CMS Finalizes Remote Monitoring Guardrails for 2027, Delays Outsourced Staffing Restriction to 2029

On Nov. 4, the Centers for Medicare & Medicaid Services (CMS) released the CY 2027 Medicare Physician Fee Schedule (PFS) final rule (CMS-1848-F), which is scheduled for publication on Nov. 9. The final rule resolves the remote physiologic monitoring (RPM) and remote therapeutic monitoring (RTM) proposals CMS published on July 16 in the CY 2027 PFS proposed rule (91 FR 43842), which we described in our July 17 alert, CMS Proposes to Restrict Outsourced Remote Monitoring Services Under Medicare. Citing the same program integrity concerns and HHS-OIG oversight findings, CMS finalized all three proposed guardrails but gave practices and vendors two additional years before the restriction on outsourced clinical staff takes effect. 

Beginning Jan. 1, 2029, Medicare will not pay for RPM or RTM services unless the clinical staff performing them are direct employees of the billing practitioner or the practitioner’s practice. CMS did not define “direct employee,” declined to amend the “incident to” regulation that has long permitted leased employees and independent contractors for remote monitoring, and instead committed to issuing sub-regulatory guidance on acceptable staffing arrangements before 2029. The initiating visit and RTM established-patient requirements take effect Jan. 1, 2027, along with a revaluation of the RPM and RTM codes that is narrower than CMS originally proposed.

CMS Finalizes New Medicare Billing Requirements for RPM and RTM Services 

The final rule adopts the three guardrails CMS proposed for RPM and RTM services billed under the PFS, with a significant change in timing and several clarifications: 

• Established-patient requirement (effective Jan. 1, 2027): RTM services are limited to established patients, matching the existing RPM rule. CMS adopted the standard PFS definition (professional services from the practitioner, or from a same-specialty practitioner in the same group, within the past three years) and clarified that a beneficiary is considered an established patient once the initiating visit requirements are met.
• Initiating visit (effective Jan. 1, 2027): RPM or RTM must be initiated by the billing practitioner during a face-to-face visit, in person or via telehealth, at which remote monitoring is discussed. The visit need not be dedicated to remote monitoring, CMS set no deadline between the visit and device activation, and a new visit is not required for device changes, clinical changes, or a change of billing practitioner within the same practice. Beneficiaries already receiving RPM or RTM before Jan. 1, 2027, do not need an initiating visit, although CMS discouraged any misuse of enrolling beneficiaries between the rule’s publication and Jan. 1, 2027, to avoid the requirement. 
• Employed-staff requirement (effective Jan. 1, 2029): Medicare will pay for RPM and RTM only when clinical staff time is furnished by a direct employee of the practitioner or the practitioner’s practice, under the billing practitioner’s general supervision, with all other “incident to” requirements met. Staff need not be physically located in the practice. Through Dec. 31, 2028, practices may continue contracting with third parties, but CMS emphasized that the billing practitioner must retain meaningful involvement and that services lacking practitioner oversight or clinical integration should not be billed.

Importantly, the final rule confirms that CMS is not banning RPM/RTM technology vendors. CMS stated that practices may continue to obtain devices, software, connectivity, data hosting, cybersecurity, implementation support, technical assistance, and interoperability services from outside companies, and that the policy does not reach vendors that supply technology but not third-party staff time. CMS did not adopt the four bundled Healthcare Common Procedure Coding System (HCPCS) G-codes on which it sought comment, but it may revisit the concept in future rulemaking.

Who Counts as a “Direct Employee” for Medicare RPM and RTM Billing? 

The most consequential question in the final rule is the one CMS left open. Many commenters asked what “employed by the practice” means, described specific employment and contracting arrangements, and asked CMS to define “direct employee of the practitioner or the practitioner’s practice.” Commenters also pointed out that the existing “incident to” regulation at 42 C.F.R. § 410.26 defines employees, leased employees, and independent contractors and permits all three. CMS responded that it is not changing the supervision requirements or the text of § 410.26 for remote monitoring, acknowledged that it may need more time to specify additional clinical staff arrangements that may be appropriate, and committed to publishing sub-regulatory guidance before Jan. 1, 2029. The final rule does not address W-2 status, professional employer organizations (PEOs), or staffing agencies. 

Pending that guidance, the ends of the spectrum are reasonably clear. Clinical staff who are common-law employees on the billing practice’s own payroll present the lowest risk, and staff employed or contracted by an RPM/RTM vendor are likely excluded after 2028. The harder questions lie in between, where many practices and health systems actually staff their remote monitoring programs: 

• Leased employees. Section 410.26 continues to define and permit leased employees as auxiliary personnel, and CMS declined to amend it for remote monitoring. A leased worker who is embedded in the practice’s workflows and supervised by its practitioners does not resemble the disconnected outsourced model CMS described. Still, the word “direct” suggests CMS intends to distinguish the practice’s own employees from workers whose employment runs through another entity. 
• PEO co-employment. Under a PEO arrangement, the practice typically directs the work while the PEO handles payroll, benefits, and tax reporting, so the W-2 may not come from the billing practice. The final rule does not mention PEOs or W-2 status, and it is unclear whether CMS will look to common-law control, the payroll employer of record, or both. 
• Affiliate employers. Academic medical centers and hospitals often employ or engage clinical staff through an entity other than the billing practice. Commenters raised these structures specifically, and CMS did not resolve them. In our view, the same questions extend to groups supported by management services organizations. We expect these questions to be the focus of promised guidance. 

Two features of the final rule point in opposite directions. On one hand, CMS framed its concern around third-party staff with little relationship to the patient or care team and little contact with the billing practitioner, and it acknowledged that additional arrangements “may be appropriate.” On the other hand, CMS stated that it does not believe services furnished by staff contracted by a third party can ensure the billing practitioner has adequate oversight, management, or collaboration (a rationale broad enough to reach PEO and staffing-agency models). And in the same rule, CMS expressly allows health coaching by staff employed by community-based organizations, suggesting that when CMS intends to accept another entity’s employees, it says so. 

Because the direct-employee requirement appears in the preamble rather than in the regulatory text, and § 410.26 was not amended for remote monitoring, there may be questions about how the requirement will be applied alongside the existing regulation. Organizations should not rely on that tension as a compliance strategy. Those with leased or affiliate staffing models do, however, have strong reasons to document integration and supervision now and to engage with CMS as it develops guidance.

What’s Next for Medicare Remote Monitoring Policy After the 2027 Final Rule

CMS declined to adopt outcome-based guidelines or to rely on the initiating visit alone to address cold-calling, and said it may consider stricter credentialing of vendors in future rulemaking. It reiterated that paying only when services are furnished by practice-employed clinical staff is the best way to ensure integrated care, sufficient practitioner oversight, and delivery of all required service elements. CMS also distinguished the CMS Innovation Center’s ACCESS model, which tests outcome-aligned payments for technology-supported chronic care, from fee-for-service remote monitoring. 

Several signals suggest that remote monitoring policy will keep moving. The 2029 date could be revisited in future PFS rulemaking or affected by congressional activity on remote monitoring access. The American Medical Association’s Relative Value Scale Update Committee (RUC) January 2027 practice expense review may produce further revaluations, and CMS left the G-code bundling concept and a definition of monitoring “onset” open for future rulemaking. CMS also summarized comments on its proposed-rule questions about whether supervision requirements for care management services should change to prevent fraudulent billing and what proportion of care management services auxiliary personnel should furnish, an indication that remote monitoring may not be the last care management service to face staffing scrutiny. 

Key Takeaways for Practices, Health Systems and RPM Vendors 

The final rule gives the remote monitoring industry time, not relief. Every RPM and RTM program must meet the initiating visit and established-patient requirements and absorb revised valuations beginning Jan. 1, 2027, and outsourced clinical staffing models have a fixed end date of Dec. 31, 2028. Who qualifies as a “direct employee” will likely determine whether many health system, leased, and PEO staffing models survive, and organizations should plan accordingly.