Medicare Care Management Programs in 2026: CCM, APCM, RPM, and How to Bill Them Without a Clawback

Medicare pays practices a recurring monthly fee to manage patients between visits through a family of care management programs: Chronic Care Management (CCM), Advanced Primary Care Management (APCM), Remote Physiologic Monitoring (RPM), Principal Care Management (PCM), and Behavioral Health Integration (BHI). Most practices start with CCM, because it's the oldest, the most searched, and the one most patients qualify for. It's also the one auditors know best. The money across these programs is real and recurring. So is the audit exposure. The most common reason a practice gives the money back is sloppy documentation, not bad medicine.

I run a Medicare-only house-call practice, and I tried to build a CCM program four years ago. It never got off the ground. I was running the whole thing on spreadsheets: who consented, who got called, how many minutes, who already billed this month. It collapsed under its own weight before it ever made money. These programs are some of the most predictable revenue a small practice can build, and also some of the easiest to lose on a post-payment review. Consider this the map I wish someone had handed me four years ago: which program fits which patient, what each one pays, and the documentation that keeps the whole stack from falling apart on review.

What is Chronic Care Management in Medicare?

CCM is the foundational care management program and the one to understand first, because the rest of the family borrows its structure. It's the work that happens between visits: care coordination, medication reconciliation, calls to specialists, and patient outreach for people with two or more chronic conditions. Medicare started paying for it on January 1, 2015, under the Physician Fee Schedule, and it pays monthly as long as the requirements are met.

The eligibility bar is specific. The patient must have two or more chronic conditions expected to last a minimum of 12 months, and those conditions must place the patient at significant risk of death, acute decompensation, or functional decline. Diabetes plus heart failure qualifies. COPD plus chronic kidney disease qualifies. A single condition, however severe, does not.

The care happens remotely. Medicare allows CCM to be delivered either by phone or a telehealth platform, which is why it fits a mobile or small practice so well. You don't need the patient in a room. You need a clinical reason to touch base, a plan, and a clean record that you did.

What are the CCM CPT codes for 2026?

The CCM family splits into non-complex and complex, with separate lanes for clinical-staff time and physician-personal time. Here is the full set with approximate 2026 national non-facility rates.

A few things matter more than the dollar figures. Code 99439 can be billed no more than twice in a given month, which caps non-complex clinical-staff CCM at 60 minutes. The split between 99490 and 99491 is about who does the work: 99490 is clinical staff (nurses, medical assistants, care coordinators) under the general supervision of the billing physician, while 99491 requires the physician or QHP to personally perform the time. Complex CCM (99487) is not just "more minutes." It requires moderate-to-high complexity medical decision-making and substantial care-plan revision. Billing 99487 because the staff spent an hour, without the decision-making to back it, is a documentation gap waiting to be found.

Local rates vary by Medicare locality, so pull your own numbers from the CMS Physician Fee Schedule Look-Up Tool before you model revenue. The national averages above are for planning, not for your claim.

What documentation does a CCM claim require?

Every CCM claim rests on four pillars: patient consent, an established and shared care plan, a qualifying diagnosis, and a time log tied to specific activities. Miss any one and the claim is indefensible on review.

1. Consent. Documented patient consent before the first month you bill. The patient has to understand cost-sharing applies and that only one practitioner can bill CCM for them. Get it in writing or document the verbal consent in the chart with date and who obtained it.
2. Comprehensive care plan. A real plan, not a template stuffed with the same five problems for every patient. It has to be created with the patient, shared with them, and available to the care team. Noridian, my MAC, lists G0506 as the add-on for the CCM initiating visit when the assessment and care planning go beyond the usual effort of the AWV or E/M that starts the program. That code is specific to CCM; APCM and the other programs have their own enrollment requirements and don't use it.
3. Eligibility documented in the record. Two or more qualifying chronic conditions, noted by the provider, expected to last 12 months or until death. The conditions should be active problems you're actually managing.
4. Time log. Minutes tracked per calendar month, tied to named activities and the staff member who performed them. Time does not roll over. If a care coordinator spends 40 minutes on a patient in March, the practice bills 99490 and one unit of 99439 for March. The extra minutes do not reduce the threshold for April. Each month starts fresh at zero.

The place of service on a CCM claim is your billing location, the place where you'd normally see the patient face to face, not POS 11 by default. For a clinic that's 11; for a mobile or facility-based practice the billing-location rule is what governs, so don't assume 11 fills in automatically. One more rule matters if you see patients where I do: you can't bill CCM for a patient who is a hospital or SNF inpatient in a Medicare Part A covered stay, or who resides in a facility already being paid by Medicare to manage that patient's care. You can bill CCM for patients in a SNF, nursing facility, or assisted living facility when the facility is not receiving Medicare payment for their care management, for example a long-term custodial resident who is not in a Part A stay. And only one provider, the one who wrote the plan of care, is allowed to bill monthly. Those same four pillars (consent, care plan, eligibility, time or activity log) carry across APCM, PCM, and the rest with small variations, which is why getting them right for CCM sets you up for the whole family. That last rule, one provider per patient per month, is where a lot of money disappears on audit, which is the next section.

Why is CCM a frequent target for Medicare audits?

CCM is high-risk because it has no face-to-face encounter to anchor it, the payments recur every month, and total spending has climbed fast. OIG flagged it years ago and has not let go.

The numbers tell the story. In an audit of 2017 and 2018 claims, OIG found that providers billed for and received overpayments totaling $1,918,278. Because beneficiaries owe roughly 20% coinsurance on CCM, those improper claims also charged patients up to $540,680 in cost sharing on services that should never have been billed to them in the first place. The biggest single bucket was duplication: 38,447 claims resulting in $1.4 million in overpayments for instances in which providers billed noncomplex or complex CCM more than once for the same beneficiary for the same month. A second bucket was overlap, where the same provider billed for CCM and overlapping care management services rendered to the same beneficiaries for the same service periods.

Read those two failure modes again. Double-billing the same patient in the same month. Stacking CCM with another care-management service that can't be billed alongside it. Neither is a clinical mistake. Both are tracking failures that decent software prevents automatically.

This is not old news. On March 16, 2026, OIG announced a new audit, Project OAS-26-09-007, of Medicare CCM payments at risk of noncompliance, noting that from calendar year 2019 through calendar year 2024, Medicare Part B payments for CCM services increased substantially. Rising spend plus a recurring code plus no in-person anchor is the exact profile that draws post-payment review. If you are billing CCM in 2026, assume someone will eventually look.

I've been on the receiving end of a Medicare audit. Not for CCM, but the experience taught me what actually matters when a contractor requests your records. They don't care about your clinical reasoning. They care about whether the documentation in front of them proves the claim, line by line, on its own. If the record doesn't stand without you in the room to explain it, you lose. I came out of that audit clean, and the lesson stuck: build the documentation so it defends itself, before anyone asks.

How does CCM compare to APCM, RPM, PCM, and BHI?

CCM is one code in a family of Medicare care-management programs, and the right play is usually a stack, not a single code. They share DNA: monthly, mostly non-face-to-face, consent required, one care plan, documentation that has to hold up. Where they differ is what triggers them and whether they're time-based. Here's the short version of the ones that matter for a primary care or house-call panel.

A few distinctions worth holding onto. APCM is the one that dropped the time requirement entirely: it pays a flat monthly rate by patient complexity with no minute threshold, which is why a lot of practices now reach for it on new enrollees instead of CCM. The catch is that the flat rate isn't a lighter lift. To bill APCM, your practice has to be capable of delivering all 13 service elements CMS requires, including consent, an initiating visit, 24/7 access to the care team, a patient-centered electronic care plan, care-transition coordination, population-level data analysis, risk stratification, and performance measurement. You don't have to provide every element to every patient every month, but you have to be able to. The two that most often expose a practice are 24/7 access with real-time record access and the population-health and risk-stratification pieces, which a lot of EHRs don't do out of the box. APCM trades time tracking for infrastructure. I'll break down all 13 in a separate article.

PCM is the single-condition cousin. When one dominant problem drives a patient's risk, you manage that, not a whole panel of conditions. BHI is for the patient with a behavioral health diagnosis layered on top, scored with tools like the PHQ-9 or GAD-7.

BHI has a wrinkle worth knowing if you're running APCM. The standalone BHI code (99484) is time-based: at least 20 minutes of clinical staff time a month. But for CY 2026, CMS finalized a set of behavioral health add-on codes (G0568, G0569, G0570) that attach directly to an APCM base code, and those dropped the minute-counting entirely. They're valued by crosswalk from the older collaborative-care and BHI codes, not by time. So a practice already running APCM can layer behavioral health onto it without reintroducing the time tracking APCM was built to avoid. That's the cleanest behavioral health revenue in the 2026 schedule, and it only exists if APCM is your base.

The stacking rules are where the money and the audit risk both live. CCM, APCM, and PCM are mutually exclusive for the same patient in the same month. You pick one lane. RPM layers on top of any of those lanes, as long as the time is tracked separately and never double-counted. Behavioral health layers on too, but the form it takes depends on your base: standalone time-based BHI (99484) alongside CCM, or the non-time-based add-on codes when APCM is the base. A patient with diabetes, hypertension, and a depression diagnosis could carry CCM plus RPM plus BHI in the same month, which is how a single panel patient gets past $400 in monthly care-management revenue when it's documented cleanly.

That's also the reason the documentation problem gets worse, not better, as you grow. One program on spreadsheets is survivable. Four overlapping programs, each with its own consent, time pool, and conflict rules, is not. The system has to know which lane each patient is in and refuse the combinations that don't bill together.

How do you build an audit-defensible care management workflow?

The defensible workflow turns every audit failure mode into a step the system handles before a claim ever goes out. The skeleton is the same for one program or five: CCM alone uses it, and so does a panel running CCM plus APCM plus RPM. Here's the sequence I use.

• Enroll once, consent on the record. One intake step captures consent, explains cost-sharing, and confirms the patient isn't already enrolled with another practice. No consent, no enrollment.
• Build the care plan at enrollment, not at billing. Tie it to the initiating AWV or E/M, use G0506 for CCM enrollment when the assessment genuinely exceeds the usual effort, and make the plan patient-specific.
• Run a monthly eligibility and conflict check before billing. This is the step that kills the $1.4 million problem. Before any CCM claim goes out, the system confirms the patient is enrolled with you only, hasn't been billed this month already, and isn't being billed an incompatible overlapping service.
• Log time as it happens, by activity and staff member. Not reconstructed at month-end. Real-time logging with the activity attached is what survives a record request.
• Reconcile against the stacking rules. CCM, APCM, and PCM are mutually exclusive for the same patient-month, so the system has to know which lane each patient is in. 99490 and 99491 can't both be billed in the same month. Complex and non-complex CCM can't be stacked. RPM and behavioral health can layer on, but only with separately tracked time. The system should refuse the conflicting claim, not trust the biller to remember which combinations bill together.

The throughline is that none of this should depend on a person remembering a rule at the moment of billing. People forget. A team scales past what any one biller can track. Spreadsheets, the way I learned the hard way four years ago, don't scale at all, and they break completely once you're running more than one program. The OIG findings are not about clinical judgment. They are about claims that one monthly automated check would have stopped. Software that enforces the consent, the plan, the eligibility recheck, and the conflict logic across every program you run is how a small practice captures this revenue without building a clawback liability in the background.

That's the design principle behind the documentation platform I'm piloting in my own practice right now. It's the program I tried to run on spreadsheets four years ago, rebuilt so the system does the remembering instead of the biller, and built to handle the whole family, not just CCM. Consent, care plan, the monthly eligibility recheck, the cross-program conflict logic, the time and activity log: every one of OIG's failure modes becomes a step the software won't let you skip. I'm three weeks in and submitting my first month of billing through it this week, so I'm living the workflow, not theorizing about it. The goal is narrow and specific. Make the compliant claim the only claim the system will let you submit.

Frequently asked questions

Start with the system, not the codes

If you take one thing from this: don't launch care management by memorizing codes. Launch it by building the gate that runs before every claim. One practitioner, one claim, the right program for the patient, no conflicting overlap, consent on file, plan in place, time logged by activity. Get that right and the codes take care of themselves, at one program or five.

That gate is what I built into the platform I'm now piloting at Mobile Health Providers, and it's the difference between my spreadsheet attempt four years ago and a program that actually runs. It enforces consent at enrollment, holds the care plan against the initiating visit, runs the monthly eligibility and conflict check across programs automatically, and logs time to the activity and the staff member who did it, so the record defends itself before anyone requests it. It's built by a physician who actually bills these codes and has lived the documentation problem, not by a software vendor who has never billed a 99490.

Dr. Wyzscx Patacxil, MD, CWSP

Physician-Owner, Mobile Health Providers

Dr. Patacxil is the physician-owner of Mobile Health Providers, a house-call primary care and advanced wound care practice serving patients across San Bernardino, Riverside, Los Angeles, and Orange counties. He treats homebound and mobility-limited Medicare beneficiaries in their homes, skilled nursing facilities, and assisted living communities. His clinical focus includes chronic wound management, chronic care management, and preventive medicine. He writes about wound care, aging, health technology, and what modern house-call medicine actually looks like.

Read more about Dr. Patacxil →