Medicare's telehealth flexibilities now run through December 31, 2027. For care-at-home leaders who spent the last two years watching deadlines lapse and get patched at the last minute, this is a real relief. However, it is also easy to misread.
The extension buys time. It does not lower the bar for documentation, and it does not slow the oversight building around virtual care and home-based services. The months between now and the end of 2027 are when the gap between organizations that can defend their data and those that cannot will start to show.
Where OIG Is Focusing Telehealth Oversight
The Office of Inspector General has been clear about where it sees risk. Its review of the first pandemic year identified 1,714 practitioners whose telehealth billing posed a high risk to Medicare, together receiving about $127.7 million. These providers were flagged for further scrutiny, not necessarily for confirmed fraud or improper billing.
More than half practiced alongside at least one other high-risk provider, suggesting that potential billing issues may stem from shared practices or oversight gaps. For healthcare organizations, this underscores the importance of consistent billing processes, strong internal controls, and organization-wide compliance monitoring.
OIG published a toolkit for analyzing telehealth claims that outlines seven measures to identify potentially problematic billing patterns. These measures help flag providers for further review. The toolkit reinforces the need for organizations to monitor billing data, investigate outliers, and address potential issues before they trigger external scrutiny.
The Importance of Enrollment & Status Details
Some telehealth compliance risks come down to administrative details. CMS requires practitioners who provide telehealth exclusively from home to enroll their home address as a practice location for administrative purposes. Since 2023, home health agencies have also been required to report telecommunications technology use on claims.
These requirements may seem minor, but missed updates or incomplete reporting can create billing discrepancies and invite additional scrutiny. With staff stretched thin, these details are also easy to overlook.
The cost of overlooking them is rising. In November 2026, CMS finalized a home health rule that allows enrollment revocations to take effect as of the date noncompliance began. That means Medicare can recover payments back to that point, which makes routine administrative checks an essential part of compliance.
Why Telehealth Compliance Depends on Data Defensibility
Most providers treat telehealth as a clinical delivery question: which visits can go virtual, which patients are good candidates, which platform to use. While those questions matter, the question that determines your risk exposure is different. Providers should also be asking themselves, “Can I prove what happened?”
Data defensibility means a reviewer can trace any virtual encounter from scheduling to documentation to claim and see the same story at every step. That requires:
Visit modality captured consistently in the EMR
Clinician credentials and enrollment status that match the claim
Documentation that reflects the patient's actual condition rather than template language
When telehealth platforms, EMRs, and billing systems don't talk to each other, those links break.
5 Telehealth Compliance Steps for Care-at-Home Providers Before 2027
Building effective defensibility starts with five practical steps most agencies can begin this quarter.
1. Audit your telehealth documentation.
Pull a sample of virtual encounters from the last two quarters and test them the way a reviewer would: modality, clinician, enrollment, medical necessity, and signatures.
2. Benchmark yourself before someone else does.
Use your own claims data to see where your telehealth use, visit patterns, or lengths of stay sit against peers. Outliers are not proof of wrongdoing, but they are where reviews begin.
3. Close the system gaps.
Map where telehealth data moves between platforms and where staff re-enter it by hand. Every manual handoff is a point where the record can drift from the claim.
4. Assign ownership.
Telehealth compliance cuts across clinical, operations, billing, and IT. In many agencies, this leads to confusion as to where responsibility lies. Name one person accountable for telehealth compliance across all four functions, with authority to resolve gaps between them.
5. Plan for what comes after 2027.
Some requirements, such as in-person visits for mental health telehealth patients, are already scheduled to return in 2028. Decide now which services you would keep virtual and what it would take to shift the rest.
Preparing for the End of Medicare Telehealth Flexibilities in 2027
The road to 2027 is not a reprieve. Organizations that use it to tighten documentation, connect their systems, and clarify ownership will be ready for whatever follows the extension.
At Momentum Healthcare & Technology Consulting, this type of work is exactly what we do with care-at-home organizations. We specialize in finding where compliance risk lives and building the governance and data practices that help make records defensible. We are technology-neutral, so our focus stays on what your organization needs, not on what a vendor sells.
Our recommended data and governance practices have implications beyond compliance. As care-at-home organizations adopt more advanced technologies, including AI, the quality, accessibility, and oversight of their data become increasingly important. In our next article, we'll explore what it takes to build an AI strategy on a foundation of reliable data and effective governance.
