The Enrollment Spike Trap: Why Fast RPM Growth Is a 2026 Audit Risk

12/19/2025 Justin Brochetti , CEO

If you run an independent practice, rapid RPM growth probably still feels like a win. Below is a practical breakdown of what this means and what to do next.

For years, the prevailing advice was simple: enroll more patients, deploy more devices, and let scale solve the economics. When reimbursement was loose and audits felt distant, that approach often worked well enough.

But 2026 is changing the incentives in a way many practices are not fully accounting for yet.

Today, the biggest risk in RPM is no longer whether your staff can handle the workload. The bigger risk is financial: scaling a program faster than you can prove eligibility, medical necessity, and service delivery.

That gap is what I call compliance debt. And sudden enrollment spikes are one of the clearest signals that compliance debt may be building.


Why 2026 Changes the Math for RPM

Two forces are converging at the same time.

First, commercial payers are tightening how they define medically necessary RPM. UnitedHealthcare’s Commercial and Individual Exchange policy effective January 1, 2026 draws a much sharper line around which conditions qualify and which do not. This alone changes the revenue stability of many existing RPM panels.

Second, CMS is continuing to evolve primary-care payment toward structured, month-based management models like Advanced Primary Care Management. New APCM options and add-on codes are expanding in 2026, giving practices alternatives to relying entirely on RPM volume.

Taken together, these shifts create pressure. When one revenue stream tightens, the natural instinct is to increase volume somewhere else. In RPM, that pressure often shows up as aggressive enrollment pushes.

You can see a breakdown of how these payer and CMS changes interact here: https://fairpath.ai/resources/cms-rpm-apcm-2025-26


The OIG Warning Most Practices Will Miss

In August 2025, the Office of Inspector General published a Medicare RPM data snapshot that deserves close attention.

The report confirms what most people already know: RPM usage and payments continue to grow rapidly. In 2024 alone, Medicare RPM payments exceeded $500 million and nearly one million enrollees received monitoring.

But the more important part of the report is not the totals. It is the patterns OIG says warrant further scrutiny.

One of those patterns is sudden spikes in new enrollees.

OIG identified 32 medical practices where new RPM enrollment jumped by at least 150 percent in a single month, representing at least 100 new enrollees added at once. In one example, a practice billed RPM for nearly 3,400 new enrollees in a single month.

OIG is careful to say these spikes can be legitimate. But they also note that similar spikes have been markers of fraud in other Medicare services and therefore signal a need for further scrutiny.

That distinction matters. OIG is not accusing practices of wrongdoing. They are telling CMS and payers where to look first.

Why Enrollment Spikes Happen in 2026 and Why They Get Risky Fast

This is where practice owners need to be clear-eyed about incentives.

If you run your own RPM program, tighter coverage and reimbursement volatility create pressure to add patients to keep revenue steady. But when enrollment grows faster than your ability to document eligibility, medical necessity, and clinical management, you are not scaling income. You are scaling exposure.

If you work with a third-party RPM company, especially one paid on a revenue-share model, the pressure is just as real. When payer changes threaten their book of business, the instinct is to protect volume. That often shows up as enrollment pushes that outpace documentation rigor.

This does not automatically mean anything improper is happening. But it does mean that sudden growth should be treated as a risk event, not a victory lap, because the liability always sits with the billing practice.

If you want to understand where incentives may be misaligned in your current setup, this analyzer can help: https://fairpath.ai/lp1-vendor-analyzer


What an Enrollment Spike Usually Signals

An enrollment spike is not proof of fraud. It is a signal that deserves attention.

In practice, sudden spikes often correlate with one or more of the following:

Enrollment outpacing eligibility and medical necessity documentation.
Patients are onboarded faster than the practice can clearly prove why monitoring was appropriate.

Gaps in the required prior relationship.
The visit may exist in reality, but it is not consistently captured, retrievable, or clearly tied to the RPM start date.

Clinical management capacity lagging behind device deployment.
Devices ship and readings flow, but documented clinical decision-making does not scale at the same rate.

Programs that feel vendor-driven instead of practice-governed.
When enrollment curves look like marketing campaigns, the burden of proof increases dramatically.

This is how compliance debt accumulates quietly.


The Practice-Owner Safeguard Checklist

Before greenlighting a large enrollment push, every practice owner should demand three things.

First, a month-over-month new enrollee report.
You want to see how many patients were added this month, how that compares to the prior month, where those patients came from, and which clinicians ordered monitoring.

If the curve turns into a hockey stick, pause and review before billing.

Second, prior visit and ordering proof for each new enrollee.
For every patient, the practice should be able to quickly produce evidence of the required prior visit, the ordering clinician, and how that visit ties to RPM enrollment.

If your vendor cannot produce this cleanly, the risk is yours.

Third, evidence that clinical management and documentation keep up at scale.
For each billed patient-month, there should be a defensible trail showing device activity, required patient interaction, and clinical decision-making.

If that evidence cannot be produced consistently, the growth is unstable.

A broader audit-readiness checklist is available here:
https://www.fairpath.ai/resources/2025-oig-audit-survival-checklist.html


What to Do If You See a Spike Right Now

Do not panic. But do not ignore it.

Treat the spike as a control moment. Verify before you celebrate.

Run an audit-signal scan using the same kinds of aggregate patterns CMS and OIG look for. You can start with a free RPM Fraud Risk and Optimization Report here: https://fairpath.ai/lp1-oig-audit

If you rely on a third-party RPM vendor, pressure-test the arrangement now, not after a denial or audit letter arrives.
https://fairpath.ai/resources/vendor-exit

Finally, consider whether your 2026 strategy relies too heavily on RPM alone. Many practices are moving toward APCM as a stable base, using RPM selectively where it clearly improves care and remains defensible.

You can explore that transition here: https://fairpath.ai/resources/oig-2026-rpm-audit-practice-guide


FairPath is your guide

FairPath exists for one reason: defensible revenue.

Not just billing, but the ability to explain and prove your program under scrutiny, patient by patient, month by month.

If you want to see how compliance-as-code can block non-compliant claims before they go out the door: https://fairpath.ai/demo

If you want the platform overview: https://fairpath.ai/how-it-works

If there’s interest, the next logical follow-up to this article is a companion piece on how to structure an APCM-first panel where RPM is used deliberately, not reflexively.

Related resources: The OIG's 2026 RPM Audit is Scheduled: Are You Ready?, OIG RPM Audit Red Flags: What Auditors Look for in Billing Data (and How to Prevent It).

Disclaimer: This article is informational only. Coverage, coding, and rates vary by Medicare Administrative Contractor (MAC) and payer plan.

Standard Operating Procedures

FairPath is built on operational work, not theory. We publish the playbooks and checklists we use to keep programs compliant and profitable. Use them whether you run FairPath or not.

Browse the Expert Library →

RPM Manual

The practical 2026 guide to device rules, day thresholds, management time, and audit defensibility for Remote Patient Monitoring.

Read the RPM Guide →

RTM Guide

How to run Remote Therapeutic Monitoring for MSK, respiratory, and CBT workflows with the correct 9897x and 9898x rules.

Read the RTM Guide →

CCM Guide

Calendar-month operations for CCM: consent, initiating visit, care plan requirements, time counting, and concurrency rules.

Read the CCM Guide →

APCM Playbook

The operator blueprint for Advanced Primary Care Management: eligibility, G0556–G0558 tiers, and monthly execution.

Read the APCM Playbook →