The Direct Answer for Clinics
For remote patient monitoring (RPM), the most important billing-compliance fact on September 26, 2026 is that Medicare Part B still recognizes RPM as distinct, billable treatment-management services under Current Procedural Terminology (CPT) codes 99453, 99454, 99457, and 99458. Those codes have not disappeared, but a clinic cannot treat the mere transmission of patient data as sufficient. A valid claim generally requires an eligible patient, an enrolled clinical relationship, a medically appropriate device that meets Food and Drug Administration requirements, a documented treatment plan, at least 16 days of remotely collected data during the 30-day period, and 20 minutes of clinical staff or physician time over the calendar month. For ongoing RPM, the physician or qualified health professional must personally participate in at least one real-time, two-way interactive communication with the patient or caregiver during the calendar month.
Also worth reading: How Can AI Healthcare Compliance Metrics Transform Care Coordination for Clinics and Networks? · Can patient pulse consent management scale across clinics without becoming another compliance bottleneck? · Is RPM billing and compliance ready for CMS's tougher 2025 rules?
That baseline applies to CY 2026, but clinics should not confuse current payment rules with a permanent guarantee. The Centers for Medicare & Medicaid Services has proposed revisions for CY 2027 that reported legal and reimbursement analysis has framed as a tighter RPM environment. Those proposals should be treated as regulatory developments rather than billable instructions until finalized. The defensible response is not to stop RPM or redesign every program around an uncertain final rule. Instead, clinics should document clinical value, separate device charges from monitoring services, quantify staff time, verify consent, preserve the origin of transmitted data, and confirm that each monthly communication requirement was actually met. Those controls can satisfy both current requirements and many of the concerns raised by the proposed changes.
A useful framing is that RPM payment is compensation for remote care management, not for hardware or data transport. A blood-pressure cuff, scale, pulse oximeter, glucose monitor, or other device supplies measurements, but CMS pays the professional for assessing, interpreting, and managing the clinical course. This distinction drives coding, Health Insurance Portability and Accountability Act controls, Food and Drug Administration device questions, payer policy, and the evidence retained when a claim is audited.
What Medicare RPM Billing Requires Now
RPM services fall within Medicare’s outpatient physician fee schedule, with Medicare Part B generally responsible for payment subject to beneficiary cost sharing. Code 99453 covers initial setup and patient education on device use, data transmission, and the remote monitoring plan. The initial setup and education must involve a physician, qualified health professional, or clinical staff under general supervision. Code 99454 is the subsequent communication and treatment-management code and is generally billable once per calendar month when the service meets the medical-necessity and time requirements. Code 99457 represents treatment management services, while 99458 covers an additional 20 minutes of eligible clinical time in the same month.
The data window is specific: the device must collect and transmit data for at least 16 days during the 30-day period. The 20-minute requirement is not satisfied by 20 minutes of automated dashboard review, server processing, or multiple data transmissions. It must represent qualifying time in which the clinical team reviews data, assesses the patient, and provides treatment management, and the time must be documented. The calendar-month time requirement cannot simply be accumulated across two reporting periods or presumed from staffing levels. Although the annual Medicare payment is tied to the relative units and physician fee schedule amount for the applicable year, the service-specific amount should never be hard-coded into a budgeting model without checking the current fee schedule and the patient’s actual payer.
RPM is distinct from remote therapeutic monitoring, or RTM. RTM codes 98975 through 98978 generally apply to a treatment plan guided by an FDA-defined medical device and the active treatment of a patient with a condition requiring a prescribed treatment, such as diabetes or respiratory disease. RPM instead centers on collecting physiologic data and managing a patient’s condition remotely. Claims should not be selected merely because the service is remote; the clinical purpose, device, plan, and treatment workflow determine the correct code family.
Why CMS Proposed Changes for CY 2027
The pressure for reform comes partly from Medicare spending growth and a mismatch that policymakers see between the simplicity of transmitting data and the clinical work required to manage a patient safely. Higher utilization, inconsistent provider interpretations, and limited evidence about outcomes have prompted scrutiny of both the monthly data threshold and the way communication time is reported. In a proposed environment, a clinic should not assume that a proposal has already changed the code set. The CY 2026 rules remain the operative basis unless CMS publishes a final rule and it becomes effective, and a proposed rule can be modified or withdrawn before then.
Reported analysis from Wilson Sonsini, Nixon Peabody, Foley & Lardner, and Telehealth.org describes proposed revisions involving RPM requirements and data submission. Because the exact final text should control, clinics should avoid claims that a proposed threshold, percentage, or documentation standard is final. The practical lesson is that the federal government is moving toward a closer examination of whether RPM generates measurable care rather than simply generating billable interactions. Clinical Trial Vanguard has similarly noted that sponsors of decentralized clinical studies should pay attention because proposed federal requirements may affect how remote-monitoring services are described, justified, and reimbursed.
A proposed payment change also has a human effect on care networks. A hospital or physician group may respond by raising internal documentation standards, reducing enrollment, narrowing device eligibility, or shifting staff from low-risk data review toward active patient outreach. That can be sensible if programs had weak governance, but excessive restriction can leave patients without useful monitoring and make clinical teams less effective. The better response is a documented program that can distinguish low-risk data collection from high-risk clinical deterioration and route alerts based on clinical protocols rather than on reimbursement alone.
The 2027 proposal should therefore be monitored through official CMS channels rather than vendor alerts alone. Clinics should compare any finalized text with their current contracts, policies, consent forms, device relationships, billing systems, and staffing model. They should also evaluate non-Medicare payers separately because commercial insurers can use different authorization rules, code edits, and medical policies even when the same CPT codes are reported.
How a Compliant RPM Program Actually Works
A defensible RPM program begins with a documented clinical reason for monitoring. Blood pressure, glucose, oxygen saturation, heart rate, weight, temperature, or another physiologic measure may be appropriate when the condition can be managed remotely and the data can affect treatment or follow-up. Merely enrolling a patient because a device is available is weak. The record should explain why the measurement is necessary, who reviews it, how quickly abnormalities are addressed, and what clinical action follows. A program that stores readings for months without review is not made compliant by accurately submitting a monthly code.
Consent and device documentation are equally important. Medicare generally requires a documented verbal or written consent that acknowledges the services and authorizes transmission of PHI electronically, subject to applicable privacy law and any required authorization for the patient’s jurisdiction. The consent process should identify the remote-monitoring service and the transmission of protected health information. A generic telehealth consent may not expressly satisfy every organizational expectation, and a paper consent that is never accessible to the billing team creates avoidable friction.
The device must also meet the relevant FDA device-definition standard. Not every consumer tracker, wellness product, or manually entered reading supports RPM billing. A clinic should retain evidence of the device’s model, intended use, FDA status, and connection to the service. It should not assume that an app, scale, or sensor is eligible simply because a clinician recommends it. Manual data entry by a caregiver may satisfy the definition of data collected in the patient’s home or other setting, but the billing record should still show the origin and method of collection because the source must support the clinical representation.
For ongoing care, the required interactive communication must actually occur. A patient portal message is not automatically the same as a real-time, two-way interaction, and automated outreach does not necessarily qualify. The personnel performing the service must be qualified under the relevant code and supervision model. All time supporting the claim should be contemporaneous and attributable to the care management performed. Overlapping RPM time cannot normally be double counted with another distinct service, although a payer’s rules and applicable coding guidance should govern any specific edge case.
Finally, the clinic should connect the monitoring plan to an ordering, prescribing, or supervising framework where required. The remote work is part of a treatment relationship, not an independent data subscription. A care network should retain a single source of truth connecting enrollment, consent, data, communication, clinician review, intervention, and claim submission. That record makes the service easier to audit and reveals whether the program is creating outcomes such as fewer inappropriate escalations, timely medication adjustments, or improved control—not merely more records for billing.
Practical Steps Before the CY 2027 Rule Becomes Effective
The first operational step is to perform a code-level sample audit. A clinic should select 20 to 30 RPM encounters from several months and compare the claim to the chart, not just the technical log. The reviewer should confirm enrollment, diagnosis, consent, device, 16-day threshold, treatment plan, 20-minute time, interactive communication, staff qualification, and supervision. A dashboard showing 20 minutes of dashboard activity is not enough unless the underlying record demonstrates eligible care. Sampling should include high-volume clinicians, remote monitoring nurses, outsourced vendors, and locations with different workflows.
The second step is to correct the interface between the device and the billing system. Many billing errors originate before the claim reaches Medicare: duplicate feeds, missing days, device-to-patient mismatches, or services tied to the wrong episode. Count unique data-collection days, preserve transmission timestamps and time zones, and distinguish missing days from days on which no data was transmitted. A clinic should also ensure that automated time estimates are not represented as clinical time without staff review. Clinical logs can use structured fields for data review, patient communication, medication management, and treatment-plan modification, while still allowing a compliant narrative of the actual work.
The third step is to examine the evidence for clinical value. Reports should show more than monthly claims and collections. Depending on the population, clinics can track blood-pressure control, glucose time in range, oxygen saturation trends, adherence, follow-up completion, hospitalization or emergency-department use, and documented interventions. Baselines and denominators matter; a 90% “response rate” is difficult to interpret without knowing how response is defined. These measures are not substitutes for CMS rules, but they help distinguish active care management from a poorly governed data stream.
The fourth step is to establish a regulatory change process. The compliance, billing, clinical, legal, privacy, and technology leads should review each proposed or final CMS rule against a written control map. A vendor may participate, but the billing organization must retain responsibility for code interpretation and claim accuracy. The owner should also evaluate whether a proposed change affects contracts with commercial payers, hospitals, accountable care organizations, or patients participating in value-based arrangements.
Comparing RPM, RTM, and Other Remote-Care Models
| Feature | RPM | RTM | Digital health subscription | General telehealth visit |
|---|---|---|---|---|
| Medicare framework | 99453, 99454, 99457, 99458 | 98975–98978 | Usually no Part B RPM code | E/M and other covered services |
| Core requirement | Physiologic data collection, remote review, and care management | FDA-defined therapeutic device and prescribed treatment workflow | Access to technology or periodic reports | Synchronous clinical evaluation or other defined service |
| Typical data threshold | At least 16 days in 30 days; confirm current code guidance | Device data collection and communication requirements vary by code and payer | Often none | Not applicable unless the visit code specifies it |
| Time requirement | 20 minutes for 99457; additional 20 minutes for 99458, subject to code guidance | Communication requirements vary by code and payer | Usually none | Based on the selected service and payer policy |
| Patient communication | Real-time two-way interaction at least monthly for ongoing RPM | Communication and treatment workflow must support the applicable code | Usually not a qualifying service | Interaction is generally the visit itself |
| Best fit | Ongoing physiologic monitoring and management | Active device-guided treatment for an eligible condition | Patient education or convenience features | A defined synchronous or asynchronous clinical encounter |
Common Compliance Mistakes and Cost Consequences
The most common mistake is confusing transmitted data with clinically actionable care. Another is reporting the 20-minute threshold solely from software activity or counting several short communications that do not meet the required real-time interaction. Clinics also frequently fail to distinguish RPM from RTM, use a consumer wellness device without checking eligibility, or bill a service for a patient who did not meet enrollment requirements. Repeated claims for the same month and service can be rejected, audited, or appealed depending on the payer’s processes.
Financial risk is rarely limited to the individual claim. A denied or reversed RPM claim can leave a clinic responsible for repayment, even if the patient received care and received no refund. Recoupment can also affect later claims, administrative costs, vendor disputes, and physician participation in a payer or value-based contract. A clinic that cannot reconstruct who provided the service, when it was provided, or why it was medically necessary may find it difficult to appeal. That is why contemporaneous logs and a reliable audit trail often cost less than reconstructing services months later.
Pricing and software cost also require disciplined treatment. Device acquisition, cellular connectivity, platform licenses, clinical labor, training, consent workflows, and coding support should be separated. Vendor subscription prices vary widely and are not the same as Medicare payment; neither should be quoted as a universal 2026 reimbursement amount. Medicare Part B payment can be based on the physician fee schedule, and the patient may owe applicable deductible and coinsurance, although some Medicare beneficiaries have secondary coverage. Before enrollment, the clinic should explain the expected patient cost under the relevant plan, verify that the device fits the patient’s home technology, and ensure that patients are not pressured into a paid program they do not need.
The largest hidden cost is often noncompliant work. Time spent correcting duplicate records, retrieving missing consent, re-documenting a month that was never timely entered, or appealing a claim is avoidable cost. Conversely, avoiding the real-time communication or reducing clinical review to protect a monthly metric can damage patients. A credible program treats compliance as part of clinical quality rather than as a final claims check performed after care has already occurred.
When Clinics Should Act
Immediate action is appropriate if a clinic currently bills RPM, has volumes growing quickly, uses multiple device vendors, or has not audited claims recently. Review should also be triggered by news of a CMS proposal, a new payer policy, a change in device software, an acquisition, a shift from asynchronous to synchronous monitoring, or a plan to expand RPM into higher-risk populations. The September 26, 2026 planning point is useful: the organization has time to test controls before the CY 2027 cycle, but it should not wait until a final rule or first denial to identify defects.
A small practice can begin with a documented workflow, a monthly claim sample, a shared consent record, a device register, and named accountability for communication time. A large care network should add centralized policy, role-based access, automated threshold alerts, vendor scorecards, clinical dashboards, and a formal change-management committee. The level of governance should reflect the patient population and business model; a small low-risk program does not need the infrastructure of a health system, while a network monitoring thousands of patients cannot safely rely on spreadsheets and informal text messages.
The best near-term posture is readiness, not abandonment. Clinics should not withdraw established monitoring solely because reform is proposed, and they should not assume that retaining current revenue justifies weak oversight. They should also avoid hard-selling RPM to patients who do not need it. Remote monitoring is most defensible when a clinician expects it to improve or safely maintain care, when the patient can use the service, and when the organization can measure both clinical results and compliant execution. That approach supports payer negotiations, patient trust, and preparation for whatever final text CMS adopts.
Sources and Verified Regulatory Anchors
The official Federal Register CY 2026 Medicare Physician Fee Schedule final rule is the primary source for current payment policy. CMS’s physician fee schedule files support the applicable payment amount for a service year, while Medicare Benefit Policy Manual Chapter 15 supplies remote-treatment and remote-physiologic-monitoring guidance. The Electronic Code of Federal Regulations, particularly 42 C.F.R. § 410.32, provides the durable legal baseline for Medicare Part B services, and the eCFR should be checked for amendments. For payment uncertainty, the Federal Register CY 2027 proposed-physician-fee-schedule materials must be distinguished from any final rule; a proposal is not a final billing requirement.
Decision Summary for 2026
RPM billing remains available in Medicare Part B, but the code is earned through a documented care-management process. A clinic should verify the 16-day data threshold, 20-minute clinical-time requirement, qualifying real-time communication, consent, device eligibility, staff qualification, supervision, and medical necessity for every claim. It should monitor the CY 2027 proposals without treating them as effective until finalized, and it should preserve the same evidence regardless of payer. The practical standard is simple: the service should be clinically useful, appropriately supervised, accurately coded, supported by the record, and easy for an independent reviewer to reconstruct.