Last updated: July 14, 2026
The 2026 Medicare Physician Fee Schedule brought the largest set of RPM billing changes in program history. At the same time, the HHS Office of Inspector General ramped up enforcement activity. Cardiology practices billing CIED and chronic condition monitoring codes now face two pressures at once: capture new reimbursement opportunities and survive tighter documentation scrutiny.
CMS introduced CPT 99445 (device supply, 2 to 15 transmission days, roughly $47 to $52 per month) and CPT 99470 (treatment management, 10 to 19 minutes, roughly $26 per month) effective January 1, 2026. These codes fill a gap that previously left low-adherence patients unbillable. Reimbursement rates for existing codes rose too, marking the first rate increase for time-based remote monitoring services in five years.
The financial upside comes with real audit exposure. The OIG's August 2025 Data Snapshot found nearly one million Medicare beneficiaries received RPM services in 2024, generating about $536 million in payments, a 31% increase over the prior year. That growth drew direct enforcement action: the DOJ secured a $1.29 million False Claims Act settlement in June 2025 against a provider for improperly billed RPM services. Unified Program Integrity Contractors are now actively targeting RPM and RTM claims, and findings can trigger payment suspensions and extrapolated overpayment demands. OIG has also recommended that CMS require RPM services to be ordered by a physician or qualified practitioner, with that ordering information listed on claims.
That enforcement pressure makes eligibility documentation non-negotiable before the first claim goes out. Medicare requires a chronic or acute condition needing monitoring, plus an internet-connected device meeting the FDA's medical device definition that transmits health data at least 2 days every 30 days. A valid physician order must come from an established patient relationship, meaning at least one face-to-face encounter in the prior year.
Only one practitioner may bill RPM for a given patient in any 30-day period. RPM can be billed alongside CCM or APCM, but only when the work and minutes are documented separately with no double-counting. Payer rules vary further: commercial plans, Medicaid, and Medicare Advantage apply different RPM requirements than traditional Medicare, including inconsistent acceptance of new codes 99445 and 99470. UnitedHealthcare, for instance, postponed a planned policy that would have limited RPM coverage to heart failure and hypertensive disorders of pregnancy patients. Check payer-specific rules before submitting any claim.
CMS distinguishes RPM from Remote Therapeutic Monitoring based on the data collected. RPM covers physiologic data. RTM covers non-physiologic therapeutic data. The two cannot be billed together for the same patient in the same period.
RPM devices must be FDA-cleared medical devices. Consumer fitness trackers like Fitbit or Apple Watch don't qualify unless cleared for the specific clinical parameter being monitored. Qualifying devices include blood pressure monitors, glucometers, pulse oximeters, digital weight scales, and cardiac implantable electronic devices such as pacemakers, ICDs, and CRT devices. For cardiology programs, this extends to CardioMEMS pulmonary artery pressure sensors, implantable loop recorders, and cellular-connected weight scales used in heart failure management.
The 2026 rule sharpens the line between RPM physiologic data and RTM therapeutic data, and prohibits substituting one for the other. That distinction matters more each year: circulatory system diagnoses rose from 49.0% of RPM visits in 2020 to 59.8% in 2024, concentrating utilization in cardiovascular and metabolic conditions.
CPT 99453 covers one-time device setup and patient education. CPT 99454 covers ongoing device supply and data transmission. The two aren't mutually exclusive by definition, but strict same-month restrictions govern how they interact with the 2026 code set.
CPT 99453 can be billed only once per device, and must be reported in different months when a patient receives multiple devices. CPT 99454 requires transmission on at least 16 separate days within a 30-day period. Multiple readings on one day count as a single transmission day, and manual entry never qualifies. New CPT 99445 covers 2 to 15 transmission days and is mutually exclusive with 99454. Only one device supply code applies per month.
The same exclusivity applies to time-based codes. 99470 and 99457 are mutually exclusive per calendar month. Once a patient reaches 20 minutes, only 99457 plus 99458 add-ons apply; 99470 covers only 10 to 19 minutes with no add-on available. CPT 99458 covers each additional 20-minute block, cannot be billed without 99457 first, and caps at two uses per month. Getting these combinations wrong is a known audit flag: HHS OIG report OEI-02-23-00260 flags duplicate 99453 billings as automated overpayments, especially during device swaps without a documented new episode of care.
The 2026 CMS final rule, effective January 1, represents the biggest restructuring of RPM billing since the program began. It adds 2 to 15 day device supply codes and 10 to 19 minute treatment management codes alongside existing longer-duration options. Selecting the right device supply code now requires documenting exact transmission dates and total monitoring days; management code selection requires documenting time spent reviewing data and making care decisions.
CMS treats RPM as a longitudinal ongoing service requiring documented medical necessity, not a short-term episode of care. The rule requires RPM and RTM to function as clinically integrated services, with clear attribution of work to eligible staff and a defensible link between data, patient interaction, and clinical decisions. OIG has gone further, recommending more specific RPM codes or modifiers since current codes are generic. Practices should document detailed device and data information proactively.
These stricter documentation standards still operate within a flexible supervision framework. Congress extended COVID-era telehealth provisions through 2027, preserving audio-only and audio-video supervision options for RPM without geographic restriction. CMS does not classify RPM as a telehealth service, so RPM codes carry no originating-site restrictions and remain billable for home monitoring regardless of location.
General supervision applies in most cases, meaning the billing practitioner doesn't need to be present during monitoring activities, though billing responsibility stays with the practitioner of record. Codes 99457 and 99470 still require at least one real-time interaction each month, and telehealth extensions allow virtual touchpoints to satisfy that requirement.
Every rule above converges on one practical question: can your practice retrieve the right documentation per patient per billed period? CMS, OIG, and UPICs evaluate the same ten items when reviewing RPM claims.
Cardiology practices managing CIED and HF/HTN populations run into a specific problem: device data lives in separate OEM portals, time gets tracked manually, and consent workflows sit disconnected from billing. These gaps are what drive most of the claim denials and audit findings tied to the checklist above.
Rhythm360, developed by RhythmScience, is a vendor-neutral, HIPAA-compliant platform built for exactly this workflow. It consolidates data from Medtronic, Boston Scientific, Abbott, Biotronik, and other manufacturers into one audit-ready workspace, removing the need to check separate OEM portals one by one.
The platform's automated CPT code capture maps directly to the ten checklist items: consent logging with staff attribution, activity-level time tracking for codes 99445, 99454, 99457, 99458, and 99470, transmission-day verification against billing thresholds, and exportable documentation per patient per period. A Twilio-powered communication hub logs every patient interaction with a full audit trail, and bi-directional EHR integration with Epic, Cerner, and Athenahealth removes manual transcription.
After implementing the platform, a University of Chicago Medicine clinician noted: "We have improved billing and accountability for our patients after the integration." Practices using Rhythm360 have reported up to a 300% increase in revenue capture and an 80% reduction in response time for critical patient alerts.
See a live walkthrough of Rhythm360's audit-ready documentation workflow.
| Compliance Requirement | Rhythm360 Capability |
|---|---|
| Patient consent documentation | Automated consent logging with date, time, and staff attribution stored before billing begins |
| Clinical time tracking | Activity-level time tracking with staff identity and timestamps for 99457, 99458, 99470, and 99445 |
| Device qualification verification | Vendor-neutral ingestion from FDA-cleared devices with automated transmission-day counting for 99445 and 99454 thresholds |
| Audit-ready documentation export | Structured, exportable records including consent, orders, transmission summaries, and time logs per billed period |
| Interactive communication logging | Twilio-powered call and message logging with full audit trail for 99457 and 99470 |
| EHR integration | Bi-directional HL7 integration with Epic, Cerner, Athenahealth, eClinicalWorks, and others |
The 2026 RPM billing landscape gives cardiology practices a real revenue opportunity. New codes 99445 and 99470 extend reimbursement to shorter monitoring periods, and rate increases across the existing code set reward practices that document correctly. The risk runs alongside that opportunity: OIG's five flagged billing patterns and 2025's record False Claims Act enforcement mean sloppy documentation now carries real financial consequences.
For electrophysiology clinics and cardiology practices managing CIED populations alongside HF and HTN patients, multi-device workflows and OEM data fragmentation make this compliance burden harder to manage. Several remote monitoring platforms serve this market, including Paceart, Murj, PaceMate, Implicity, Rhythm Management Group, and Octagos.
Separately, Rhythm360 addresses the specific gaps outlined in the checklist above: automated consent logging, activity-level time tracking, transmission-day verification, and audit-ready export, all built around a vendor-neutral data layer and EHR integration.
Talk to the Rhythm360 team about your practice's RPM compliance workflow.
Both codes cover RPM device supply and data transmission, but apply to different monitoring day thresholds within a 30-day period. CPT 99445 covers 2 to 15 unique transmission days and reimburses at roughly $52. CPT 99454 covers 16 or more days at the same rate. The two are mutually exclusive, so only one applies per patient per 30-day period. Verify the exact transmission count from device logs before choosing. Multiple readings on the same day still count as one transmission day, regardless of device count.
OIG's August 2025 Data Snapshot flagged five specific patterns: enrollment spikes of 150% or more month-over-month, billing for patients with no prior in-person relationship, device supply billing without corresponding treatment management, overlapping claims from multiple providers for one beneficiary, and billing for multiple devices per patient per month. Cardiology practices also commonly trigger findings through duplicate 99453 billings during device swaps, vague time entries, and missing interactive communication records. Quarterly audits of a 10 to 20% patient sample catch these issues before external reviewers find them.
Rhythm360 maps its automation directly to the audit items covered earlier in this article: consent logging, activity-level time tracking for codes 99445 through 99470, transmission-day verification, interactive communication logs, and bi-directional EHR integration. The result is documentation that stays audit-ready across both CIED and HF/HTN service lines without manual portal checking.
Yes, under 2026 rules, provided staff time for each program is tracked and documented separately with no overlap. A single minute of staff time cannot count toward both. Each program needs its own consent, its own physician order, and its own time logs with date, duration, activity, and staff identity. RPM and RTM, by contrast, cannot be billed together for the same patient in the same period since CMS treats them as duplicative.
Four categories must be in place first. Patient consent needs to cover participation, single-provider billing, cost-sharing disclosure, and revocation rights. A valid physician order must come from an established relationship and specify the condition and monitoring type. The device must be FDA-cleared with automated transmission, since manual entry doesn't qualify. Medical necessity must link to a specific ICD-10 diagnosis with clinical rationale. Verbal consent is acceptable under CMS rules, but it must be logged with the date, time, and staff name who obtained it.
