# Auditing RTM: Bulletproofing Your Clinic's Data Tracking

By Sulo Team (Pediatric therapy & RTM) · Published 2026-08-20
Canonical: https://sulomotion.com/blog/auditing-rtm-data-tracking/

**The bottom line:** An RTM audit starts as a letter — an Additional Documentation Request — and you get 45 calendar days to answer it (30 if it comes from a UPIC). What it asks you to prove is narrow and mechanical: that the plan of care was current, that qualifying days fell inside the right 30-day window, that review minutes were real and reviewed by someone allowed to review them, and that a live interactive communication happened. The failure mode isn't clinical judgment — it's reconstruction. CMS expects services to be documented when they're rendered, so a spreadsheet assembled on the 30th is a delayed entry, and it has to be labeled as one. Contemporaneous, timestamped counting is the whole defense.

- The same 2021 final rule that created RTM payment also created the regulation letting contractors deny a claim when you don't answer a records request in time.
- 45 calendar days to respond to a MAC, SMRC, or RAC; 30 for a UPIC. The letter goes to your Medical Review Correspondence Address — check that it's current.
- Small clinics are not exempt. CMS runs a Low Biller Probe and Educate program specifically for providers whose volume would keep them out of standard review.
- CMS expects documentation at the time of service. Month-end reconstruction is a delayed entry and has to be identified as one.
- Keep the file for 7 years from the date of service, and keep it per claim — not per patient.

---

## What does an RTM audit actually look like?

**It looks like a letter.** There is no inspector in the lobby. Medicare medical review runs through an **Additional Documentation Request** — an ADR — sent by one of several contractors: your Medicare Administrative Contractor, the Supplemental Medical Review Contractor, a Recovery Audit Contractor, or a Unified Program Integrity Contractor. The letter names specific claims and asks you to produce the records that support them.

Three things about that letter decide how the rest goes.

**It has a clock.** You get **45 calendar days** to respond to a MAC, the SMRC, or a RAC — on both prepayment and post-payment review. A UPIC gives you **30**. Those contractors may accept late documentation for *good cause*, which CMS describes as natural disasters, interruptions in business practices, or other extenuating circumstances — not "we were busy."

**It goes to an address you may not have looked at in years.** CMS instructs providers to keep the **Medical Review Correspondence Address** on file with Medicare current for exactly this reason. An ADR mailed to a closed suite or an old billing company burns the 45 days while you're unaware there's a clock at all. Verifying that address is a fifteen-minute task with an outsized payoff.

**Silence is a decision.** Under **42 CFR 405.930**, if a contractor gives you notice and time to respond and you don't produce the documentation, the contractor has authority to deny the claim. Not review it unfavorably — deny it, without anyone forming a view on whether the care was appropriate.

There's a detail here that is more than trivia. **42 CFR 405.930 was created by the same final rule that created RTM payment.** The CY 2022 Physician Fee Schedule final rule (86 FR 64996, published November 19, 2021) establishes the RTM code family beginning at page 65114 — and adds the failure-to-respond regulation at page 65660. RTM arrived with its documentation enforcement attached. The rule's own title names both: payment policies *and* "Provider and Supplier Prepayment and Post-Payment Medical Review Requirements."

## Is a small pediatric clinic too small to get reviewed?

**No — and CMS built a program specifically to reach clinics that assume they are.** The main education-first review vehicle is **Targeted Probe and Educate**. A standard TPE round looks at **20–40 claims** per provider per item or service, followed by one-on-one education, for up to **three rounds**. CMS is explicit about where round three leads for providers who don't improve: referral to CMS for "100 percent prepay review, extrapolation, referral to a Recovery Auditor, or other action." Extrapolation is the one to notice — it projects an error rate across a universe of claims rather than recouping only the ones reviewed.

The part small clinics miss: CMS also runs a **Low Biller Probe and Educate** program, described in its own words as designed for "providers and suppliers who have lower claim volumes and would otherwise not be selected for the traditional TPE program" — fewer than 20 claims per round, up to three rounds. Selection everywhere in this system is driven by data analysis of billing patterns relative to peers, not by practice size. A ten-therapist pediatric clinic with an unusual RTM pattern is a perfectly ordinary candidate.

## Is remote monitoring actually drawing scrutiny?

**Yes — though the published evidence is about RPM, not RTM, and that distinction matters.** Two HHS Office of Inspector General reports have driven federal attention to remote monitoring. The September 2024 report, *Additional Oversight of Remote Patient Monitoring in Medicare Is Needed*, found that about **43 percent** of enrollees who received remote patient monitoring "did not receive all 3 components of it." The August 2025 follow-up, *Billing for Remote Patient Monitoring in Medicare*, reports Medicare payments for remote patient monitoring **exceeding $500 million in 2024** and describes measures OIG developed to flag practices for scrutiny — among them billing for a high proportion of enrollees who have **no prior history with the practice**, and billing for **multiple monitoring devices** for one enrollee in a month.

Read that carefully before you take it personally. Both reports study **Remote Physiologic Monitoring** — CPT 99091, 99453, 99454, 99457 and 99458 — and their target is high-volume monitoring vendors, not outpatient therapy clinics. RTM is a different code family with different billers. What carries over is structural: the same contractors adjudicate both, RTM's code architecture mirrors RPM's, and "the practitioner billed for monitoring components the patient never actually received" is the specific failure OIG's work put on the federal map. It is worth noting that the first of OIG's two measures — enrollees with no prior relationship to the practice — is close kin to CMS's [CY 2027 proposal](/blog/rtm-2027-changes/) to restrict RTM to established patients. Proposals of that kind don't come from nowhere.

## What does a records request ask you to prove?

**Five things, and none of them are clinical judgment calls.** An RTM claim is a set of mechanical assertions, and review tests them one at a time:

1. **The patient was eligible and the plan of care was current.** The RTM codes are designated "sometimes therapy"; when a therapist furnishes them they are always therapy, which means they ride on an active therapy plan of care with current certification or recertification. This is the quiet denial driver, because RTM keeps running through stretches with no in-person visits — and a certification can lapse in exactly those stretches without anyone noticing.
2. **The device qualifies.** The software must meet the FDA's definition of a medical device or software as a medical device under §201(h) of the Food, Drug, and Cosmetic Act. It does *not* need to be FDA-approved, cleared, or registered — but you should hold the vendor's written confirmation that it meets the definition, before you need it.
3. **The qualifying days fell in the right window.** Not a calendar month, not a rolling window: **sequential fixed 30-day periods counted from that patient's RTM start date.** The record has to show which days carried data, inside which period.
4. **The review minutes were real, attributable, and appropriate.** Date and duration of each review session, the cumulative monthly total, who performed it, and what changed as a result. If a PTA or OTA did the reviewing, the supervision and the CQ/CO modifier have to line up.
5. **A live interactive communication happened.** Real-time and synchronous — phone, video, or in person — with the date, duration, and content recorded. Portal messages and texts don't qualify, and in-person time already counted toward a billable visit can't be counted again here.

The per-code documentation list is in the [code-by-code breakdown](/blog/rtm-cpt-codes-explained/) and we won't repeat it here. What that list doesn't tell you is the part that actually decides audits: *when* the record was made.

## Why does month-end reconstruction fail?

**Because Medicare has a rule about when documentation is supposed to exist, and reconstruction is on the wrong side of it.** If you read one section of this post, read this one.

The Medicare Program Integrity Manual, at §3.3.2.5, states the expectation plainly: **"All services provided to beneficiaries are expected to be documented in the medical record at the time they are rendered."** When that doesn't happen, the manual permits amendments, corrections, and delayed entries — but with conditions: "The date and author of any amendment, correction or delayed entry should be identifiable, and the change/addenda should be clearly and permanently denoted."

Now apply that to how most new RTM programs actually run. The therapist reviews data on the 6th, the 12th, the 19th and the 26th. On the 30th, a biller opens a spreadsheet and writes down what they think happened, and that spreadsheet becomes the evidence that 20 minutes accrued. That is a delayed entry describing four separate services. It has one date, one author, and no contemporaneous trace of any of the four.

That leaves two options, both bad. Label it as a delayed entry — correct, honest, and a materially weaker record than a timestamped one. Or don't label it, and present a month-end reconstruction as if it were contemporaneous documentation. The second path stops being a coding question. Program Integrity Manual §3.3.2.4 directs reviewers who have "authenticity concerns related to the legitimacy or falsity of the documentation" toward the attestation and signature-log processes, and where those don't resolve it, toward "denial, and/or fraud referral." Nobody sets out to end up there. It's the kind of place a program can arrive at simply because the tracking was manual and the month closed faster than the paperwork did.

One related limit worth knowing, because clinics discover it at the worst moment: an attestation can clarify *who* wrote an illegible entry, but the manual is explicit that it **cannot be used to "backdate" a plan of care**. If certification lapsed during the service dates, no signature added later fixes the claim.

**The structural answer is unglamorous: capture the timestamps as the work happens.** A platform that starts and stops a timer when a clinician opens a patient's data, records the qualifying day when the family logs, and stamps the interactive communication when it occurs produces contemporaneous documentation as a byproduct. Nothing gets reconstructed because nothing was ever pending. That's the whole argument for automating this layer, and it's a compliance argument before it's a convenience one.

## What belongs in an RTM claim file?

**Assemble it per claim, not per patient.** An ADR names specific claims and specific dates of service, and the reviewer is matching what you send to what you billed. A patient chart dumped whole makes them hunt for it, which serves nobody and invites questions about material you weren't asked about.

For each RTM claim, the packet should contain:

- **The ADR letter itself as page one.** CMS names this as best practice — it ensures your documentation gets matched to the right patient and claim.
- **The therapy plan of care and the current certification or recertification**, covering the service dates.
- **The 98975 setup record**: device type, the education you provided, and the specific instructions given — what to log, how, how often.
- **The per-day transmission log** for the 30-day period, showing the period start date and each qualifying day. Not a summary count — the days.
- **The per-session review log**: date, duration, and clinician for every review session, with the monthly total and the CQ/CO position if an assistant participated.
- **The interactive communication record**: date, duration, and what was discussed.
- **Evidence the review changed something** — a program adjustment, a note, a message to the family. This is the difference between monitoring and billing for monitoring — and "the components weren't all actually furnished" is precisely the pattern OIG's 43 percent finding describes.
- **The device attestation** from your vendor.
- **The claim itself**, with GP/GO/GN and any CQ/CO shown.

Two practices worth adopting before you need them. **Dry-run one claim per quarter** — pick a patient at random, assemble the packet as if the letter had arrived, and see how long it takes and what's missing. And **date-stamp your exports**, so the file you produce in month 14 demonstrably reflects what the system recorded in month 2.

## How long do you have to keep all of this?

**Seven years from the date of service is the number to plan around.** 42 CFR 424.516(f) requires providers and suppliers furnishing covered ordered, certified, referred, or prescribed Part A or B services to maintain the related documentation for **7 years from the date of service** and to provide access on request from CMS or a Medicare contractor. Outpatient therapy runs on a physician-certified plan of care, which places therapy records squarely in that orbit — and where the exact reach of the regulation is arguable, the conservative reading is the only sensible one to build a retention policy on.

CMS attaches real consequences. Its own MLN guidance states that failure to comply with the maintenance and access requirements may result in **revocation of Medicare enrollment** under 42 CFR 424.535(a)(10), that CMS may weigh each instance of non-compliance in setting the re-enrollment bar, and that failure to provide a *single* record from a request letter may constitute one instance.

Two practical notes. State law and commercial payer contracts sometimes require longer — take the longest applicable period, not the federal one. And "retained" has to mean retrievable: if your RTM data lives in a vendor platform, know now what happens to the per-day and per-minute logs if you change vendors. CMS recognizes that you may rely on another entity to hold records, but when the request arrives, **you** are responsible for producing them.

## What if the claim gets denied anyway?

**Appeal, and take the first level seriously, because the question at that level is documentary rather than clinical: the file either shows what you billed or it doesn't.** You have **120 days from receipt of the initial determination** to request a redetermination from your MAC — receipt is presumed 5 calendar days after the date of the notice unless you can show otherwise — and the MAC generally issues a decision within 60 days. Four further levels follow: reconsideration by a Qualified Independent Contractor (within 180 days of the redetermination decision), a hearing at the Office of Medicare Hearings and Appeals, the Medicare Appeals Council, and judicial review in federal district court.

The reason to take level one seriously is that it's where a complete file wins. A denial for "documentation does not support the time billed" is answerable if the timestamps exist and unanswerable if they don't — which is the same point this whole post keeps arriving at, from a different direction.

Two habits close the loop. **Read your denial codes rather than writing off small claims** — a repeated remark code across several RTM denials is telling you about a systematic defect, and a systematic defect is what draws a probe. And **track your own RTM denial rate by reason**, quarterly. It's the earliest warning you get, and it costs nothing.

## What good tracking looks like

The clinics that handle review calmly aren't the ones with better binders. They're the ones that never had to assemble anything, because the counting happened in the background: qualifying days accruing against each patient's own 30-day period, review minutes stamped as sessions open and close, interactive communications logged when they happen, and a month-end report that is a *readout* rather than a reconstruction. That's the layer [Sulo](/) is built to run for pediatric PT, OT and SLP clinics — the same layer that makes the [launch playbook](/blog/how-to-start-rtm-program/) sustainable past month three, and the same one the [2026 threshold changes](/blog/new-2026-rtm-rules/) made materially harder to do by hand.

None of it guarantees payment, and any vendor telling you their exports make a claim audit-proof is selling something. What it does is narrow the question a reviewer can ask you to a set of facts you can answer, on the day they ask. That's the realistic goal, and it's worth the setup. If you'd like to see what that looks like on a real caseload, [talk to us](/contact) — or start with the [full RTM guide](/what-is-remote-therapeutic-monitoring) if you're still mapping the program out.

## Frequently asked questions

### How long do I have to respond to a Medicare records request for an RTM claim?

45 calendar days for a request from a Medicare Administrative Contractor, the Supplemental Medical Review Contractor, or a Recovery Audit Contractor — on both prepayment and post-payment review. A Unified Program Integrity Contractor gives you 30 calendar days. Those contractors may accept documentation after the deadline for good cause, which CMS describes as natural disasters, interruptions in business practices, or other extenuating circumstances. If you don't respond, 42 CFR 405.930 gives the contractor authority to deny the claim outright — no clinical review of whether the service was appropriate.

### Can I put my RTM minutes together at the end of the month?

You can, but you should understand what you're creating. The Medicare Program Integrity Manual says all services are expected to be documented in the medical record at the time they are rendered, and that anything amended, corrected, or entered afterward must have an identifiable date and author and be clearly and permanently denoted as such. A month-end reconstruction is a delayed entry. Labeled honestly, it's a weaker record than a contemporaneous one; labeled as though it were contemporaneous, it's an authenticity problem — and authenticity concerns are the path that leads a reviewer toward denial or a fraud referral rather than a coding correction. The fix is structural: capture the timestamps as the work happens.

### Is my clinic too small to be audited?

No. A standard Targeted Probe and Educate round reviews 20–40 claims, and CMS also runs a Low Biller Probe and Educate program built specifically for providers and suppliers with lower claim volumes who 'would otherwise not be selected' — fewer than 20 claims per round, up to three rounds. Selection is driven by data analysis of billing patterns, not by size. A small clinic whose RTM billing looks unusual relative to peers is a candidate.

### Is there a coverage policy that spells out what RTM documentation must contain?

Not in the way clinics expect, because RTM isn't governed by a coverage policy at all — it's governed by the Physician Fee Schedule. There is no national coverage determination for RTM, and the codes reached payment through PFS rulemaking rather than through a coverage decision. Local coverage is a separate question and worth checking yourself: LCDs and billing-and-coding articles are issued MAC by MAC, we're aware of none specific to RTM, and one can appear at any time — so search the Medicare Coverage Database for your own contractor rather than taking a national answer for a local one. Absent either, review runs against the CPT code descriptors, the payment rules in the fee schedule, the general Part B requirement at 42 CFR 424.5(a)(6) that you furnish sufficient information to determine whether payment is due, and the outpatient therapy plan-of-care rules that apply to any 'sometimes therapy' service a therapist furnishes. That's a broader standard than a checklist, which is exactly why the burden of building the file sits with you.

### How long do I need to keep RTM records?

Plan on 7 years from the date of service. 42 CFR 424.516(f) requires providers and suppliers furnishing covered ordered, certified, referred, or prescribed Part A or B services to maintain the related documentation for 7 years and to provide access on request from CMS or a Medicare contractor — and outpatient therapy runs on a physician-certified plan of care. CMS also ties this to enrollment: failure to comply may result in revocation under 42 CFR 424.535(a)(10), and CMS says failure to provide a single requested record may constitute one instance of non-compliance. State law and commercial payer contracts sometimes require longer, so take the longest applicable period.

### What happens if the claim is denied after review?

You appeal, and the first level is where a complete file does its work — the question there is whether the record supports what was billed. You have 120 days from receipt of the initial determination to request a redetermination from your MAC — receipt is presumed 5 calendar days after the notice date unless you can show otherwise — and the MAC generally issues its decision within 60 days. If that fails there are four further levels, starting with reconsideration by a Qualified Independent Contractor, which must be requested within 180 days of receiving the redetermination decision.


## Sources

1. [CMS — Additional Documentation Request (response timeframes by contractor and review type)](https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-education/additional-documentation-request)
2. [42 CFR 405.930 — Failure to respond to additional documentation request](https://www.ecfr.gov/current/title-42/section-405.930)
3. [42 CFR 424.5 — Basic conditions for Medicare payment (including the 'sufficient information' requirement at (a)(6))](https://www.ecfr.gov/current/title-42/section-424.5)
4. [CMS — Medicare Program Integrity Manual, Chapter 3 (signature requirements §3.3.2.4; amendments, corrections and delayed entries §3.3.2.5)](https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf)
5. [CMS — Targeted Probe and Educate (round size, three-round structure, and the Low Biller Probe and Educate program)](https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-and-education/targeted-probe-and-educate-tpe)
6. [42 CFR 424.516(f) — 7-year documentation maintenance and access requirement](https://www.ecfr.gov/current/title-42/section-424.516)
7. [CMS MLN — Medical Record Maintenance & Access Requirements (MLN4840534)](https://www.cms.gov/files/document/mln4840534-medical-record-maintenance-access-requirements.pdf)
8. [CY 2022 Physician Fee Schedule final rule (86 FR 64996) — establishes RTM payment at 65114 and adds 42 CFR 405.930 at 65660](https://www.federalregister.gov/documents/2021/11/19/2021-23972/medicare-program-cy-2022-payment-policies-under-the-physician-fee-schedule-and-other-changes-to-part)
9. [HHS OIG — Additional Oversight of Remote Patient Monitoring in Medicare Is Needed (OEI-02-23-00260, September 2024)](https://oig.hhs.gov/reports/all/2024/additional-oversight-of-remote-patient-monitoring-in-medicare-is-needed/)
10. [HHS OIG — Billing for Remote Patient Monitoring in Medicare (OEI-02-23-00261, August 2025)](https://oig.hhs.gov/reports/all/2025/billing-for-remote-patient-monitoring/)
11. [CMS — First Level of Appeal: Redetermination by a Medicare Contractor](https://www.cms.gov/medicare/appeals-grievances/fee-for-service/first-level-appeal-redetermination-medicare-contractor)

---

**Disclaimer:** This article is provided by SuloMotion Inc. for general informational and educational purposes only. It is not legal, billing, coding, medical, or financial advice, and no professional or advisory relationship is created by reading it. Regulations, CPT® code descriptors, coverage policies, and reimbursement rates change frequently and vary by payer, plan, and locality; SuloMotion Inc. makes no representations or warranties as to accuracy, completeness, or timeliness, and accepts no liability for actions taken in reliance on this content. Verify current requirements with CMS, your Medicare Administrative Contractor, your payers, and your own billing, legal, and compliance advisors. CPT® is a registered trademark of the American Medical Association.

Use of this content is subject to our Terms of Service: https://sulomotion.com/terms — © SuloMotion Inc., https://sulomotion.com