CMS Wants to Ban Outsourced Remote Monitoring. It Should Regulate It Instead.

I have been away for a bit hiking in southern Colorado, but I am glad to be back in your inbox. Hopefully, you are as well. As per usual, I missed so many important items in health tech during my absence. This article is about perhaps the most important one and many of you, as readers, are highly invested in the remote patient monitoring (RPM) space. Importantly, I do not want to come across as an “RPM at all costs” person. I am not. I want to go where the evidence and good policymaking take me. However, what I am about to discuss is blunt-force, ill-informed, and bad policymaking.

On July 14, CMS released the CY 2027 Medicare Physician Fee Schedule proposed rule (91 FR 43842), and buried inside it is perhaps the most consequential remote monitoring policy since the RPM codes were created in 2019.

Starting January 1, 2027, Medicare would pay for remote physiologic monitoring (RPM) and remote therapeutic monitoring (RTM) only when the clinical staff furnishing the service are employed by the billing practice, not when they work for a contractor/vendor.

That reverses an allowance CMS has extended since 2020, when it began permitting leased or contracted clinical staff to furnish these services under general supervision to the practice’s treating physician. CMS pairs the “employment rule” with two narrower guardrails: RTM would be limited to established patients (not really a deal-breaker), and practitioners would have to furnish a separately reportable, face-to-face initiating visit at the onset of monitoring (also not really a deal-breaker).

CMS also proposes to revalue the codes downward on the theory that devices now cost less than originally assumed, and it is soliciting comment on collapsing the current 17-code set into four bundled G-codes. Comments are due September 14, 2026.

The “employment requirement” proposal reshapes the RPM industry. It does not restrict a practice’s ability to buy devices, platforms, logistics, or analytics from a vendor. It restricts who may perform the billable clinical work, or the monitoring, the patient outreach, and the treatment-management minutes that actually generate payment. CMS is explicit that the restriction is about the employment relationship, not location: staff need not sit in the practice, and the beneficiary need not be on-site. It targets precisely the clinical-staffing function most “outsourced” RPM companies exist to perform.

CMS’s stated rationale is care fragmentation. In the rule, the agency reasons that outsourcing to a third party can fragment care, dilute the billing practitioner’s involvement and oversight, or yield services that do not actually include all required components. In my experience, the practice is still getting the data and has close communication with the vendor clinical staff. Outsourcing is not as distant as it may seem to CMS.

The thought is that this proposal directly stems from the HHS OIG’s September 2024 report, Additional Oversight of Remote Patient Monitoring in Medicare Is Needed (OEI-02-23-00260), documented roughly tenfold growth in RPM utilization between 2019 and 2022, with payments climbing from about $15 million to more than $300 million, and found that about 43 percent of enrollees did not receive all three required components (i.e., education and setup, device supply, and treatment management. Roughly 28 percent never got the device education and setup (including 23 percent who never received a device at all), and about 12 percent got no treatment management, the very step where a clinician reviews the data and acts on it. OIG also found that Medicare lacked basic oversight information such as “no ordering-provider requirement,” “no visibility into which data or devices were in use”, and no “systematic way to identify companies specializing in RPM.”

A follow-on OIG data snapshot in August 2025, Billing for Remote Patient Monitoring in Medicare (OEI-02-23-00261), put 2024 Medicare payments above $500 million and estimated that nearly one million enrollees received RPM that year. That report built two outlier measures worth internalizing, because they describe the actual risk: practices billing for a high share of enrollees with no prior relationship with the practice, and practices billing for multiple monitoring devices per enrollee per month. DOJ has since brought enforcement actions in the space (this was explicitly disallowed, so not sure how that happened aside from bad actors).

Are there bad actors? Probably. Is there fraud? Probably. Are there poor documentation instances? Yes. Should CMS and HHS OIG be worried? Yes. Are there other solutions other than cutting off the specialized RPM services companies from partnering with brick-and-mortar practices? Also, Yes.

This proposed rule is well-intentioned, but missing the true nature of any compliance problems within remote monitoring to the extent they exist.

The fact is that outsourcing clinical operations under general supervision of a practice is the most efficient way to implement RPM. This proposed rule will certainly stifle RPM implementation and the clinical innovations that come with it. There are other ways to address the HHS OIG reports.

The first thing to understand is that RPM is an operationally complex clinical program that defies the legacy model of care where a patient schedules a visit, shows up to the waiting room, sees a clinician, and then goes home. That is what all health care operations are built around today. The physical space, the operations, the staffing, and the business models are built around this workflow. RPM is not.

A practice that runs its own program has to solve device procurement and inventory, shipping and reverse logistics, cellular connectivity, replacement and battery management, patient onboarding and technical support, dynamic staffing, data integration into the EHR, alert triage protocols, complex scheduling, time documentation, clinical workflows and interventions for remote patients, monthly billing and revenue cycle, and the compliance scaffolding around all of it.

None of that mentioned above resembles the work an ambulatory practice already knows how to do. A practice manager who can run a five-provider clinic at 95 percent schedule utilization has no particular reason to be good at running a distribution operation and a telephonic care-management and remote monitoring team at the same time. The full-service vendor model exists because delivering virtual care well is its own discipline, which is a case I made at length in A Virtual Care Blueprint, not a bolt-on to an exam-room practice.

Economically speaking, specialization and comparative advantage in production or services is generally beneficial to any market and CMS appears to be denying that. CMS is once again asking brick-and-mortar practices to do everything under the sun in the name of compliance issues that they are mis-reading and mis-attributing.

In addition to being complex operationally, the built practice environment is a real constraint too, and it is under appreciated by people who have not walked a clinic floor. Most practices are designed around exam rooms, not around clinical staff spending six hours a day on the phone. There is no quiet space, no headset infrastructure, no workforce-management software, no supervisor whose job is call quality. Health systems have some of this in their nurse triage lines, but those lines are already understaffed and optimized for inbound acuity triage rather than longitudinal outbound chronic care engagement. Telling a practice to internalize this work is telling it to build a small contact center all by itself.

Second, the outsourced model shifts execution risk and start-up capital away from the practice. RPM economics are volume- and workflow-dependent in that the fixed costs of staffing, systems, and device inventory are meaningful, while per-patient monthly revenue is modest. A practice cannot responsibly hire two RNs and a coordinator to serve forty enrolled patients, and it usually cannot float the working capital to carry that team through the twelve to eighteen months it takes to reach scale where the program is break-even.

Outsourced vendors solve this by pooling demand across many practices and pricing per enrolled patient. That is not a loophole; it is the ordinary economics of specialization, and it is why small independent practices and rural clinics (i.e., those with thinnest margins, the least infrastructure) have any access to RPM at all. A ban on outsourcing to specialist organizations does not make those programs insourced. It makes them disappear, and it advantages the large integrated systems that can absorb the fixed cost, at a moment when policy elsewhere is nominally trying to sustain independent practice.

Third, specialization produces better programs. Firms that do nothing but RPM have learned, across thousands of enrollments, what onboarding converts, what device mix works for which populations, what escalation pathways catch deterioration early, and what causes patients to churn out at day sixty. That accumulated operational knowledge is important and it represents real value to the health care services market.

A practice standing up an internal program starts from zero on all of it, and the likely result is not a better-integrated program but a worse-run one with lower enrollment, weaker adherence, sloppier documentation, and a higher likelihood of missing required components than an experienced vendor operating at scale.

The 43 percent completion failure OIG found is not obviously cured by forcing the work in-house; it may be aggravated.

If the problem is fragmentation and program integrity, then CMS should regulate for fragmentation and program integrity. Several of OIG’s own recommendations point the way, and CMS has not exhausted them. Three principles should anchor the fix.

Put documentation responsibility squarely on the treating provider. No matter who performs the monitoring minutes, the billing practitioner owns the record. Require that the ordering and treating provider, not the vendor, attest to the clinical documentation, so that outsourcing execution never outsources accountability. This is the cleanest single answer to the fragmentation worry, and it holds regardless of who employs the staff.

Require medical necessity to be documented and re-justified over time. Tie enrollment to a documented condition and treatment goal, and require periodic reassessment that continued monitoring is still medically necessary rather than merely still billable. Perpetual monitoring with no clinical action is the low-value pattern worth attacking, and a standing re-justification requirement attacks it directly. A default episode length, after which continuation must be affirmatively justified in the record, would give the standard teeth. Perhaps, even, require the prescribing and oversight provider to note the continued medical necessity and goals at an E/M visit.

Require the data to drive real care-plan changes. The billable event should be tethered to clinical action: documented physician review at a defined interval, an escalation protocol, and treatment-management notes showing how the readings changed the plan (such as a medication titration, an added visit, a referral) returned to the medical record of the billing practice. Monitoring that never alters clinical management is exactly the “insufficient involvement” CMS says it is worried about, and it is a documentable failure rather than an inherent property of contracting. Importantly, monitoring itself and the act of patient engagement is an intervention itself, not just a feature of care.

Around those three, CMS should add the actual transparency OIG asked for. Ordering-provider identification on the claim makes the treating practitioner’s order visible and renders cold-call enrollment detectable. Vendor identification, such as a modifier or attestation naming the entity furnishing clinical staff, gives CMS the ability it currently lacks to spot RPM-specialist outliers. Or, require RPM outsourced services companies get an organizational NPI number and add them to the claim as a provider. Or, create a certification or accreditation program for RPM vendors.

Anyone with a program has until September 14 to put that case on the record, via docket CMS-2026-2377 at Regulations.gov.