A payer sends your billing manager a letter in February 2026 asking for documentation on 41 remote physiologic monitoring claims from calendar year 2023. Somebody in your office now has to reconstruct two things: the time logs behind each claim, and the fee-schedule math that produced the payment. That second part means pulling the cpt 99457 2023 work rvu from an archived RVU file, not from this year's tool.

This guide is for the person who has to answer that letter — the practice administrator, the billing lead, the privacy officer who gets looped in when the records leave the building. It covers where the historical RVU actually lives, what a 99457 claim has to be able to prove, who on your staff owns each piece, and the vendor and records-handling exposure that remote monitoring creates whether or not you were thinking about it in 2023.

What was the work RVU for CPT 99457 in 2023?

Under the CY2023 Medicare Physician Fee Schedule, CPT 99457 carried a work RVU of 0.61. Add-on code 99458 carried the same work value. Total RVUs — work plus practice expense plus malpractice — put the non-facility national allowable in the high $40s per month before geographic adjustment, using the 2023 conversion factor of $33.8872. Facility-setting values were lower because practice expense drops.

That is the snippet answer. Now the part that matters operationally: do not quote that number from memory in an audit response. Print it from the source.

Where to verify the number, not guess it

Two authoritative places to pull it:

Save the export as a PDF with the retrieval date in the filename. When a reviewer asks how you arrived at an expected allowable three years after the fact, a dated screenshot of the official tool ends the conversation faster than a spreadsheet nobody can source.

Why the cpt 99457 2023 work rvu still comes up in 2026

Four scenarios drive the lookup, and all four land on an administrator's desk:

Retrospective payer review. Commercial contracts define their own lookback windows; Medicare contractor and recovery-audit timelines are set by CMS policy. Either way, 2023 dates of service are still live for some reviewers. You need the RVU basis to check whether the recoupment demand is even arithmetically right.

Underpayment recovery. If your contract pays a percentage of Medicare, the only way to prove a 2023 underpayment is to rebuild the expected allowable from that year's RVUs and conversion factor.

Productivity compensation reconciliation. Practices that pay clinicians on work RVUs have to use the RVU value in force for the service year. Mixing a 2026 value into a 2023 true-up creates a compensation dispute, and in some arrangements a regulatory one.

Program economics. The work RVU for 99457 has been stable, but the conversion factor has not — it declined in CY2024 and CY2025, and CY2026 brought a statutory split into separate conversion factors for qualifying APM participants and everyone else. If your remote monitoring program's break-even model still assumes 2023 dollars, it is wrong. Rebuild it against the current final rule.

Work RVU is not payment

Say this out loud to anyone who asks you "what does 99457 pay." Work RVU measures clinician time and intensity only. Payment equals the geographically adjusted sum of all three RVU components times the conversion factor, then adjusted for sequestration, deductible, coinsurance, and whatever your contract says. A single-number answer is always wrong.

The three things a 99457 claim has to be able to prove

Code selection is a clinical and coding determination made by the billing practitioner against the current CPT descriptor and payer policy. What your operation controls is whether the record can substantiate the elements the descriptor and payer rules require. For 99457, that has historically meant three artifacts:

  1. Time. The descriptor is built on cumulative treatment-management time within a calendar month — the first 20 minutes for 99457, with 99458 as the add-on for each additional increment. Your record needs start and stop entries, or at minimum durations tied to named staff and dated activities, aggregated per calendar month rather than per rolling 30 days.
  2. Interactive communication. The descriptor requires interactive communication with the patient or caregiver during the month. A dashboard review with no documented live contact does not carry that element. Your template should force a discrete field for the date, modality, and participant.
  3. Supervision and staff eligibility. CMS has permitted clinical staff time for RPM treatment management to be furnished under general supervision, but the incident-to and state scope-of-practice conditions still apply. Keep a current roster mapping each person who logs RPM time to their credential, their supervising practitioner, and their employment or contract status.

Note the ordering codes are separate: device supply and data transmission live in a different code with their own data-day requirements. Administrators get burned when a single dashboard report is treated as evidence for every code in the family. Pull the elements apart in your documentation checklist.

Who owns each piece: a role assignment that survives turnover

Write this into your RPM standard operating procedure and post it where the billing team can see it.

  • Clinical staff logging time: enters duration, activity, and date the same day. No end-of-month reconstruction.
  • Billing lead: runs a pre-submission report at month close showing, per patient, total logged minutes, whether an interactive contact is documented, and which staff member logged each entry. Claims without all three fields do not go out.
  • Practice administrator: keeps the archived RVU exports, the payer policy versions, and the supervision roster, by year, in one folder. Three-year-old audits are won by whoever kept the folder.
  • Privacy officer: owns the vendor inventory, the business associate agreements, and the access-request workflow for monitoring data.

Your RPM time log is PHI, and so is the device feed

Here is the part that gets skipped when a practice is focused on revenue. Every artifact that supports a 99457 claim is protected health information: the minute-by-minute time log, the device readings, the dashboard alerts, the text message asking the patient to re-take a reading, the recorded phone call if your system records calls.

Three consequences your operation has to absorb:

Retention. HIPAA requires six years of retention for required documentation such as policies and risk analyses under 45 CFR 164.316(b)(2). Medical record retention itself is set by state law and payer contract. RPM data often sits in a vendor platform rather than your chart, which means your retention obligation depends on a contract clause somebody negotiated years ago. Go read it.

Designated record set. If monitoring data is used to make treatment decisions and is maintained by or for you, treat it as part of the designated record set for access purposes. The HHS individual right of access guidance sets the 30-day response clock, with one 30-day extension available on written notice. "It lives in the vendor portal" is not an exception. Test your ability to export a full monitoring history for one patient before someone asks you to.

Minimum necessary. Audit responses are where practices over-disclose. A payer asking about 41 claims does not need every reading for every patient in the panel. Scope the production to the dates of service and elements at issue, log what you sent, and have the privacy officer sign off before it leaves.

The vendor chain behind every RPM claim

Count the entities that touch monitoring data in a typical program: the device manufacturer, the cellular or gateway connectivity provider, the monitoring platform, the cloud host underneath it, sometimes an outsourced clinical staffing service that logs the minutes you bill, and your EHR integration layer. Most of these are business associates. Some are subcontractors of business associates, which means your agreement needs to reach them by flow-down.

Do this exercise: pull the vendor list for your RPM program and mark each row with the date of the executed agreement and the person who signed it. Practices that stood up monitoring quickly — and many did — commonly find a signed platform agreement, no agreement for the device supplier, and nothing at all for the staffing vendor whose employees generated the billed time. That last gap is the worst one, because the vendor is producing the documentation your claims rest on.

If you find blanks, close them before your next audit response, not after. A six-step wizard that generates a signature-ready Business Associate Agreement with PDF and DOCX export gets a real document in front of a vendor the same afternoon, as a one-time purchase rather than another subscription. For reference on the required provisions, HHS publishes sample business associate agreement language you can compare against whatever your vendor sends you.

Contract terms that actually matter for monitoring vendors

  • Data export on termination — in a usable format, with a defined timeline, at no additional charge.
  • Audit support — the vendor produces time logs and audit trails within a stated number of business days when a payer requests them.
  • Breach notification timing — measured in days from discovery, not "promptly."
  • Subcontractor disclosure — you get a current list, and notice before it changes.
  • Retention and deletion — aligned to your state's record retention period, not the vendor's default.

A 2026 lookback checklist for 2023 RPM claims

  1. Export and archive the 2023 RVU values for the codes at issue from the CMS look-up tool, dated.
  2. Recompute expected allowables using the 2023 conversion factor and your locality, then compare against remittances.
  3. Pull the time logs for the sampled months and confirm calendar-month aggregation, named staff, and a documented interactive contact.
  4. Match every staff member who logged time to the supervision roster in force during 2023.
  5. Confirm a business associate agreement was in place with each vendor that handled the data during that period — and note the gaps in writing.
  6. Scope the production to minimum necessary and log the disclosure.
  7. Feed what you learn back into your risk analysis; remote monitoring changes where PHI lives, and the analysis has to reflect that.

Programs that fail these reviews rarely fail on the RVU math. They fail because the minutes were reconstructed, the interactive contact was assumed, or the vendor holding the evidence has no contractual duty to produce it.

Next step

Take an hour this week: archive the historical fee-schedule exports, then walk your RPM vendor list row by row and mark the missing agreements. If you find gaps, generate the BAAs you need and get them signed before the next records request arrives. If the same review turns up an outdated risk analysis or policy set, automating the risk analysis and compliance document set is the faster path to closing it out.