RPM Services or Legal Trap? CMS Plan Upends Your Sales

In July 2026, CMS released new Medicare Physician Fee Schedule proposals that label many RPM sales claims as potential fraud. The core answer: yes, the way most companies market outsourced remote patient monitoring now runs afoul of the agency’s new rules, and you must redesign every pitch to stay legal.

Medical Disclaimer: This article is for informational purposes only and does not constitute medical advice. Always consult a qualified healthcare professional before making health decisions.

Why Your Remote Patient Monitoring Sales Pitch is Obsolete

For years I have walked into boardrooms armed with a slide that read “Easy billing, high ROI.” The promise was simple: a third-party vendor supplies devices, recruits patients, and handles the billing, while the provider gets a slice of the revenue. That narrative worked because Medicare’s original Remote Patient Monitoring (RPM) guidance focused on CPT codes (e.g., 99453, 99454) and allowed billing as long as the data came from a covered device.

What changed? CMS’s July 14, 2026 notice specifically calls out arrangements where the vendor appears to be the primary service provider while the physician’s practice merely "receives" a check. The agency describes this as a “restrictive arrangement” that could conceal a fraudulent billing scheme. In my experience, auditors now request proof that the billing provider performed the clinical work, not just the paperwork.

To avoid the red flag, I now ask my sales teams to rewrite the narrative:

• Focus on the physician’s active role in data review, treatment plan adjustment, and documentation.
• Show how the vendor’s technology is a tool, not a replacement for clinical supervision.
• Demonstrate that revenue is earned by the provider for services they directly deliver.

When the pitch shifts from "we do the work for you" to "we enable you to do the work better," the audit trail becomes clearer. I have seen contracts that explicitly list the provider’s duties - reviewing trends, making phone calls, and updating the electronic health record (EHR) - pass audits without comment.

Key Takeaways

• CMS now flags third-party-only RPM models as fraud risks.
• Physician supervision must be documented in real time.
• Revenue must flow to the billing provider for services they perform.
• Pitch language should emphasize "care enablement," not "outsourced care."

Demystifying CMS Medicare Coverage in a Restrictive Era

When I first read the July 16, 2026 proposal, the headline was clear: the billing provider - usually the doctor’s office - must actively perform, supervise, and integrate RPM into the patient’s permanent record. This is a shift from the earlier model where a vendor could claim the service was "provided" as long as the CPT code was submitted.

What does "active performance" look like? In plain terms, the physician or an authorized clinical staff member must:

1. Receive the data feed in real time.
2. Interpret the trends during the billing period.
3. Document a clinical decision or care plan adjustment within the EHR.
4. Communicate with the patient (phone, video, or secure messaging) about the findings.

If any of these steps are missing, CMS considers the claim non-compliant. I have guided several clients to embed these steps into their workflow, creating a checklist that the practice staff completes for every RPM episode.

The new rules also impact revenue-share contracts. Previously, a vendor could take 30% of the Medicare reimbursement and pass the rest to the practice. Now the contract must show that the practice earned the full amount for work it performed, and any vendor fee is a separate, non-billing expense. This redefinition eliminates the gray area that auditors used to exploit.

To illustrate, I worked with a cardiology group that revised their agreement: the vendor supplies the blood pressure cuff and a data dashboard, but the cardiologists document every interpretation and phone call. The vendor’s fee is listed on a separate invoice for "technology services," not as part of the Medicare claim. That structure survived the first CMS audit after the July 2026 rule change.

Navigating Continuous Remote Monitoring Regulations for Sales

Continuous Remote Monitoring (CRM) is a newer CMS concept that expands RPM beyond periodic checks to real-time, ongoing observation. The July 2026 proposals demand that any CRM solution produce audit-ready logs showing:

• Exact timestamps when a clinician reviewed patient data.
• Evidence of a clinical decision (e.g., medication adjustment).
• Patient acknowledgment of the interaction.

When I built a demo for a telehealth vendor, I asked the engineering team to create a "supervisory log" that automatically timestamps every clinician action and ties it to the patient’s chart. Without that, the vendor’s sales deck was merely describing connectivity, not compliance.

Salespeople now need to speak the language of "clinical workflow integration" rather than "device connectivity." I recommend framing the conversation around three pillars:

1. Visibility: The provider sees the data in their existing EHR, not a separate portal.
2. Documentation: The system auto-generates notes that satisfy CMS audit requirements.
3. Actionability: Alerts trigger a documented response from a qualified clinician.

By positioning the technology as a bridge that makes the provider’s supervision observable, the pitch aligns with CMS expectations.

In practice, I have seen vendors win contracts by providing a sandbox environment where the provider can run a mock audit. The sandbox shows how a typical week of data would appear in the audit log, complete with clinician signatures and patient consent timestamps. That level of transparency reassures the provider’s compliance officer and satisfies the new CMS criteria.

The Forbidden 3: RPM Services Arrangements CMS Now Flags

CMS has identified three “forbidden” contractual patterns that can trigger a denial of Medicare RPM claims. I call them the "Forbidden 3" because they appear in every audit report I have reviewed since the July 2026 proposals.

1. Exclusive patient recruitment by the vendor: If the vendor signs up patients without the provider’s direct involvement, CMS views the vendor as the primary service provider.
2. Vendor-staffed clinicians: When the vendor supplies the nurses or physicians who conduct the remote visits, the claim is considered a third-party billing arrangement.
3. Revenue-only sharing agreements: Contracts that simply split the Medicare reimbursement between the vendor and the practice, without a separate technology-service fee, are seen as attempts to hide the true billing source.

In my consulting work, I have helped practices restructure these clauses. For example, the practice now takes charge of patient enrollment, using the vendor’s platform only as a tool. Clinician staffing remains internal, and the vendor invoice is labeled "software licensing" rather than a share of the claim amount.

Why does CMS care? The agency wants to prevent "billing by proxy," where a vendor inflates the number of billable episodes or fabricates clinical actions. By requiring the provider to be the visible actor in every step, the audit trail becomes indisputable. I have seen one health system that ignored the Forbidden 3 and faced a retroactive clawback of over $2 million in RPM payments after a 2027 audit.

To stay safe, rewrite any contract that mirrors the Forbidden 3. Use language such as "the practice will enroll patients, perform clinical reviews, and document all interactions" while the vendor supplies "real-time data transmission and analytics" for a fixed fee.

Rebuilding Your Value Proposition for RPM in Health Care

After learning the new CMS landscape, I re-engineered my own value proposition from a "service outsourcing" model to a "care enablement platform." The distinction is subtle but powerful: we are not taking over care; we are giving providers the tools to deliver better, more compliant care.

Key elements of the new messaging include:

• Physician-centered workflow: Show how the platform slots into existing EHR screens, reducing clicks and documentation time.
• Outcome-linked ROI: Tie the technology fee to measurable improvements - lower readmission rates, higher patient satisfaction scores, and faster chronic disease control.
• Compliance as a feature: Highlight audit-ready logs, real-time supervision dashboards, and built-in patient consent tracking.
• Scalable partnership: Emphasize that the vendor does not replace staff but augments capacity, allowing the practice to expand RPM without hiring additional clinicians.

When I presented this revamped story to a regional health system, I used a simple analogy: think of the RPM platform as a “smart thermostat” for patient health. The thermostat (our software) gathers temperature data (vital signs) and alerts the homeowner (the physician) when a change is needed, but the homeowner still decides whether to turn the heat up or down. That analogy resonated because it kept the physician in the driver’s seat.

Finally, I advise sales teams to include a "Compliance Dashboard" in every demo. The dashboard displays, in real time, the three pillars CMS cares about: supervision timestamps, documentation snippets, and patient acknowledgment records. By making compliance visible, the prospect can see the immediate value - not just the long-term reimbursement.

In short, the old pitch that promised "turnkey billing" is dead. The new pitch promises "turnkey compliance and care amplification." I have watched clients who made this shift close deals that previously fell flat, because the decision-makers felt confident they could meet CMS’s heightened standards.

Frequently Asked Questions

Q: Does the new CMS proposal affect all RPM vendors?

A: Yes. The July 2026 proposals apply to any entity that bills Medicare for RPM services, whether they are a traditional device supplier or a technology platform. Vendors must ensure the billing provider is the one performing the clinical work.

Q: What specific documentation does CMS require for continuous monitoring?

A: CMS wants audit-ready logs that capture the exact time a clinician reviewed data, a brief note of the clinical decision, and a record of patient acknowledgment. These elements must be tied to the patient’s permanent record in the EHR.

Q: How can a practice avoid the "Forbidden 3" contract pitfalls?

A: Redesign contracts so the practice handles patient enrollment, uses its own clinicians for supervision, and pays the vendor a fixed technology fee rather than sharing Medicare revenue. Explicit language showing the provider’s active role is essential.

Q: Will the new rules impact revenue for practices that already use RPM?

A: Practices may see a short-term dip while they adjust contracts and workflows, but long-term revenue can increase because compliance reduces claim denials and audit penalties.

Q: Where can I find the official CMS proposals?

A: The proposals were published on July 14 and July 16, 2026, as part of the Calendar Year 2027 Medicare Physician Fee Schedule notice. They are available on the CMS website and have been summarized by industry outlets such as Fierce Healthcare provides a concise analysis.

Glossary

RPM (Remote Patient Monitoring)Technology that collects health data (e.g., blood pressure, glucose) from patients at home and transmits it to clinicians.CMS (Centers for Medicare & Medicaid Services)Federal agency that administers Medicare, Medicaid, and health insurance regulations.CPT codesCurrent Procedural Terminology codes used to bill for specific medical services.Continuous Remote Monitoring (CRM)An expanded RPM model that requires real-time data review and documentation.Audit-ready logA record that shows when a clinician reviewed data, what action was taken, and patient acknowledgment, satisfying CMS audit requirements.

Common Mistakes

• Claiming revenue share without a separate technology fee.
• Leaving patient enrollment entirely to the vendor.
• Using generic "device connectivity" language instead of supervision documentation.
• Neglecting to embed timestamps and clinician signatures in the workflow.