Remote patient monitoring (RPM) has been one of the fastest-growing service lines in Medicare since 2019, and the 2026 OIG Work Plan now flags RPM billing patterns for review. The agency is asking three specific questions about every billed CPT 99454 claim: was there a valid physician order, did the patient transmit data on at least 16 distinct days within the 30-day billing period, and is there a clinical interpretation tied to the data that justifies medical necessity. The 2026 fee schedule also makes 99445 and 99454 mutually exclusive within a 30-day period, which means any practice billing both for the same patient in the same window will trigger automated review.
The 16-day rule and what counts
CPT 99454 reimburses for the device supply and data transmission portion of RPM, and it requires at least 16 days of automated transmission within a consecutive 30-day window. The 2026 update clarifies that measurement days count regardless of device type, so readings from a connected blood pressure cuff on Monday and a glucose meter on Tuesday count as two distinct days. What does not count: manually entered data, days with only patient-initiated check-ins (not device data), and days where the device transmitted but the data failed quality checks. The defensible audit trail captures the source of every transmission, the time stamp, and the data quality outcome.
The physician order: missing more often than billed
OIG audits consistently find practices billing 99454 without a physician order in the chart that names the diagnosis, the device type, the monitoring frequency, and the clinical reason for monitoring. A standing order from an enrollment visit is not enough; the order must be specific to the patient and the device. The fix is a templated order signed at the initiation of monitoring (CPT 99453) that becomes the foundation for every subsequent monthly bill. Without it, the entire claim chain (99453 setup, 99454 transmissions, 99457 and 99458 management time) is at risk.
Time logs that hold up
CPT 99457 (first 20 minutes of clinical staff time on RPM management per calendar month) and 99458 (each additional 20 minutes) require minute-level time documentation, not estimates. The audit-defensible format is time-in and time-out for each interaction, plus a one-line description of the activity. Vague entries like “RPM review, 25 minutes” fail the test. Specific entries like “08:30 to 08:42, reviewed 7 days of glucose data, identified pattern of post-prandial highs, called patient to discuss medication timing change, 12 minutes” pass it. The difference is not effort, it is a one-time template change that staff can use consistently.
Medical necessity interpretation
The most subtle audit finding is the absence of clinical interpretation. RPM data without a documented review and clinical response is monitoring without management, and CMS policy treats those as different services. Each monthly billing period needs at least one clinical note that references specific data trends (not “data reviewed”), a clinical assessment, and any care plan adjustments. For cardiology programs running CIED or heart failure monitoring, this means tying device data to specific clinical events. For diabetes programs, it means linking glucose patterns to medication adjustments or lifestyle counseling. Without this thread, the bill looks like data collection rather than care.
Mutual exclusivity in 2026
CPT 99445 (the new short-window RPM code introduced in 2026 for 2 to 15 days of monitoring within a 30-day period) and 99454 cannot be billed for the same patient in the same 30-day period. Practices running mixed protocols (some patients on continuous monitoring, others on short-window evaluation) need a tagging system in their RPM platform that prevents accidental dual billing. Audit findings in this category typically result in full repayment plus extrapolation, because the violation is mechanical and easy for OIG to identify in claim data.
The HIPAA-compliant data trail
Audit-readiness includes the technical infrastructure. Transmitted data must be stored in a HIPAA-compliant environment with full audit logging of access, transmission, and clinical review. Practices using consumer-grade devices that sync to non-compliant cloud services can lose entire programs in a single audit, regardless of clinical quality. Verifying the device vendor’s BAA, the transmission encryption, and the audit log capability before scaling a program is cheaper than retrofitting compliance after a notice arrives.
How MHB helps RPM programs stay audit-ready
For practices that want their RPM billing reviewed by specialty-trained coders before claims go out, with order verification, transmission-day audits, time-log review, and 99445/99454 conflict checks built in, our team supports medical coding for RPM programs across cardiology, endocrinology, pulmonology, and behavioral health. The work integrates with major RPM platforms.
The bottom line
RPM is one of the OIG’s specifically named 2026 audit lanes, and the rules are mechanical enough that errors are easy to find in claim data. The defense is not stopping the program. It is making sure the order, transmission days, time logs, clinical interpretation, and data infrastructure are documented at the time the claim is generated, not reconstructed after a notice arrives.
