What Are the Current RPM Medicare Billing Requirements—and How Could the 2027 Proposed Rule Change Remote Patient Monitoring?

The Short Answer: What Medicare Requires for RPM Billing

As of September 24, 2026, Medicare generally pays for remote patient monitoring, or RPM, when a practitioner satisfies the requirements for one of the established RPM codes: 99453, 99454, 99457, and 99458. The service must involve the remote transmission of physiologic data, such as blood pressure, glucose, oxygen saturation, respiratory rate, or heart rate, and it must be connected to an interactive communication with the patient. RPM is not a simple equipment fee: Medicare also requires clinical staff to provide at least one real-time, non-face-to-face discussion with the patient during the relevant billing period, unless the established medical necessity standard for a telephone-only service is met. The monitoring must relate to an already established clinician-patient relationship and be medically reasonable, and the required data must be collected and documented rather than generated solely for billing purposes. The 2027 Physician Fee Schedule is still subject to change, so proposed restrictions should not be treated as current law.

Also worth reading: What Are the Proposed 2027 RPM Billing Changes Every Clinic Should Review Before January 1? · How Can Medicare Prior Authorization Analytics Reduce Denials in Post-Acute Care? · How Should Clinics Plan an RPM Program for CY 2027 Medicare Changes?

For CY2026, a common billing pattern is to bill the initial setup and training once per patient, 99454 when the practitioner meets the remote data collection requirement, and treatment or management services under 99457 and, when appropriate, 99458. Medicare does not require RPM to be performed in a particular geographic location, and beneficiaries generally may be located in their homes. However, the service must meet all applicable documentation, supervision, technology, and communication requirements. Equipment and supply costs are ordinarily treated as part of the practice’s operating costs rather than billed separately under the standard RPM framework. Because the payment environment is changing, clinics should verify the current CMS manual, fee schedule, local coverage policies, and any final CY2027 rule before redesigning their operating model.

RPM and RTM Are Related but Not Interchangeable

Remote therapeutic monitoring, or RTM, is a separate Medicare framework designed for a physician or eligible practitioner’s treatment plan using digital communication and monitoring technologies. RPM is primarily oriented toward physiologic data collection and clinical management of a patient’s condition, while RTM addresses a defined course of treatment, such as respiratory illness, diabetes, or rehabilitation. Both can involve devices, data platforms, and clinical review, but one service cannot automatically be billed merely because it looks like the other. Clinicians must select the code set whose definitions, treatment context, consent requirements, communication standards, and documentation actually match what was delivered. Billing RPM simply because a vendor markets a remote-monitoring program is not a defensible interpretation of Medicare policy.

The proposed CY2027 changes discussed in industry coverage are particularly important for organizations that use third-party technology vendors or clinical partners. CMS has proposed restrictions on arrangements in which an outside party supplies both the technology and the clinical services used to satisfy RPM or RTM requirements. The proposal is associated with requirements intended to establish a more direct connection between the supervising practitioner and the patient, as well as stronger controls over who performs or supervises monitored services. The proposal has also raised questions about synchronous communications, the allowable time for providing services after a notification, and how Medicare treats contracted clinical support. These are proposed changes, not settled requirements, and operational decisions should wait for the final rule and CMS clarifications.

## How RPM Billing Works in the Current Framework

RPM has several distinct components, and each component answers a different Medicare question. Code 99454 covers remote physiologic data collection, transmission, and storage at least every 30 days, subject to the more specific 16-day data-collection requirement. Code 99457 covers clinical staff interpretation, physician or practitioner review, and treatment management during a 30-day period, provided at least one interactive communication occurs with the patient. Code 99458 covers additional treatment management time when the clinical record supports a higher level of work, but it is not justified merely by generating extra alerts. Code 99453 covers initial device supply, programming, data transmission, instruction, and related setup, generally once per beneficiary. The codes should be used only when their individual definitions and the applicable frequency limits are met.

Medicare’s established RPM framework has generally required a device capable of recording and transmitting physiologic data and must be capable of calculating and displaying the information for review by the practitioner and patient. The information must be analyzed and used to manage the patient’s condition, not merely stored. A continuous glucose monitor, a connected blood-pressure cuff, and a scale that reports weight are examples of technologies that may fit the physiologic-data model; a wearable that only forwards marketing information or an app without a clinically defined monitoring function may not. The practitioner must document the condition being managed, the purpose of the monitoring, the data reviewed, the clinical decision, and the communication with the patient. Documentation should explain why the service was reasonable and how it avoided or reduced an in-person visit when that is relevant to the claim.

Payment is not a single all-inclusive price, and the fee depends on the code, date of service, setting, and applicable payment rules. For orientation, the established CY2026 Medicare physician fee schedule placed 99453 at approximately $20, 99454 at approximately $67, 99457 at approximately $55, and 99458 at approximately $42 before any site-of-service or other applicable adjustment. A clinic should check the current CMS fee schedule for exact amounts, because annual conversions and payment limits can change. RPM services are generally paid separately from an office or hospital visit only when the requirements for both services are met, and bundling rules can apply. Cost also includes software, devices, training, connectivity, staff time, interpretation, documentation, and compliance controls. A vendor’s monthly subscription is not the same as Medicare reimbursement or profit.

How the CY2027 Proposed Rule Could Change Third-Party RPM and RTM

The proposed CY2027 Physician Fee Schedule is not a simple fee increase or decrease. Coverage descriptions cited in legal and industry analysis point to proposed changes affecting how third-party vendors may support RPM and RTM, including who may provide the monitored service, how the supervising practitioner interacts with the patient, and whether an outside organization can perform the work that establishes the code. The direction of the proposal is important for hospitals, physician groups, digital-health companies, home-health organizations, and independent practices that have built delivery models around outsourced RPM programs. A clinic that purchases software is not necessarily affected in the same way as a clinic that delegates clinical interpretation, patient communication, or treatment management to a separate organization. The distinction between technology-as-a-service and clinical-service delivery is central.

The proposal has also drawn attention to communication timing and the treatment period. Existing RPM rules have allowed a real-time, non-face-to-face discussion with the patient to occur at least once during the 30-day period in appropriate circumstances. Proposed language has been described as potentially narrowing when communication must occur and requiring the communication to be more directly connected to the practitioner’s clinical oversight. For RTM, CMS has discussed changes to the treatment-plan and communication framework rather than simply extending the existing RPM rules. These proposed requirements could create operational changes even if the final text is modified. Clinics should therefore treat the proposal as a planning scenario: model staffing, vendor contracts, data flows, consent processes, and patient communications without assuming that every proposed provision will survive unchanged in the final rule.

The compliance implication is especially serious for arrangements in which a third party has access to identifiable health information. Business associate agreements, HIPAA safeguards, cybersecurity controls, role-based access, audit logs, incident response, and vendor oversight remain relevant regardless of whether CMS later changes the billing rules. If a vendor performs clinical services, the parties should document who interpreted data, who contacted the patient, which practitioner reviewed the information, and how the practitioner fulfilled any applicable oversight requirement. A contract cannot repair a claim that lacks medical necessity or required clinician involvement. In addition, a proposed rule may affect future revenue, but it does not automatically authorize repayment of previously paid claims under rules that were valid at the time. Organizations should distinguish prospective planning from retrospective compliance review.

What Care-Coordination Teams Should Verify Before Acting

The first practical step is to identify the exact service being delivered. Teams should separate technology procurement, data transmission, clinical review, patient outreach, treatment management, and documentation instead of treating the entire program as one vendor product. They should then map each activity to the applicable code definition and Medicare manual guidance. A useful review includes a sample claim, the signed consent or authorization record, the enrollment and initiation documentation, device specifications, transmitted data, the clinician’s review, the interactive communication, and the treatment-management note. Reviewers should also check whether the patient was eligible for RPM on the date of service and whether the code was billed at the appropriate frequency. The sample should be understandable without relying on the vendor’s marketing materials.

The second step is to examine staffing and supervision. A practice should know whether internal clinical staff, an affiliated professional group, an independent contractor, or a technology company performs the monitoring and communication work. The organization should identify the practitioner who is responsible for the patient’s care and document that responsibility. Under current rules, auxiliary personnel may perform many activities under appropriate clinical supervision and direction, but proposed CY2027 language could narrow how third parties provide the service. Care-coordination leaders should ask vendors for their legal basis, staffing model, escalation path, practitioner-review process, and audit reports. They should not accept a statement that the platform is “CMS approved” as evidence that a particular claim is billable. Medicare certification of a device, health-plan coverage, and payment under a particular CPT code are different questions.

The third step is to prepare a future state that does not depend on one reimbursement assumption. Practices can preserve the ability to deliver the service through a compliant software platform, internal clinical staffing, or a clearly governed care partner, provided each arrangement meets the rules in force when the claim is submitted. They should review contracts for termination rights, data ownership, service-level commitments, breach notification, subcontractor restrictions, reimbursement assumptions, and the return of records after termination. Patient communication scripts should be tested so that they support meaningful clinical discussion rather than automatic message delivery. These actions take time, so a clinic should not wait until a final rule is published or an audit begins to identify the affected workflows.

Common Billing Mistakes and Operational Weaknesses

One common mistake is billing RPM for every month in which a device transmits data, even though the data has not been clinically reviewed or used to manage a patient. Another is assuming that patient consent, enrollment, and data collection automatically satisfy the treatment-management code. A second mistake is using 99458 without showing that the additional work was medically reasonable and exceeded the requirements of 99457. Practices also sometimes count alerts as clinical discussion, submit claims for the same service under both RPM and RTM, or use RTM codes for routine physiologic monitoring that fits the RPM framework. These errors can result in denials, repayments, audits, and credibility problems with payers.

Technology creates another category of risk. A dashboard may display data, but the underlying device must meet the applicable technical definition, and the program must collect data at the frequency required by the code. Software cannot manufacture a qualifying communication or retrospective documentation. A clinic that permits a vendor to make autonomous clinical decisions without appropriate oversight may be unable to demonstrate that the billed work was performed. Small practices are not immune: a concise staffing model is not the same as an absent staffing model. A clinic should maintain records showing the date, time, participants, substance of the communication, clinical decision, and practitioner responsibility. It should also avoid overstating the clinical value of a remote program when the evidence supports only limited surveillance or no material treatment change.

The final common error is treating a proposed rule as final or ignoring it until the effective date. CMS may change proposed provisions, and final implementation guidance can contain operational details that affect revenue and workflow. However, a proposal can still reveal where the agency is concerned about third-party control, patient access, and utilization. Organizations that wait for the final text without evaluating their dependencies may have little time to renegotiate contracts or recruit staff. Those that immediately dismantle a working program may overreact. The better approach is a documented impact assessment, legal review, payer-specific modeling, and a staged implementation plan.

RPM Billing Compared With RTM and Alternative Delivery Models

RPM is one of several ways a care network can support patients between visits. RTM may be more appropriate when the intervention is a defined treatment program and the measurable outcome is treatment adherence, symptom change, or response to a prescribed course of therapy. Chronic care management, office visits, home-health services, and disease-specific remote monitoring may also be appropriate depending on the patient, condition, and payer contract. These services should not be treated as interchangeable revenue sources. A patient may receive more than one service over time, but each service needs its own medical rationale, documentation, and coding support. A care network should select the model based on clinical need rather than the highest expected reimbursement per patient.

The operational burden also differs. RPM generally emphasizes reliable device data, review, alert management, communication, and documentation. RTM can require a defined treatment plan, patient engagement, progress measurement, and periodic reassessment. A vendor-led service may reduce the need to build software, but it can increase contractual, privacy, and oversight dependencies. Internal staffing gives the practice greater control over the clinical workflow but may be more expensive and harder to scale. A hybrid arrangement can work when the technology vendor is limited to functions that do not displace required clinical services and when the practitioner’s role is visible in the record. Cost comparison should include labor, technology, training, compliance, denial rates, and the value of avoided visits—not only a subscription price.

## When to Act and What the Next 60–180 Days Should Accomplish

Organizations should not wait until January 1, 2027 to determine whether they are exposed. Within the next 60 days, they can inventory RPM and RTM programs by location, clinician, vendor, patient population, and code family. They can identify third parties that provide more than software, distinguish internal staff from contracted clinical personnel, and collect a sample of claims and supporting records. They can also obtain written confirmation of the current CY2026 requirements and monitor the CY2027 proposed and final rulemaking. Legal and compliance teams should review vendor contracts and privacy obligations alongside the coding assessment. This work may reveal that the largest risk is not the proposed payment rate but an unclear relationship between the practitioner and the company delivering the service.

Over the next 90 to 180 days, the organization can build a compliant operating model and model several financial scenarios. A base case should use current payment rules, while an alternative case should test a more restrictive third-party model, higher staff costs, and lower utilization. The review should calculate the contribution margin per service, not just gross reimbursement. It should also account for patient attrition, device failure, alert volume, staffing shortages, denials, and the cost of documentation. Care networks should define who owns the patient relationship, who may communicate clinical information, who can access the data, and what happens if a vendor exits or is unable to deliver the service. A decision made before these questions are answered is usually a guess dressed as a strategy.

The most defensible posture for September 2026 is informed caution. Continue delivering RPM when it is clinically appropriate and meets the requirements in force for the date of service, but document the work carefully and avoid assuming that every current third-party arrangement will remain unchanged. Do not treat a vendor’s claim of eligibility, a high projected return on investment, or a proposed-rule summary as billing advice. Reassess the program after CMS publishes the final CY2027 Physician Fee Schedule and after any applicable CMS instructions, national coverage determinations, or local policies are updated. For organizations such as care-coordination and patient-pulse technology providers, the opportunity is to make clinical accountability, auditability, and patient communication visible rather than hiding them behind a software interface. That approach is less dramatic than a full operational change, but it is much more likely to withstand payer review and future policy changes.