RPM Compliance Checklist for Skilled Nursing and Senior Living Operators

Skilled nursing facilities and senior living operators increasingly contract with outside companies to furnish remote patient monitoring (RPM) services to residents enrolled in Medicare Part B. The facility is rarely the entity that submits the claim, but it is almost never insulated from the audit that follows. When a Medicare Administrative Contractor, a UPIC, or a private payor opens a document request, the facility's own orders, consent forms, device logs and staff time records become part of the file under review. A compliance program that assumes the vendor alone owns RPM compliance leaves the facility exposed to recoupment, Medicare exclusion and a referral under the civil false claims act.

Physician Orders and the Established Relationship

RPM can be billed only by a physician or a non-physician practitioner eligible to bill evaluation and management services, and the service requires an established relationship with the resident. Before monitoring begins, the facility should confirm a signed order identifying the condition being monitored, the clinical reason for monitoring and the device the vendor will supply. A device that does not meet the FDA's definition of a medical device, or one a resident operates by typing in readings rather than through automatic transmission, does not qualify for RPM billing, regardless of what the vendor's intake paperwork assumes.

Patient Consent and the Device Data Threshold

Medicare requires documented patient consent before RPM services begin, and the facility's own consent record, not only the vendor's copy, should be available to support the claim if the arrangement is audited. On the device side, CMS's current guidance requires a practitioner to collect physiologic data for at least 16 days in a 30-day period to bill the standard device-supply code; a second code added for 2026 covers 2 to 15 days of data at the same payment rate, per CMS's Telehealth & Remote Monitoring booklet (December 2025) and the CY 2026 Medicare Physician Fee Schedule final rule. A facility must be able to show which days a resident's device actually transmitted data to defend the month that was billed.

A facility's own orders, consent forms and device logs become part of the file a Medicare contractor reviews, regardless of which entity submitted the claim.

Time Logs and Care Team Roles

Treatment management is billed in minutes, not days: the base code requires at least 20 minutes of interactive communication with the resident or a caregiver in a calendar month, with each additional 20-minute increment billed separately; a lower-paying code added for 2026 covers at least 10 minutes instead. Auxiliary personnel, including facility nursing staff, can perform this work under the general supervision of the billing practitioner, but the record must show who did the work, on what date, for how long and what was discussed. A staffing arrangement shared between the facility and the vendor should assign, in writing, who logs time, who reviews the transmitted data and who is the billing practitioner of record for each resident.

Vendor Contracts and Record Retention

An RPM vendor contract that pays the vendor per enrolled resident rather than per service rendered can raise anti-kickback statute exposure for both vendor and facility when payment tracks referrals or volume rather than fair market value for work performed. The vendor contract should address data ownership, a business associate agreement, audit cooperation and indemnification for billing errors the vendor controls. Resident records, including the vendor's device logs and the facility's consent and order documentation, should be retained for the period state law requires, or five years from discharge if state law sets no such requirement, under 42 CFR 483.70(h)(4).

Operators running an RPM program can carry three related exposures: a telehealth-adjacent acquisition under diligence (see Telehealth Practice Acquisitions and Regulatory Diligence), the prescribing volume of the physicians who order the monitoring (see Telehealth Prescribing Volume as an Audit Trigger), and payor records requests reaching the same files directly (see Telehealth Records Requests From Payers).

Why Early Legal Counsel Is Critical

It is critical that skilled nursing and senior living operators promptly retain experienced healthcare defense counsel upon receiving an audit notice, a document request or any other government inquiry touching RPM billing. Early legal intervention can protect the facility's rights, shape the record that gets produced, avoid inadvertent admissions and preserve defenses before the contractor builds its file around documents the facility never reviewed. Delaying legal representation can significantly affect the outcome of a matter and expose the facility to recoupment and referral risk counsel could otherwise have limited.

Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience.

How Health Law Alliance Can Help

Health Law Alliance represents skilled nursing facilities, senior living operators and the physicians who order remote patient monitoring in MAC, UPIC and payor audits, from the first document request through appeal. If your facility has received an audit notice or a vendor contract you want reviewed before signing, contact Health Law Alliance for a free, confidential consultation.