CMS' proposed ban on contracted RPM staff should not survive the comment period

Remote patient monitoring (RPM) allows physicians to collect patient data away from the office, gaining insights that can lead to marked improvements in chronic conditions. The calendar year 2027 Medicare Physician Fee Schedule contemplates significant changes to the delivery and value of RPM. We believe key elements of Medicare’s proposal are clinically and financially misguided. Here’s why.

What CMS is proposing

As proposed, the Centers for Medicare & Medicaid Services would pay for RPM and remote therapeutic monitoring (RTM) services only when clinical staff employed by the billing practice deliver them. Practices using contracted partners would no longer qualify for payment under the service.

Office of Inspector General data behind the proposal

CMS' published materials describe the restriction without detailing the reasoning behind it, but the underlying concern is not new. The Department of Health and Human Services’ Office of Inspector General (OIG) flagged RPM program integrity concerns in September 2024, then followed with a data snapshot analyzing more than 4,600 practices that billed for RPM in 2024. I wrote about those data for Medical Economics when they came out.

Of those 4,600 practices, OIG flagged 45 that predominantly billed for patients with no prior relationship to the practice. One identified practice lacked a prior relationship with more than 30,000 enrollees. CMS is rightfully concerned that this signals an outsourced vendor that is not clinically integrated with its clients. One could see why CMS would think mandating that practices employ the staff delivering RPM services would solve the problem.

There are two fundamental flaws in the CMS proposal:

(1) the vendors the OIG flagged would pass the proposed employment test, whereas the partnerships the test prohibits are ones the OIG never implicated, and

(2) Medicare's existing rules already prohibit the conduct the OIG flagged. The gap is in enforcement, not policy.

Related coverage: Physician Fee Schedule 2027: What physicians need to know now

What health care groups are saying about the 2027 Medicare Physician Fee Schedule

The vendors OIG flagged would pass CMS' proposed employment test

The "medical practice" enrolling 30,000 RPM patients that the OIG flagged is not the medical practice you are likely envisioning: one with an office and exam rooms that delivers ongoing primary or specialty care. Rather, the medical practice in this case is a vendor that exists solely for RPM delivery. It may acquire patients through referrals from third parties or indiscriminate marketing to Medicare-aged patients. The vendor often employs or is owned by one or more billing providers, under whom claims are submitted; that billing provider supervises vendor-employed staff. Note what that structure means under the proposal: Because the vendor directly employs its own clinical staff, it would pass the employment test without changing a thing. The model CMS is trying to stamp out is the one its proposal rewards.

The arrangement the proposal actually prohibits is the opposite structure. A practice that contracts with clinical staff it directs under general supervision, but remains responsible for its own billing, is a distinct arrangement from a vendor billing under its own identifier. The patient's actual physician designs these types of partnerships, which require meaningful clinical integration to succeed. Yet, the proposed rule as written would outlaw them.

There is also a structural reason these partnerships behave differently: Accountability follows the billing. When RPM runs through the patient's own physician, every claim is submitted under that physician's identifier, and audit and repayment exposure land on the practice. The patient on the other end of the program is one the physician will see again in the exam room. The physician has every legal, financial and clinical incentive to demand a compliant, patient-focused program. The vendor-clinic model severs that accountability: The entity submitting claims has no ongoing patient relationship to protect and no supervising physician's license at stake.

As one example, my company supports a 1,630-patient hypertension monitoring program with contracted staff at a California practice. Each month:

• All 1,630 patient monthly reports are reviewed and approved by a practice-employed physician.
• 8.6% of patients trigger at least one communication between our care managers and practice physicians.
• 14.3% of patients trigger at least one communication between our care managers and practice nonphysician clinical staff.
• The patient’s physician has access to and reviews RPM readings with patients during in-office appointments.

The physicians adjust protocols, care plans and workflows to ensure the program meets evolving practice and patient needs.

This is what clinical integration looks like operationally, and none of it depends on who employs the care manager. Enrolled patients with stage 2 hypertension see an average reduction of 10.4 mm Hg systolic and 6.9 mm Hg diastolic blood pressure after just 3 months in the program. Given that the practice does not have the employed staff to run the program independently, this program and these results would not exist without contracted support.

The conduct OIG flagged is already against the rules

Marketing-driven enrollment by vendor-operated clinics already violates Medicare's current rules.

Since the COVID-19 public health emergency ended in May 2023, Medicare has required an established patient relationship before RPM can be billed. That requirement governed throughout 2024, the year of billing data the OIG analyzed. To be established, a patient generally must have received a prior face-to-face professional service from the billing practitioner. Billing RPM for tens of thousands of patients a practice has never seen goes beyond exploiting a loophole. Either the enrollment calls are being mischaracterized as established relationships, or the requirement is being ignored outright, with the practice betting it won't get audited. The OIG's own methodology proves these violations are detectable. It identified the 45 outlier practices through straightforward claims analysis, checking whether the billing practice had any prior claims history with the enrollee. CMS possesses the same data and could direct its contractors to flag, audit or deny RPM claims where the billing provider has no prior evaluation and management relationship with the patient. That is an enforcement problem with an available enforcement solution. New rules do not fix enforcement problems; actors ignoring the current requirement will ignore the next one.

Viewed this way, the employment mandate is a strange remedy twice over. It does not touch the OIG-flagged vendors, who already employ their own staff, and it is not needed for the conduct at issue, which existing policy already prohibits. Program integrity policy should escalate from the least restrictive effective tool, and the least restrictive tool here is one CMS already holds: Enforce the established patient requirement using the claims data the OIG just demonstrated are sufficient to find violators.

Why this should not be the final word

When the federal government expanded Medicare access to RPM in 2019, the service required direct, in-office supervision, which contributed to its slow adoption. The shift to general supervision the following year is what allowed the contracted-staffing model now on the table to develop in the first place.

CMS itself does not present this provision as settled. In my statement on the 2027 PFS proposed rule, I noted that CMS acknowledges lacking the cost and clinical workflow data it says it needs to finalize some of these provisions. The proposal functions, in effect, as a request for that data. CMS has a particularly good track record of changing or withdrawing proposals along these lines once commenters supply the missing detail, particularly here, where the OIG's findings already suggest a different answer.

What to do during the comment period

The comment period runs through September 14. Practices with a stake in the outcome should use it. A few things worth including in a comment:

• A description of how contracted RPM staffing works in the practice, including who directs the clinical work and who bears billing responsibility.
• Reference to the OIG's data on billing relationships between vendors and referring practices.
• Specific details on what an employment requirement would cost the practice in patient access, particularly for practices that currently meet clinical staffing needs through contracted arrangements.
• Outcomes data showing the clinical results of RPM programs delivered through contracted or outsourced staffing.

CMS has asked for exactly the kind of information practices are positioned to provide. The OIG's recommendation already points to it: Require RPM claims to run through the referring practice's own billing, not a vendor's separate identifier. That does not necessitate dismantling a staffing model that's proven to work for practices and hospital systems and has extended RPM's reach to the patients who need it. Comments that make that gap clear are the ones most likely to move this rule before it's final.

Daniel Tashnek, J.D., is the co-founder of Prevounce Health, a health care software and services company that simplifies the provision of preventive medical services, chronic care management and remote patient management. Daniel is also a practicing health care attorney specializing in regulatory compliance, reimbursement, scope of practice and patient care issues.