What should be on a CCM and RPM billing compliance checklist for 2026?

Chronic Care Management (CCM) and Remote Physiologic Monitoring (RPM) remain two of the most audited Medicare care-management programs in 2026, and the practices that lose money on them rarely lose it because the programs don't work clinically. They lose it because documentation, consent, time-tracking, or device-data requirements fail an audit months after the fact. A working CCM RPM billing compliance checklist is therefore less about memorizing CPT codes and more about building repeatable, provable workflows that survive a post-payment audit. Below is the definitive checklist framework, organized by the failure points CMS actually targets.

The Direct Answer: What Must Be on Your Checklist

Also worth reading: What is the definitive RPM compliance checklist for 2027 to ensure Medicare reimbursement and data security? · What are the 2026 APCM billing compliance requirements for Medicare and commercial payers? · What is the definitive RPM billing code compliance guide for clinics using SaaS platforms in 2026?

A complete CCM RPM billing compliance checklist for 2026 covers eight domains: patient eligibility verification, written informed consent, individualized care plans, qualified healthcare professional (QHP) involvement, contemporaneous time tracking with total-time thresholds, correct code selection by complexity and duration, device and data requirements for RPM, and audit-ready record retention. Each domain maps to specific CPT codes — 99490, 99439, 99487, 99489 for CCM; 99453, 99454, 99457, 99458 for RPM; plus Principal Care Management codes 99424–99427 and Remote Therapeutic Monitoring codes 98975–98981 where applicable.

The stakes are concrete. CCM code 99490 reimburses roughly $62–65 per patient per month under the 2026 Physician Fee Schedule, and RPM monitoring code 99454 adds another $50–55 per 30-day period. At scale — say 500 enrolled patients across both programs — that is $60,000+ per month of gross billing, which is exactly why MACs and the OIG sample these claims aggressively. An audit clawback covering even six months of non-compliant claims can erase a year of program margin, so the checklist below treats every item as something you must be able to prove, not just do.

Eligibility Verification: The First Gate

Every billed month must start with confirmed eligibility, and this is where many checklists are too vague. For CCM, the patient must have two or more chronic conditions expected to last at least 12 months or until death, conditions that place the patient at significant risk of death, acute exacerbation, decompensation, or functional decline. You need a documented problem-list entry supporting each condition — "two chronic conditions" asserted without chart support will not survive review. For RPM, the patient must have an established diagnosis requiring physiologic data monitoring; unlike CCM, RPM does not require multiple chronic conditions, but the ordering practitioner must determine the monitoring is medically necessary.

Two additional gates matter in practice. First, the patient must not be simultaneously receiving identical services from another provider — duplicate CCM enrollment across practices is one of the most common denial triggers, and CMS's beneficiary-level edits catch it automatically. Second, for RPM initiated after January 1, 2025 rules, the ordering physician or QHP must have furnished at least one service to the patient within the prior 12 months (the established-patient requirement), though the interactive communication requirement within the first 16 days of setup was relaxed in earlier rulemaking and remains a point practices frequently get wrong. Verify eligibility monthly, not just at enrollment, because hospitalizations, hospice elections, and plan changes mid-month all affect billability.

Written Informed Consent: The Most Common Audit Failure

Consent failures account for a disproportionate share of CCM recoupments because CMS requires specific elements, not just a signature. The consent must be written (or documented verbal per state law, but written is strongly recommended), obtained before billing begins, and must explain that only one practitioner can bill CCM in a calendar month, that cost-sharing applies (typically 20% coinsurance for traditional Medicare beneficiaries), that the patient may decline or stop at any time without affecting other benefits, and how the service affects any applicable deductible. The consent must also identify who may furnish the service.

The practical standard: store the signed consent as a discrete, retrievable document linked to the patient record with a date stamp preceding the first billed date of service. Scanned consents buried in scanned intake packets are hard to produce during audits and reviewers treat them accordingly. Re-consent is not required annually, but if your consent form changes materially — for example, adding RPM devices or changing cost-sharing disclosures — obtain fresh signatures. Practices using care-coordination platforms should confirm their system timestamps consent capture independently rather than relying on backdated manual entries, which auditors flag when the consent date matches the first claim date to the day.

Time Tracking: Contemporaneous, Cumulative, and Defensible

Time-based billing lives or dies on time documentation. For CCM, 99490 requires at least 20 minutes of qualifying clinical staff time per calendar month, 99439 covers each additional 20 minutes, and complex CCM (99487/99489) requires 60 minutes with moderate-to-high complexity medical decision-making. For RPM, 99457 requires at least 20 minutes of treatment-management services in a calendar month, and 99458 each additional 20 minutes. Critically, CMS requires that time be recorded contemporaneously — meaning at or near the time the work occurs — and that the total time include cumulative minutes from all clinical staff, not just the billing practitioner.

Your checklist should require three things here. First, a time-tracking mechanism inside the EHR or care-coordination platform that logs each interaction with date, duration, staff identity, and activity description; sticky notes reconstructed at month-end are indefensible. Second, a monthly reconciliation step confirming the summed time meets or exceeds the threshold before the claim drops — billing 99490 on 18 documented minutes is a guaranteed recoupment. Third, awareness that RPM device-supply time does not count toward 99457; only qualified professional or clinical staff time spent managing the patient counts. Note also that CCM time cannot double-count toward Transitional Care Management or Principal Care Management in the same month unless you carefully apportion activities, which most practices should avoid entirely.

Code Selection and Stacking Rules

Choosing the right code combination each month is its own discipline. The table below summarizes the core 2026 landscape:

Three stacking rules cause the most trouble. First, CCM and RPM can be billed together in the same month, but the same minute of work cannot count toward both — you need activity-level attribution showing which tasks belong to which program. Second, RPM 99454 requires data transmission on at least 16 days out of 30; if a patient transmits on 14 days, you cannot bill the supply code that month, and platforms that auto-bill regardless of transmission counts create systematic overpayment exposure. Third, incident-to-style supervision rules apply differently across programs: RPM management time can be furnished by clinical staff under general supervision, while some CCM activities require direct supervision depending on setting and year-specific policy. Build a monthly code-selection worksheet into your workflow rather than letting billers improvise.

RPM Device and Data Requirements

RPM has hardware-side requirements that CCM lacks, and they generate distinct compliance obligations. The device must meet the FDA definition of a medical device and collect physiologic data (blood pressure, weight, glucose, pulse oximetry, respiratory flow rate); simple symptom questionnaires fall under Remote Therapeutic Monitoring instead. The device must be technically capable of automatic data transmission to the provider — patient-manual-entry-only devices generally do not qualify for 99454. The data must be reviewed and available to the treating practitioner, and the program requires daily access to the transmitted data, not batch downloads.

Your checklist should verify four items per patient per month: the device is FDA-cleared and properly assigned with serial-number tracking; transmissions occurred on at least 16 days; the data was actually reviewed by qualified staff (documented review, not just receipt); and the device was supplied by the billing practice or under a legitimate arrangement — buying devices through a vendor who also bills on your behalf raises anti-kickback questions that OIG has flagged repeatedly. Beware of turnkey RPM vendors promising "no-touch" billing; if no one at your practice meaningfully reviews data or furnishes management time, the claims are not yours to bill, and several enforcement actions since 2023 have targeted exactly this arrangement.

Common Mistakes That Trigger Audits

The recurring failure patterns are predictable enough to list precisely. Billing 99490 without a signed, dated consent on file is the single most common recoupment reason. Second is time inflation: claiming 20+ minutes when the platform logs 12–15, often because staff rounded up or counted non-clinical tasks like scheduling. Third is missing the 16-day RPM transmission minimum while billing 99454 anyway. Fourth is duplicate enrollment — enrolling patients already enrolled with an ACO, hospital system, or another primary-care practice. Fifth is inadequate care-plan documentation: CMS expects a person-centered plan addressing health issues, goals, and self-management, shared with the patient, and updated as needed; a static PDF generated at enrollment and never touched fails review. Sixth is billing during incompatible periods — hospice election, certain SNF stays, or months where TCM was billed for overlapping time.

A subtler mistake is organizational: relying entirely on a third-party vendor for compliance while the NPI on the claim belongs to your practice. Under Medicare rules, the billing practitioner owns the compliance obligation regardless of who operates the software. If your vendor cannot produce contemporaneous time logs, consent records, and transmission reports on demand within 48 hours, treat that as a red flag equivalent to a compliance failure of your own.

When to Act and How to Operationalize the Checklist

Run the full checklist at three cadences. At enrollment: verify eligibility, capture consent, build the care plan, assign devices, and set up time tracking before any claimable activity occurs. Monthly, before claim submission: reconcile accumulated time against thresholds, confirm RPM transmission-day counts, confirm no conflicting enrollments or hospice status, and select codes from the worksheet. Quarterly: pull a random sample of 10–15% of billed charts and self-audit against the same criteria a MAC reviewer would use; refund identified overpayments proactively, since voluntary disclosure dramatically reduces penalty exposure compared with discovered overpayments under the 60-day overpayment rule.

Practices using care-coordination and patient-engagement platforms should configure automated guardrails — hard stops preventing claim generation when time thresholds aren't met, dashboards tracking transmission-day counts mid-cycle so outreach can push patients over 16 days before month-end, and consent-expiry alerts. Automation reduces error rates substantially, but it shifts your diligence burden to validating that the automation reflects current CMS rules, which change annually in the Physician Fee Schedule final rule typically released in November with January 1 effective dates. Budget one compliance-review cycle per quarter specifically to re-map your checklist against the latest final rule and any relevant MLN articles.

Cost Considerations and Program Economics

Understanding the economics clarifies why compliance rigor pays for itself. Gross revenue potential per fully compliant dual-enrolled patient runs roughly $130–170 per month (CCM base plus one increment plus RPM supply and management), against typical platform costs of $8–25 per patient per month and staffing costs of roughly 0.3–0.5 FTE per 300–400 enrolled patients. But the net figure depends entirely on clean-claim rates: a practice billing at 85% compliance effectively gives back 15% of revenue and accumulates audit liability on top. Deducting a single 12-month lookback recoupment on 200 patients at $150/month exceeds $360,000 — far more than the cost of the quarterly self-audit process described above.

Cost-sharing is also part of the equation: traditional Medicare beneficiaries owe 20% coinsurance on these services, and waiving it routinely creates inducement concerns under the Anti-Kickback Statute and Civil Monetary Penalties law. Decide your financial-hardship policy deliberately, document it uniformly, and never waive selectively based on enrollment volume targets.

Building a Culture Where the Checklist Actually Gets Followed

The final checklist item is organizational. Assign named ownership: a compliance lead accountable for the quarterly self-audit, a clinical lead accountable for care-plan currency, and a revenue-cycle lead accountable for pre-submission reconciliation. Train every clinical staff member whose time gets billed on what qualifies as billable activity and how to log it in real time. Review your vendor contracts annually for audit-support clauses requiring production of source documentation. And keep a versioned copy of your checklist itself, dated and mapped to the fee-schedule year it reflects — when an auditor asks how you ensured compliance in a given period, being able to show the operative checklist and training records from that exact period is often what separates a warning letter from a repayment demand.