Staying on Track: Navigating Compliance & Pitfalls in Care Management

Care management (CM) programs such as Chronic Care Management (CCM) and Remote Patient Monitoring (RPM) help practices progress on the path to value-based care. They have been shown to help keep high-risk patients out of the hospital, improve patient engagement, and generate predictable recurring revenue for practices.

Yet, if you’ve been reading the news lately, you’ve likely noticed a significant narrative taking hold: a wave of federal oversight, OIG reports, and multi-million-dollar enforcement actions targeting care management fraud.

Why is the government scrutinizing care management programs? What separates an unintentional operational gap from a disastrous audit? And most importantly, can healthcare practices still run these programs profitably and safely?

Here is what you need to know about what regulators are focused on, where practices stumble, and how to build an effective, compliant, and scalable care management operation.

Why Is the Government Scrutinizing Care Management?

The explosion of virtual and non-face-to-face care during and after the pandemic opened the door for incredible clinical innovation, but it also invited the potential for systemic abuse.

Care management programs rely heavily on time-based billing, clinical staff delegation, and proactive data monitoring. Because these services occur outside traditional clinic encounters, CPT codes could be mistreated as low-effort revenue streams.

What Triggered the Alarm: OIG's Spotlights on RPM

The Department of Health and Human Services Office of Inspector General (OIG) has issued a series of reports and alerts specifically addressing RPM and care management services.

The OIG uncovered red flags across the country, including:

• Non-transmitting devices: Platforms and providers billing for RPM services using hardware that fails to automatically collect and transmit physiological data.
• Phantom patient relationships: Dozens of practices billing RPM for thousands of patients with whom they had zero established clinical history or prior qualifying encounters.
• Billing for devices without treatment: Billing monthly device supply codes consistently while failing to ever record clinical staff time spent actually reviewing the data or managing the patient's care.

What Is CMS Doing About It?

The Centers for Medicare & Medicaid Services (CMS) is cracking down. Rather than scrapping these vital programs, CMS is tightening the parameters.

They are increasing automated claim-data audits, evaluating mandates requiring ordering provider IDs on claims, introducing granular CPT options (like short-duration pathways to reduce all-or-nothing billing incentives), and working closely with Medicare Administrative Contractors (MACs) to claw back illegitimate payments.

Tell-Tale Signs of Care Management Pitfalls (and What Happens When You Get Them Wrong)

Most practices aren't trying to commit fraud. The real danger for the average practice is operational negligence, i.e. letting workflows lapse until legitimate clinical work becomes unbillable or non-compliant under current regulatory frameworks.

General Tell-Tale Signs of CM Pitfalls

• "Setup and Forget": Enrolling patients into a program, handing them a device or care plan, and collecting monthly supply or care management fees without documented active clinical engagement.
• Over-reliance on Unvetted Third Parties: Outsourcing care management to white-label tech vendors who promise "100% turnkey revenue," only to find out they aren't documenting staff time to Medicare standards or lack licensed clinical staff.
• Time-Counting Anomalies: Billing for care management minutes that overlap with other billable services (e.g., claiming CCM time while the patient is sitting in the clinic for an Annual Wellness Visit (AWV)).

Program-Specific Examples (using RPM, RTM & CCM as primary settings)

• In RPM / Remote Therapeutic Monitoring (RTM): Billing device codes when data transmissions don't meet monthly threshold minimums, or failing to capture a treating clinician's explicit, documented order for the device.
• In CCM: Treating a care plan as a static PDF created once at intake rather than a "living document" that is updated, shared, and managed dynamically across the care team.

What Happens When You Do It Wrong?

Failing an audit isn't just an embarrassing wrist slap.

The consequences can be financially and operationally severe:

1. Immediate Clawbacks: CMS can demand 100% of reimbursed funds back for audited cohorts across multi-year lookback windows.
2. Pre-Payment Review: MACs can put your entire practice on "pre-payment edit status," holding all submitted care management claims for manual review and paralyzing cash flow for months.
3. False Claims Act (FCA) Exposure: If a practice "recklessly disregards" billing rules or fails to oversee an outsourced vendor, it can face 3x damages plus mandatory civil penalties per claim under the False Claims Act.

Are Care Management Programs Inevitably Prone to Fraud?

No. The heightened scrutiny isn't a sign that care management is broken.

It’s a sign the industry is maturing.

When run correctly, care management programs are among the most effective tools in modern medicine, since they drive down emergency room admissions, stabilize chronic conditions, and deepen the patient-provider relationship.

How to Do Care Management Right

Doing care management right doesn't require an excessive compliance budget; it requires clean workflows and real awareness & accountability.

1. Confirm Eligibility First: Verify the patient meets program-specific criteria and that the relationship is established through a qualifying visit. Informed consent is required prior to enrollment.
2. Proactively Document Clinical Time: Stop estimating staff minutes at the end of the month. Proactively use care management platforms with automated time logs that record what was done, by whom, and for how long.
3. Integrate Clinical Triage, Not Just Data: Make sure incoming remote monitoring data or chronic care updates drive actual clinical decisions, such as medication tweaks, lab orders, or care team check-ins.
4. Vet External Partners Thoroughly: If you partner with a digital health platform or outsourced clinical service, ensure their staff actions are completely transparent, audit-ready, and directly integrated into your EHR.

Real-World Success: What Doing It Right Looks Like
Consider a multi-provider cardiology group that implemented a structured RPM and CCM program for heart failure patients.

By tying remote weight and blood pressure readings directly into nurse triage protocols, the practice caught early fluid retention before patients ever felt short of breath. Over the course of a year, the practice reduced 30-day hospital readmissions for heart failure by over 35%, while generating compliant, sustainable revenue that funded two dedicated nurse navigators.

The audit trail was simple: every device had a clear physician order, every minute of clinical outreach was time-stamped, and every monthly claim matched clear medical necessity.

The Bottom Line

Care management programs aren't a shortcut to easy revenue, nor are they a regulatory minefield to be avoided. They are a core pillar of modern chronic disease management.

By understanding where well-intentioned practices slip up, your organization  can build a compliant, high-performing program that satisfies regulators, boosts financial sustainability, and above all, delivers better care to the patients who need it most.