Updated for 2026. Remote Patient Monitoring (RPM) continues to receive increased Medicare program-integrity attention. HHS Office of Inspector General (OIG) has an active audit of Medicare Part B RPM services examining whether providers furnished and billed these services according to Medicare requirements.
OIG reported that Medicare RPM payments exceeded $500 million in 2024 and identified several billing patterns that may warrant additional scrutiny. These indicators do not automatically mean improper billing, but they demonstrate why practices should maintain strong documentation and internal controls.
This 2026 RPM audit checklist can help practices evaluate documentation before a Medicare, MAC, payer, or internal compliance review.
2026 RPM Audit Checklist at a Glance
- Verify an established patient relationship.
- Document the condition being monitored.
- Document medical necessity.
- Document patient consent.
- Confirm the RPM device meets applicable medical-device requirements.
- Confirm physiologic data is electronically and automatically transmitted.
- Document device setup and patient education.
- Verify actual qualifying monitoring activity.
- Match the device-supply code to the documented monitoring period.
- Document treatment-management activity separately.
- Document required interactive communication.
- Identify the staff member or practitioner performing each service.
- Confirm only one practitioner bills RPM during the applicable period.
- Check for duplicate devices or duplicate device-supply billing.
- Do not bill RPM and RTM concurrently for the same patient.
- Review duplicate time across CCM and other care-management programs.
- Maintain device assignment and return records.
- Document patient discontinuation when RPM ends.
Why RPM Audit Readiness Matters in 2026
HHS OIG has stated that Remote Patient Monitoring has the potential to improve patient care but also presents risks involving fraud, waste, abuse, inadequate monitoring, unsolicited devices, and inappropriate billing.
OIG's current Medicare Part B RPM audit is examining whether providers furnished and billed RPM services in accordance with Medicare requirements.
Practices should therefore be able to reconstruct the complete RPM service from the medical record and supporting technology records.
1. Verify the Patient Relationship
CMS currently requires an established patient relationship for Remote Physiologic Monitoring.
Your audit file should be able to show evidence of the patient's relationship with the billing practitioner or practice before or in accordance with applicable RPM requirements.
Documents to Review
- Prior office or telehealth encounters
- Patient registration information
- Clinical history
- RPM enrollment date
- Practitioner responsible for the monitoring program
OIG specifically identified billing for a high proportion of patients with no prior history with the medical practice as a measure that may warrant additional scrutiny.
2. Document the Condition Being Monitored
Medicare broadly covers medically necessary RPM for acute and chronic conditions.
The patient's record should clearly identify the condition or clinical problem associated with RPM.
Examples
- Hypertension
- Heart failure
- Diabetes
- COPD
- Other acute or chronic conditions requiring physiologic monitoring
A diagnosis code by itself is not a substitute for documentation explaining why remote monitoring is clinically appropriate.
3. Document Medical Necessity
CMS requires RPM to be medically reasonable and necessary.
Documentation should explain why remotely collected physiologic data is needed for the patient's care.
Example
Remote blood-pressure monitoring initiated to evaluate home hypertension trends and treatment response between office visits. Transmitted readings will be reviewed to support medication-management and follow-up decisions.
Stronger documentation links the device, physiologic measurement, condition, and treatment-management objective.
4. Confirm Patient Consent
CMS requires patient consent for RPM and permits consent to be obtained when the RPM service is furnished.
Your record should clearly indicate that consent was obtained.
Consider Documenting
- Date of consent
- Verbal or written consent according to practice policy
- Program explanation
- Device responsibilities
- Potential cost-sharing information
5. Verify the Device
CMS requires the device used for RPM to meet the applicable definition of a medical device and electronically collect and transmit physiologic data.
The audit record should identify the device associated with the patient.
Maintain
- Device type
- Manufacturer
- Device identifier or serial number when available
- Patient assignment date
- Activation date
- Replacement history
- Return or deactivation date
6. Confirm Automatic Data Transmission
Medicare RPM is not simply a patient writing readings on paper and later telling the practice the results.
CMS requires physiologic data to be electronically collected and automatically uploaded to a secure location where it is available for analysis and interpretation.
Your audit evidence may include:
- Device transmission logs
- Timestamped measurements
- Platform reports
- Device-to-patient assignment records
7. Verify Device Setup and Patient Education
Education and setup are one of CMS's three major RPM components.
When the setup service is billed, the documentation should support that the patient received appropriate device education.
Potential documentation includes:
- How to use the device
- Correct placement or measurement technique
- How frequently measurements should be taken
- Confirmation that transmission works
- Troubleshooting guidance
- When to contact the practice
OIG has previously raised concerns that some Medicare beneficiaries receiving RPM did not receive all major components of the service.
8. Audit the Actual Monitoring Data
Do not rely solely on an enrollment record or invoice from an RPM vendor.
Auditors should verify that the underlying device data exists.
Review:
- Dates with physiologic transmissions
- Number of qualifying days or readings required by the applicable code
- Type of physiologic data collected
- Missing or duplicate readings
- Long periods without transmission
CMS's current RPM information reflects 2026 monitoring pathways that recognize shorter monitoring periods as well as longer monitoring periods depending on the applicable CPT code.
9. Verify CPT 99445 vs CPT 99454
2026 introduced a shorter-duration RPM device-supply pathway.
CodeGeneral 2026 Device-Supply Pathway99445Shorter monitoring period, including the applicable 2-15 day requirements99454Longer monitoring period under the applicable code requirements
The claim should match the patient's actual documented monitoring activity.
Do not automatically bill the longer-duration code merely because the patient remained enrolled for the entire month.
10. Audit Treatment-Management Time
RPM treatment-management services involve reviewing remotely collected physiologic data and using that information to manage the patient's treatment.
Your audit should compare billed treatment-management services against actual documented activity.
Review
- Date of service
- Person performing the activity
- Duration
- RPM data reviewed
- Clinical decision or management activity
- Patient or caregiver communication
11. Review CPT 99470 and CPT 99457 Carefully
For 2026, RPM includes treatment-management pathways with different time requirements.
CPT 99470 provides a shorter initial treatment-management pathway, while CPT 99457 remains the traditional first 20-minute treatment-management pathway.
Billing teams should apply the exact current CPT requirements rather than selecting a code based only on a rounded monthly time total.
12. Verify Interactive Communication
Applicable RPM treatment-management services include interactive communication with the patient or caregiver.
CMS has historically described interactive communication for RPM as real-time synchronous, two-way communication.
Your documentation should identify:
- Date
- Patient or caregiver participant
- Communication method
- Clinical issue discussed
- Relevant RPM data
- Action taken
Example
Reviewed transmitted blood-pressure readings with patient during real-time communication. Discussed medication adherence and elevated morning measurements. Escalated persistent hypertension to supervising practitioner for treatment-plan review.
13. Verify That Data Was Actually Used
Collecting physiologic measurements without meaningful clinical review may not support treatment-management billing.
Audit documentation for evidence that the care team used RPM data to manage the patient's condition.
Examples include:
- Trend analysis
- Medication-management decisions
- Patient education
- Escalation to a practitioner
- Follow-up appointments
- Changes to treatment strategy
14. Identify Who Performed Each Activity
Each activity record should identify the person who performed the service.
Include:
- Name
- Professional role
- Date
- Activity
- Duration when applicable
This allows reviewers to determine whether staffing and supervision requirements were satisfied.
15. Confirm the Billing Practitioner
CMS states that only one practitioner can bill RPM services for a patient during the applicable 30-day period.
Your pre-claim review should therefore check for potential duplicate RPM billing by:
- Primary care
- Cardiology
- Endocrinology
- Pulmonology
- Other specialists
Coordination is particularly important when multiple clinicians have access to the same device data.
16. Review Multiple Device Billing
OIG specifically identified billing for multiple monitoring devices in a month for one enrollee as a measure that can identify practices warranting additional scrutiny.
This does not mean every multiple-device situation is improper. However, practices should be prepared to explain and document legitimate device replacements or clinically appropriate device use.
Audit Questions
- Was more than one device-supply service billed?
- Why?
- Was a device replaced?
- Was the original device defective?
- Are duplicate vendor claims present?
17. Look for Patients With No Prior Practice History
OIG also identified a high proportion of RPM patients with no prior history with the billing practice as a potential scrutiny measure.
When auditing enrollment, confirm that your records support the established patient relationship required by Medicare.
Particular attention may be appropriate for patients enrolled through:
- Outside marketing companies
- Third-party vendors
- Bulk outreach campaigns
- External lead sources
Third-party involvement does not itself make RPM inappropriate, but the medical practice remains responsible for Medicare compliance.
18. Audit Vendor Relationships
If an outside company supplies devices, technology, or staff, the medical practice should still maintain visibility into the underlying service.
Consider reviewing:
- Vendor agreement
- Staff qualifications
- Supervision structure
- Patient enrollment process
- Device inventory
- Data-access controls
- Documentation ownership
- Billing responsibilities
- HIPAA and security obligations
Do not rely on a vendor's statement that a claim is billable without verifying that the medical record supports the service.
19. Check RPM and RTM Conflicts
CMS states that RPM and Remote Therapeutic Monitoring (RTM) cannot be billed concurrently for the same patient.
Your billing system should flag patients enrolled in both programs before claim submission.
20. Check Duplicate CCM Time
Medicare permits qualifying RPM and Chronic Care Management services during the same period when each service independently meets its requirements.
However, the same time and effort should not be counted twice.
Example
A nurse spends 12 minutes performing qualifying RPM treatment management.
Those same 12 minutes should not also be copied into the patient's CCM monthly time total.
Instead, maintain separate program-specific activity logs.
21. Review Other Concurrent Services
CMS permits RPM or RTM, but not both together, to operate concurrently with certain care-management services when their individual requirements are met and time is not duplicated.
Review potential overlap with:
- CCM
- PCM
- TCM
- Behavioral Health Integration
- Chronic Pain Management
22. Compare Claims to Platform Data
A strong internal audit should reconcile billing data against the actual RPM platform.
Claim DataCompare AgainstDevice-supply codeActual transmission historyTreatment-management codeTime and communication recordsPatient IDDevice assignmentService periodEnrollment and discharge datesBilling practitionerResponsible practitioner record
Automated reconciliation can help identify problems before claims leave the practice.
23. Look for Impossible or Unusual Time Patterns
Internal auditing should identify unusually high volumes of time-based RPM services that may warrant manual review.
Examples include:
- Large numbers of patients showing identical time totals
- Overlapping staff activity
- Unusually high daily documented hours
- Repeated identical notes
- Time recorded after patient discharge from RPM
An unusual pattern is not automatically an error, but it should be explainable from the medical record.
24. Check for Template Documentation
Templates can improve efficiency, but excessive copy-forward documentation can weaken the record.
Auditors should look for evidence that each note reflects the patient's actual:
- Physiologic measurements
- Condition
- Clinical changes
- Communication
- Treatment-management activity
25. Verify RPM Discharge
Practices should maintain an explicit process for ending RPM.
Document:
- Discontinuation date
- Reason
- Device status
- Return or reassignment
- Final patient communication
- Final billing period
This can help prevent billing from continuing after the patient is no longer actively monitored.
Sample RPM Audit Record
Patient: Medicare patient with hypertension.
Clinical rationale: Remote blood-pressure monitoring required to evaluate treatment response between office visits.
Relationship: Established primary-care patient.
Consent: Documented before RPM activation.
Device: Connected blood-pressure cuff assigned to patient and configured for automatic transmission.
Education: Setup, measurement technique, transmission, and troubleshooting reviewed.
Monitoring: Timestamped physiologic readings available in RPM platform.
Management: Staff reviewed elevated readings, completed qualifying patient communication, and escalated trends to the practitioner.
Billing review: Device-supply and treatment-management codes reconciled with actual monitoring and time records. No duplicate CCM time identified.
RPM Audit Scoring Template
Audit AreaStatusEstablished patient relationshipPass / ReviewMedical necessityPass / ReviewConsentPass / ReviewDevice eligibilityPass / ReviewAutomatic transmissionPass / ReviewSetup and educationPass / ReviewMonitoring requirementPass / ReviewCorrect supply codePass / ReviewTreatment-management documentationPass / ReviewInteractive communicationPass / ReviewSingle billing practitionerPass / ReviewMultiple-device reviewPass / ReviewRPM/RTM conflictPass / ReviewDuplicate care-management timePass / ReviewDevice inventoryPass / ReviewDischarge documentationPass / Review
What OIG's RPM Findings Mean for Practices
OIG reported that Medicare payments for RPM exceeded $500 million in 2024. It also developed measures to identify billing patterns that may warrant further scrutiny, including practices billing RPM for a high proportion of enrollees with no prior practice history and claims involving multiple monitoring devices in a month.
These measures are screening indicators, not automatic findings of wrongdoing. Practices with legitimate clinical reasons should maintain records that clearly explain their services.
Active OIG RPM Audit
HHS OIG currently lists its Audit of Medicare Part B Remote Patient Monitoring Services as active.
The stated objective is to determine whether providers furnished and billed RPM services according to Medicare requirements.
This makes 2026 a good time for practices to perform proactive internal reviews rather than waiting for an external request for records.
How Often Should You Audit RPM?
The appropriate frequency depends on practice size, billing volume, risk, staffing, and compliance processes.
A practical program may include:
- Pre-billing automated checks
- Monthly exception reports
- Periodic random chart reviews
- Focused audits of unusual billing patterns
- Vendor-performance reviews
- Corrective-action follow-up
How ChronicSync Can Help
Audit readiness is much easier when enrollment, device data, patient communication, treatment-management activity, and care-management time are not scattered across spreadsheets and disconnected systems.
ChronicSync helps practices organize chronic-care and remote-monitoring workflows, maintain structured documentation, track patient activity, and improve visibility into program-specific services.
A structured workflow can help identify missing documentation, duplicate time, monitoring gaps, and other issues before claim submission.
Start your ChronicSync Free Pilot and explore a more organized approach to Remote Patient Monitoring and chronic care management.
Frequently Asked Questions
Is OIG auditing Medicare RPM?
Yes. HHS OIG currently lists an active audit of Medicare Part B Remote Patient Monitoring services to determine whether providers furnished and billed RPM according to Medicare requirements.
How much did Medicare spend on RPM?
HHS OIG reported that Medicare RPM payments exceeded $500 million in 2024.
What RPM billing patterns has OIG highlighted?
OIG developed measures that include billing for a high proportion of enrollees with no prior practice history and billing for multiple monitoring devices in a month for an enrollee. These are indicators for potential scrutiny, not automatic determinations that billing was improper.
Does Medicare RPM require an established patient relationship?
Yes. CMS's current guidance requires an established patient relationship for Remote Physiologic Monitoring.
Does RPM data have to transmit automatically?
Yes. CMS requires physiologic data to be electronically collected and automatically transmitted to a secure location where it can be analyzed and interpreted.
Can CCM and RPM be billed together?
Yes, when the requirements of each service are independently satisfied and the same time and effort are not counted twice.
Can RPM and RTM be billed together?
No. CMS states that RPM and RTM cannot be billed concurrently for the same patient.
Should practices audit third-party RPM vendors?
Practices should maintain sufficient oversight of vendors to confirm that patient enrollment, devices, staffing, documentation, and billed services comply with applicable Medicare requirements.
Sources
- CMS: Remote Patient Monitoring
- CMS Medicare Learning Network: Telehealth & Remote Patient Monitoring
- HHS OIG: Billing for Remote Patient Monitoring in Medicare
- HHS OIG: Audit of Medicare Part B Remote Patient Monitoring Services
This checklist is provided for educational purposes only and does not constitute medical, legal, coding, reimbursement, compliance, or billing advice. CPT, CMS, Medicare Administrative Contractor, OIG, and payer requirements can change. Verify current requirements before submitting claims.