The Compliance Reality Behind Scalable CCM & RPM

Published: 4/23/2026Updated: 4/23/20265 Min ReadChuck WashburnChief Revenue Officer

The Compliance Reality Behind Scalable CCM & RPM

Chronic care management (CCM) and remote patient monitoring (RPM) have firmly established themselves as pillars of modern value-based care. For enterprise health systems, ACOs, and large physician groups, the question is no longer if you should implement these programs, but rather how to scale across complex populations.

But there’s a major shift happening beneath longitudinal care models that we need to discuss.

On March 16, 2026, the Office of Inspector General added a new item to its 2026 Work Plan: a specialized audit of Medicare Part B payments for Chronic Care Management. The project is active through FY 2028, and the OIG has already signaled where it's looking — scaled programs, vendor-driven models, and documentation that can't substantiate the "multiple chronic conditions" threshold.

The question is no longer whether to invest in remote care. It's whether the program you already have can withstand a federal audit.

Most can't.

Not because the clinical work is wrong, but because programs built for rapid enrollment weren't designed for enterprise-scale scrutiny.

CCM Expansion Was Fun, It’s Time for Examination

Since 2015, CCM adoption has accelerated rapidly. Organizations focused on:

• Improving outcomes for chronic populations
• Extending care between visits
• Reducing acute utilization
• Capturing reimbursement opportunities
• Meeting quality metrics

That worked — programs launched and revenue followed.

But as programs scaled, new questions emerged:

• Can we consistently prove medical necessity?
• Why are claims being rejected?
• Can we defend these claims?
• Do care plans hold up over time?

What works as a pilot breaks under enterprise pressure.

The Illusion of Compliance in CCM

On paper, CCM programs look compliant:

• Patients meet eligibility
• Care plans exist
• Time is tracked
• Outreach is documented

But compliance at scale is about consistency — and that’s where programs fail.

Where Things Start to Break

1. Eligibility Without Defense

Patients qualify, but documentation fails to connect conditions to ongoing clinical risk.

2. Static or Generic Care Plans

Care plans become templated artifacts instead of evolving clinical tools.

3. Time Tracking Without Context

Minutes are logged, but lack linkage to medically necessary activities.

4. Limited Clinical Oversight

Physician involvement becomes implied instead of clearly documented.

What Makes Remote Programs Sturdy: The Triad

1. Clinical Integrity

• Clear, documented medical necessity
• Conditions tied to clinical risk
• Evolving care plans
• Continuous clinical relevance

In strong models, justification is ongoing — not a one-time check.

2. Operational Consistency

• Standardized workflows across all patients
• Consistent documentation structure
• Uniform enrollment and consent processes

Inconsistent execution creates compliance risk at scale.

3. Physical Integration

• Physician-directed care plans
• Alignment between care teams and providers
• Documented provider oversight

Remote care must be anchored to the provider — not operating independently.

Why “At Scale” Is Where Programs Fail

Small issues in pilot programs become major risks at scale.

A 5% documentation gap in a 10,000-patient program impacts hundreds of claims.

Variability becomes a structural problem.

The Vendor Model Mismatch

Most vendors were built for:

• Rapid deployment
• Enrollment growth
• Revenue generation

They were not built for:

• Enterprise standardization
• Documentation integrity
• Clinical rigor at scale

This creates risk — especially under audit conditions.

What a Defensible Partner Looks Like

• Clinical staff delivering care — not call centers
• Standardized workflows across all patients
• Provider-anchored oversight
• Continuous quality assurance

These are structural safeguards — not operational tweaks.

The Real ROI: Protection AND Performance

Most organizations measure:

• Revenue
• Engagement
• Efficiency

But should also evaluate:

• Revenue integrity
• Program sustainability
• Audit readiness
• Confidence in every billed service

The real risk isn’t growth — it’s regulatory pressure at scale.

The Question You Should Ask Your Vendor

If the OIG audited your program tomorrow, would every billed minute hold up?

If you have to think about it, you already have your answer.