CMS Just Declared War on RPM Vendors. Clinical Trial Sponsors Should Be Paying Attention.

On July 14, 2026, CMS dropped its proposed Calendar Year 2027 Medicare Physician Fee Schedule, and buried inside its technical language was a provision that should have set off alarms across every decentralized trial operations team in the country. Starting in 2027, CMS proposes to restrict payment for remote physiologic monitoring and remote therapeutic monitoring services exclusively to clinical staff directly employed by the billing practice. Third-party vendors — the commercial RPM companies that have built an entire industry on the gap between what a physician wants to offer and what their staff can actually manage — would no longer be reimbursable under Medicare. The proximate cause: the Office of Inspector General documented that Medicare payments for RPM services reached $536 million in 2024, a 31% increase from 2023, while enrollment of nearly one million Medicare beneficiaries in those same services rose 27% in a single year. That growth curve does not reflect clinical demand. It reflects a billing ecosystem that got ahead of its own oversight.

The question this enforcement action is going to answer: if these vendors cannot be trusted with Medicare billing integrity, what exactly is the clinical trial industry doing letting them run safety surveillance infrastructure in IND-regulated studies?

How the Fraud Architecture Was Built

The RPM vendor model emerged as a seemingly elegant solution. A physician practice signs a service agreement with a third-party company, which ships devices to patients, collects physiologic data, handles the alerting, and bills Medicare under the practice’s provider number for CPT codes 99454 and 99457. The practice gets a revenue stream it didn’t have to build. The vendor gets a cut of every reimbursement. And the patient gets a blood pressure cuff they may or may not use. CMS looked at that structure and, after watching $536 million flow through it in a single year, concluded the incentive architecture was generating fraud rather than care.

The OIG’s findings document a pattern: vendors billing for device data days that patients didn’t generate, billing for clinical time that no clinician spent, and enrolling Medicare beneficiaries into RPM programs without a treating physician ever making a clinical decision that remote monitoring was medically necessary. The billing was real. The oversight was fictional.

What the OIG did not say loudly enough — and what no one in the trial operations community has said at all — is that the exact same vendor infrastructure is currently embedded inside decentralized clinical trials across multiple therapeutic areas. The global DCT market was valued at $8.8 billion in 2024 and is projected to hit $18.8 billion by 2030. Hardware components, including wearable devices and remote monitoring equipment, represented $1.4 billion of that market in 2025 alone. A meaningful slice of that infrastructure runs through the same commercial RPM vendors that OIG just characterized as a fraud-saturated billing sector.

The Sponsor Liability Nobody Has Priced In

Here is where this stops being a Medicare story and becomes a GCP story.

Under 21 CFR Part 312, sponsors bear accountability for the integrity of data collected in IND-regulated studies, regardless of which vendor collected it. FDA Compliance Program 7348.810, which governs BIMO inspections of sponsors and CROs, makes clear that delegating a monitoring function to a third party does not transfer the sponsor’s regulatory responsibility. In a November 2024 warning letter following a BIMO inspection, FDA cited a sponsor for failures in records and audit trail management that traced directly to a vendor relationship the sponsor believed was operating compliantly. The sponsor’s defense — we relied on the vendor — did not appear in the agency’s response.

Now map that accountability structure onto what OIG has just documented about the RPM vendor sector. These companies were billing for data transmission days that may not have occurred, for clinical review time that was not performed, for device engagement that was not verified. Every one of those failures, transposed into a clinical trial context, is a potential data integrity finding. If a sponsor’s Phase III safety surveillance relies on daily RPM data feeds from a third-party vendor, and that vendor has the same operational DNA as the companies OIG just flagged, the sponsor has a problem that no quality agreement will fully insulate.

The counterintuitive read here is worth sitting with. Most sponsors treat RPM vendor qualification as a procurement question: does the device have 510(k) clearance, does the vendor carry adequate insurance, does the MSA include appropriate data ownership clauses. That framing misses the actual risk. The OIG findings reveal that the fundamental operating weakness of these vendors is not technical — it is behavioral. The fraud pattern was not about bad hardware. It was about a business model that rewards billing volume over clinical rigor, and that incentive structure does not disappear when the same vendor pivots from Medicare reimbursement to a sponsor service agreement.

Between CMS’s proposed employment requirement and the OIG’s enforcement posture, the commercial RPM vendor sector is now facing an existential threat to its primary revenue source. Companies that have built their operational capacity on Medicare billing are about to lose it — and the clinical trial market will look like an attractive replacement revenue stream. Sponsors that have not audited their RPM vendor relationships in the past 12 months are at risk of inheriting the compliance failures of a sector in financial distress.

What the FDA Has Not Said Yet — and Should

FDA’s current IND submission guidance does not require sponsors to document RPM vendor qualifications with the specificity that CMS’s proposed rule now implies is necessary. There is no IND section that asks: has this vendor been audited for billing integrity? Does this vendor’s alert-response workflow meet the minimum documentation standard for GCP-regulated data? The agency has issued general vendor oversight guidance through 7348.810, but it has not published anything that speaks specifically to the RPM vendor sector or to the compliance risk that the OIG findings now make concrete.

That gap is going to close, and the question is whether it closes through a warning letter that names a sponsor and a trial, or through proactive guidance that gives the industry a standard to build toward. The latter is clearly preferable. But FDA’s enforcement bandwidth has been strained throughout 2025 and 2026, and proactive guidance requires resources that the agency is not currently deploying at scale in the DCT vendor space.

For sponsors, the Watchdog directive is specific: pull every active RPM vendor agreement in your DCT portfolio and run it through a compliance lens that includes the OIG’s documented fraud patterns as a risk checklist. If your vendor cannot produce audit logs showing actual device transmission days, actual clinical review timestamps, and documented escalation pathways with response times, you have a data integrity exposure in a study that FDA can inspect. Build a vendor-quality metric that includes billing-integrity track record into every RPM service agreement before the next contract cycle closes. The DCT market’s hardware and connectivity segment was valued at $1.4 billion in 2025 — there is enough at stake to justify the audit cost.

For site directors: if your institution is running a decentralized study in which RPM data flows through a sponsor-designated third-party vendor, you need written clarity on who is accountable for data quality verification. The BIMO inspection will not ask the vendor. It will ask you.

CMS’s comment period on the 2027 Physician Fee Schedule closes before the rule takes effect, and the RPM vendor lobby is already mobilizing. Watch whether CMS softens the employment requirement in the final rule — if it does, the OIG findings will still be on the record, and FDA will eventually have to decide whether those findings are relevant to its own vendor-oversight framework for IND-regulated studies. That decision is the next signal to watch.

References

1. MedCity News — “Why CMS Is Trying to Ban Third-Party Remote Patient Monitoring”
2. CMS — “Calendar Year (CY) 2027 Medicare Physician Fee Schedule Proposed Rule Fact Sheet”
3. McDonald Hopkins — “OIG Report Identifies Remote Patient Monitoring Billing Compliance Concerns”
4. FDA — “Compliance Program 7348.810: Sponsors, Contract Research Organizations, and Monitors”
5. Clinical Pathways Research — “FDA Warning Letter to Sponsor: Records, Reports, and Audit Trails” (April 2025)
6. BCC Research — “Decentralized Clinical Trials Market to Reach $18.8 Billion by 2030”
7. Dataintelo — “Decentralized Clinical Trials Market Report 2025”