Seven months ago in this blog, FHAS predicted that the skin substitute boom would end the way Medicare booms usually end: an OIG data brief, payment reform, prior authorization, and possible legal action or indictments. It did. The next treatment area on the same arc toward Medicare payment correction is remote patient monitoring — and its correction has already begun. The comment period on Calendar Year (CY) 2027 Medicare Physician Fee Schedule Proposed Rule closed Sept. 14. Typically, CMS issues the final rule in early November with changes taking effect the following January 1.
What RPM is – and why it grew
Remote patient monitoring, or RPM, sends a patient home with a connected device – a blood pressure cuff, glucose meter, pulse oximeter, or scale – that transmits readings to the practice automatically. A clinician reviews the data and adjusts treatment between visits. Medicare pays for three pieces of the service: setting up the device and educating the patient; supplying the device, which requires at least 16 days of readings in a 30-day period; and treatment management, which requires at least 20 minutes of clinical staff time per month, including a live interaction with the patient. Done well, RPM keeps people with hypertension, diabetes, and heart failure out of the emergency department.
Medicare began paying for RPM in 2018, and its use accelerated during the pandemic. It also scales easily: a practice can enroll hundreds of patients, and a third-party vendor can supply the devices, handle the enrollment, and staff the monitoring in exchange for a share of the revenue. That model drove the growth. By 2024, according to the HHS Office of Inspector General, nearly one million Medicare enrollees were receiving RPM, payments had reached $536 million, up 31% in a single year, and more than 4,600 practices were billing for it routinely.https://oig.hhs.gov/documents/evaluation/10902/OEI-02-23-00261-highlights.pdf
Where it went wrong
The OIG’s first look at RPM, a September 2024 report covering claims from 2019 through 2022, found that about 43% of enrollees who received RPM did not receive all three components of the service, raising the question of whether anyone was acting on the data. The report also found that Medicare could not tell from claims what health data were being monitored or who had ordered the device, and it recommended stronger oversight.
The OIG’s August 2025 follow-up, using 2024 claims, turned that concern into a set of measures. It identified five billing patterns that signal risk: monthly spikes in new enrollees of 150% or more; a high share of enrollees with no prior relationship to the practice; enrollees for whom treatment management is never billed; enrollees billed by multiple practices at once; and multiple devices billed for the same patient in a month. Each points to vendor-driven enrollment rather than physician-driven care. By then, enforcement had already begun: in June 2025, the Justice Department announced a False Claims Act settlement with an RPM company over monitoring billed without devices capable of transmitting data.
What CMS proposed
The CY 2027 Physician Fee Schedule proposed rule goes directly at the vendor model. Monitoring would have to be furnished by direct employees of the billing practitioner or practice. An initiating visit would be required before monitoring begins, extending the established-patient rule to remote therapeutic monitoring as well. Payment for device and setup codes would fall, and CMS asked for comment on collapsing 17 codes into four. The staffing restriction drew heavy objections and could be softened, but the direction is not in doubt: CMS has described what legitimate RPM looks like, and reviewers on both sides of the claim will treat that as the standard.
The scorecard
Scored against the five signals that define this FHAS “correction” series, RPM checks at least four.
| Signal | RPM | Evidence |
| Steep Part B spending curve | Yes | 31% growth in 2024; nearly one million beneficiaries |
| Per-unit prices disconnected from cost | Yes | CMS proposes to cut device and setup codes as overvalued |
| Thin clinical evidence for expanding indications | Partial | Evidence supports monitoring for defined conditions; expansion outran it |
| Marketer- or vendor-driven ordering | Yes | The proposed direct-employment rule targets this directly |
| OIG data brief | Yes | Two OIG reports since 2024, plus a set of standardized audit measures |
What providers should do differently
Stop treating RPM as a vendor program and start treating it as a clinical service the practice owns. That means the physician decides who is enrolled and why, and the chart shows it: a diagnosis that monitoring will change, an initiating visit, and a documented care plan. Log the 16 days of readings and the 20 minutes of management time every month, and record what was done with the data – a medication change, a call, or a visit. Audit the roster: patients who were enrolled without ever being seen, who stopped transmitting months ago, or who are being monitored by two practices at once should be discharged before an auditor finds them. And if a vendor is doing the work today, plan now for how it gets done Jan. 1, because auditors will work backward through 2024 and 2025 claims using the same patterns regardless of what the final rule says.
What payers should do differently
Most plans, Medicare Advantage and commercial alike, have paid RPM claims on the codes alone. The OIG’s five patterns are ready-made medical review criteria and can be applied now: flag practices whose RPM enrollment jumps sharply month over month, require evidence of a prior encounter before the first monitoring claim, look for device codes that run for months without a management code, and question multiple devices or multiple billing providers for one patient. Prior authorization, where a plan uses it, should ask for the diagnosis and the care plan rather than a device order. And when a claim is denied and appealed, the determination should rest on documented clinical criteria applied consistently – the standard regulators are now holding plans to as closely as they hold providers.
The bottom line
For providers: The documentation you build now defends the claims you have already submitted.
For payers: RPM can be reviewed against the OIG’s risk patterns today, without waiting for CMS. An independent reviewer applying consistent, evidence-based criteria produces determinations that hold up on appeal and in audit.
Skin substitutes took two years to travel from OIG brief to indictment. RPM is on the same road, moving faster.
Legal Disclaimer
The information contained in this content piece is for general informational purposes only. While we strive to ensure the accuracy and completeness of the information presented, we make no representations or warranties of any kind, express or implied, about the accuracy, reliability, suitability, or availability with respect to the content or the information, products, services, or related graphics contained in the content piece for any purpose. Any reliance you place on such information is therefore strictly at your own risk. The content of this page is subject to change without notice. The information provided in this document does not constitute legal or other professional advice, and is non-binding upon FHAS and any federal government agencies.
