The needle has moved into the red zone

The four dials OIG reads on every RPM claim

OIG audits are not mysterious. For remote patient monitoring, the reviewers test a short list of objective requirements, and each one is binary: the chart either supports it or it does not. These are the same four dials your self-audit should sweep first.

How the oversight cycle built, step by step

1. December 2024

   OIG opens the audit

   OIG announces the Work Plan item Audit of Medicare Part B Remote Patient Monitoring Services (oig.hhs.gov/reports/work-plan).

2. Fall 2025

   Report to Congress raises the flag

   OIG's Fall 2025 Semiannual Report to Congress flags RPM growth as requiring enhanced oversight, elevating RPM from a line item to a named priority.

3. FY2026

   Audit stays open, kickback focus added

   The audit remains ongoing in the FY2026 Work Plan, which adds items on kickback risk in vendor-driven RPM arrangements.

4. CY2027 rulemaking

   CMS moves on staffing

   CMS proposes to bar outsourced RPM staffing in the CY2027 proposal, converging payment policy with OIG's integrity concerns.

Why findings hurt more than the sample

The vendor-driven model deserves its own risk review. Where a turnkey RPM company supplies the devices, enrolls the patients, performs the monitoring, and charges per enrolled patient, the FY2026 Work Plan's kickback-risk items ask whether those arrangements induce referrals or billing that would not otherwise occur. The practice, as the billing provider, holds the overpayment liability either way. If your vendor contract pays on enrollment volume or a share of collections, have counsel look at it now, not after a subpoena.

The operator self-audit: run this before OIG does

1. Pull a device-data sample. For a recent sample of 99454 billing periods, verify 16 days of transmitted device data per 30-day period from the platform's raw logs, not the vendor's summary dashboard.
2. Reconcile time logs. For 99457 and any add-on time, confirm 20 minutes of documented management time per month with staff name, dates, activity, and the interactive communication noted.
3. Produce every consent. Sample enrolled patients and physically retrieve the dated consent for each. If any live only in a vendor system, export them into your record now.
4. Map who furnishes the monitoring. Document, in writing, whether monitoring is performed by your employed or contracted clinical staff under required supervision, or by vendor personnel, and reassess the model against CMS's CY2027 proposal to bar outsourced RPM staffing.
5. Re-read the vendor contract. Flag per-enrollment fees, percentage-of-collections pricing, free devices, or marketing support, the fact patterns behind the Work Plan's kickback-risk items on vendor-driven RPM arrangements.
6. Check medical necessity at enrollment. Each enrolled patient should have an ordering practitioner, a condition the monitoring manages, and evidence the data is actually used in care.
7. Quantify and act on what you find. Defects you identify carry refund obligations. Sizing the exposure yourself is dramatically cheaper than an extrapolated demand across a six-year lookback.
8. Stage your audit response. Name an owner, know where every artifact lives, and rehearse producing a complete claim file, data logs, time records, consent, and order, within a records-request deadline.

Sources

• HHS Office of Inspector General, Work Plan: Audit of Medicare Part B Remote Patient Monitoring Services, oig.hhs.gov/reports/work-plan, announced December 2024, ongoing in the FY2026 Work Plan, with FY2026 additions on kickback risk in vendor-driven RPM arrangements.
• HHS Office of Inspector General: Fall 2025 Semiannual Report to Congress, flagging remote patient monitoring growth as requiring enhanced oversight.
• Centers for Medicare & Medicaid Services: CY2027 proposal to bar outsourced RPM staffing.