CCM Requirements, Compliance, and Clinical Outcomes
Dr. Aamir Iqbal, MD  | Medical Director, Vivo Care  | April 2026
Dr. Aamir Iqbal is a practicing physician and Medical Director at Vivo Care. He oversees clinical standards across RPM, CCM, and PCM programs operating in 300+ healthcare organizations nationwide.
Sources: All regulatory and enforcement data cited in this article is drawn exclusively from CMS, OIG, and DOJ primary documentation.
Chronic Care Management (CCM) is one of the most clinically important and operationally complex programs in the Medicare Physician Fee Schedule. When it is running correctly, it closes the gap between office visits for patients managing two or more chronic conditions, improves care coordination, and generates recurring revenue for the practice. When it is running incorrectly, it creates substantial compliance exposure and minimal patient benefit.
This article covers the full picture: what CCM is, what it requires clinically and operationally, what the federal audit and enforcement record shows about where programs break, and how a well-designed CCM infrastructure addresses those risks. It is written for providers and clinical operations leaders who want a single reference they can use to evaluate or improve their program.
What CCM Is and Why It Matters
Centers for Medicare & Medicaid Services launched CCM on January 1, 2015. Before that date, the care coordination work embedded in chronic disease management was largely uncompensated as a distinct service. CMS’s decision to create a dedicated billing pathway reflected a straightforward clinical reality: patients with multiple chronic conditions need structured support between visits, and that support takes time and infrastructure that the E/M code set was never designed to capture.
The patient population CCM addresses is significant. CCM is available to Medicare patients with two or more chronic conditions expected to last at least 12 months. These are patients managing combinations like hypertension and diabetes, chronic kidney disease and coronary artery disease, heart failure and COPD. They require medication oversight, care plan maintenance, coordination across specialties, and regular check-ins by clinical staff who know their history.
The clinical benefit is documented. Structured chronic care management reduces care fragmentation, supports earlier identification of complications, and maintains patient engagement between visits. CMS and the American Medical Association both reinforced this direction in December 2025 with the ACCESS Model framework, which emphasizes continuous engagement, earlier intervention, and workflow-integrated tools as the direction for chronic disease management in 2026 and beyond.
CCM was Vivo Care’s fastest growing program by total enrollments for the full year, through February 2026. The majority of those patients are supported through our Managed Clinical model, with U.S.-based, state-licensed care navigators managing monthly outreach, care plan maintenance, and compliance documentation as a direct extension of the provider team. Many of those practices came to Vivo Care with programs already running. The gap was not clinical staff. It was a vendor infrastructure that could not keep pace with CMS updates, surface billing and engagement performance proactively, or scale with the organization. If your program has the team but not the operational support around it, request a program evaluation here.
The CCM Code Set: Requirements by Code Family
CCM is not a single code. It is a family of codes with distinct time thresholds, staff type requirements, and documentation obligations. Understanding the structure is prerequisite to building a compliant program because audit findings consistently show that violations cluster around misapplication of these distinctions.
| Code Family | Codes | Who Performs Time | Time Threshold | 2026 National Rate (Non-Fac) | Key Compliance Requirement |
| Noncomplex CCM | 99490 + 99439 | Clinical staff (billing practitioner time may count if not used for 99491) | 99490 = first 20 min/month; 99439 = each additional 20 min | 99490: $66.13 (+9.4% YoY) 99439: $50.43 (+9.9% YoY) | Per-beneficiary time ledger required. 99439 is the add-on for the second clinical unit and must be billed alongside 99490 when applicable. |
| Practitioner-Only CCM | 99491 + 99437 | Billing practitioner personally | 99491 = first 30 min/month; 99437 = each additional 30 min | Contact Vivo Care for local rate analysis | Clinical staff time does not count. Using staff-only logs to support these codes is structurally misaligned with CMS requirements. |
| Complex CCM | 99487 + 99489 | Clinical staff, with additional complexity requirements | 99487 = first 60 min/month; 99489 = each additional 30 min | Contact Vivo Care for local rate analysis | Requires moderate to high complexity medical decision-making by the billing practitioner as a documented service element. |
Sources: CMS MLN909188, June 2025; CMS 2026 Physician Fee Schedule, Non-Facility (GPCI 1.0, national). Local rates vary by geography. Contact Vivo Care for a practice-specific reimbursement analysis.
A critical billing note on 99439: This add-on code is billable for the second clinical unit of noncomplex CCM and must be reported alongside 99490 when the patient’s monthly time crosses the 40-minute threshold. Omitting 99439 when it applies materially understates the reimbursement the practice has earned and the clinical work that was performed.
Advanced Primary Care Management (APCM) is a newer Medicare program that bundles much of this CCM-type coordination work into a single monthly, per-patient payment with no time tracking. The same practitioner cannot bill APCM and CCM for the same patient in the same month, so understanding how the two programs interact is now part of any CCM planning conversation. Learn how APCM works alongside CCM.
Core Service Elements: What CCM Requires Beyond Time
Time thresholds are the most visible CCM requirement, but they are not the only one. CMS defines a set of operational service elements that must be in place for CCM to be billable. These are the elements that appear most frequently in audit and enforcement findings when programs are deficient.
1. Patient-Centered Electronic Care Plan
CMS requires a comprehensive, patient-centered, electronic care plan for each CCM patient. The care plan is expected to include a problem list, measurable goals, prognosis, planned interventions, medication management, caregiver considerations, and coordination with outside resources. It must be accessible within and outside the billing practice, and patients or caregivers must receive a copy when necessary.
The care plan is not a one-time document. It is a living record that the clinical team creates, revises, and monitors over time. Audit vulnerability increases when practices cannot produce a retrievable, timestamped care plan artifact that demonstrates creation, revision, and communication history.
2. Patient Consent
CMS requires that the billing practitioner obtain patient consent before CCM services begin. As of the CMS FAQ update in August 2022, verbal consent is acceptable and does not require a separate initiating visit. The consent must be documented in the medical record, and patients must be informed that only one practitioner can bill CCM per calendar month.
Consent documentation gaps are a compliance risk. If a program operates at scale using contracted clinical staff or external platforms, the billing practitioner must maintain access to consent records and be able to demonstrate that consent was obtained before service delivery began.
3. 24/7 Access and Care Continuity
CCM requires that patients have access to urgent care support at any hour of any day, and that they have an ongoing relationship with a designated member of the care team. This requirement is not satisfied by a general after-hours line. The patient should be able to reach clinical support and receive meaningful guidance outside of regular office hours.
This is one of the structural advantages of a well-staffed CCM program. Care navigators who know the patient, have access to the care plan, and can escalate to the billing practitioner when clinically necessary satisfy this requirement in a way that generic call routing does not.
4. Structured Care Management Processes
CMS describes CCM as predominantly non-face-to-face but still requiring structured care management processes, not ad-hoc check-ins. Medication management, coordination with other providers, and follow-through on planned interventions are expected components of the monthly service.
Billing Rules That Cannot Be Violated
CCM carries explicit constraints on when it can and cannot be billed. These constraints are the source of the two largest overpayment categories identified in OIG audits.
One claim per beneficiary per calendar month
Only one provider can bill CCM for a given beneficiary in a given calendar month. This rule applies across locations and NPIs. The OIG’s two completed CCM audits, covering CY 2015 through 2018, identified multiple claims for the same beneficiary in the same service period as the dominant overpayment category. OIG attributed these errors to the absence of claim system edits that should have detected and blocked the duplicates before payment.
Prohibited service overlaps
CCM cannot be billed in the same calendar month when the same physician bills overlapping care management services. The prohibited overlap list includes transitional care management (TCM), home health care supervision, hospice care supervision, and certain ESRD services. The OIG audits identified these overlaps as the second major overpayment category.
Where compliance depends on mutually exclusive billing rules, controls must exist before claim submission, not after. OIG’s audits consistently show that retrospective detection is not sufficient. Pre-bill claim logic that hard-stops prohibited combinations is the standard CMS and OIG expect.
What the Federal Audit and Enforcement Record Shows
The compliance risk in CCM is not theoretical. The OIG has completed two full audits of Medicare CCM payments and has announced a third. DOJ and USAO have resolved False Claims Act matters that name specific CCM failure modes. Four separate OIG Civil Monetary Penalties settlements reference CCM noncompliance.
The documented failure modes cluster into two categories: coding mechanics that can be tested algorithmically, and service substantiation weaknesses that require chart-level verification.
OIG Audit CY 2015 through 2016 (Report A-07-17-05101)
OIG identified $640,452 in overpayments across 20,165 claims, plus an additional $1.16 million in potential overpayments set aside for further determination. The primary causes were multiple CCM claims for the same beneficiary in the same service period, and CCM billed in the same month as overlapping care management services. OIG concluded that CMS lacked adequate claim system controls to prevent these patterns at the point of payment.
OIG Audit CY 2017 through 2018 (Report A-07-19-05122)
OIG reported $1.9 million in overpayments across 50,192 claims, driven by the same two root causes at larger scale. OIG recommended recovery actions and system edits, and explicitly referenced providers’ overpayment return obligations under the 60-day rule.
OIG Work Plan: New CCM Audit (Announced March 2026)
In March 2026, OIG announced a new audit covering CY 2019 through 2024, explicitly noting substantial growth in Medicare CCM payments over that period. The framing focuses on payments at risk of noncompliance with the multiple chronic conditions requirement. This signals that CCM remains an active OIG oversight priority and that the CY 2019 through 2024 growth period will be examined against the same compliance framework as prior audits.
Enforcement Actions: Specific CCM Failure Modes on Record
Sources: OIG Audit A-07-17-05101; OIG Audit A-07-19-05122; OIG Work Plan (March 16, 2026); DOJ press release (June 5, 2024); USAO WDNY press release (February 19, 2025); OIG enforcement postings for Piedmont, 1st Choice, and Smart Clinic.
What Good CCM Infrastructure Looks Like
The audit and enforcement record is a direct blueprint for what CCM infrastructure needs to include. Every documented failure mode maps to a control that can be built into the program before claims are submitted.
Pre-bill claim logic
The single highest-yield control is a rules engine that hard-stops prohibited billing combinations before a claim is generated. That means: one CCM claim per beneficiary per calendar month, and a hard block when overlapping care management services appear in the same service period. OIG attributed both its largest overpayment categories to the absence of this type of pre-bill control.
Time ledger integrity by code family
A defensible CCM program maintains a per-beneficiary, per-month time ledger that explicitly distinguishes clinical staff time from billing practitioner personal time. This structure is required because the code families have different staff type requirements, and using clinical staff time to support practitioner-only codes (99491 and 99437) is structurally misaligned with CMS requirements. Time must be demonstrable at the beneficiary-month level, not just at aggregate staffing levels.
Care plan evidence bundle
The care plan artifact and its change history must be retrievable. Create date, revision history, and sharing or communication documentation all matter. A program that can produce a timestamped care plan, evidence of its availability to the care team, and documentation of when patients received a copy is in a materially better position when audited than one that cannot.
Vendor governance for Managed Clinical delivery
When CCM is delivered by a staffed clinical team operating under the billing practitioner’s general supervision, the governance structure matters. The billing practitioner must be able to demonstrate general supervision, maintain access to consent records and medical documentation, and show that clinical staff time was furnished and properly attributed. This is especially important when the clinical team operates at scale across a large patient panel.
Overpayment response process
The 60-day overpayment return obligation applies to CCM. A program that identifies a billing error through internal monitoring must have a defined process for investigation, quantification, and repayment. OIG’s CY 2017 through 2018 audit explicitly referenced providers’ obligations in this area. A predefined playbook for overpayment discovery, linked to the same duplicate and overlap conditions OIG audited, is not optional for a program operating at scale.
The Clinical Case: What CCM Delivers Between Visits
Compliance infrastructure is necessary. It is not sufficient on its own to build a program worth running. The reason to invest in CCM is the clinical work that happens between office visits when patients have consistent, personalized contact with a care team that knows them.
Across our population, the pattern is consistent. Patients managing multiple chronic conditions who receive structured monthly care management maintain better engagement with their care plans, catch problems earlier, and feel more supported navigating the complexity of their conditions. The care navigator relationship is central to this.
Tammy followed a patient whose blood pressure had been critically low for weeks. She stayed in close contact, educated the patient on the risks, and kept the clinic informed. The patient resisted seeking care. Tammy kept reaching out. Eventually the patient saw her cardiologist, her medication was adjusted, and her readings improved. That kind of persistence is not captured in an E/M code. It is exactly what CCM is designed to support.
Patricia reached a patient who had been avoiding calls for months. When he finally answered, he shared that he had been in a very dark place. She did not push through a checklist. She slowed the call down and listened. He told her the call made his day. That contact, and the follow-through that came after it, is the clinical value of a program that is actually functioning.
Choosing a CCM Program Structure
Practices that run CCM internally or through an external partner both face the same compliance requirements. The code set, the time thresholds, the care plan obligations, and the billing interaction rules apply regardless of who is doing the clinical work. What varies is who has the infrastructure to meet those requirements reliably at scale.
Self-Managed CCM
Some practices have the clinical staff and the internal workflow capacity to run CCM without external support. Self-Managed programs give those practices full control over the clinical engagement while providing the platform infrastructure, documentation workflows, and billing alignment they need to operate compliantly. This is the right structure for practices that want to keep the care navigator relationship in-house.
Managed Clinical CCM
Practices that want to extend their capacity without adding headcount can activate Vivo Care’s clinical nursing team as an extension of the provider team. Care navigators are U.S.-based, state-licensed nurses operating under the billing practitioner’s general supervision. They handle monthly outreach, care plan maintenance, and the documentation that supports billing, while escalating clinically appropriate situations back to the provider.
Managed Clinical CCM enrollments at Vivo Care grew by more than 1,600% between February 2025 and February 2026. That growth reflects practices making a deliberate choice to scale CCM without expanding their internal clinical headcount.
The program structure is independent of the compliance requirement
Regardless of whether a practice runs Self-Managed or Managed Clinical CCM, the compliance requirements are identical. The care plan must exist and be retrievable. Consent must be documented. Time must be attributed correctly by staff type. Prohibited billing overlaps must be blocked. The structure of a compliant program does not change based on who performs the clinical work. What changes is who is accountable for maintaining the controls.
What to Do Now
If your practice is running CCM and has not audited the program against the OIG’s documented failure modes, the March 2026 Work Plan announcement is a reasonable prompt to do so. The audit period under review is CY 2019 through 2024. That covers the growth period for most practices that expanded CCM enrollment after the code family was clarified and verbal consent was permitted.
The three analytic tests that map directly to OIG’s quantified overpayment categories are straightforward to run against your billing data: check for any beneficiary-month with more than one CCM claim, check for any months where CCM and a prohibited overlap service were billed by the same provider, and recalculate per-beneficiary-month time against the code thresholds and staff type requirements.
If the program structure is sound, those tests confirm it. If there are gaps, finding them internally and addressing them is categorically better than having OIG find them during an audit.
Vivo Care supports both Self-Managed and Managed Clinical CCM programs across 300+ active healthcare organizations. If you want to evaluate your current CCM program structure, understand what local reimbursement rates look like for your geography, or explore what a compliant and scalable program looks like in practice, our team can walk through a practice-specific analysis.
Contact us at vivocaresolutions.com or click here for a local reimbursement analysis and program review.
Frequently Asked Questions
How often can CCM be billed for a patient?
Only one provider can bill CCM for a given beneficiary in a given calendar month, and that rule applies across locations and NPIs. Multiple claims for the same beneficiary in the same month were the dominant overpayment category in the OIG’s completed CCM audits.
What are the CCM time thresholds by code?
Noncomplex CCM uses 99490 for the first 20 minutes per month and 99439 for each additional 20 minutes. Practitioner-only CCM uses 99491 for the first 30 minutes and 99437 for each additional 30 minutes. Complex CCM uses 99487 for the first 60 minutes and 99489 for each additional 30 minutes, and also requires moderate to high complexity medical decision-making by the billing practitioner.
Does CCM require patient consent?
Yes. The billing practitioner must obtain patient consent before CCM services begin. As of the CMS FAQ update in August 2022, verbal consent is acceptable and does not require a separate initiating visit, but it must be documented in the medical record, and the patient must be informed that only one practitioner can bill CCM per calendar month.
What services cannot be billed in the same month as CCM?
CCM cannot be billed by the same physician in a calendar month that also includes overlapping care management services. The prohibited overlap list includes transitional care management (TCM), home health care supervision, hospice care supervision, and certain ESRD services. These overlaps were the second largest overpayment category in the OIG audits.
Can a practice bill APCM and CCM for the same patient?
No. The same practitioner cannot bill Advanced Primary Care Management (APCM) and CCM for the same patient in the same calendar month. APCM bundles much of the CCM-type coordination work into a single monthly payment, so practices weighing both should map which model fits each patient. See how APCM works alongside CCM.
Related Resources
Source Disclosures
All regulatory and enforcement data in this article is sourced exclusively from primary government documentation: CMS MLN909188 (June 2025), CMS CCM FAQs (August 16, 2022), OIG Audit A-07-17-05101 (November 2019), OIG Audit A-07-19-05122 (August 2021), OIG Work Plan announcement (March 16, 2026), DOJ press release and settlement agreement (June 2024, Bluestone Physician Services), USAO WDNY press release (February 19, 2025, Western New York Medical P.C.), and OIG Civil Monetary Penalties enforcement postings for Piedmont Health Services (April 2025), 1st Choice Healthcare (July 2025), and Smart Clinic (April 2017).
CPT codes referenced in this article are registered trademarks of the American Medical Association.
Patient stories referenced in this article are drawn from Vivo Care’s Moments That Matter series and are based on documented care navigator interactions. Identifying details are not included.