The OIG's RPM Audit Playbook: What Auditors Are Actually Looking For in 2026

← Back to Blog

The OIG's Fall 2025 Semiannual Report named remote patient monitoring a high-risk billing area heading into 2026. That's not a vague warning — it's a signal that RPM claims are being pulled for review at a higher rate than before. Understanding what auditors are specifically looking for is the first step to making sure your program isn't the one getting flagged.

The five most common RPM audit triggers in 2026:

1. Missing component documentation. Each RPM code has specific requirements — day counts for device supply codes, time logs for management codes, interactive communication records for 99457 and 99470. Auditors aren't satisfied by a general note saying "patient was monitored this month." They want to see the specific data that justifies the code billed.

2. Vague ICD-10 codes. Billing RPM with a non-specific diagnosis code (e.g., "essential hypertension" without clinical context) raises flags. Auditors want to see that the condition being monitored is documented as requiring ongoing remote oversight — not just listed as a background diagnosis.

3. New code documentation gaps. CPT 99445 and 99470 are new in 2026. Many practices are billing them correctly but without the documentation specificity those codes require — exact day counts for 99445, exact minute ranges (10–19) for 99470. Vague time entries don't support new codes the way they might have supported older ones under audit tolerance.

4. Time double-counting between RPM and CCM. If your records show a clinician spent 25 minutes reviewing RPM data and coordinating care — and that same 25 minutes appears in both the RPM management note and the CCM time log — that's a bundling violation. Both services are auditable independently, and the overlap will surface.

5. Enrollment without documented clinical rationale. A physician order and patient consent are required. But auditors are also looking for documented clinical justification: why does this patient need remote monitoring? What condition are you tracking, and why does it require daily data? Programs that enroll broadly without per-patient rationale are the ones generating findings.

The programs that sail through audits aren't doing anything extraordinary — they're just treating documentation as a clinical responsibility, not a billing afterthought.

← Back to Blog