What Are the Proposed 2027 RPM Billing Changes Every Clinic Should Review Before January 1?

The Short Answer for RPM Billing Compliance 2027

For RPM billing compliance in 2027, clinics should treat the proposed Medicare changes as a design review rather than a simple coding update. The central issue is not whether remote patient monitoring remains billable; it is whether the billing arrangement, enrollment, consent, documentation, and vendor relationships still fit the way CMS pays for the service. The CY 2027 Physician Fee Schedule proposed rule, released by CMS in 2026, prompted law-firm and industry alerts because it would change how third-party RPM and remote therapeutic monitoring arrangements are treated. Those alerts should be treated as risk notices, not as final regulations. A clinic should confirm the current Medicare manual language, the final rule, contractor instructions, and payer-specific rules before changing claims or contracts.

Also worth reading: What Changes Should Clinics Prepare For in RPM Billing Compliance for 2026? · How is care coordination billing automation reshaping clinic revenue in 2027? · How Should a Clinic Run an RPM Vendor Security Review in 2026?

The dates matter. As of September 25, 2026, the CY 2027 rule is still part of the proposed-rule process unless a final rule has been published. The final rule normally becomes part of the Medicare program for the calendar year beginning January 1, but a proposed rule can be modified or withdrawn. A clinic that waits until December 31 to ask basic questions may not have enough time to amend consent forms, vendor agreements, staffing workflows, or revenue-cycle controls. A clinic that assumes every proposed change will become final may also overcorrect and disrupt a service that remains reimbursable.

RPM is broadly the collection and transmission of physiologic data, such as blood pressure, glucose, heart rate, oxygen saturation, or weight, under a physician-directed treatment plan. RTM is related but different: it generally involves a connected device or system that measures a patient's therapeutic response, such as a medication adherence device or a digital behavioral program. The distinction affects device requirements, time thresholds, codes, and operational controls. A platform may support both services, but one dashboard does not prove that both codes are appropriate.

What Is Actually Known About the CY 2027 Proposal

CMS published a proposed CY 2027 Physician Fee Schedule rule, and multiple legal and industry analyses described proposed changes affecting third-party RPM and RTM arrangements. The analyses also connected those proposals to heightened attention from the Office of Inspector General and concerns about how vendors, enrollment, and billed services are documented. The exact mechanics need to be read in the rule text rather than summarized from headlines. In particular, a phrase such as “vendor oversight,” “enrollment,” or “anti-markup” can mean several different requirements depending on the service, payer, and delivery model.

The safest factual position is therefore conditional. If CMS adopts a requirement that ties payment to a clinician’s direct oversight, a clinic must show that its clinicians actually review incoming data, respond when thresholds are crossed, and document the work performed. If the proposal changes how a third-party entity must enroll or be identified, the clinic must be able to connect the vendor record to the Medicare record. If it changes consent or time-tracking requirements, the clinic must preserve evidence of both. A clinic should not advertise a proposed requirement as already mandatory, and a vendor should not promise that its software automatically makes a claim compliant.

The proposal is also related to a broader enforcement environment. OIG scrutiny does not automatically mean that a particular clinic has violated Medicare rules, and scrutiny can be selective. However, it raises the value of a clean audit trail. Records should show why the patient needed monitoring, what device collected the data, who interpreted it, how much time was spent, and what happened next. The more a billing model depends on third parties, the more important it is for the clinic to own the medical justification and the claim decision.

## Why Third-Party RPM Arrangements Are the Main Risk Area

RPM billing is vulnerable to a structural mismatch between the legal provider, the enrolled entity, the vendor, and the staff member who performs work. A device company can collect data without being the entity that bills Medicare. A clinic can supervise a program while a separate company supplies software and technicians. A health plan or network can contract with one organization while care is delivered by another. Those arrangements are not inherently improper, but each role must be defined and documented.

The 2027 proposal should prompt clinics to ask whether the party receiving payment is the party that owns the clinical service, and whether a vendor is performing work that must be identified or reported separately. The questions are more precise than asking whether a vendor is “Medicare approved.” There is not one generic vendor approval that makes every remote-monitoring arrangement billable. Device status, coding rules, enrollment status, contractual duties, and the clinician’s actual participation are separate facts.

The change may also affect how a third-party company is treated in the context of Anti-Kickback Statute or fraud-and-abuse concerns. A clinic should not assume that a referral relationship, revenue share, or free software arrangement is harmless simply because it is common in the market. Compensation should be reviewed by counsel against the facts, fair-market-value evidence, the services actually provided, and the applicable safe-harbor rules. A compliance program cannot substitute for a legal analysis of a specific contract, but it can ensure that contracts are reviewed before signature and periodically afterward.

A practical response is to create an RPM responsibility matrix. The matrix should name the billing entity, the entity that enrolled, the vendor, the supervising clinician, the staff or service company reviewing data, and the organization receiving any portion of the payment. It should also identify who can access the record, who can transmit data, who responds to alerts, and who signs the claim. In a small practice, one person may fill several roles. That is acceptable if the facts are clear, but the roles should still be written down.

How to Audit Existing RPM Claims Before Year-End

The best preparation is a sample claim review. Clinics should pull a small but representative set of RPM claims, perhaps 20 to 50 claims, and trace each claim from enrollment through payment. For each claim, confirm the diagnosis and medical necessity, the order or treatment plan, the patient’s consent, the device used, the dates and frequency of data transmission, the time spent on treatment management, and the follow-up action. The sample should include new patients, established patients, patients with high alert volume, and cases involving a vendor or outside care team.

RPM coding has existing quantitative thresholds. CPT 99453 covers the initial setup and patient education on device use and generally requires data to be transmitted over at least 16 days in a 30-day period. CPT 99454 covers subsequent remote physiologic monitoring and generally requires at least 20 minutes of clinical treatment-management time in a calendar month. Codes 99457 and 99458 relate to treatment management and each additional 20 minutes under the applicable rules. These examples illustrate why a dashboard’s general activity report is not enough; the code record must match the clinical service and the current code definitions.

The audit should also test whether the clinic can distinguish a device that measures a physiologic parameter from a device or system that supports RTM. It should check whether the patient’s consent identifies who may receive data, whether the patient was told how data will be used, and whether the record contains a signature or a properly documented verbal consent when permitted. For treatment-management time, the clinic should retain a contemporaneous log or other auditable evidence rather than reconstructing hours at the end of the month.

A clinic that cannot produce these records should not simply submit the claim “because the vendor reported it.” It should determine whether the service can be corrected, whether the claim should be held, or whether the patient record needs clarification. The answer may differ by payer, and some contractors may issue guidance before CMS publishes a final national rule.

What Clinics Should Change Operationally

The first operational change is to identify one owner for RPM compliance. That owner may be in revenue cycle, compliance, clinical operations, quality, or information security, but one accountable person should coordinate the rule review. The team should include a clinician, a billing representative, a vendor contact, and legal or contract support. A useful meeting produces decisions, dates, and owners rather than a general promise to “stay current.”

The second change is to standardize consent. Consent should explain that the patient’s data will be monitored remotely, identify the types of data that may be collected, describe who can access the information, and address communication of urgent or abnormal findings. It should also be retained in a form that can be retrieved quickly. If the CY 2027 proposal changes consent language, the clinic should treat the current form as a controlled document with a version number and an effective date.

The third change is to make clinical action visible. Platforms often display a dashboard, but compliance may depend on who reviewed the information, when they reviewed it, and what they decided. The workflow should define alert thresholds, backup procedures for weekends and absences, escalation rules, and documentation requirements. A clinic should not let the same employee serve as the sole reviewer, technical administrator, and billing approver without a compensating control. Separation of duties is not an automatic legal requirement in every setting, but it improves the reliability of the audit trail.

The fourth change is to review vendor contracts. Contracts should describe the exact services, data ownership, security obligations, subcontractors, breach notice, record retention, assistance with audits, and payment method. A clinic should know whether the vendor bills Medicare, bills the clinic, or receives a share of reimbursement. It should also determine whether the vendor uses subcontractors or offshore support. Those details may become more important if CMS adopts rules addressing third-party enrollment, identification, or oversight.

Common Mistakes During an RPM Compliance Transition

One common mistake is confusing a proposed rule with a final rule. A legal alert may accurately describe a proposal while the final rule later changes the scope, wording, or effective date. Clinics should mark internal materials as “proposed,” cite the publication date, and identify what still requires confirmation. This avoids confusing staff and reduces the risk of reporting an unapproved rule as a current obligation.

Another mistake is treating vendor certification as a substitute for Medicare requirements. A product can have security features, clinical dashboards, and device documentation, while the clinic still has problems with consent, enrollment, time records, or medical necessity. Conversely, a vendor’s lack of a particular marketing badge may not mean that a properly used device cannot support a covered service. The claim must be evaluated from the payer’s rules and the facts of the patient’s care.

A third mistake is billing for data collection without reviewing whether treatment-management work occurred. The time thresholds for 99457 and 99458 are not satisfied by a device that automatically sends readings. A clinic should be able to identify the person who analyzed the data, the time spent, and the clinical decision or follow-up. This is particularly important when a vendor’s platform reports large volumes of data but the medical record contains no meaningful response.

A fourth mistake is assuming that a network or management-services company can be left out of the compliance file. A B2B care-coordination or patient-pulse platform may coordinate several clinics and present a unified dashboard, but each clinic remains responsible for understanding how its own patients and claims are handled. Shared software should support independent enrollment, access, consent, documentation, and audit functions. A network-level agreement does not automatically authorize every participating clinic to use the same billing approach.

When to Act, and What It May Cost

Clinics should begin before the final CY 2027 rule is issued, because contract and workflow changes take time. A reasonable planning window is 90 to 180 days, depending on the number of RPM patients and vendors. A small practice with one vendor and a modest census may complete an initial review in several weeks. A hospital or multi-site network may need several months to reconcile enrollment records, consent forms, security terms, training, and historical claims. The September 25, 2026 date is therefore a reason to act now, not a reason to assume that the proposal is already final.

There is no single universal price for an RPM compliance program. A basic review may consist of internal staff time, a sample-claim audit, and vendor contract review. External coding, legal, security, or operational assistance can add separate fees, and software or enrollment expenses may also vary. Clinics should request an itemized proposal that identifies deliverables rather than paying for an undefined “compliance package.” The cost of leaving a documentation problem unresolved can include denied claims, refunds, repayment exposure, audit scrutiny, and lost trust.

For a care network, the return on investment is not only in preventing a bad claim. A consistent data model can reduce the time clinicians spend locating readings, make quality reporting easier, and improve follow-up for patients whose measurements cross a defined threshold. Those benefits are real, but they are not guaranteed. If a platform adds alerts that no one can responsibly manage, or if a network cannot separate patient identities across locations, the software may increase rather than reduce work.

The Best Alternative: A Layered Compliance Program

There are three broad approaches. A clinic can wait for CMS’s final rule, make a limited documentation cleanup, or adopt a formal RPM compliance program. Waiting is cheapest in the short term but carries policy and enforcement risk. A documentation cleanup helps with immediate claim support but may not address vendor structure, enrollment, or clinical escalation. A formal program costs more initially but provides a repeatable process for new patients, new vendors, and new locations.

For getpulse.care and similar B2B care-coordination platforms, the relevant question is not whether a dashboard can show a trend. It is whether the platform can preserve a defensible chain from patient consent to device data, clinical review, intervention, and claim. A neutral evaluation should test role-based access, patient-level separation, reporting exports, alert histories, time records, audit logs, and the ability to produce records without depending on a vendor employee’s memory. The platform should support compliance work, not promise that technology alone makes a claim payable.

The most defensible strategy is to document current practices, compare them with the final CY 2027 rule when available, and close gaps without changing patient care unnecessarily. Clinics should monitor official CMS publications and contractor communications, retain the source and date of every rule summary, and seek specialized review for contracts or disputed claims. RPM billing compliance in 2027 is manageable when responsibilities are explicit and evidence is routine. It becomes risky when a clinic treats a proposal, a vendor report, and a Medicare requirement as if they were the same thing.

The information above is general and does not replace advice about a specific claim, contract, or patient. The proposed CY 2027 rule should be verified against the final rule and applicable Medicare program instructions before implementation.