What OIG Compliance Actually Looks Like in an RPM Program

← Back to Blog

"We're compliant" is something I hear from a lot of practices running RPM programs. When I ask what that means specifically, the answers get vague. OIG compliance in an RPM program isn't a general posture — it's a checklist of specific requirements, each of which must be documented per patient, per month. Here's what the checklist actually looks like.

Per-patient enrollment requirements:

• A physician order for RPM, specific to the patient and the condition being monitored
• Written patient consent documenting that the patient understands what RPM involves, including any costs
• A specific ICD-10 code linked to the monitoring rationale — not a generic chronic condition code, but the condition being actively tracked

Monthly billing requirements:

• Day-count documentation: exact number of days readings were received, used to determine whether 99445 or 99454 applies
• Time documentation for management codes: exact minutes logged for 99457/99470, with a record of who performed the review
• Interactive communication: a documented two-way communication event between clinical staff and the patient each month — required for 99457 and 99470. Voicemail doesn't count.
• Clinical decision documentation: what did the monitoring data show, and what clinical decision (if any) resulted from that review?

Separation from other billed services: RPM time cannot overlap with CCM time. If a clinician spends 30 minutes reviewing RPM data and coordinating care, those 30 minutes must be allocated between the two services in the documentation — not claimed in full for both.

Programs that build these requirements into their workflow from day one — not as an audit-response afterthought — find that compliance becomes automatic. The documentation happens as a byproduct of clinical practice, not as a separate administrative burden. That's the goal: a program where the billing is a natural consequence of doing the clinical work right.

← Back to Blog