A practice manager's guide to documentation gaps, compliance risk, and building an audit-ready care-management program.

QUICK ANSWER Failing a CCM or RPM audit does not necessarily mean your practice committed intentional fraud. It can mean that the medical record does not adequately support the services billed. Common risk areas include incomplete documentation, missing consent, insufficient evidence of medical necessity, unclear time records, missing care-plan information, inappropriate billing, or inability to demonstrate that required services were actually performed. The goal is to build a workflow where the right documentation is created as care happens.

 

An audit generally asks a fundamental question: “Can the practice prove that the billed service actually occurred and met the applicable requirements?”

For RPM, practices should be able to support the applicable components of education and setup, device supply and data collection, and treatment management.

For CCM, documentation should support the care-management services, applicable time requirements, care plan, and other program requirements.

1. Missing or weak documentation

If the claim says a service occurred but the record does not support it, the claim becomes difficult to defend.

2. Time that cannot be verified

Care-management programs often depend on time-based requirements. Staff should record time consistently and connect it to documented activities.

3. Missing RPM components

RPM is not simply giving the patient a blood-pressure cuff. Required program components must be supported.

4. Double-counting time

Practices using multiple care-management programs need strong time-tracking controls so the same time or effort is not counted twice.

The exact consequences depend on the payer, claim, audit mechanism, findings, and severity.

Potential outcomes can include requests for additional records, claim denials, repayment or recoupment, corrective action, increased scrutiny, compliance review, or broader examination of billing practices.

An audit is much easier to manage when the documentation already exists.

☐       Patient eligibility is documented

☐       Medical necessity is supported

☐       Required consent is documented

☐       Appropriate initiating requirements are met

☐       The patient is enrolled in the correct program

☐       RPM education and setup are documented

☐       Device/data requirements are supported

☐       Clinical review is documented

☐       Treatment management is documented when required

☐       CCM care plan is established and maintained

☐       Coordination activities are documented

☐       Time is accurately tracked

☐       Staff performing services are appropriately identified

☐       Codes match services performed

☐       Time is not double-counted

☐       Documentation supports billed services

 

EXAMPLE: THE DIFFERENCE BETWEEN A WEAK AND STRONG RECORD Weak: “RPM reviewed. Patient doing well.” Stronger: “RPM data reviewed for the monitoring period. Trend reviewed against the patient's established treatment plan. Patient contacted regarding readings and current symptoms. Relevant findings communicated to the clinical team and follow-up plan documented.” The stronger entry creates a clearer connection between data, review, patient communication, and clinical action. Practices should use approved compliance templates rather than copying generic notes.

 

The best compliance strategy is process design.

Instead of asking employees to remember every requirement, build the workflow around them:

Enrollment  →  Consent  →  Setup  →  Data  →  Review  →  Communication  →  Escalation  →  Documentation  →  Billing Review

 

Each step should have an owner. If something goes wrong, the practice should be able to answer: Who was responsible? What happened? Where is it documented?

BOTTOM LINE An audit-ready practice is not one that creates perfect paperwork after an auditor arrives. It is one where the workflow naturally produces defensible documentation every month.

 

Does failing an audit automatically mean fraud?

No. Audit findings can involve documentation or billing errors of varying severity. The consequences depend on the specific findings and applicable rules.

How long should RPM and CCM documentation be retained?

Retention requirements can vary by program, payer, and applicable law. Practices should follow their legal and compliance requirements rather than relying on a generic retention period.

What is the biggest RPM audit risk?

A major risk is billing for services without sufficient evidence that required components were actually provided.

Can technology make audits easier?

Yes. A well-designed platform can create structured records, track activity, identify missing information, and make documentation easier to retrieve. Technology does not replace compliance oversight.