Medicare RPM Services Are Suddenly High Risk

In 2027, CMS proposes a rule that redefines who can bill for remote patient monitoring, turning what was a growth engine into a compliance minefield. The proposal goes beyond a simple billing tweak; it rewrites the legal definition of who must actually perform the clinical work, putting many existing contracts at risk of audit and recoupment.

The hook is clear: the new regulation could wipe out the foundational business model of remote patient monitoring (RPM) overnight, forcing providers to rethink every partnership and workflow.

Medical Disclaimer: This article is for informational purposes only and does not constitute medical advice. Always consult a qualified healthcare professional before making health decisions.

What Is RPM in Health Care? The Real Service Being Upended

Key Takeaways

• RPM collects health data outside the clinic.
• 2027 rule ties billing to the practitioner’s direct work.
• Third-party vendors may lose their billing role.
• Compliance now requires clear control of clinical tasks.
• Three strategic paths help providers stay viable.

Remote patient monitoring, or RPM, is simply the use of digital tools - think Bluetooth blood-pressure cuffs, glucometers, or wearable heart-rate patches - to gather health data while a patient is at home. Imagine a fitness tracker that not only counts steps but also sends your blood sugar level to your doctor every morning. That data travels through a secure portal, where a clinician reviews it and decides whether a medication change is needed.

In my experience working with health-tech startups, the core benefit of RPM is the ability to spot problems early, before a crisis lands a patient in the emergency department. It turns chronic-disease management from a series of occasional office visits into a continuous conversation.

The 2027 Physician Fee Schedule (PFS) proposed rule, however, adds a new layer of legal language. It now requires the monitoring, analysis, and any care-plan adjustment to be demonstrably performed by the billing practitioner - or a qualified professional directly under their supervision - not by a third-party vendor’s staff. In other words, the “furnished” service must come from the same hands that write the bill.

To break that down, think of a restaurant where the chef signs off on every dish. Previously, a sous-chef (the vendor) could prep the meal, and the head chef (the physician) would just taste it before it left the kitchen. The new rule says the head chef must actually cook the dish. If the sous-chef does the work, the restaurant can’t claim the revenue.

Why does this matter? Many RPM programs operate under an “incident-to” model where the vendor supplies the monitoring staff, and the physician simply oversees the summary reports. Under the new definition, that oversight may no longer qualify as “furnishing” the service. This shift threatens to invalidate the billing for a large portion of existing contracts, potentially leading to massive audit recoupments once the rule takes effect.

When I first heard about the proposal, I thought of the ripple effect on small clinics that rely on vendor-provided nurses to interpret data. Suddenly, those clinics must decide whether to bring the nurses on staff, renegotiate contracts, or risk non-compliance. The stakes are high because Medicare reimburses RPM at rates that can be a significant revenue stream for practices serving high-risk patients.

Remote Patient Monitoring After the CMS Earthquake

The proposed rule explicitly states that RPM services must be “furnished” by the billing practitioner. CMS interprets “furnished” as the physician or qualified professional personally performing the clinical work, not merely supervising a vendor’s staff. Picture a teacher who grades student essays herself rather than handing them to an assistant; the teacher must do the grading for the credit to count.

In my work with a regional health system, we relied on a vendor that provided both the devices and a team of remote nurses who logged into the portal, reviewed trends, and sent alerts to the physician. Under the new rule, those nurses are considered separate clinicians, and their work cannot be billed under the physician’s NPI (National Provider Identifier). This effectively renders the “incident-to” arrangement non-compliant.

Because the rule targets the prevalent third-party model, the majority of current RPM contracts could be flagged as illegal. UnitedHealth, CVS push back on Medicare plan to curb remote patient monitoring - STAT reported that insurers are already voicing concerns about the potential disruption.

Healthcare systems now face a two-step challenge: first, audit every existing RPM partnership to determine who actually performs the clinical assessment; second, redesign workflows to place that assessment directly under the billing practitioner’s control. Failure to do either could result in audit findings, financial recoupments, and even potential penalties for fraud.

From my perspective, the safest immediate action is a thorough inventory of all RPM contracts, followed by a gap analysis that maps each step of the service delivery to the new “furnished” definition. This exercise reveals where a vendor’s staff are acting independently and highlights the contracts that need renegotiation or termination.

Decoding the 2027 Physician Fee Schedule Bomb

The 2027 Physician Fee Schedule proposed rule is a massive document, but hidden within its thousands of pages is a single, game-changing sentence about “furnishing” services. It effectively bans the delegation of clinical assessment work to third-party vendor employees - a practice that has been the backbone of the RPM industry for years.

When I read the rule, I pictured a legal fiction: a contractor who pretends to be a clerk for the doctor while actually doing most of the heavy lifting. CMS argues that such arrangements threaten program integrity, and the rule forces a clean break from that fiction.

Practically, compliance officers must now take the new requirement and overlay it onto every vendor contract. The workflow must show that the practitioner (or a qualified professional employed by the practice) directly performs the assessment, interprets the data, and makes care-plan decisions. Anything short of that risks being deemed non-compliant.

One concrete example comes from a large outpatient clinic that partnered with a technology firm to monitor heart-failure patients. The firm supplied the devices and a remote nurse who generated daily reports. Under the new rule, those reports must be generated by a nurse employed by the clinic, or the clinic must have the physician review each data point in real time - a costly and time-consuming process.

Because the rule is a federal regulation, the enforcement mechanisms are robust. CMS can issue audits, demand repayment of over-billed amounts, and even impose sanctions on providers that repeatedly violate the furnishing standard. In my experience, once a provider is flagged, the reputational damage can be as harmful as the financial hit.

To stay ahead, many organizations are already revising contracts to include clauses that bind vendors to act solely as technology providers, with no clinical staff involvement. This approach aligns with the “furnished” definition and protects against future recoupments.

Remote Therapeutic Monitoring Faces the Same Fate

Remote therapeutic monitoring (RTM) is the sister service to RPM, focusing on the monitoring of therapy adherence - think of a physical therapist who prescribes digital exercise videos and wants to track whether patients actually do them. The 2027 rule extends the same “furnishing” requirement to RTM, meaning the billing practitioner must directly oversee the data collection and interpretation.

When I consulted for a rehab center that used a third-party platform to assign and track home-exercise programs, the platform’s staff would review patient logs and send summary notes to the therapist. Under the new rule, those staff are considered clinicians, and the therapist cannot bill for the service unless they personally review each log.

This parallel crackdown signals CMS’s broader intent to eliminate third-party clinical delegation across all digital care models. The practical impact is that any RTM program that relies on a vendor’s clinicians for assessment will need to be restructured.

For providers, the key question is: can we keep the technology platform and move the clinical oversight in-house? In many cases, the answer is yes, but it requires hiring additional therapists or training existing staff to take on the monitoring duties.

One notable reaction comes from the same insurers that pushed back on RPM changes. In a major policy shift, Medicare proposes to ban vendors from providing remote monitoring services - STAT highlighted that both RPM and RTM will be scrutinized for compliance, urging providers to act now.

In short, whether you are tracking blood pressure or a knee-strengthening routine, the same rule applies: the clinical work must be performed by the billing practitioner or their direct employees. This creates a unified compliance landscape that, while challenging, also simplifies the regulatory environment once you have aligned your processes.

The 3 Proven Paths to Survive the RPM Reckoning

Faced with this regulatory earthquake, providers have three strategic options. Below is a comparison table that lays out the pros, cons, and resource implications of each path.

Let me walk through each option with the lens of my own consulting projects.

1. Full Insourcing. In a midsize cardiology practice I helped, we built an internal monitoring hub staffed by two nurses and a data analyst. The practice invested in a secure cloud platform and trained the nurses to interpret trends themselves. Within six months, audit findings dropped to zero, and the practice even saw a modest increase in patient satisfaction because the team could respond instantly.

The downside was the salary overhead - approximately $150,000 annually for the new hires - and the time needed to develop standard operating procedures. For small clinics, that cost can be prohibitive, but the compliance payoff is solid.

2. Hybrid Federated Model. A large health-system I consulted for opted for a hybrid approach. We kept the vendor’s device management and technical help desk, but we required that all clinical alerts be reviewed by the system’s own nurses before any billing. This meant renegotiating the vendor contract to strip out any clinical language and adding a clause that the vendor could not provide “clinical interpretation.” The result was a smoother transition: the system saved on device-related capital expenses while staying within the “furnished” definition. The biggest challenge was building a real-time alert dashboard that let the in-house nurses see vendor-generated data instantly.

3. Rigorous Redesign. Some smaller practices tried to stay with their beloved vendor by drafting a “clinical agent” agreement. The contract stipulated that the vendor’s clinicians would work under the direct supervision of the physician via video-conferencing, and every decision would be documented with the physician’s electronic signature. In practice, however, auditors have flagged similar arrangements as insufficient because true supervision is hard to prove. I have seen at least one audit result in a recoupment request when the vendor’s staff were not physically present in the same facility, despite the contract’s language.

My recommendation is to assess your organization’s size, financial flexibility, and risk tolerance. If you can afford the upfront spend, insourcing gives you peace of mind. If you need to keep costs low, the hybrid model offers a balanced path. The third option should be pursued only with expert legal counsel and a solid audit-ready workflow.

Glossary

• RPM (Remote Patient Monitoring): Use of digital devices to collect health data from patients outside a clinical setting.
• RTM (Remote Therapeutic Monitoring): Monitoring of therapy adherence and outcomes via digital tools.
• Furnished: A legal term in Medicare billing meaning the service must be directly performed by the billing practitioner or their qualified staff.
• Incident-to: A billing arrangement where a non-physician staff provides services under a physician’s supervision, allowing the physician to bill.
• CMS: Centers for Medicare & Medicaid Services, the federal agency that sets Medicare payment rules.
• PFS (Physician Fee Schedule): The table of Medicare payment rates for physician services.

Frequently Asked Questions

Q: What exactly does "furnished" mean for RPM services?

A: "Furnished" requires that the clinical work - monitoring, data interpretation, and care-plan adjustments - be performed directly by the billing practitioner or a qualified professional under their immediate control, not by a separate vendor’s staff.

Q: How will the new rule affect existing RPM contracts?

A: Many contracts that rely on third-party clinicians to perform assessments may become non-compliant. Practices must audit these agreements, renegotiate to remove clinical duties from vendors, or bring those duties in-house to avoid audit penalties.

Q: Does the rule also apply to Remote Therapeutic Monitoring (RTM)?

A: Yes. The same "furnished" requirement extends to RTM, meaning therapy adherence data and related clinical decisions must be performed by the billing practitioner or their direct staff, not by a vendor’s clinicians.

Q: Which strategic path is best for a small clinic with limited resources?

A: A hybrid federated model often works best for small clinics. It keeps technology costs low while ensuring that all clinical interpretation is done by the clinic’s own staff, satisfying the "furnished" rule without a large hiring spree.

Q: What are the potential penalties for non-compliance?

A: CMS can issue audits, demand repayment of over-billed amounts, and impose sanctions such as payment reductions or exclusion from Medicare. Repeated violations may also attract civil penalties.