Remote patient monitoring was supposed to be one of healthcare’s cleaner success stories: a connected blood pressure cuff here, a glucose reading there, fewer missed warning signs, and maybe fewer hospital visits. In many cases, it still is. But once money, coding rules, and fast-growing vendors enter the chat, things can get messy faster than a copier jam on payroll day.

That is why the Office of Inspector General, or OIG, has been staring hard at Medicare remote patient monitoring billing. Its message is not that remote patient monitoring, often shortened to RPM, is a bad idea. Quite the opposite. RPM can help clinicians track chronic and acute conditions between visits and intervene sooner. The problem is that a useful clinical tool can also become a billing magnet if the guardrails are fuzzy, documentation is thin, or companies decide growth matters more than actual care.

In its recent Medicare reviews, OIG essentially said: RPM is growing fast, Medicare is paying a lot more for it, and some billing patterns look strange enough to deserve a second cup of coffee and probably an audit. For providers, health systems, digital health companies, and compliance teams, that is not background noise. It is the soundtrack.

Why OIG Is Paying So Much Attention to Medicare RPM Billing

The big reason is scale. Medicare’s use of remote patient monitoring exploded in just a few years. What started as a niche digital care model is now a significant payment category. OIG found that the number of Medicare enrollees receiving RPM jumped from roughly 55,000 in 2019 to more than 570,000 in 2022. By 2024, nearly 1 million enrollees received RPM, and Medicare payments hit $536 million.

Whenever a benefit grows that quickly, oversight agencies start asking predictable questions. Are patients getting the service as intended? Are providers following billing rules? Is the care medically necessary? Are some companies treating RPM as a clinical service, or as a subscription box with a CPT code attached?

OIG’s concern is not theoretical. The agency has already warned about fraud schemes involving unsolicited remote monitoring offers, questionable device shipments, and services billed without real clinical need. The Department of Justice has also shown it is willing to pursue enforcement around allegedly nonreimbursable RPM claims. In other words, this is not a policy discussion floating in a vacuum. It is a compliance issue with real financial and legal consequences.

What Medicare RPM Billing Is Supposed to Look Like

To understand why OIG flagged risks, it helps to understand what compliant Medicare RPM billing is supposed to look like. At a high level, RPM is not just “send device, collect money, good luck.” It is a sequence of connected clinical services.

The Core RPM Components

Under the familiar Medicare RPM framework, providers commonly use CPT codes 99453, 99454, 99457, and 99458. Broadly speaking, those codes cover initial setup and patient education, device supply and transmission over a 30-day period, and treatment management time tied to the data. The clinical point is simple: the device is not the service by itself. The service includes setup, data flow, and actual clinical management.

CMS guidance makes several things clear. RPM must be medically reasonable and necessary. It generally requires an established patient relationship. The physiologic data must be electronically collected and automatically uploaded, not casually scribbled on a sticky note and spiritually transmitted. Patient consent matters. Only one practitioner can generally bill RPM for a patient in a 30-day period. And RPM cannot simply be stacked with remote therapeutic monitoring, or RTM, for the same patient at the same time as if reimbursement were a buffet.

There are also coding details that trip people up. For example, the 16-day data collection rule applies to certain setup and device-supply codes, while treatment management codes focus on calendar-month time and interactive communication. That difference is not minor. It is the kind of nuance that separates a clean claim from a future headache.

What OIG Actually Flagged in Medicare RPM Billing

OIG’s more recent work is especially notable because it moved from broad oversight concerns to specific billing patterns that can identify practices warranting scrutiny. Translation: the government is not just worried in theory anymore. It has built a checklist.

1. Sudden Spikes in New RPM Patients

Fast growth is not automatically suspicious. Sometimes a practice finally launches a strong chronic care program, and enrollment jumps. But OIG flagged practices with dramatic month-to-month growth in new RPM enrollees because sudden spikes can also resemble marketing-driven schemes rather than careful clinical rollout.

One especially eyebrow-raising example involved a practice billing RPM for nearly 3,400 new enrollees in a single month. Could there be an explanation? Maybe. Is that the kind of number that makes auditors sit up straighter? Absolutely.

2. No Prior Relationship With the Patient

CMS requires a prior relationship before billing RPM, typically through an in-person or telehealth visit. That makes sense. A provider should know the patient, assess whether RPM is appropriate, and determine medical necessity before billing begins.

Yet OIG found 45 medical practices that did not have a prior relationship with more than 80% of the patients for whom they billed RPM in 2024. In one example, a practice lacked a prior relationship with more than 30,000 enrollees. That does not look like care coordination. It looks like the patient list and the billing department met before the clinician did.

3. Little or No Treatment Management

This is one of OIG’s most important points. RPM is not meant to stop at collecting data. The entire value proposition is that clinicians use the information to make treatment decisions and communicate with the patient or caregiver.

OIG found that for 52 medical practices, more than 75% of enrollees never had treatment management billed during the year. Now, not every patient needs billable treatment management every month. But when a practice has a very high share of patients who never seem to get that clinical follow-through, the obvious question is whether the monitoring is actually being used to manage care at all.

4. The Same Enrollees Showing Up Across Multiple Practices

Medicare generally expects RPM to be billed in a structured, non-duplicative way. OIG found that some practices frequently billed RPM for the same enrollees as two or more other practices. That raises concern about unnecessary services, duplicate billing risk, or fragmented arrangements where responsibility becomes so blurry that nobody is clearly steering the patient’s care.

When too many entities appear to be monitoring the same patient, the paperwork may be multiplying faster than the clinical value.

5. Billing for Multiple Devices Per Enrollee Per Month

Medicare generally does not allow billing for more than one RPM device per enrollee per month. OIG still found a small group of practices frequently billing for two or more devices in the same month. Again, maybe there is a specific operational story. But as a billing pattern, it is unusual enough to attract scrutiny.

And in compliance, “unusual enough to attract scrutiny” is rarely the sentence you want attached to your revenue cycle.

Why These RPM Billing Risks Matter

It is tempting to view this as a narrow coding story, but it is bigger than that. Medicare RPM billing risks matter for at least three reasons.

First, there is patient trust. Seniors who agree to remote monitoring should receive real clinical support, not just a device in the mail and a mysterious entry on their Medicare statement. OIG’s prior consumer alert shows the government is worried that some beneficiaries are being signed up for RPM services they do not need, did not fully understand, or never meaningfully received.

Second, there is program integrity. Medicare does not love mystery billing, and OIG has made clear that missing information about who ordered the service, what data were monitored, and whether the full service was delivered weakens oversight. When a benefit grows quickly and key data are missing, that is fertile ground for waste, abuse, and fraud.

Third, there is the future of digital health reimbursement. Legitimate RPM programs can improve care, especially for hypertension, diabetes, heart failure, and other chronic conditions. But if policymakers start to believe the category is too vulnerable to misuse, the likely response will be tighter rules, heavier documentation demands, and more aggressive audits. Good actors usually end up doing extra paperwork because bad actors got too creative.

What Providers and RPM Companies Should Do Next

For organizations billing Medicare RPM, the smart response is not panic. It is discipline.

Build a Compliance Program That Matches the Billing Reality

If your RPM operation is growing, your compliance controls should grow with it. Audit prior-relationship documentation. Verify that patient consent is recorded. Make sure the device qualifies as a medical device and that physiologic data are automatically uploaded. Confirm that treatment management time is documented correctly and tied to real clinical decisions.

Watch for Growth That Looks Great on a Dashboard but Weird in an Audit

A dramatic enrollment surge may look wonderful in a board presentation, but it may also look odd to OIG. If your RPM numbers jump sharply, document why. Was there a new service line, a new contract, a clinic acquisition, or a legitimate care-management initiative? Explain it before someone else asks.

Clarify Vendor and Provider Responsibilities

Many RPM programs involve third-party vendors, device companies, management platforms, or outsourced support staff. That can be perfectly legal and operationally useful. It can also turn into a compliance maze if nobody is clear about who handles patient education, who reviews data, who documents time, and who ensures medical necessity.

Providers cannot outsource responsibility just because they outsourced part of the workflow.

Separate Clinical Value From Pure Revenue Logic

The safest RPM programs are the ones designed around patient care first. Start with the population that truly benefits. Define escalation pathways. Track outcomes. Make sure the data lead to action. When an RPM program exists mainly because someone discovered recurring reimbursement, the cracks tend to show up fast.

What These Medicare RPM Billing Risks Look Like in Real Life

Across clinics, compliance teams, and digital health operations, the experience on the ground usually feels less like a dramatic fraud movie and more like a slow accumulation of small mistakes that eventually become expensive. A physician group launches RPM with good intentions, a vendor promises easy enrollment, staff members are told the program will improve patient engagement, and for a while everyone focuses on getting devices into homes. Then the questions begin. Was there a documented prior visit for every patient? Did the data upload automatically, or did someone rely on manually entered values? Did the patient actually receive treatment management, or did the practice just assume that monitoring alone counted as care?

Compliance officers often describe the same uneasy moment: the revenue looks strong, but the documentation does not tell a clean story. Maybe the setup code is there, the monthly device code is there, but there is little evidence that clinicians consistently used the data to adjust treatment. Maybe the patient roster grew quickly because a marketing campaign worked a little too well. Maybe different entities in the arrangement each believed someone else was handling consent, medical necessity, or ongoing follow-up. Nobody intended chaos, yet chaos still managed to clock in.

Smaller practices can have a different experience, but not necessarily an easier one. They may genuinely use RPM for hypertension or diabetes management and see real patient benefit. However, they often struggle with the operational side. Nurses are busy, physicians are busy, and billing staff are asked to translate evolving Medicare rules into clean claims. A single misunderstanding about the 16-day requirement, treatment management time, or duplicate billing can ripple across dozens of patients before anyone notices. In that setting, the risk is not a flashy fraud scheme. It is ordinary administrative overload wearing a very boring disguise.

Patients feel the difference too. In a well-run RPM program, they know why they were enrolled, understand how to use the device, and hear from the care team when the data suggest something is off. In a poorly run program, the device becomes just another object on the kitchen counter, silently collecting dust and possibly data, while the patient wonders why Medicare is paying for something that feels invisible. That gap between billed service and lived experience is exactly the kind of thing OIG notices, because it signals that the program may exist more clearly on paper than in care delivery.

Even vendors with legitimate products have learned that Medicare RPM is no longer a “move fast and see what sticks” environment. Health systems now ask tougher questions about contracts, documentation, audit trails, and workflow ownership. Investors ask about enforcement risk. Lawyers ask whether growth patterns can be defended. The mood is shifting from excitement to proof. That is probably healthy. Remote patient monitoring still has real promise, but the organizations most likely to succeed long term will be the ones that treat compliance as part of the product, not as a mop brought in after the floor is already flooded.

Conclusion

OIG’s warning about Medicare RPM billing risks is not a rejection of remote patient monitoring. It is a reminder that Medicare will pay for digital care, but only when the service looks like actual care. That means a real patient relationship, real medical necessity, real data transmission, real treatment management, and real documentation tying it all together.

The big takeaway is simple. RPM is no longer a novelty, and Medicare regulators are no longer treating it like one. The category is larger, the billing patterns are easier to analyze, and the enforcement climate is more data-driven than ever. Providers that built thoughtful RPM programs around clinical value should use this moment to tighten their processes and prove what is already true. Providers that built RPM around speed, volume, or vague operational promises should consider this a very polite government hint to get their house in order before someone official arrives with sharper questions.

SEO Tags