Remote patient monitoring, built for the patient who has never used an app.

Key takeaways

• RPM reimburses collecting and interpreting a patient’s physiologic data — blood pressure, blood glucose, weight, pulse oximetry — from an FDA-defined connected device, plus the clinical time spent managing the patient on that data. It requires an established patient relationship and the patient’s consent.
• The 2026 code stack is 99453, 99454, 99457, and 99458 — plus two new codes. For 2026, CMS finalized 99445 (device supply for a 2–15 day window, below the old 16-day floor) and 99470 (treatment management for 10–19 minutes, below 99457’s 20-minute threshold). Each new code is mutually exclusive with its full-length counterpart in the same period.
• The 16-day rule is the single most common RPM denial trigger. 99454 is only billable when the patient transmits 16 or more days of readings within a 30-day period. Miss the count and the claim doesn’t pay — 99445 now catches part of the gap.
• Documentation is the moat. Medicare RPM reached ~$536M in 2024 (+31% year over year), and the HHS Office of Inspector General’s August 2025 data report flagged five audit-drawing patterns. Structured, at-the-moment capture is now the difference between a paid claim and a False Claims Act problem.
• RPM stacks with both APCM and CCM in the same month for the same patient — so the daily device signal and the monthly care coordination bill concurrently.
• CareAtlas devices ship cellular-connected and pre-provisioned — no home broadband, no smartphone, no app. The patient presses one button; a care navigator calls them. AI tracks the data, our nurses hold the hands, and your clinicians decide.

This guide includes

Remote Patient Monitoring (RPM) is the Medicare program with the hardest track record — dead devices in drawers, enrollments that stall at day 30, staff who drown in an alert stream. Almost none of that is a coding problem. It is an operating problem, and it shows up in the billing as denials. This guide is written for the person who has to make the claim pay: the billing lead, the practice administrator, the medical director at a rural clinic or community health center.

It lays out exactly what RPM reimburses in 2026, the full code table with the two new codes CMS added, the 16-day rule that trips most claims, the documentation requirements the OIG is now auditing against, and how a rural panel runs the whole program — devices, enrollment, monitoring, and clean claims — without broadband in the patient’s home or new headcount in your clinic.

What is Remote Patient Monitoring (RPM)?

Remote Patient Monitoring (RPM) is a Medicare-covered service that reimburses a practice for collecting and interpreting a patient’s physiologic data — blood pressure, blood glucose, weight, pulse oximetry — from an FDA-defined connected medical device, plus the clinical staff time spent managing the patient on that data. The device must digitally record and transmit the readings on its own; patient-reported numbers typed into a form do not qualify.

Two gates sit in front of every RPM claim. First, RPM requires an established patient relationship — you cannot enroll a patient you have never seen. Second, the patient must consent to the service, and that consent has to be documented. From there, RPM pays across two axes: the device (setup and monthly supply) and the clinical work (the staff time spent reviewing readings and managing the patient). The code table below splits along exactly those two axes.

What are the 2026 RPM CPT codes?

RPM bills across four core codes — 99453, 99454, 99457, 99458 — with two new 2026 codes (99445 and 99470) that reach patients the old thresholds excluded. All rates below are 2026 national averages, rounded, and adjusted by your Medicare Administrative Contractor (MAC). Confirm your locality’s amounts before you model revenue.

The exact national averages for 99445 and 99470 vary by MAC and locality — present them with a “~” and verify before billing. The core stack has stayed stable; the two additions are what changed for 2026.

What’s new for RPM in 2026?

CMS finalized two new RPM codes for 2026 that make the program billable for patients who engage but fall below the old thresholds. Both are shorter-duration codes, and each cannot be billed alongside its full-length counterpart for the same patient in the same period.

• 99445 — device supply for a 2–15 day window. Before 2026, a patient who transmitted only 8 or 10 days of readings in a month left the practice with zero device-supply reimbursement. 99445 covers that 2–15 day band. It is mutually exclusive with 99454: you bill one or the other in a given period, based on the day count — never both.
• 99470 — treatment management for 10–19 minutes. 99457 requires a full 20 minutes of monitoring time. 99470 pays for 10–19 minutes of monthly treatment management, so a stable chronic-condition patient whose footprint runs short of 20 minutes is still billable. It is mutually exclusive with 99457 in the same period, and — like 99457 — requires at least one real-time interactive communication with the patient or caregiver.

For a rural panel, these two codes matter more than anywhere else: they turn patients who engage but don’t max out from an unbillable liability into a clean, defensible claim.

The 16-day rule — the single most common RPM denial trigger

99454 is only payable when the patient transmits 16 or more days of qualifying readings within a 30-day period. Fifteen days does not pay. This one count — not the code, not the device, not the diagnosis — is the most common reason a clean-looking RPM claim gets denied.

The rule is unforgiving because it is binary, and it is invisible until claim time unless someone is tracking the day count as the readings arrive. Two things defend it. First, build enrollment for adherence, not just sign-up — the patient who never engages never clears 16 days. In the CareAtlas cohort, enrolled patients submit 30+ vital readings per month, comfortably above the threshold. Second, watch the count in real time: know on day 20 which patients are at 9 days and which are at 15, so a navigator can call before the window closes. For the months a patient still lands in the 2–15 day band, 99445 now catches the device-supply reimbursement the 16-day rule used to forfeit.

What a clean RPM claim requires

Every RPM claim carries a fixed set of elements, and a denial usually means one of them wasn’t captured. The codes are the easy part; the elements are where revenue is won or lost.

Why documentation is the moat — the OIG’s 2025 RPM report

Medicare paid about $536 million for RPM in 2024, up 31% year over year — and in August 2025 the HHS Office of Inspector General (OIG) published a data report flagging five patterns that draw audit scrutiny. RPM’s growth made it a target. The clinics that keep the revenue will be the ones whose documentation holds up.

The stakes are no longer theoretical: the Department of Justice has begun pursuing RPM cases under the False Claims Act. The defensible posture is structured capture — consent logged once and carried forward, each qualifying activity time-stamped to the code that pays for it, the ordering provider and device data attached to the claim as the work happens rather than assembled at billing time. That is the moat. A bundle used to forgive gaps; individual RPM codes under active enforcement do not.

RPM in a rural setting — devices that need no broadband

The reason RPM fails in rural panels is almost never the patient — it’s the device that assumes a home the patient doesn’t have. Setup that needs WiFi, a smartphone, or an app to install ends the program before the first reading.

CareAtlas devices ship cellular-connected and pre-provisioned: no home broadband, no smartphone, no app, no Bluetooth pairing. Blood pressure cuffs, glucose monitors, pulse oximeters, and scales arrive at the patient’s door ready to use. The patient presses one button, and the reading flows back on its own. Then a care navigator — a real, named person — calls them. That is the whole interaction. For an 85-year-old on a gravel road with no cell of their own routed through the device’s own cellular radio, “press one button” is the difference between a program that runs and a box in a drawer. Rural is where this design earns its keep — a proof point, not a slogan.

What our RPM program produces

Run the operating model right and the outcomes follow — even in the hardest cohort. These figures are from a 145-patient RPM/CCM cohort (89% age 65+, 38% COPD, 24% CHF), as of October 2025.

• 73% of enrolled patients submit readings 8+ days per month — the adherence that makes the 16-day rule clearable.
• Fewer than 1% voluntary discontinuation — patients stay because a person, not an app, stays with them.
• 14.8% 30-day readmission rate vs. the 19% CMS benchmark for the same population — a 23% relative reduction in a 145-patient cohort (89% age 65+, 38% COPD, 24% CHF), October 2025. The cohort composition is disclosed on purpose, so the benchmark comparison is honest.

These outcomes come from the combined RPM and CCM program; RPM is one of the major operational levers behind the readmission result. Results are not a guarantee of income or outcomes.

Co-billing: RPM + APCM + CCM in the same month

RPM stacks with both Advanced Primary Care Management (APCM) and Chronic Care Management (CCM) for the same patient in the same month. The device data and the care coordination are different services, so they bill concurrently — the daily readings give the monthly care touch something concrete to act on, and the monthly touch gives the readings a clinician who owns the response.

In practice, the navigator who reads the vitals is usually the same navigator who runs the APCM or CCM cadence — so the patient experiences one relationship, not three programs. The stacking rules (what layers, what’s mutually exclusive, and how the codes sit together on the claim) are worked in full in the APCM + RPM co-billing guide.

How to run RPM without adding staff

The codes are the easy part. The hard part is the operating model — the devices, the enrollment calls, the daily monitoring, and the documentation that has to survive an audit — and that is exactly where a rural clinic runs out of people.

CareAtlas runs that model for you as an extension of your clinic. Care navigators — real, named people who know your patients — make the enrollment call, hold the monthly cadence, and pick up the phone when a reading drifts. Devices ship cellular-connected and pre-provisioned, so the patient is never blocked by setup. AI-assisted tools track the incoming data and surface the patients who need attention; the navigators do the human work; your clinicians own the clinical decision. AI tracks the data, our nurses hold the hands, you decide. Nothing here runs the patient on its own.

CareAtlas is the management services organization; clinical services are delivered through its affiliated professional corporation (Austin Health Wired P.A.). Hospitals bill RPM through that affiliated PC; practices export billing-ready documentation into their existing RCM and stay the provider of record. The economics are structured to work: the CareAtlas software fee starts at about $10 per patient per month, sized below what Medicare reimburses, so the program is net margin positive by design — the fee is disclosed, and your clinic keeps the difference.

Documentation & denials — the new moat

With RPM under active OIG and DOJ scrutiny, documentation is where the revenue is won or lost. Each code carries its own threshold — 16 days for 99454, 2–15 for 99445, 20 minutes for 99457, 10–19 for 99470 — plus consent, an established relationship, ordering-provider data, and an FDA-defined device. Miss any one and the claim is either denied or exposed.

The defensible move is structured capture as the work happens: consent logged once and carried forward, the day count tracked live so the right device-supply code is chosen before the window closes, each monitoring minute time-stamped to its code, and the ordering provider and device data attached to the claim rather than reconstructed at billing time. CareAtlas’s platform captures those elements in the moment — which is the difference between a clean claim and a denial that eats the margin the program was supposed to create.

‍