archive api

Medicare's $536 Million Subscription

Medicare spent fifteen million dollars on remote patient monitoring in 2019. It spent five hundred and thirty-six million in 2024. HHS-OIG has now published the audit metrics. There has been exactly one RPM-specific False Claims Act settlement.

K3 Analytics · April 20, 2026

Let's start with the number that turned a quiet policy corner into an enforcement priority. In 2019, Medicare paid providers roughly $15 million to monitor patients from afar. In 2024, that figure was $536 million. The beneficiary count rose from about 55,000 to roughly one million over the same period. The codes at the center of this growth — 99453, 99454, 99457, 99458 — did not exist on any Medicare fee schedule before 2018. By 2024, they supported a recurring-revenue model that looked a lot less like medicine and a lot more like a subscription business, which is exactly what HHS-OIG has now told CMS, politely, in writing, twice.

The enforcement response has been real but small. In June 2025, DOJ announced the first RPM-specific FCA settlement — Health Wealth Safe, $1.29 million. In August 2025, OIG published five standardized audit metrics that Medicare Administrative Contractors can run tomorrow. In November 2025, CMS finalized the CY 2026 Physician Fee Schedule, adding short-duration codes that simultaneously legitimize real-world clinical workflows and create new billing surface area. The ratio that matters: roughly $536 million in annual Medicare RPM spend, against one settlement for $1.29 million. That gap is what the next twenty-four months will narrow.

Scale: thirty-six times the money, eighteen times the patients

OIG's August 2025 Data Snapshot gives the cleanest time series available. Remote patient monitoring payments — combining Original Medicare and Medicare Advantage — grew from about $15 million in 2019 to $536 million in 2024. Beneficiaries receiving RPM services grew from roughly 55,000 to close to one million. In OIG's own understated framing, "Payments for remote patient monitoring in Medicare were more than 20 times higher in 2022 than in 2019." Extend the curve two more years and the ratio hits 36×.

The growth is lumpy in ways that track policy more than epidemiology. Between 2019 and 2020, Medicare relaxed the structural fraud brake on 99454 — a requirement that devices transmit at least 16 of 30 days — dropping it to 2 days and waiving the "established patient" rule. Spending jumped from $15M to $82M. Between 2020 and 2021, CMS added the 99458 add-on, letting practices bill extra 20-minute increments; spending jumped to $202M. By 2022, the OIG's study year, Medicare paid $311 million ($201M traditional Medicare, $110M Medicare Advantage) for RPM delivered to 570,000 beneficiaries. The average payment per beneficiary doubled from $266 in 2019 to $545 in 2022. And long-term monitoring — more than nine months per patient — went from 5% of enrollees to 25%, consistent with the monthly recurring billing pattern becoming the operating model rather than the exception.

How an RPM claim actually pays

Four CPT codes do nearly all the work. 99453 pays about $20 once, per patient, for education and setup. 99454 pays about $47 every 30 days for "supply of the device" plus daily transmission — contingent, post-PHE, on at least 16 of 30 days of readings actually being transmitted. 99457 pays about $48 every calendar month for the first 20 minutes of clinical staff time reviewing data and talking to the patient. 99458 adds about $39 per additional 20 minutes. There is also 99091, an older physician-only data-interpretation code CMS unbundled in 2018 as the transition path before the full RPM code set launched.

The economics are cleaner than most of Medicare. A practice that mails a Bluetooth blood-pressure cuff to a patient with hypertension can plausibly bill $47 + $48 = ~$95 per patient per 30 days, indefinitely, as long as 16 days of readings arrive and someone on staff logs 20 minutes of "review and interaction." Data collection is passive. The patient-provider interaction can be as minimal as a single monthly phone call. A primary care practice with 2,000 hypertensive Medicare patients and a willing RPM vendor can, on paper, generate more than $2 million per year in incremental Part B revenue from a patient population already under care.

The business model that grew around this math is the device-and-bill vendor — a company that mails FDA-cleared devices, runs the call center that logs "interactive communication," handles billing under the NPI of a contracted physician group, and splits revenue. OIG estimated that in 2022, about 1 in 10 Medicare RPM enrollees received the service from such a company, and identified 41 RPM-specialist companies in its sample. When the code set is clean and the vendor is above board, the model is a legitimate chronic-care delivery mechanism. When it isn't, the code set has an on-switch and no off-switch.

Provider density is equally striking. In 2022, 15,017 rendering providers billed RPM in traditional Medicare. The specialty distribution matters for understanding which corners of clinical practice are most exposed: primary care dominates, but a small handful of specialties carry disproportionate concentration.

By 2024, 10,388 medical practices billed at least one RPM service and 4,639 practices billed routinely (≥10 enrollees, ≥100 claims). The average payment per enrollee doubled from $266 in 2019 to $545 in 2022, and average monitoring duration rose from under three months to more than five, with long-term monitoring (>9 months) climbing from 5% to 25% of enrollees. Demographically, Black enrollees received RPM at 15 per 1,000 compared with 7 per 1,000 for White enrollees, and dually eligible beneficiaries at 14 per 1,000 versus 7 per 1,000 for Medicare-only. 94% of enrollees received RPM for chronic conditions, with 55% for essential hypertension alone.

What OIG found, in actual numbers

The September 2024 report's most-quoted finding is that 43% of Medicare RPM enrollees did not receive all three required components of RPM in 2022. In absolute terms: approximately 244,000 of 570,000 enrollees were missing at least one of education/setup, device supply, or treatment management. Roughly 113,000 were missing two. Component-level gaps: 28% missing education and setup, 23% missing a device claim, 12% missing any treatment management.

The single most alarming data point in the 2024 report: one provider billed 23,569 hours of treatment management for RPM in 2022, more hours than exist in a calendar year. For 44% of enrollees, Medicare had no information at all about who ordered the RPM service — because CMS does not require an ordering-provider field on RPM claims. You can bill RPM without Medicare knowing who prescribed it. That is not a loophole. That is a hole.

The August 2025 Data Snapshot is where OIG turned concern into audit metrics. Of the 4,639 medical practices that routinely billed RPM in 2024, OIG flagged five billing-pattern indicators and counted the practices hitting each one:

These are small absolute numbers against a 4,639-practice universe. But the OIG's examples are not small. One practice enrolled nearly 3,400 new Medicare beneficiaries in a single month. One lacked any prior medical relationship with more than 30,000 enrollees. One billed for multiple devices per patient per month more than 1,700 times in a year. These are the patterns DOJ will now pattern-match against, because the Data Snapshot doubles as the audit playbook.

Enforcement, named and so far small

The public enforcement footprint on RPM specifically remains thinner than the spending curve. There is exactly one RPM-specific False Claims Act settlement on record. The larger enforcement actions involve cardiac remote monitoring — a related but pre-existing billing category — and the broader telehealth-and-DMEPOS schemes that adjacent RPM but are not primarily about it.

Operation Gold Rush, despite the evocative name, is not an RPM case. It is the transnational DME/urinary-catheter fraud centerpiece of the 2025 Takedown, with approximately $10.6 billion in alleged fraudulent Medicare claims and CMS blocking all but about $41 million of $4.45 billion scheduled for payment. It matters here because it signals DOJ's analytics posture. And because the Criminal Division's new Health Care Fraud Data Fusion Center, announced on the same June 30, 2025 date, is the enforcement infrastructure that will process OIG's RPM billing-pattern indicators at scale. The August 2025 Data Snapshot gave the Fusion Center a ready-made target list.

The policy timeline is a ratchet

The striking thing about RPM rulemaking is how consistently each round of CMS attention expanded the billing surface while adding marginal constraints. It is a policy ratchet that has, over eight years, turned a niche chronic-care delivery tool into a $536 million line item.

The CY 2026 Final Rule, published November 5, 2025, is where the ratchet meets the Data Snapshot. CMS added 99445 for shorter-duration device supply (2–15 days, paid at the same rate as 99454 but non-additive within a month) and 99470 for 10-minute treatment management (non-additive with 99457). CMS shifted RPM valuation methodology from RUC practice-expense inputs to OPPS Geometric Mean Cost data, and 99454 rose to $47.06. The stated clinical rationale — that real-world short-term monitoring deserves a payment path — is plausible. The stated integrity implication is that a month which previously failed the 16-day test and therefore produced no revenue can now produce revenue under 99445. This is not, by itself, a bad thing. But it complicates audit visibility, because audit and short-duration legitimate will now share a column.

The vendor landscape: public information only

The RPM vendor market is venture-backed startups, health-system internal programs, and divisions of public companies. The entries below reflect only publicly-verifiable funding, M&A, or regulatory disclosures. None of these companies has been charged with RPM-specific fraud. Their inclusion here is not an allegation of any kind.

Cadence Health (New York, 2020) has raised approximately $143 million, including a $100M Series B in December 2021 led by Coatue at a $1B valuation. Biofourmis (Boston) raised roughly $465M across a 2022 Series D led by General Atlantic; in October 2024 it merged with CopilotIQ and subsequently divested its Life Sciences business. Vivify Health was acquired by Optum (UnitedHealth) in October 2019. Current Health was acquired by Best Buy in 2021. 100Plus was acquired by Connect America in August 2021. Hello Heart, Podimetrics, Optimize Health, and Health Recovery Solutions remain privately held with no public enforcement actions on record.

Public-company stories are more textured. Teladoc Health (NYSE: TDOC) acquired Livongo for about $18.5B in October 2020 and subsequently recorded $13.4 billion in goodwill impairments in 2022. The securities class action Schneider v. Teladoc (S.D.N.Y.) was dismissed in July 2023. Teladoc's BetterHelp subsidiary settled FTC allegations for $7.8 million in 2023 regarding sharing mental-health data with major ad platforms. Dexcom (NASDAQ: DXCM) faces two pending securities class actions, one tied to a March 7, 2025 FDA Warning Letter regarding unauthorized design changes to the G6 and G7. iRhythm (NASDAQ: IRTC) received a May 25, 2023 FDA Warning Letter regarding its Zio AT cardiac monitor and is the subject of a publicly-disclosed, unresolved DOJ investigation and a surviving securities class action in N.D. Cal.

The BioTelemetry/LifeWatch/CardioNet family under Philips carries the largest publicly-settled RPM-adjacent FCA exposure of any vendor — roughly $59.6 million across the 2022 and 2023 settlements combined. None of this is RPM proper. It is the adjacent cardiac-monitoring ecosystem from which RPM-specific enforcement will likely take its methodological cues.

Cross-program connections via FraudGraph

RPM rarely travels alone in suspected fraud schemes. The dominant bundling pattern, visible in DOJ charging documents from the 2023, 2024, and 2025 National Takedowns, is RPM + telehealth E/M + DMEPOS: a telehealth company generates a "visit" with a contracted physician; the physician signs a device order; the device is dispensed (sometimes under DMEPOS, sometimes under 99454); monthly RPM claims begin. The 2025 Takedown's $1.17 billion in telemedicine/genetic-testing charges illustrates the architecture even where RPM is not the named product.

The FraudGraph cross-reference angle: the same entities that show up as high-volume RPM billers also appear across NPPES rendering-provider records, CMS Medicare Part B Provider Utilization data, HHS-OIG LEIE exclusions, state corporate records linking shell entities to common owners, Open Payments for device-manufacturer marketing to high-billing clinicians, and CourtListener qui tam dockets flagged for telehealth or DMEPOS. The formal rule is that the device is bundled into 99454 as a practice expense, meaning practices cannot simultaneously bill RPM and DMEPOS for the same device. Enforcement of this rule is weak, because CMS does not capture device type on RPM claims. Source: FraudGraph cross-reference of Medicare Part B, NPPES, LEIE, Open Payments, and CourtListener — the same ingredients that produced the audit-ready billing profiles for previous DME and catheter schemes.

Bottom line

How we did it

This report combines HHS-OIG's two RPM reports (OEI-02-23-00260, September 2024, and OEI-02-23-00261, August 2025), the CY 2018, 2019, 2021, and 2026 Medicare Physician Fee Schedule Final Rules, DOJ press releases from the 2022–2025 cardiac-monitoring and national healthcare fraud actions, the USAO-NDGA Health Wealth Safe announcement (June 26, 2025), and FDA Warning Letters to iRhythm (May 25, 2023) and Dexcom (March 7, 2025). Single-category shares in the component-completeness chart are estimates apportioned from OIG's non-exclusive aggregate figures; the 57% "got all three" and 20% "missing 2+" figures come directly from OIG. Cross-program analysis framing references FraudGraph cross-references of CMS Part B utilization, NPPES, HHS-OIG LEIE, Open Payments, and CourtListener data; specific practice names are withheld in accordance with K3's defamation-safety protocol absent a public enforcement action.

Sources