November 30, 2023

This article was originally published in the Alabama Medicine Magazine published by the Medical Association of the State of Alabama in its Fall 2023 edition.

Billing and Other Regulatory Considerations

In response to the COVID-19 Pandemic, telehealth has become a popular care option with many patients, with numerous patients opting to receive remote care from the comfort of their own homes. Remote Patient Monitoring, or “RPM,” is becoming an increasingly popular care model, allowing physicians to provide and bill for remote services rendered to manage the care of patients with acute and chronic conditions, such as kidney disease or diabetes. Qualified providers may bill for RPM services under CPT Codes 99453, 99454, 99091, 99457, and 99458.

99453

CPT code 99453 is used to bill for time spent on the initial set-up of the patient’s remote monitoring device. Initial set-up includes patient onboarding for the RPM services, specifically educating the patient on the device and the accompanying treatment schedule. Under this code, clinical and non-clinical staff can provide education on RPM services to the patient and set up the patient’s device. This individual can be contracted or employed by the billing provider, allowing for outside RPM vendors to provide the initial education and set-up services.

This code may only be billed for once during each “episode” of care, meaning the time of the device’s initial activation to the end of treatment. This rule applies even if the patient receives care from multiple providers or has multiple RPM devices. This code should not be used if monitoring services last less than 16 days.

99454

Code 99454 covers the supply of the actual monitoring device to the patient and collection of data or programmed alert transmissions over a 30-day period. In short, this code covers the continuous device supply and patient monitoring, including the cost associated with leasing the remote monitoring device and monthly device servicing costs. Examples of common devices billed under 99454 include blood pressure cuffs, pulse oximeters, blood glucose monitors, and digital weight scales.

Code 99454 may only be billed once every 30-day period, even if the patient has multiple devices. In other words, this code may be billed monthly, but only once per patient regardless of the patient’s number of devices. At least 16 days of data must be collected and transmitted to bill for services under this code. Unlike code 99453, which allowed for education and set-up by a wide range of individuals, the primary provider must order the device and provide the invoices for the cost of the device and services under 99454.

99091

Code 99091 is used to bill for the analysis and interpretation of data collected and transmitted from the RPM device, including 30 minutes of RPM clinical time between patient and provider each month. There must be at least one instance of communication between provider and patient, which may be conducted in person or virtually or electronically in the form of a call, video visit, or email. This code may only be billed for services provided by a qualified health professional and cannot be billed in conjunction with code 99457.

99457

This code covers a patient’s initial treatment management services, including the development of a treatment plan and plan management informed by collected data from the RPM device. Twenty minutes of care must be provided to the patient in conjunction with the treatment plan. This requires the provider to have interactive communication with the patient, which may be administered remotely by phone or video call; but the total time spent to reach the required 20 minutes may include time spent furnishing management services. This code is intended as a follow-up to codes 99453 and 99454 after data has been collected by the device.

99458

Code 99458 is used as a follow-up code to 99457, covering any additional time spent on treatment and management of the patient’s condition and treatment plan above the first 20 minutes provided under 99457. Time billed under this code is measured in 20-minute increments and cannot be rounded up or carried over to subsequent periods. Like code 99457, 99458 requires the provider to have interactive communication with the patient.

CMS Guidelines

CMS has established its own payment policies in order for providers to submit bills for RPM services. As a notable change from relaxed pandemic guidelines, providers must have an established patient-physician relationship before they may submit bills to Medicare for RPM services. Both physicians and non-physician practitioners eligible to furnish evaluation and management services may bill for RPM services.

Moreover, there are specific guidelines that must be followed before submitting bills using codes 99453 and 99454. Specifically, the collection and transmission of data must occur automatically and be readily available for analysis and interpretation. In other words, the data is not self-recorded and/or self-reported by the patient. The RPM device must meet the definition of a “medical device” as defined by the FDA, but need not be certified by the FDA as a medical device. The device must also be capable of transmitting daily recordings of patient health data, or transmitting alerts to the patient if the data values fall outside of a set value range as set in the treatment plan. Furthermore, the device must be reasonable and necessary for diagnosis or treatment of the patient’s condition. Finally, if RPM services are provided by auxiliary personnel, such services must be provided under the general supervision of the billing practitioner.

Regulatory Considerations

RPM involves furnishing monitoring services to patients through a medical device provided by a physician or practice. These devices and services are often contracted for and sourced from an outside entity specializing in RPM devices and/or services. Accordingly, Providers must be aware of Stark Law implications when entering arrangements with RPM service providers and submitting bills to Medicare and Medicaid for eligible patients.

Stark Law prohibits physician referrals for designated health services (“DHS”) billable under Medicare to an entity in which the physician has a financial relationship.2 A physician with an indirect or direct financial relationship "may not make a referral to that entity for the furnishing of DHS for which payment otherwise may be made under Medicare,", nor may an entity "present or cause to be presented a claim or bill to the Medicare program…for the DHS performed pursuant to the prohibited referral."3 DHS, as relevant to RPM services, includes durable medical equipment and supplies ("DME").4 For purposes of Stark Law, DME is defined as "equipment, furnished by a supplier or home health agency that meets the following conditions: (1) can withstand repeated use; (2) effective with respect to items classified as DME after January 1, 2012, has an expected life of at least 3 years; (3) is primarily and customarily used to serve a medical purpose; (4) generally is not useful to an individual in the absence of an illness or injury; [and] (5) is appropriate for use in the home."5 Although RPM services are generally considered to be evaluation and management ("E/M") services (which are physician services not considered DHS), under this definition, it is possible that they may also be considered DHS for purposes of the Stark Law due to the medical device component of the services.

RPM devices and services are bundled together and billed under CPT code 99454, which is designated as an E/M code used to bill for evaluation and management services provided by a qualified provider. Because CPT code 99454 is used to bill for the device provided to the patient, which likely meets the definition of DME for Stark Law purposes, services billed for under 99454 are likely DHS, subjecting RPM arrangements to Stark Law. Therefore, providers must be wary of existing financial relationships before contracting with third parties for RPM services and submitting bills to Medicare and Medicaid.

Providers must also consider potential violations of the Anti-Kickback Statute (“AKS”) when contracting and billing for RPM services. Generally, AKS prevents the offer, exchange, or receipt of remuneration in exchange for referrals for federally insured beneficiaries. For purposes of AKS, remuneration is simply anything of value, whether in the form of cash or otherwise. As applied to RPM, providers should exercise caution in structuring any relationships with RPM vendors and in how they offer RPM services to patients.  Depending on the structure of the arrangement, the provider could be viewed as receiving remuneration from an RPM vendor in exchange for referrals, or as providing remuneration to the patient in the form of free or below-market equipment used for the RPM services.

As the demand for telehealth services has increased, CMS has passed several new safe harbors under the AKS statute for value-based enterprises ("VBEs"), including the patient engagement and support safe harbor. Under this safe harbor, the VBE participant must use tools and supports, such as an RPM device, to further value based care.6 Among other requirements, to fall within the bounds of this safe harbor, patients receiving RPM services must be a “patient in the target patient population of a value-based arrangement to which the VBE participant is a party.”7 Notably, this safe harbor only protects in-kind remuneration (excluding cash) up to a maximum aggregate retail value of $500 per patient. The patient engagement tools and supports safe harbor and other VBE-based safe harbors may be applicable in structuring an RPM arrangement.

Finally, providers must consider the interplay of HIPAA and RPM services when entering into arrangements with patients and RPM vendors. RPM devices automatically collect and upload protected health information (“PHI”). As such, patient consents and heightened digital security measures may be necessary before beginning any RPM services to protect PHI. Furthermore, contracts with RPM vendors for their devices and services may require business associate agreements under HIPAA due to the sensitive nature of the PHI collected and monitored by the RPM devices.

Aside from regulatory compliance concerns discussed above, additional considerations when structuring RPM arrangements include liability protections and allocation of responsibility between the parties to an RPM arrangement. For example, patients should be clearly advised of the scope of RPM services, how frequently patients will be monitored (e.g., 24/7, during the work week only, etc.), and proper protocols to follow when they receive an abnormal RPM reading. In addition, agreements with RPM vendors should allocate responsibility between the parties for operational and financial duties and responsibilities (e.g., monitoring patient readings, maintaining medical records, billing, and responding to audits).

RPM services offer many opportunities for enhanced patient care. However, providers should proceed with caution in structuring arrangements with RPM vendors in this relatively new field of remote care.

Sources:

1. Interactive communication has been defined by CMS as meaning “a real-time synchronous, two-way audio interaction that is capable of being enhanced with video or other kinds of data transmission.” See 85 F.R. 248, 84544 (2020).

2. 42 C.F.R. § 411.350(a). A financial relationship may be direct or indirect, consisting of an ownership or investment interest in the entity, or a compensation arrangement with the entity. See 42 C.F.R. § 411.354.

3. 42 C.F.R. § 411.353(a)-(b).

4. 42 C.F.R § 411.351. Under this definition, RPM devices likely qualify as durable medical equipment.

5. 42 C.F.R § 414.202.

6. VBE requirements can be found at 42 C.F.R. § 411.351.

7. See 42 C.F.R. §1001.952(hh).