OIG report recommends oversight for remote patient monitoring in Medicare

On September 24, 2024, the Office of Inspector General (OIG) at the US Department of Health and Human Services (HHS) issued a report titled, “Additional Oversight of Remote Patient Monitoring in Medicare Is Needed” (the Report). The Report discusses the increased use of and payment for remote physiologic monitoring (also commonly referred to as remote patient monitoring, or RPM), and the need for greater oversight of RPM by OIG and the Centers for Medicare and Medicaid Services (CMS). Given this increased scrutiny over RPM services, providers and companies using or participating in the provision of RPM services are encouraged to carefully scrutinize and audit their operations to ensure that their use and/or billing of RPM services meet CMS requirements.

Background on RPM

In 2018, Medicare began broadly covering RPM of health data for chronic and acute conditions. RPM is the use of a connected medical device and software to remotely collect patient physiologic data (eg, blood pressure, heart rate, weight, temperature, or glucose data) that is then automatically transmitted to the patient’s healthcare provider. The provider then uses the data to treat or manage the patient’s condition. For example, the provider may review the RPM data and determine that the patient’s blood pressure medication needs to be adjusted.

To bill for RPM in Medicare fee for service, the Medicare beneficiary must:

• Have a chronic or acute condition that requires monitoring


• Use an internet-connected device that meets the Food and Drug Administration’s (FDA) definition of a medical device that digitally uploads data


• Collect and automatically transmit health data at least 16 days every 30 days


• Ensure that such collected data is physiologic data, and that it is automatically transmitted (ie, not patient-reported)

Providers bill Medicare for RPM services using a set of procedure codes that cover one of three components to RPM services:

1. Patient education and setup. Initial education and training on the use of the device and the transmission of data for purposes of condition management


2. Device supply. The internet-connected medical device, including the collection and transmission of at least 16 daily readings every 30 days


3. Treatment management services. Treatment management by the provider reviewing the RPM data and using it to manage the patient’s condition, which requires at least 20 minutes of review and management time, including interactive, virtual communication with the patient/caregiver each month that RPM is billed. Incident-to billing is permitted.

Medicare pays separately for the three components and pays each component at the same rate, regardless of the type of device used or the health data collected.

The Report findings

The Report found that the use of RPM in Medicare increased dramatically from 2019 to 2022. Additionally, Medicare payments for RPM services were more than 20 times higher in 2022 than in 2019. In traditional Medicare, payments increased from $9 million in 2019 to $201 million in 2022, while payments for those in Medicare Advantage grew from $6 million in 2019 to $110 million in 2022.

The payment increase was driven by both the number of enrollees using RPM and the average payment per enrollee. In particular, the length of time a Medicare beneficiary received RPM increased from five percent of enrollees using RPM long-term in 2019 to 25 percent receiving long-term RPM services in 2022. Medicare has no limit on the length of time for which RPM services can be used.

Given the increase in the use of and payment for RPM services, OIG and CMS raised concerns that they lack key information to accurately oversee the use of RPM. Additionally, OIG noted that approximately 43 percent of enrollees who received RPM did not have claims submitted for all three components of the monitoring, which the OIG raised as a potential fraud concern. Most commonly, patients did not receive education/setup or the device, according to claims data.

We note that there are circumstances when a provider does not bill for the device, but the treatment monitoring RPM services is permissible. This happens when the provider does not purchase the device (ie, the provider cannot submit a claim for a device if it does not represent an expense to the provider). In these cases, the patient may still have a qualifying device, but no claim is dropped for the device. OIG’s Report did not address these types of situations.

OIG acknowledged that CMS does not require that providers bill for all three components, however, it noted that the high percentage of enrollees who did not receive all components raises questions about whether the RPM services are being used as intended. While fewer patients did not receive the treatment management (12 percent), OIG identified these situations as raising concerns that the monitoring may not have been necessary to treat the patient’s condition, meaning that the setup and device may not be medically necessary and therefore not reimbursable.

In a November 2023 Consumer Alert, OIG warned about companies signing up Medicare enrollees for RPM, regardless of medical need, companies “cold calling” enrollees to solicit them for RPM devices, and companies providing devices without having sufficient staff to monitor enrollees. Because RPM companies are not Medicare providers that require enrollment, OIG raised concerns that CMS does not have a systematic way to identify companies that specialize in RPM.

In addition, Medicare does not have an explicit requirement that RPM must be ordered or that the ordering provider (eg, a physician or other qualified health care professional) be listed on the claim. The Report states that, for 44 percent of enrollees, CMS lacks information about who ordered the RPM services. Without information about ordering providers, CMS’s ability to determine whether services are medically necessary and to identify patterns of high-risk billing is limited, according to the Report.

OIG also raised concerns that “incident-to” billing allows multiple individuals to deliver services under a single provider identification number. As a result, CMS does not always know who delivered the services or even how many individuals delivered services. OIG provided an example of a single provider who billed 23,569 hours of treatment management for RPM in 2022, far more hours than in the year. However, because CMS does not know how many individuals delivered these services, OIG could not determine whether this is an unreasonable number of hours.

Further, the Report notes that CMS lacks information about the types of health data being monitored and the types of devices enrollees use. In both traditional Medicare and Medicare Advantage, providers use general procedure codes to bill for RPM that indicate only which component of RPM was provided (eg, the device or treatment management). The codes do not include more detailed information, such as the type of device.

OIG’s recommendations

OIG recommends that CMS take the following steps to strengthen oversight of RPM:

1. Implement additional safeguards to ensure that RPM is used and billed appropriately in Medicare


2. Require that RPM be ordered and that information about the ordering provider be included on claims and encounter data for RPM


3. Allow transparency of “incident-to” billing through the use of an incident-to modifier


4. Develop methods to identify what health data are being monitored and which devices are used, such as the creation of new HCPCS procedure codes or modifiers to identify health data being collected


5. Conduct provider education about billing of RPM


6. Conduct periodic analysis to identify providers who frequently bill for enrollees who do not receive all the components of remote patient monitoring, especially providers who bill for enrollees who never receive treatment management


7. Conduct analysis to identify providers who frequently submit Medicare claims with diagnosis codes that do not represent a chronic or acute condition, such as the code for “other specified counseling,” and take action, as appropriate


8. Identify and monitor companies that bill for RPM

OIG also noted that it has additional work under way examining RPM, including a companion evaluation that will identify billing patterns that may indicate fraud, waste, and abuse.

CMS concurred with or indicated that it would take into consideration all of OIG’s recommendations. Certain recommendations, however, such as the ordering of RPM, would require notice and comment rulemaking.

What this means for providers and companies

OIG recommended, and CMS accepted, that CMS identify and monitor companies that bill for RPM services. This may include CMS’s use of data analytics to identify providers who bill for higher numbers of RPM services as well as proactive research to identify companies who provide RPM support and management services to providers. Following identification, providers and companies may be subject to claim audits, requests for information, or even denials. Regardless of the methods used, the Report clearly indicates that the federal government will be scrutinizing RPM services and billings more closely going forward and that changes to RPM coverage and reimbursement may be forthcoming through notice and comment rulemaking.

Companies operating in the RPM space, and providers who are prescribing and billing for RPM services, are encouraged to evaluate their RPM policies and billing guidelines to ensure that required elements are present, including a patient consent to the RPM, the use of a “medical device” as defined under the FDA, and also whether the provider is providing and billing for all three components, and whether physiologic data is collected at least 16 out of 30 days for treatment monitoring. Companies and providers involved in RPM services are encouraged to closely monitor CMS activities in this space, including potential new coverage or reimbursement through notice and comment.

DLA Piper continues to monitor these CMS initiatives and regulatory developments.

For more information on the Report and its implications, please contact the authors of this alert or any member of our Healthcare Regulatory practice.