When remote patient monitoring (RPM) surged during the pandemic, the appeal was clear: Give physicians real-time insights and intervene early to prevent complications. Medicare’s coverage accelerated adoption, and use continued to rise.

That growth has also drawn government attention. The Office of Inspector General (OIG) has issued two RPM reports, most recently in August 2025, underscoring Medicare’s sharpened focus on how these services are billed and used. Medicare payments exceeded $500 million in 2024, and nearly one million beneficiaries received RPM, prompting OIG to urge stronger safeguards.

“Broad billing codes can create incentives for misuse, so oversight is a natural response,” said Jared Conley, MD, PhD, MPH, emergency physician and researcher at Massachusetts General Hospital and Harvard Medical School, Boston, who studies digital care models. “The goal should be to refine, not restrict, RPM’s use. Clinicians see the promise, but they need clearer guidelines to apply it where it makes the greatest impact.”

Red Flags for Providers

OIG’s findings point to practices that can draw scrutiny, such as enrolling patients without a prior medical relationship, billing multiple devices for the same patient in a single month, or reporting monitoring without billing any treatment-management time. Each pattern suggests RPM may be disconnected from routine clinical practice. Regulators are essentially asking the same questions physicians ask at the bedside: Is the service medically necessary, and is the data being used to inform care?

Thomas T.J. Ferrante, attorney and partner at Foley & Lardner LLP who advises health systems and practices on digital health compliance, said medical necessity is the standard regulators emphasize. “Some organizations that have been investigated treated RPM like a subscription, billing month after month,” he said. “That’s not how Medicare views compliant billing. The expectation is that monitoring is tied to a care plan and adjusted as the patient’s condition evolves.”

Ferrante said enforcement has picked up. “In the last 18 months, we’ve had at least half a dozen government audits, when before we saw very few,” he said. “Large health systems are also auditing their vendor relationships after government warnings. They sometimes find no documentation of interactive communication or required data thresholds weren’t met, which has led to self-reporting and repayment.”

Before You Bill for RPM

Experts emphasize that the best defense is strong documentation showing RPM is integrated into care. Records should:

• Explain why monitoring is necessary at this time
• Explain how it supports the patient’s condition
• Demonstrate patient understanding of the program

For Medicare patients, there must be evidence of an in-person or telehealth visit before initiating monitoring. 

Clinical notes should show how the data informed care — eg, through trend review, medication changes, threshold-based outreach, or patient education. Auditors pay close attention to whether treatment-management services are consistently documented and supported by the record.

Accuracy in coding is central to compliance. RPM codes establish requirements for data days and treatment-management minutes; practices must be able to demonstrate that thresholds are met. Reviewing claims rather than relying solely on vendor systems reduces errors. Third-party contracts should also address Health Insurance Portability and Accountability Act protections, audit trails, and breach procedures.

Technology and patient factors can pose hurdles as well. Devices may perform inconsistently, integration into records is uneven, and privacy obligations require clear communication about how data will be used. Engagement is equally critical — patients may stop transmitting data, struggle with setup, or feel weighed down by continuous tracking. Education, simple escalation rules, and regular feedback help sustain participation.

Balancing Promise and Risk

Even with added oversight, RPM remains a powerful tool for managing chronic conditions and catching deterioration early. Additional guidance is emerging from initiatives such as the RPM Leadership Council, which promotes principles centered on continuity of care, targeted patient selection, and billing practices, and the 2026 Remote Patient Monitoring Leadership Summit, co-chaired by Conley and focused on case studies and best practices.

He emphasized that physician judgment remains essential in evaluating how devices perform in real-world settings. “FDA clearance may be based upon a predicate device from very different settings or populations,” he said. “The questions are whether the device is accurate in your population, whether the data actually changes management and improves patient outcomes. Otherwise, RPM risks becoming noise rather than delivering true value.”

Conley believes the economics can work in favor of patients and health systems if programs focus on those most likely to benefit. “We’ve seen great outcomes and savings for RPM in the hospital-at-home use case, for instance,” he said. “The savings and improved patient outcomes could be substantial if we use RPM where it truly changes outcomes.”

Ferrante added that recent coding refinements have made compliance more realistic. A patient who transmits fewer days of data than older rules required, or who needs slightly less treatment-management time, may still qualify.

“That better reflects what happens in practice,” Ferrante said. “But the fundamentals haven’t changed: Document the treatment plan, show that the data informed decisions, and make sure the service is reasonable and necessary. That’s what survives an audit.”