2025 rate: $43.02.
  • CPT 99445 — New in 2026. Device supply and daily recording for 2 to 15 days in a 30-day period. Monthly. Mutually exclusive with 99454.
  • CPT 99457 — First 20 minutes of treatment management per calendar month with at least one real-time interactive communication. Mutually exclusive with 99470. 2025 rate: $47.87.
  • CPT 99458 — Each additional 20 minutes of treatment management per calendar month. Add-on to 99457.
  • CPT 99470 — New in 2026. Treatment management for first 10 minutes with at least one real-time interactive communication. Mutually exclusive with 99457.
  • CPT 99091 — Collection and interpretation of physiologic data by a physician or qualified healthcare professional. Less frequently used in current practice.

For complete 2026 rates and documentation requirements, see our RPM Billing Guide.

What are the Medicare reimbursement rates for RPM CPT codes in 2025?

2025 Medicare reimbursement rates (national average, non-facility setting):

  • CPT 99453: $19.73 (one-time setup fee)
  • CPT 99454: $43.02 per month (16-30 day transmission)
  • CPT 99457: $47.87 per month (first 20 minutes treatment management)

Source: CMS Telehealth and Remote Monitoring MLN, December 2025. The 2026 MPFS introduced reimbursement for new codes 99445 and 99470; specific 2026 rates vary by locality and should be confirmed against the current CMS fee schedule.

What new RPM CPT codes were introduced in the 2026 CMS Physician Fee Schedule?

The 2026 CMS Physician Fee Schedule Final Rule (effective January 1, 2026) introduced two new RPM codes:

CPT 99445 covers device supply and daily recording for 2 to 15 days in a 30-day period. It is mutually exclusive with CPT 99454. This code addresses the "compliance cliff" where patients transmitting fewer than 16 days generated zero reimbursement — a situation that was pressuring practices to either forgo revenue or misrepresent transmission days.

CPT 99470 covers treatment management for the first 10 minutes in a calendar month with at least one real-time interactive communication. It is mutually exclusive with CPT 99457 and enables billing for patients where meaningful clinical management occurs in under 20 minutes.

Both codes require EHR billing logic and clinical workflow reconstruction. Practices that have not updated their systems for these codes by Q1 2026 are generating CPT coding errors on current claims.

How is the 20-minute interactive communication requirement met under CPT 99457?

CPT 99457 requires a minimum of 20 minutes of treatment management services per calendar month, including at least one real-time interactive communication between the patient and clinical staff. "Real-time interactive" means telephone or video — asynchronous messages and portal communications do not qualify.

Documentation must include: start time, stop time, nature of the interaction, and clinical content reviewed. Automated alert review by staff without patient contact does not count toward the 20-minute threshold. Time accumulates across multiple interactions in the month.

CPT 99470 (new in 2026) covers the same service structure for the first 10 minutes, enabling billing for practices where average patient interactions are less than 20 minutes.

Can only one provider bill RPM per patient per 30-day period?

Yes. CMS permits only one provider or practice to bill RPM treatment management and device supply codes for a given patient in a given calendar month. Overlapping provider billing — multiple practices billing RPM for the same Medicare beneficiary in the same month — is one of the OIG's five high-risk audit warning flags.

Multi-specialty practices and health systems must have documented protocols establishing which provider is the designated RPM billing provider for each patient. This must be documented in the patient record and reviewed at enrollment.

Are there prior authorization requirements for RPM services?

Medicare does not require prior authorization for RPM services. However, commercial payers and state Medicaid programs frequently impose prior authorization requirements that vary significantly by payer and state. Some commercial payers require diagnosis-specific authorization; some Medicaid programs require separate authorization for device procurement.

IHS recommends verifying prior authorization requirements for each payer in your mix before deploying devices and establishing a payer-specific authorization tracking workflow as part of your RPM program infrastructure.

OIG Enforcement and Risk

What are the OIG's top RPM billing red flags from its 2025 audit report?

The OIG's August 2025 Data Snapshot (OEI-02-23-00261) identified five high-risk billing patterns driving audit targeting:

  1. Missing required care components — 43% of audited enrollees lacked at least one of: setup claim (99453), data transmission claim (99454/99445), or treatment management claim (99457/99470). Any missing component invalidates the episode of care.
  2. Enrollment spikes — Abrupt, disproportionate surges of 150%+ month-over-month are flagged by OIG automated analysis as fraud indicators.
  3. Lack of prior medical relationship — 45 practices billed RPM for more than 80% of patients with no documented clinical history with the billing provider.
  4. Inadequate time documentation — Weak audit trails failing to prove 20 minutes of interactive clinical time occurred for CPT 99457 billing.
  5. Concurrent device billing — Multiple monitoring devices billed for the same patient in a single 30-day period.

Practices matching two or more of these patterns are at significantly elevated audit risk.

What was the first False Claims Act settlement involving RPM billing?

In June 2025, Health Wealth Safe, Inc. and Dr. Subodh Agrawal agreed to pay $1.29 million to resolve False Claims Act allegations in the Northern District of Georgia. The allegations centered on billing Medicare for RPM services without medical necessity and using unapproved devices that did not meet FDA medical device standards.

This settlement confirmed OIG's shift from observation to active enforcement. The OIG subsequently added RPM to its Work Plan in August 2025 and published the Data Snapshot identifying high-risk practices. Source: Benesch Law analysis of DOJ press release and OIG OEI-02-23-00261.

What constitutes a prior medical relationship for RPM billing purposes?

A prior medical relationship requires that the ordering provider has previously evaluated and treated the patient — not merely that the patient is listed on the practice's panel. Documentation must be in the medical record and retrievable on audit. CMS has not published a bright-line definition, but OIG audit findings indicate that documented clinical encounters, active medication management, or chronic disease management visits within the past 12 months constitute an established relationship.

Telephone or video triage encounters alone are insufficient. The OIG found 45 practices billing RPM for more than 80% of patients with no documented prior relationship — a pattern consistent with mass-enrollment schemes using purchased patient lists.

Eligibility and Consent

Which providers can bill for RPM?

RPM services can be ordered and billed by physicians, nurse practitioners (NPs), and physician assistants (PAs) under Medicare. Clinical staff — registered nurses, medical assistants, health coaches — can perform monitoring and treatment management activities under direct supervision and bill incident-to, but the supervising provider must be immediately available.

Under URAC RPM Accreditation v1.0, all delegated personnel must have credentialing records verified and on file. As of 2026, FQHCs and Rural Health Clinics are newly eligible to bill RPM codes independently.

Is patient consent required for RPM and what must the consent cover?

Yes. CMS requires documented patient consent prior to initiating RPM services. URAC RPM Accreditation v1.0 makes consent documentation a mandatory standard. Consent must cover:

  • The nature of the RPM service and what data will be collected
  • How data will be transmitted and stored
  • Who will have access to the data
  • The patient's right to withdraw consent at any time
  • Any costs the patient may incur (including device costs and copays)
  • Identity verification procedures

Consent must be documented in the medical record before the first device is deployed. Missing consent is one of the top 10 deficiencies IHS identifies in RPM program audits and renders subsequent services unbillable for those patients.

What data must be automatically uploaded vs. manually entered for RPM?

CMS requires automatic electronic data transmission — manual patient entry of data into an app or portal does not qualify as RPM data for billing purposes. The device must auto-transmit without patient intervention beyond normal device use.

This is one of the most common compliance errors IHS identifies: practices using consumer wellness apps rather than FDA-cleared devices with cellular or Bluetooth auto-transmission, then billing RPM codes for manually entered data. This constitutes billing for services not rendered and creates False Claims Act exposure.

Operational Requirements

What staffing ratio is safe for RPM clinical monitoring?

The maximum safe RPM clinical monitoring ratio is 120 active patients per 1 Clinical Support FTE. At 135:1, compliance risk escalates exponentially. At 150:1, average alert response times increase from approximately 15 minutes to 45 minutes — a 3x degradation that creates both patient safety risk and the documentation deficiencies that OIG flags as the top billing deficiency.

IHS assesses current staffing ratios as part of every RPM gap assessment and builds proportional staffing recommendations into the remediation roadmap.

What HIPAA and cybersecurity requirements apply to RPM?

RPM programs transmit protected health information (PHI) and are subject to full HIPAA Security Rule requirements:

  • Business Associate Agreements (BAAs) with every RPM platform vendor, device manufacturer, and software company that handles PHI
  • Data encryption in transit and at rest
  • Audit controls on who accesses patient biometric data
  • Breach notification procedures for device loss, theft, or unauthorized access
  • Device disposal protocols including data wiping for redeployed devices

URAC RPM Accreditation v1.0 includes a dedicated Technology module with explicit cybersecurity standards beyond the HIPAA baseline.

What is the ROI for an RPM program at a typical medical practice?

At 2025 Medicare rates, a patient enrolled in RPM who transmits 16+ days per month and receives 20 minutes of treatment management generates approximately $110.62 per month in Medicare reimbursement: 99454 ($43.02) + 99457 ($47.87) + 99453 ($19.73 one-time setup prorated). For a practice managing 100 active RPM patients, that represents approximately $10,000 per month or $120,000 per year in recurring revenue — before the 2026 code changes that add billing pathways for patients transmitting fewer than 16 days (99445) and shorter clinical interactions (99470).

IHS includes an ROI analysis based on your specific patient population and payer contracts in every gap assessment deliverable.

Accreditation and State Rules

What is URAC RPM Accreditation and who should pursue it?

URAC RPM Accreditation v1.0 is a voluntary third-party quality credential on a 3-year cycle with approximately 45 requirements across seven modules: Mandatory, Business, Professional Oversight, Quality/Patient Safety, Clinical Workflows, Technology, and Risk Management.

Organizations that should pursue URAC RPM Accreditation:

  • Hospital systems and health systems seeking enterprise payer contracting advantages
  • Digital health vendors differentiating in a crowded market
  • FQHCs and RHCs building new programs who want a structured compliance framework from the start
  • Any organization seeking independent third-party validation of its compliance posture ahead of OIG audit risk

IHS has over 25 years of URAC accreditation experience and applies that expertise directly to URAC RPM v1.0 preparation.

What are the state-level RPM regulations that differ from Medicare requirements?

Over 42 state Medicaid programs reimburse RPM with dramatically varied requirements. Key state-specific variations:

  • New York: Covers RPM for CHF, diabetes, COPD, and maternal health up to 84 days postpartum — specific diagnosis codes required for each condition
  • North Carolina: Established patient requirement (stricter than CMS baseline), 48-hour documentation rule for data review, prohibits same-day E/M billing with RPM treatment management
  • Florida: CGM data processed as Medicaid pharmacy benefit, not medical benefit — different billing pathway required
  • Arkansas: Expanded Medicaid RPM for maternal health effective July 1, 2025
  • South Dakota: Permanent post-pandemic RPM Medicaid coverage codified

IHS provides state-specific compliance overlays for organizations billing in multiple states. Contact us to discuss your specific state footprint.

Can RPM be billed at the same time as Chronic Care Management (CCM)?

Yes — RPM and CCM (CPT 99490-99491) can be billed concurrently for the same patient in the same calendar month, but the time spent on each service must be separately documented and cannot overlap. Counting the same staff time toward both the RPM treatment management threshold and the CCM care coordination threshold is a double-billing error that constitutes a false claim.

IHS recommends time-tracking software that logs RPM management time separately from CCM coordination time in the EHR, with supervisor review of monthly billing prior to claim submission. See our RPM vs. RTM vs. CCM comparison for the full concurrent billing analysis.

Questions Not Covered Here?

RPM compliance has program-specific nuances that a general FAQ cannot fully address. IHS conducts RPM gap assessments and answers program-specific compliance questions through our consulting engagements.

Request a Gap Assessment 2026 Billing Code Guide RPM Compliance Services