Blog

What the OIG’s Remote Patient Monitoring Data Snapshot Report Shows

An analysis for remote monitoring organizations, physician practices, and compliance teams working with RPM. The snapshot below informs proposals in the CY 2027 Physician Fee Schedule; comments on that rule are due September 14, 2026.

In August 2025, the HHS Office of Inspector General published a Data Snapshot titled “Billing for Remote Patient Monitoring in Medicare” (OEI-02-23-00261). It presents five statistical measures of RPM billing and frames outliers on those measures as potential signals of fraud, waste, and abuse. It arrives with a fraud-alert banner and a hotline appendix, and it is already being read by enforcement bodies and the trade press as evidence of a program-integrity problem.

Read carefully, the evidence included in the report proves far less than its framing implies. The report involved no medical record review, made no improper-payment estimate, and identified no confirmed fraud. Its own Limitations section concedes that its measures “do not confirm that a particular medical practice is engaging in fraudulent or abusive practices.” And its central analytical move repeats the error of OIG’s September 2024 RPM report: it treats the absence of a billed code as evidence of an absent or improper service, when the RPM code set is deliberately built so that legitimate work does not always generate a billable claim.

For any organization that furnishes RPM or advises those who do, the distinction matters. A practice that deploys and pays for a device transmitting only 12 days cannot bill CPT 99454. A care team that spends a month trying to engage a patient who never answers the phone cannot bill CPT 99457. In both cases, the missing claim is proof the practice followed the rules, not evidence of fraud.

What the report concedes

The report makes several concessions that support the claim that RPM fraud is not widespread. 

No fraud finding. The Limitations section states: “We did not conduct a medical record review… the measures that we analyzed do not confirm that a particular medical practice is engaging in fraudulent or abusive practices or does not meet Medicare billing requirements for remote patient monitoring. Any determination of fraud or an overpayment requires additional investigation.” OIG representatives separately told Fierce Healthcare, regarding the predecessor report, that it “does not claim there is fraud in remote monitoring.”

Legitimate growth. On the new-enrollee spikes it flags, the report acknowledges: “While significant increases in billing may represent legitimate growth in a practice’s uptake of remote patient monitoring, these types of spikes in billing have been a marker of fraud in other Medicare services.” The evidence that spikes indicate fraud is imported from other benefits, not drawn from RPM.

Unbillable management codes. The report concedes that “all enrollees may not need treatment management or may not need the full 20 minutes of treatment management that is required to bill each month.” Delivered-but-unbillable care explains the pattern of only some codes being billed that the report flags.

Data-quality gaps. The footnotes concede that Medicare Advantage encounter data is incomplete, that payment information “may be missing in some instances,” and that MA plans “may have different requirements” for both the prior-relationship rule and the one-device rule. The report nonetheless applies fee-for-service rules to pooled FFS-plus-MA data.

No dollar quantification. The report snapshot does not estimate improper payments or connect any measure to a single confirmed overpayment.

In short, while the report presents valuable data, the fraud framing and hotline appendix outrun the evidence. 

The structural error: an absent claim is not an absent service

The RPM code family separates the service into three separately billable components: education and setup (99453, once per episode), device supply (99454, requiring 16 days of transmissions in 30 days), and treatment management (99457/99458, requiring 20 interactive minutes per month; 99091 is an alternative physician-level data-interpretation code). Each carries independent conditions of payment. By design, a compliant practice will frequently perform work in a month for which no claim may lawfully be submitted. OIG’s measures repeatedly read the resulting claim gaps as red flags. That is backwards, in three specific ways.

Treatment management (99457): the patient-engagement dependency

CPT 99457 requires at least 20 minutes of clinical staff, physician, or QHP time in the calendar month plus at least one real-time interactive communication with the patient or caregiver. Passive data review does not count; unanswered outreach attempts do not count. The claim therefore depends on something outside the practice’s control: whether the patient picks up the phone. A practice can absorb the full cost of monitoring, platform fees, staff review, repeated outreach, and still be legally barred from billing 99457 that month. When it submits no claim, it is conserving the Medicare trust fund, not defrauding it. The OIG’s measure accidentally implies that a practice could fix its outlier status by billing 99457 for unengaged patients, which would be fraud.

Several additional lawful mechanisms suppress treatment-management claims: concurrent Chronic Care Management, where the same minutes of staff time may be counted only once, so integrated CCM+RPM programs properly attribute interactive time to CCM; the 99091 pathway, which cannot be billed in the same month as 99457 and which may or may not have been counted in the report; clinical appropriateness, since conditions like obesity may warrant device data but not 20 minutes of monthly management; and year-boundary truncation, since patients enrolled in November or December, or who died or disenrolled early, mechanically inflate the “never managed” count.

CMS has already rejected the premise underlying this measure. In the CY 2024 Physician Fee Schedule it clarified that “the 16 day data collection requirement does not apply to CPT codes 99457, 99458, 98980, and 98981. These CPT codes are treatment management codes that account for time spent in a calendar month and do not require 16 days of data collection in a 30-day period.” The components are independent. OIG’s expectation that the codes travel together as a family rests on framing language, not on any condition of payment.

Device supply (99454): the 16-day cliff

CPT 99454 may be billed only when an FDA-defined device automatically transmits data on at least 16 days within a 30-day period. The practice buys or leases the device, ships it, pays for connectivity and platform monitoring, and staffs the program, all before a single billable day accrues. If the patient transmits 15 days, the practice absorbs 100 percent of that month’s cost. Published adherence research shows how demanding this threshold is: in a retrospective Medicaid diabetes cohort, roughly half of patients fell into the non-adherent group, with mean transmission rates as low as 46 percent before targeted outreach. A payment rule that converts patient behavior into provider revenue loss will, by construction, generate the setup-but-no-supply and supply-but-no-management patterns OIG counts as anomalies.

The strongest evidence that this critique is correct comes from CMS itself. In the CY 2026 PFS final rule, CMS finalized payment for new CPT 99445, covering device supply with as few as 2 to 15 days of transmissions, and new CPT 99470, covering the first 10 minutes of treatment management, both effective January 1, 2026. The AMA CPT panel and CMS created these codes precisely because clinically legitimate monitoring was falling below the 16-day and 20-minute cliffs and going uncompensated. The federal payment system has now formally acknowledged that the “missing component” pattern in 2024 claims reflected code architecture, not misconduct. Any rebuttal should lead with this point: the government fixed the thresholds that produced the patterns the government’s own watchdog calls suspicious.

The 43-percent headline, analyzed

The widely repeated statistic from the September 2024 report, that about 43 percent of enrollees “did not receive all 3 components” of RPM, is often paraphrased as proof that providers bill fragments of a service they never deliver. The breakdown tells a different story: roughly 28 percent of enrollees lacked an education/setup claim, 23 percent a device-supply claim, and 12 percent a treatment-management claim.

Three points neutralize this headline. First, 99453 is billable only once per episode of care, so a patient enrolled in 2021 and monitored continuously through 2022 correctly shows zero setup claims inside a one-year study window; the window guarantees false positives for every continuing patient. Second, many practices simply do not bill 99453 for the roughly $19 it pays, folding education into the workflow, and Medicare should welcome free services. Third, nothing in the code set requires the components to be billed together, per CMS’s own CY 2024 clarification. The Alliance for Connected Care formally requested that OIG retract and republish the 2024 report over these characterizations; OIG declined, but CMS identified no support for the report’s premise in its official response.

The snapshot report’s numbers refute its framing

The snapshot analyzed 4,639 practices that routinely billed RPM in 2024 (out of 10,388 total billers). Here is what its five measures actually flagged:

OIG measure	Practices flagged	% of routine billers
Sudden new-enrollee increases	32	0.69%
No prior relationship for >80% of patients	45	0.97%
No treatment management for >75% of enrollees	52	1.12%
Shared enrollees with 2+ practices (>25%)	34	0.73%
Multiple devices billed >100 times/year	~20	0.43%
Maximum possible flagged (assuming no overlap)	≤183 |	≤3.9%

Even assuming zero overlap among flagged practices, at least 96 percent of routine RPM billers, and over 98 percent of all RPM billers, sit inside OIG’s own definition of normal on every measure. The snapshot also reports that the median routine practice billed RPM for about 70 enrollees and added about 5 per month, that nearly 90 percent of practices never shared enrollees with two or more others, and that for most practices fewer than 1 percent of enrollees never received treatment management. These are the statistics of a small, clinically targeted benefit billed conservatively at scale. A report whose data show 98 to 99 percent normalcy, published under a fraud-alert banner, is a framing exercise, and the framing, not the data, is what enforcement bodies and journalists consume.

The trend line reinforces the point: the 2024 report found 12 percent of 2022 enrollees never received treatment management, while the 2025 snapshot puts that share under 1 percent for most practices, evidence of an industry maturing rapidly that the snapshot never acknowledges.

A closer look at the five measures

Sudden increases in new enrollees. RPM adoption is inherently a step function: a practice signs a vendor contract, integrates a platform, and enrolls its eligible chronic-disease panel over a few weeks. A mid-size cardiology group activating RPM for its hypertensive panel trips the 150-percent, 100-new-enrollee threshold in its launch month by definition, as does a practice switching vendors, acquiring another group, or absorbing a retiring competitor’s panel. Notably, OIG excluded very large practices from this measure, which structurally targets mid-size organizations for whom a single launch dominates monthly statistics. The report’s marquee example, a practice adding nearly 3,400 enrollees in one month, is exactly the scale of a health-system-wide go-live.

No prior relationship. This is the measure most vulnerable to data artifacts. OIG searched claims and MA encounter data back to January 1, 2021 for a prior visit with the same billing practice. At least five mechanisms generate false “no relationship” findings: patients who aged into Medicare during the window, whose earlier visits were billed to commercial insurance; incomplete MA encounter data, which OIG concedes; practice reorganizations, where TIN/NPI changes sever the claims linkage; MA plans not bound by the FFS established-relationship policy at all; and group-practice relationships, which claims-level entity matching handles poorly. The headline example, a practice lacking prior relationships with 30,000-plus enrollees, may be a bad actor, or it may be a national MA-focused medical group whose encounter data never reached the Integrated Data Repository. Without record review, the measure cannot distinguish the two.

No treatment management. The engagement dependency, CCM time-attribution rule, 99091 ambiguity, clinical-appropriateness cases, and year-boundary truncation all push the same direction. Lawful, conservative billing produces high never-managed shares in specific practice models, for example a program serving rural or low-engagement populations where devices transmit reliably but patients are hard to reach, or an integrated care-management operation booking its interactive time under CCM. The measure cannot tell a compliance success story apart from a shell that ships devices and manages nothing; only record review can.

Billing for the same enrollees. The actual Medicare rule is that only one practitioner may bill RPM for a patient in any 30-day period. OIG’s measure instead counts enrollees who received RPM from two or more practices at any point during the year, a radically different test. A patient who moves cities, changes PCPs, or transitions from a cardiologist’s post-discharge program to a primary-care chronic program will lawfully appear on two or three annual rosters with zero same-month collisions. Snowbird beneficiaries do this every year. The rule-based measure, same-30-day collisions, was fully computable from the same data; the choice of the inflated annual measure warrants explicit challenge. Serial monitoring across practices in a year is continuity of care.

Multiple devices per month. Billed is not paid: Original Medicare’s claims edits limit 99454 to one unit per patient per 30 days, so a second device claim is generally denied, and the snapshot report never shares how many were actually paid. Legitimate claim mechanics also produce apparent duplicates, including replacement devices and corrected resubmissions. And some MA arrangements pay for multiple clinically indicated devices, since monitoring two conditions with two devices is good medicine. The flagged cohort here is roughly 20 practices, and the report cannot say whether any were ever paid for a second device.

The denominator the report leaves out

Total Medicare RPM payments in 2024 were $536 million, against total Medicare spending of roughly $1.1 trillion, about five one-hundredths of one percent of program spend. For scale, CMS’s own estimate of Medicare fee-for-service improper payments was about $31 billion in FY 2022 alone, roughly one hundred times the entire RPM benefit.

The growth rate the snapshot flags is likewise context-free. Growth from a near-zero 2019 base is exactly what CMS intended when it built the code set to expand chronic-disease management. The more telling number cuts the other way: OIG’s own 2024 report found that more than 60 percent of Medicare enrollees have hypertension, yet only about 1 million of roughly 68 million enrollees, under 1.5 percent, received any RPM in 2024. Against the eligible clinical population, RPM is dramatically under-utilized, not overrun. That same report found 94 percent of RPM was furnished for chronic conditions and that Black and Hispanic beneficiaries and dual-eligibles received RPM at roughly double the rate of white beneficiaries, an access and equity profile Congress is actively trying to expand through the RPM Access Act, which advanced through committee markup in July 2026.

The clinical evidence the report cites but does not engage

The report snapshot’s very first endnote cites Tang et al., Annals of Internal Medicine (2023), for the proposition that RPM helps manage hypertension and reduce hospitalizations, then never returns to whether the billing it scrutinizes is creating results. A large retrospective cohort published in 2024 found that after 90-plus days of RPM, uncontrolled hypertension fell from 66.3 percent to 40.2 percent, stage-2 hypertension fell from 37.5 percent to 19.1 percent, and systolic blood pressure improved 7.3 mmHg overall and 16.7 mmHg in stage-2 patients, reductions the cardiology literature associates with materially lower stroke and heart-attack risk. Any honest cost-integrity analysis of a $536 million benefit must net these avoided acute-care costs against the unquantified and unalleged improper payments. The snapshot does not attempt this.

Where the report raises valid concerns

The extreme data standouts of the report deserve scrutiny: a practice with no documented relationship to 30,000 patients, or one billing duplicate devices 1,700 times a year, should be examined, and if the facts are what they appear to be, prosecuted. Fraudulent RPM shells harm compliant operators most, inviting the code-set restrictions, prior-authorization proposals, and payment cuts that damage legitimate programs, and eroding referring physicians’ trust. RPM fraud may exist. But OIG’s measures, as designed, cannot distinguish fraud from compliance. The flagged population is relatively small, and targeted, record-review-based enforcement against true outliers is the correct tool, not statistical framing that stigmatizes a clinically valuable benefit.

Why this matters now

The snapshot report is not an academic exercise. Its measures and its framing underpin proposals in the CY 2027 Physician Fee Schedule proposed rule, including a request for comment on bundling RPM and RTM codes into new HCPCS G-codes, a design that would hard-code the very “missing component” artifact the snapshot draws attention to. That direction also runs against CMS’s own contemporaneous move toward population-based, non-time-based payment in Advanced Primary Care Management and the broader accountable-care agenda. Comments on the CY 2027 rule are due September 14, 2026. Organizations that furnish RPM, and the practices and patients who rely on it, have a narrow window to put the counter-evidence, real device costs, actual adherence data, and the outcomes literature, into the rulemaking record, and we encourage them to do so. 

---

This analysis reflects a review of the OIG Data Snapshot OEI-02-23-00261 and the public evidence base on remote monitoring, prepared with input from the ChartSpan policy team. It is provided for informational purposes and does not constitute legal advice.

Primary sources: HHS-OIG, “Billing for Remote Patient Monitoring in Medicare,” OEI-02-23-00261 (August 2025) and OEI-02-23-00260 (September 2024); Alliance for Connected Care letter to HHS-OIG (September 2024); CY 2020, CY 2021, CY 2024, and CY 2026 Medicare PFS rules; Tang et al., Annals of Internal Medicine (2023); and published RPM adherence and outcomes literature cited throughout.