A 20-minute time increment, a work RVU of 0.61, and a vendor you have never met holding your patients' blood pressure readings. That is the operational shape of the 99457 work RVU 2020 final rule conversation, and it lands on your desk — not the physician's — the moment your practice signs a remote physiologic monitoring contract.

This guide is written for practice administrators, billing managers, and privacy officers. It covers what CMS finalized in the CY2020 Physician Fee Schedule for remote physiologic monitoring (RPM) treatment management, how that valuation drives staffing and productivity math, and — the part most RPM rollouts skip — the records-handling and business associate obligations the whole arrangement creates. It is administrative guidance. Code selection for any specific patient encounter belongs to your clinicians and coding staff.

What the 99457 work RVU 2020 final rule actually established

CPT 99457 describes remote physiologic monitoring treatment management services requiring interactive communication with the patient or caregiver during the month, first 20 minutes of clinical staff, physician, or other qualified health professional time. CMS finalized a work RVU of 0.61 for the code in the CY2020 Physician Fee Schedule final rule, aligning with the RUC recommendation.

Two other pieces of that rule matter more to your operations than the RVU itself.

The add-on code for additional time

CMS finalized CPT 99458 as an add-on for each additional 20 minutes of treatment management time in the same calendar month, also valued at 0.61 work RVUs in that rule. Before this, practices had no mechanism to report time beyond the first 20 minutes. After it, your billing team needed a time-capture method granular enough to defend a second and third increment.

The supervision change that reshaped staffing

The CY2020 final rule clarified that RPM services may be furnished under general supervision rather than direct supervision. That single change is why RPM staffing models moved off-site, why staffing agencies and "RPM-as-a-service" companies exist, and why your vendor list grew. It is also why a person who has never set foot in your building may be documenting billable time in a chart that carries your NPI.

Quick answer: what is the work RVU for 99457 under the 2020 final rule?

CMS finalized a work RVU of 0.61 for CPT 99457 in the CY2020 Medicare Physician Fee Schedule final rule, effective January 1, 2020. The companion add-on code 99458, created in that same rule for each additional 20 minutes, was also finalized at 0.61 work RVUs. Total RVUs and payment amounts differ from work RVUs because they include practice expense and malpractice components, and both the components and the conversion factor change annually. Always pull current-year values from the CMS Physician Fee Schedule Look-Up Tool rather than from a rule that is now six years old.

Why a six-year-old RVU still drives your 2026 staffing math

The absolute values have moved. The structure has not. The 20-minute increment, the interactive-communication requirement, and the general supervision allowance all trace back to the 99457 work RVU 2020 final rule, and every RPM staffing model you evaluate today is built on those three assumptions.

Here is the administrative math your finance lead will run. If a care coordinator can reliably document 20 minutes of qualifying treatment management time for 60 enrolled patients in a month, the program produces roughly 36.6 work RVUs from 99457 alone before any add-on time. Whether that supports the coordinator's salary depends on your compensation plan, your payer mix, and your device costs — not on the RVU in isolation.

Three operational realities blow up that math more often than the RVU does:

  • Patients who do not transmit. Enrollment is not utilization. Your monthly reconciliation has to separate enrolled patients from patients who actually met the program's data and time thresholds.
  • Time that is not documented contemporaneously. Reconstructed time logs are the first thing a payer auditor attacks.
  • Interactive communication that never happened. The code language requires it. A month of passive data review with no live contact is a denial waiting to be found.

Assign one person — usually your billing manager — to run a monthly RPM reconciliation report and sign off on it. Not the vendor. The vendor's report is an input, not an attestation.

The documentation your billing team must be able to reproduce on demand

Practices determine and document code selection based on the service actually furnished and the payer's published requirements. Your job is to make sure the underlying record can be produced years later, by someone who did not work there when it was created.

At minimum, your RPM documentation standard should specify where each of these lives and who owns it:

  1. The order or care plan establishing the monitoring, with the ordering practitioner identified.
  2. Patient consent to the service, including any cost-sharing disclosure your compliance policy requires.
  3. Device data with transmission dates — enough to demonstrate whatever data-day threshold the payer applies.
  4. A time log showing date, start and stop or elapsed minutes, the individual performing the work, and what was done.
  5. Evidence of the interactive communication, including date and modality.
  6. The supervising practitioner relationship for any time performed by auxiliary personnel.

Now the uncomfortable question: how many of those six items live inside your EHR, and how many live only inside a vendor platform you license month to month?

The vendor chain a single RPM code creates

Walk the data path for one patient. A cellular-enabled device transmits a reading. It moves through a device manufacturer's gateway, into a monitoring platform, possibly through an integration middleware layer, then into your EHR — or maybe not into your EHR at all. Off-site clinical staff read it in the platform and call the patient through a telephony or video service. The time log is written in the platform.

That is four to six entities touching identifiable health information for one billable service. Every one of them that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and every one needs an executed business associate agreement before the first reading moves. Subcontractors below them need agreements too — the cloud host, the SMS gateway, the offshore support desk.

Two arrangements deserve extra scrutiny:

Contracted clinical staff under general supervision

When a staffing company supplies the people who perform the 20 minutes, decide deliberately whether those individuals are your workforce members under your policies and training, or the staffing company's workforce operating under a BAA. Both structures are workable. Ambiguity is not. Write it into the contract, and make sure your sanction policy and training roster reflect the answer.

Vendors who want to keep the data

Read the secondary-use clause. Many RPM platforms reserve the right to de-identify and commercialize aggregate data. HIPAA permits a business associate to de-identify PHI only if the BAA authorizes it, and the de-identification must actually meet the standard. If your agreement is silent, your vendor may be operating outside it — and you own that finding.

If your BAA inventory for an RPM program is incomplete or built from a template someone downloaded in 2019, close that gap before the next enrollment cycle. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — one-time purchase, no subscription — which is faster than routing a redline through counsel for a $200-a-month device vendor.

Your RPM platform is probably part of the designated record set

This is the finding practices miss most often. If the monitoring platform holds records your clinicians use to make decisions about the patient — device readings, care notes, treatment management time entries — that content sits within the designated record set even though it never touched your EHR.

Consequences, in order of how quickly they will hurt you:

  • Access requests. A patient asking for "everything you have" is entitled to the RPM content too. The HIPAA right of access generally requires a response within 30 days, with one 30-day extension on written notice. If pulling data from your vendor takes 21 days, your calendar is already lost. Test the export before you need it.
  • Amendment requests. A patient can request amendment of DRS content. Confirm your vendor's platform can annotate or append rather than silently overwrite.
  • Retention and termination. When the contract ends, the BAA governs return or destruction. Get the format in writing. A proprietary export nobody can open is not a record.
  • Audit trails. The same time log that defends a claim also supports your accounting of disclosures and your investigation if something goes wrong.

Where the 2020 baseline has moved since

Do not treat the 99457 work RVU 2020 final rule as current pricing. Work RVUs, practice expense inputs, and the conversion factor have all been revisited in subsequent rulemaking, and CPT has continued to build out the remote monitoring family — including code additions for shorter data-collection windows and shorter management-time increments addressed in recent rulemaking cycles.

Your annual operating routine should include a January review that answers four questions: which RPM codes did CPT add or revise, what did CMS finalize for them, which of your commercial payers have published differing policies, and does your vendor's time-capture configuration still match the code definitions. Put a calendar reminder on it and name an owner.

A 60-day cleanup plan for an existing RPM program

Days 1–15. Build the actual data map. List every entity that touches RPM data, including subcontractors your vendor names in its own documentation. Match each against your executed BAA file. Flag missing, expired, or unsigned agreements.

Days 16–30. Request a full patient export from the vendor platform for one test patient. Time it. Confirm the format is readable and the time logs are included. Document the result — this becomes your access-request procedure.

Days 31–45. Reconcile one closed billing month end to end. Pick ten claims, trace each to device data, a time log, an interactive communication note, and a supervision relationship. Anything you cannot trace is a policy gap, not a coding gap.

Days 46–60. Update your risk analysis to include the RPM data flow, patient-owned devices, and off-site staff access. If the program materially changed your systems and it never appeared in your risk analysis, that is the deficiency an investigator finds first. Tools that automate risk analysis reports and the supporting policy set shorten this considerably, but the data map still has to be yours.

One more item for the vendor file: if any patient-facing app connected to your program is offered by an entity that is not a covered entity or business associate, the FTC Health Breach Notification Rule may apply to it independently. Know which rulebook governs each piece of your stack.

Start with the agreements

The RVU determines whether the program pays for itself. The paperwork determines whether it survives an audit or a breach. If you are standing up remote monitoring this quarter, or inherited a program with a vendor folder full of gaps, build the business associate agreements first and let the enrollment ramp follow. It is a one-time purchase and a far cheaper hour than the one you will spend explaining an unsigned BAA to an investigator.