Auditing RTM: Bulletproofing Your Clinic's Data Tracking

What does an RTM audit actually look like?

It looks like a letter. There is no inspector in the lobby. Medicare medical review runs through an Additional Documentation Request — an ADR — sent by one of several contractors: your Medicare Administrative Contractor, the Supplemental Medical Review Contractor, a Recovery Audit Contractor, or a Unified Program Integrity Contractor. The letter names specific claims and asks you to produce the records that support them.

Three things about that letter decide how the rest goes.

It has a clock. You get 45 calendar days to respond to a MAC, the SMRC, or a RAC — on both prepayment and post-payment review. A UPIC gives you 30. Those contractors may accept late documentation for good cause, which CMS describes as natural disasters, interruptions in business practices, or other extenuating circumstances — not “we were busy.”

It goes to an address you may not have looked at in years. CMS instructs providers to keep the Medical Review Correspondence Address on file with Medicare current for exactly this reason. An ADR mailed to a closed suite or an old billing company burns the 45 days while you’re unaware there’s a clock at all. Verifying that address is a fifteen-minute task with an outsized payoff.

Silence is a decision. Under 42 CFR 405.930, if a contractor gives you notice and time to respond and you don’t produce the documentation, the contractor has authority to deny the claim. Not review it unfavorably — deny it, without anyone forming a view on whether the care was appropriate.

There’s a detail here that is more than trivia. 42 CFR 405.930 was created by the same final rule that created RTM payment. The CY 2022 Physician Fee Schedule final rule (86 FR 64996, published November 19, 2021) establishes the RTM code family beginning at page 65114 — and adds the failure-to-respond regulation at page 65660. RTM arrived with its documentation enforcement attached. The rule’s own title names both: payment policies and “Provider and Supplier Prepayment and Post-Payment Medical Review Requirements.”

Is a small pediatric clinic too small to get reviewed?

No — and CMS built a program specifically to reach clinics that assume they are. The main education-first review vehicle is Targeted Probe and Educate. A standard TPE round looks at 20–40 claims per provider per item or service, followed by one-on-one education, for up to three rounds. CMS is explicit about where round three leads for providers who don’t improve: referral to CMS for “100 percent prepay review, extrapolation, referral to a Recovery Auditor, or other action.” Extrapolation is the one to notice — it projects an error rate across a universe of claims rather than recouping only the ones reviewed.

The part small clinics miss: CMS also runs a Low Biller Probe and Educate program, described in its own words as designed for “providers and suppliers who have lower claim volumes and would otherwise not be selected for the traditional TPE program” — fewer than 20 claims per round, up to three rounds. Selection everywhere in this system is driven by data analysis of billing patterns relative to peers, not by practice size. A ten-therapist pediatric clinic with an unusual RTM pattern is a perfectly ordinary candidate.

Is remote monitoring actually drawing scrutiny?

Yes — though the published evidence is about RPM, not RTM, and that distinction matters. Two HHS Office of Inspector General reports have driven federal attention to remote monitoring. The September 2024 report, Additional Oversight of Remote Patient Monitoring in Medicare Is Needed, found that about 43 percent of enrollees who received remote patient monitoring “did not receive all 3 components of it.” The August 2025 follow-up, Billing for Remote Patient Monitoring in Medicare, reports Medicare payments for remote patient monitoring exceeding $500 million in 2024 and describes measures OIG developed to flag practices for scrutiny — among them billing for a high proportion of enrollees who have no prior history with the practice, and billing for multiple monitoring devices for one enrollee in a month.

Read that carefully before you take it personally. Both reports study Remote Physiologic Monitoring — CPT 99091, 99453, 99454, 99457 and 99458 — and their target is high-volume monitoring vendors, not outpatient therapy clinics. RTM is a different code family with different billers. What carries over is structural: the same contractors adjudicate both, RTM’s code architecture mirrors RPM’s, and “the practitioner billed for monitoring components the patient never actually received” is the specific failure OIG’s work put on the federal map. It is worth noting that the first of OIG’s two measures — enrollees with no prior relationship to the practice — is close kin to CMS’s CY 2027 proposal to restrict RTM to established patients. Proposals of that kind don’t come from nowhere.

What does a records request ask you to prove?

Five things, and none of them are clinical judgment calls. An RTM claim is a set of mechanical assertions, and review tests them one at a time:

1. The patient was eligible and the plan of care was current. The RTM codes are designated “sometimes therapy”; when a therapist furnishes them they are always therapy, which means they ride on an active therapy plan of care with current certification or recertification. This is the quiet denial driver, because RTM keeps running through stretches with no in-person visits — and a certification can lapse in exactly those stretches without anyone noticing.
2. The device qualifies. The software must meet the FDA’s definition of a medical device or software as a medical device under §201(h) of the Food, Drug, and Cosmetic Act. It does not need to be FDA-approved, cleared, or registered — but you should hold the vendor’s written confirmation that it meets the definition, before you need it.
3. The qualifying days fell in the right window. Not a calendar month, not a rolling window: sequential fixed 30-day periods counted from that patient’s RTM start date. The record has to show which days carried data, inside which period.
4. The review minutes were real, attributable, and appropriate. Date and duration of each review session, the cumulative monthly total, who performed it, and what changed as a result. If a PTA or OTA did the reviewing, the supervision and the CQ/CO modifier have to line up.
5. A live interactive communication happened. Real-time and synchronous — phone, video, or in person — with the date, duration, and content recorded. Portal messages and texts don’t qualify, and in-person time already counted toward a billable visit can’t be counted again here.

The per-code documentation list is in the code-by-code breakdown and we won’t repeat it here. What that list doesn’t tell you is the part that actually decides audits: when the record was made.

Why does month-end reconstruction fail?

Because Medicare has a rule about when documentation is supposed to exist, and reconstruction is on the wrong side of it. If you read one section of this post, read this one.

The Medicare Program Integrity Manual, at §3.3.2.5, states the expectation plainly: “All services provided to beneficiaries are expected to be documented in the medical record at the time they are rendered.” When that doesn’t happen, the manual permits amendments, corrections, and delayed entries — but with conditions: “The date and author of any amendment, correction or delayed entry should be identifiable, and the change/addenda should be clearly and permanently denoted.”

Now apply that to how most new RTM programs actually run. The therapist reviews data on the 6th, the 12th, the 19th and the 26th. On the 30th, a biller opens a spreadsheet and writes down what they think happened, and that spreadsheet becomes the evidence that 20 minutes accrued. That is a delayed entry describing four separate services. It has one date, one author, and no contemporaneous trace of any of the four.

That leaves two options, both bad. Label it as a delayed entry — correct, honest, and a materially weaker record than a timestamped one. Or don’t label it, and present a month-end reconstruction as if it were contemporaneous documentation. The second path stops being a coding question. Program Integrity Manual §3.3.2.4 directs reviewers who have “authenticity concerns related to the legitimacy or falsity of the documentation” toward the attestation and signature-log processes, and where those don’t resolve it, toward “denial, and/or fraud referral.” Nobody sets out to end up there. It’s the kind of place a program can arrive at simply because the tracking was manual and the month closed faster than the paperwork did.

One related limit worth knowing, because clinics discover it at the worst moment: an attestation can clarify who wrote an illegible entry, but the manual is explicit that it cannot be used to “backdate” a plan of care. If certification lapsed during the service dates, no signature added later fixes the claim.

The structural answer is unglamorous: capture the timestamps as the work happens. A platform that starts and stops a timer when a clinician opens a patient’s data, records the qualifying day when the family logs, and stamps the interactive communication when it occurs produces contemporaneous documentation as a byproduct. Nothing gets reconstructed because nothing was ever pending. That’s the whole argument for automating this layer, and it’s a compliance argument before it’s a convenience one.

What belongs in an RTM claim file?

Assemble it per claim, not per patient. An ADR names specific claims and specific dates of service, and the reviewer is matching what you send to what you billed. A patient chart dumped whole makes them hunt for it, which serves nobody and invites questions about material you weren’t asked about.

For each RTM claim, the packet should contain:

• The ADR letter itself as page one. CMS names this as best practice — it ensures your documentation gets matched to the right patient and claim.
• The therapy plan of care and the current certification or recertification, covering the service dates.
• The 98975 setup record: device type, the education you provided, and the specific instructions given — what to log, how, how often.
• The per-day transmission log for the 30-day period, showing the period start date and each qualifying day. Not a summary count — the days.
• The per-session review log: date, duration, and clinician for every review session, with the monthly total and the CQ/CO position if an assistant participated.
• The interactive communication record: date, duration, and what was discussed.
• Evidence the review changed something — a program adjustment, a note, a message to the family. This is the difference between monitoring and billing for monitoring — and “the components weren’t all actually furnished” is precisely the pattern OIG’s 43 percent finding describes.
• The device attestation from your vendor.
• The claim itself, with GP/GO/GN and any CQ/CO shown.

Two practices worth adopting before you need them. Dry-run one claim per quarter — pick a patient at random, assemble the packet as if the letter had arrived, and see how long it takes and what’s missing. And date-stamp your exports, so the file you produce in month 14 demonstrably reflects what the system recorded in month 2.

How long do you have to keep all of this?

Seven years from the date of service is the number to plan around. 42 CFR 424.516(f) requires providers and suppliers furnishing covered ordered, certified, referred, or prescribed Part A or B services to maintain the related documentation for 7 years from the date of service and to provide access on request from CMS or a Medicare contractor. Outpatient therapy runs on a physician-certified plan of care, which places therapy records squarely in that orbit — and where the exact reach of the regulation is arguable, the conservative reading is the only sensible one to build a retention policy on.

CMS attaches real consequences. Its own MLN guidance states that failure to comply with the maintenance and access requirements may result in revocation of Medicare enrollment under 42 CFR 424.535(a)(10), that CMS may weigh each instance of non-compliance in setting the re-enrollment bar, and that failure to provide a single record from a request letter may constitute one instance.

Two practical notes. State law and commercial payer contracts sometimes require longer — take the longest applicable period, not the federal one. And “retained” has to mean retrievable: if your RTM data lives in a vendor platform, know now what happens to the per-day and per-minute logs if you change vendors. CMS recognizes that you may rely on another entity to hold records, but when the request arrives, you are responsible for producing them.

What if the claim gets denied anyway?

Appeal, and take the first level seriously, because the question at that level is documentary rather than clinical: the file either shows what you billed or it doesn’t. You have 120 days from receipt of the initial determination to request a redetermination from your MAC — receipt is presumed 5 calendar days after the date of the notice unless you can show otherwise — and the MAC generally issues a decision within 60 days. Four further levels follow: reconsideration by a Qualified Independent Contractor (within 180 days of the redetermination decision), a hearing at the Office of Medicare Hearings and Appeals, the Medicare Appeals Council, and judicial review in federal district court.

The reason to take level one seriously is that it’s where a complete file wins. A denial for “documentation does not support the time billed” is answerable if the timestamps exist and unanswerable if they don’t — which is the same point this whole post keeps arriving at, from a different direction.

Two habits close the loop. Read your denial codes rather than writing off small claims — a repeated remark code across several RTM denials is telling you about a systematic defect, and a systematic defect is what draws a probe. And track your own RTM denial rate by reason, quarterly. It’s the earliest warning you get, and it costs nothing.

What good tracking looks like

The clinics that handle review calmly aren’t the ones with better binders. They’re the ones that never had to assemble anything, because the counting happened in the background: qualifying days accruing against each patient’s own 30-day period, review minutes stamped as sessions open and close, interactive communications logged when they happen, and a month-end report that is a readout rather than a reconstruction. That’s the layer Sulo is built to run for pediatric PT, OT and SLP clinics — the same layer that makes the launch playbook sustainable past month three, and the same one the 2026 threshold changes made materially harder to do by hand.

None of it guarantees payment, and any vendor telling you their exports make a claim audit-proof is selling something. What it does is narrow the question a reviewer can ask you to a set of facts you can answer, on the day they ask. That’s the realistic goal, and it’s worth the setup. If you’d like to see what that looks like on a real caseload, talk to us — or start with the full RTM guide if you’re still mapping the program out.