On September 24, 2024, the Office of Inspector General (OIG) of the Department of Health & Human Services (HHS) issued a report recommending additional oversight of remote patient monitoring (RPM).¹ This Health Capital Topics article reviews the report and discusses industry reactions.

RPM, also called remote physiologic monitoring, “is the use of digital devices to monitor a patient’s health.”² RPM allows a patient to collect physiologic data, such as their blood pressure, heart rate, or glucose levels, via a digital device, which data is automatically transmitted to the healthcare provider in order to (remotely) monitor and treat a patient’s chronic and acute conditions.³ RPM, a type of telehealth that Medicare began covering in 2018, is comprised of three components, with each component building off the one before it:

1. Patient education and device setup (CPT code 99453);
2. Device supply (CPT code 99454); and
3. Treatment management (CPT codes 99091, 99457, or 99458).⁴

RPM has been used to monitor chronic conditions including cardiac diseases (e.g., through blood pressure monitors, Holter monitors), diabetes (e.g., through blood glucose meters), and asthma (e.g., through handheld spirometers, oximeters).⁵ Most Medicare patients who receive RPM utilize it to monitor/treat hypertension (high blood pressure).⁶ In practice, an RPM lifecycle may look as follows: a patient has high blood pressure, such that the patient’s healthcare provider determines RPM to be medically necessary; the patient is provided a connected blood pressure cuff and is educated by their provider on how to use the cuff; the patient regularly uses the device to obtain blood pressure readings, which readings are automatically transmitted by the cuff to the provider; and the provider reviews the provided data, determines the patient’s treatment, and communicates with the patient.⁷

Studies have found RPM to be “a significant factor that improved or maintained the quality of care” and beneficial in managing “chronic obstructive pulmonary disease (COPD) and congestive heart failure (CHF), resulting in fewer emergency department visits, hospital readmission avoidance, and reduced hospital length of stay.”⁸ RPM usage accelerated during the COVID-19 public health emergency – between 2019 and 2022, the number of Medicare beneficiaries utilizing RPM increased from 55,000 to 570,000 patients, an over tenfold increase.⁹ During the same timeframe, Medicare payments for RPM increased by more than twentyfold, from just $15 million in 2019 to $311 million in 2022; on a per-enrollee basis, payments doubled, from $266 in 2019 to $545 in 2022.¹⁰ OIG reported that the payment increase was partially due to the increased length of time patients received RPM services.¹¹

OIG’s report, which examined RPM claims between 2019 and 2022, focuses on three main issues: (1) providers failing to use RPM as intended; (2) fraud and abuse concerns related to RPM; and (3) a lack of information related to the use of RPM for Medicare patients. First, OIG found that approximately 43% of Medicare RPM recipients did not receive at least one of the three components. While OIG acknowledged that the Centers for Medicare & Medicaid Services (CMS) does not require providers to bill for all three components, because the components build off of one another, OIG questioned whether RPM “services are being used as intended.”¹² The component least often billed was the first component – patient education and device setup. In order to bill, and be reimbursed, for this component, the patient must receive education about how to use the device or support setting it up; receive a connected device from their provider; or take/transmit health data readings on at least 16 days in a given month.¹³ Additionally, 12% of Medicare beneficiaries did not receive treatment management, i.e., at least 20 minutes of management services for a patient’s treatment plan, including at least one conversation between the patient and provider, raising questions as to whether RPM was necessary to treat the patient’s condition.¹⁴

Second, OIG reiterated its previously-raised concerns about fraud in RPM, citing its November 2023 Consumer Alert.¹⁵ In that Alert, OIG expressed concern related to Medicare patients being recruited to receive medically unnecessary RPM services. For example, companies were reportedly “cold calling” patients with whom they had no established patient-provider relationship to market their provision of RPM services.¹⁶

Third, OIG found that “Medicare lacks key information for oversight of [RPM].”¹⁷ Medicare does not receive any information about the types of health data being collected or the devices used and does not always receive information related to the specific condition being treated/monitored or who ordered/performed the RPM services.¹⁸ This lack of transparency creates oversight challenges.

In conclusion, the OIG made the following recommendations to strengthen RPM oversight:

1. “Implement additional safeguards to ensure that remote patient monitoring is used and billed appropriately in Medicare”;
2. “Require that remote patient monitoring be ordered and that information about the ordering provider be included on claims and encounter data for remote patient monitoring”;
3. “Develop methods to identify what health data are being monitored”;
4. “Conduct provider education about billing of remote patient monitoring”; and
5. “Identify and monitor companies that bill for remote patient monitoring.”¹⁹

CMS “concurred with” recommendations 1, 4, and 5 and “stated that it would take into consideration” recommendations 2 and 3.²⁰

Healthcare industry stakeholders pushed back on the OIG report, asserting the report’s claims were “confusing, inaccurate and could jeopardize the future of the [RPM] service.²¹ In particular, the Alliance for Connected Care, which advocates for telehealth and RPM on behalf of healthcare and technology organizations, sent a letter asking OIG to consider retracting its report and revising it to “more accurately reflect the way that RPM services are required to be delivered in Medicare.”²² Among the inaccuracies claimed by the Alliance and other stakeholders is OIG’s conclusion that RPM services “are not being used as intended since patients may not have received all three components of monitoring…based on claims reviewed,” listing a number of reasons why a patient may not bill for one of the RPM components.²³ Another stakeholder reasoned that some conditions, such as obesity, do not require 16 days of monitoring each month.²⁴ While OIG asserts that, per CMS commentary in the 2021 Medicare Physician Fee Schedule (MPFS), the agency “considers the RPM codes a family of codes that should be billed together,” the Alliance for Connected Care noted that CMS overruled this consideration in the 2024 MPFS commentary, with the agency clarifying in the final rule that “the 16 day data collection requirement does not apply to CPT codes 99457, 99458, 98980, and 98981. These CPT codes are treatment management codes that account for time spent in a calendar month and do not require 16 days of data collection in a 30-day period.”²⁵

In a subsequent interview, OIG asserted that the goal of the report was to “raise areas of concern” for CMS and clarified that the report does not assert that fraud is occurring in RPM, but that some of the billing patterns raise questions that need to be addressed to prevent misuse.²⁶

Notably, efforts have been underway for years to overhaul the RPM CPT codes, now that the codes have been in use long enough to inform next steps. Some of the efforts include reducing the 16-day reporting requirement and provide an option to bill for less than 15 days of collection (probably at a lower rate), as well as decreasing the patient communication threshold from 20 minutes to 10.²⁷

With the rapid increase in the provision of RPM services has come increased regulatory scrutiny, first with the Consumer Alert, and then with an OIG report. Health lawyers predict continued, and perhaps increased, oversight and enforcement going forward.²⁸