A remote patient monitoring (RPM) program can look complete on the intake form and still fail on audit if the device data and time logs do not match what was billed. Medicare pays for RPM in three separate components: device setup, device supply, and treatment management time, each billed under its own CPT code and governed by its own documentation standard. The Centers for Medicare & Medicaid Services (CMS) finalized changes to the RPM billing framework effective January 1, 2026, and the HHS Office of Inspector General has already flagged remote monitoring as an area where billed services frequently outrun the record. For a telehealth provider, a single RPM audit can reach every enrolled patient's monthly billing cycle, not just the claim that triggered the review.
RPM Billing Codes and the 16-Day Rule
CPT 99453 covers the initial device setup and patient education, billed once per episode of care rather than monthly. CPT 99454 covers device supply and data transmission and requires the patient to transmit physiologic data on at least 16 of 30 days in the billing cycle, a threshold confirmed by CMS's Telehealth & Remote Monitoring guidance. Effective January 1, 2026, CMS created CPT 99445, a new device-supply code for patients who transmit data on only 2 to 15 days in a 30-day period, closing a gap that previously left partial-adherence monitoring unbillable. A practice that bills 99454 for a cycle with 12 transmitted days, instead of the 2-to-15-day code, is billing for a service the underlying data does not support.
Documenting Monitoring Time Under 99457 and 99458
CPT 99457 covers the first 20 minutes of RPM treatment management furnished by clinical staff, a physician, or another qualified health care professional in a calendar month, and CPT 99458 covers each additional 20-minute increment. Both codes require at least one interactive, real-time communication with the patient or caregiver during the month. Unlike the device-supply codes, CMS's Telehealth & Remote Monitoring guidance confirms that 99457 and 99458 turn entirely on minutes and the interactive-communication requirement, not on the day-count thresholds that apply to 99454 and 99445, and the time logged has to be contemporaneous, not reconstructed at month's end.
Device-Supply Findings Auditors Target
The HHS Office of Inspector General's September 2024 review of Medicare RPM claims found that about 43% of enrollees who received remote patient monitoring did not receive all three billed components. The same review found that Medicare payments for RPM grew from $15 million in 2019 to more than $300 million in 2022, more than 20 times higher in four years, while the agency lacked basic information about which devices were in use and who ordered the monitoring. Auditors reviewing RPM claims now routinely request the device transmission log, the ordering documentation, and the treatment management time log in the same request. A device-supply claim without a transmission log showing the actual dates of data collection, or a treatment management claim without a documented interactive communication, is a fast path to recoupment across an entire lookback period.
RPM audits rarely arrive in isolation. They increasingly overlap with broader telehealth billing audits covering modifiers, originating sites, and time-based codes, and the same claims data often feeds a wider telehealth fraud enforcement effort.
An RPM claim is only as defensible as the transmission log and time record behind it, not the code entered on the claim form.
Why Early Legal Counsel Is Critical
It is critical that telehealth providers promptly retain experienced healthcare defense counsel upon receiving a subpoena, audit notice, investigative request, or other government inquiry. Early legal intervention can protect the provider's rights, ensure appropriate responses to government requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with investigators on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance defends telehealth providers, physicians, and healthcare companies in remote patient monitoring audits, from the initial documentation request through recoupment appeal. We review device transmission logs, treatment management time records, and ordering documentation the way an auditor will, before the auditor does. If your practice has received an RPM audit notice or a records request, contact us today for a free consultation.
