Healthcare Compliance Guide for Cardiac RCM & CIED Billing

Last updated: July 14, 2026

Key Takeaways

• Compliant CIED remote monitoring billing requires documented physician or NPP review, clinical interpretation, and correct CPT code submission within 30 or 90-day monitoring windows.
• Seven compliance steps cover device eligibility, consent, medical necessity orders, monitoring period tracking, and clinician interpretation for every episode.
• Five regulatory layers, device requirements, transmission intervals, consent and orders, non-overlap rules, and documentation standards, must all be satisfied to avoid claim denials.
• 2026 CMS rules enforce strict non-overlap between CIED codes (93294 to 93298) and general RPM or CCM codes. Audit triggers include missing consent, vague notes, and duplicate billing.
• Rhythm360 automates interval tracking, consent capture, and audit-ready documentation. Talk to our team about your CIED program.

The 7-Step Checklist That Prevents Most CIED Billing Denials

1. Verify device eligibility. Confirm the implanted device type (pacemaker, ICD, ILR, subcutaneous cardiac rhythm monitor) and map it to the correct CPT code family (93294 to 93298) before enrollment.
2. Obtain and document patient consent. Capture consent before device activation. Record the date, time, method, and the name of the staff member who obtained it.
3. Establish a physician order with medical necessity. Document why remote monitoring fits this specific patient, condition, and time period. Standing enrollment without periodic reassessment is a top audit vulnerability.
4. Track monitoring periods, not transmissions. Bill 93294 and 93295 once per 90-day period. Bill 93297 and 93298 once per applicable 30-day window. Never bill per individual transmission.
5. Require a clinician interpretation for every episode. A physician or qualified NPP must review device function, programmed parameters, and actionable findings, then document that review at the time it happens.
6. Apply non-overlap rules before claim submission. Confirm CIED interrogation codes are not double-billed alongside RPM (99453/99454/99457) or CCM codes for the same time and effort in the same period.
7. Audit documentation before submission. Check that consent records, enrollment notes, monitoring logs, and interpretation notes are complete, specific, and tied to clinical decision-making, not copy-paste summaries.

Rhythm360 automates each of these steps inside one vendor-neutral platform. See how automated interval tracking closes the gaps this checklist is designed to catch.

Why Five Regulatory Layers Determine Whether Your Claim Gets Paid

Every compliant CIED remote monitoring claim rests on five interdependent layers. Miss any one of them and denial risk goes up, no matter how well you manage the rest.

1. Device requirements. The implanted device must match an appropriate CPT code for remote interrogation.
2. Transmission intervals. CMS fixes the monitoring periods. Billing outside the window, or more than once per window, triggers automatic denial.
3. Consent and orders. CMS requires documented patient consent before services begin, plus a physician order establishing individualized medical necessity.
4. Non-overlap rules. CIED interrogation codes, general RPM codes, and care management codes occupy distinct billing lanes. Crossing lanes without proper time separation is a primary audit trigger.
5. Documentation standards. Incomplete or inconsistent documentation remains the top reason for RPM and RTM denials under 2026 CMS audit patterns.

These five layers set the standard. The next question is how the CMS clock actually runs on each CPT code, since timing mistakes cause most of the denials tied to layer two.

How the 2026 CMS Clock Works for Each CPT Code

The table below breaks down the 2026 billing intervals for CPT codes 93294 to 93298. As noted above, every code is billed per monitoring period, not per transmission received.

The 2026 rules narrow the 93298 window specifically, cutting the minimum monitoring period to 2 to 15 days for subcutaneous monitors. That shorter window means practices need faster review turnaround for this device type than for pacemakers or ICDs.

Medicare requires a minimum 30-day monitoring period before 93294 or 93295 becomes billable. Because these codes cap out at once per 90-day window, billing 93295 twice within 90 days for the same patient and device triggers a CO-18 duplicate denial. A similar rule governs loop recorders: 93297 is billed once per 30-day period, on day 31, for review and interpretation of all transmitted device data.

What Counts as Audit-Ready Consent and Documentation

Patient consent for CIED remote monitoring is not a one-time exercise. A compliant consent record needs these elements:

• Date and time consent was obtained
• Method: verbal or written
• Name of the staff member who obtained consent
• Confirmation that the patient understands what data will be collected and any cost-sharing obligations

Consent must be re-addressed when programs change materially, for example when adding a new monitoring modality or switching device manufacturers.

The physician order must establish individualized medical necessity. As noted earlier, standing enrollment without reassessment remains a top audit vulnerability under 2026 CMS PFS guidance.

Minimum documentation for each billable episode includes:

• Patient demographics
• Device type and manufacturer
• Dates of the monitoring period
• A clinician interpretation note addressing device function, programmed parameters, and actionable findings

Under 2026 CMS PFS rules, only time spent by eligible personnel on monitoring, reviewing data, and engaging in communication that shapes treatment counts toward time-based codes. Passive data accumulation and automated alerts without human review do not count.

Where CIED Codes and General RPM Codes Can and Cannot Overlap

The table below maps the billing lanes for CIED and general RPM codes. The key takeaway: each code family has its own clock, and crossing lanes without separating time and effort is what gets claims flagged.

Practitioners receiving a global surgery payment may bill RPM or RTM, but not both concurrently, during the global period.

The Documentation Habits That Trigger Most Audits

CMS 2026 PFS commentary flags copy-paste notes, generic monthly summaries, and vendor-generated time logs without clinical context as high-risk practices. Each item below reflects a specific way that risk shows up on a claim:

• Missing or undated consent records
• Vague enrollment notes that don't establish individualized medical necessity
• Billing the same CPT code more than once within the defined monitoring window
• RPM and RTM billed together without clear service distinction
• Management codes billed without credible time documentation or interactive communication
• Interpretation notes that skip device function, programmed parameters, or actionable findings
• Submitting full monthly codes when data transmission or time thresholds weren't met

HIPAA security obligations apply to every platform used in CIED remote monitoring. Any third-party vendor handling protected health information must operate under a signed Business Associate Agreement. Platforms need encryption in transit and at rest, access controls, and audit logging strong enough to hold up in an OIG review.

Manual workflows make every one of these triggers more likely. That's the gap automated platforms are built to close.

How Rhythm360 Closes the Compliance Gaps Manual Workflows Leave Open

Rhythm360 is a vendor-neutral, HIPAA-compliant platform built for the operational complexity of CIED remote monitoring. Instead of requiring staff to log into separate portals for Medtronic, Boston Scientific, Abbott, Biotronik, and other manufacturers, Rhythm360 ingests and normalizes data from all major OEMs into one dashboard. This eliminates the manual reconciliation that creates documentation gaps and missed billing windows.

The platform tracks monitoring periods automatically, flagging 90-day and 30-day windows before they lapse. Consent and order capture are built into the enrollment workflow. Clinician interpretation prompts connect directly to each transmission review. Audit-ready documentation gets generated as the work happens, not reconstructed later. Rhythm360 achieves over 99.9% data transmissibility through redundant data feeds, computer vision, and AI-powered extrapolation, so practices aren't exposed to denials caused by OEM server outages or incomplete data.

Practices using Rhythm360 have cut critical alert response times by up to 80% and improved billing outcomes by as much as 300% through better CPT code capture and fewer denials. Other platforms in this space, including Paceart, Murj, PaceMate, Implicity, Rhythm Management Group, and Octagos, cover portions of the cardiac monitoring workflow. Rhythm360 connects clinical data, compliance documentation, and billing readiness in one place.

Request a walkthrough of how Rhythm360 handles interval tracking, consent capture, and audit-ready documentation for your CIED patient population.

Using This Checklist for Your Next Claim Cycle

The 7-step checklist at the top of this guide aligns with current CMS Physician Fee Schedule guidance and MAC billing articles for CIED remote monitoring. Billing managers can use it as a pre-submission review tool for every claim cycle. For the most current MAC-specific coverage articles governing 93294 to 93298 in your jurisdiction, consult your regional Medicare Administrative Contractor directly through CMS.gov.

Frequently Asked Questions

Can a practice bill CPT 93294 and 93295 for the same patient on the same date?

No. CMS rules don't permit billing 93294 and 93295 on the same date for the same patient. Each code corresponds to a distinct device type, 93294 for pacemakers and 93295 for ICDs, and each bills once per 90-day monitoring period per device per patient. If a patient has both a pacemaker and an ICD from separate implant events, check your MAC's coverage article for guidance, since payer policies vary.

What happens if a patient does not transmit data for the full monitoring period?

CMS requires claims to reflect actual services delivered. If transmission thresholds or time requirements aren't met within the monitoring period, billing must be reduced or withheld for that period. Submitting a full-period code when minimum monitoring activity didn't occur is a common audit trigger. Track transmission activity in real time so billing decisions rest on documented data, not assumptions.

Is verbal consent sufficient for CIED remote monitoring billing, or must it be written?

Verbal consent is acceptable under CMS rules for remote monitoring services. It must be documented in the medical record with the date, time, method of consent, and the name of the staff member who obtained it. The documentation must also confirm the patient understood what data would be collected and any cost-sharing obligations. Undocumented verbal consent offers no audit protection and gets treated the same as missing consent.

Can CIED remote monitoring codes be billed at the same time as Chronic Care Management codes?

CIED interrogation codes (93294 to 93298) and CCM codes (99490/99491) cover distinct services, and CMS does not categorically prohibit billing both. But any time or effort counted toward CCM cannot also count toward remote monitoring in the same period. Documentation must clearly separate the work performed under each code family. Keep distinct log entries for each service and confirm with your MAC that concurrent billing is supported under their specific coverage policies.

What is the biggest documentation mistake that leads to CIED remote monitoring claim denials?

Incomplete or inconsistent documentation drives most denials, specifically missing consent records, enrollment notes that don't establish individualized medical necessity, and monthly summaries that fail to connect monitoring activity to clinical decision-making. Copy-paste interpretation notes that skip device function, programmed parameters, or actionable findings for the specific period add significant risk. CMS 2026 PFS guidance makes clear that having a process on paper isn't enough. You have to execute it in the record.

Protect Revenue and Stay Audit-Ready in 2026

The 2026 CMS compliance framework for CIED remote monitoring billing is precise, interval-driven, and documentation-intensive. Fragmented workflows built around multiple OEM portals create the exact conditions, missed windows, incomplete consent records, unseparated time logs, that generate denials and audit exposure. A unified platform that automates interval tracking, embeds consent and order capture, enforces non-overlap rules, and produces audit-ready documentation in real time is no longer a convenience. It's a compliance requirement in practice.

Rhythm360 is built to meet that requirement. From patient enrollment through every transmission review and claim submission, the platform maintains the documentation chain CMS auditors expect to find. Book time with our team to see how Rhythm360 protects your practice's revenue and keeps your CIED program audit-ready in 2026 and beyond.