In 2024, close to a million people on Medicare in the United States had a connected blood pressure cuff, a scale, or a pulse oximeter at home that reported their numbers to a clinic. Ask any of those patients where the readings ended up, and you'd likely get a shrug. Plenty of their doctors couldn't name the server either.
That server plays a big role in whether remote patient monitoring works, because it's where a gadget reading becomes a medical record under federal law. If you use a connected health device, or you run a practice that hands them out, here's what happens on the other end.
Federal auditors supplied the numbers. Medicare's bill for remote monitoring came to $536 million in 2024, which was 31 percent more than it paid the year before. When an inspector general review of that billing counted the medical practices charging for the service routinely, it found about 4,600.
The program widened again in 2026. Medicare's fee schedule added two billing codes for lighter monitoring, and Physicians Practice's rundown of the rule puts one new threshold at two to 15 days of readings in a 30-day period. The older code demanded at least 16. More patients are likely to qualify, which means more data on the move.
Medicare also won't pay for numbers a patient types in by hand. Federal billing guidance for remote patient monitoring says readings must be collected electronically and uploaded automatically to a secure location. In practice, the link between the cuff and the server is a condition of getting paid.
Why the Server Deserves More Attention Than the Sensor Getty Images
Most coverage of this market focuses on hardware, and that seems like the wrong place to look. A cuff is a sensor with a radio attached. Whether a patient's readings stay private, available, and accurate mostly depends on a data center.
Follow one reading. A patient in Ohio wraps the cuff around her arm at 7 a.m. The device sends the result over a built-in cellular modem, or through a phone app, to the monitoring vendor's platform. The platform stores it, checks it against thresholds her clinic set, and alerts a nurse if the top number is too high.
From the platform, the reading gets copied into the clinic's electronic health record and logged again for billing. By lunch, one morning's measurement can sit in four or five systems, and backups add more copies overnight.
Very little of this runs on equipment the clinic owns. A monitoring startup, or a hospital group building its own program, usually rents the servers, and the rental market has a name for what they need. A HIPAA-compliant hosting provider is a company that accepts legal responsibility for the health data on its machines and can produce audit reports showing how it's protected.
Hosts can't opt out of that responsibility. Federal guidance on cloud services and health records treats any company that stores a clinic's patient data as a business associate, which means a signed agreement and direct liability under HIPAA. Holding only encrypted files, with no key to open them, doesn't change the host's status.
The same guidance says a clinic that hands patient data to a cloud company without the agreement is itself violating HIPAA. It also notes that the Office for Civil Rights doesn't endorse or certify any technology, so "HIPAA-compliant hosting" is best read as a vendor's promise about its own controls.
GearBrain readers know this hardware from the consumer side. The watches in GearBrain's guide to wearables that can take an ECG use sensors much like clinical kits, and their readings generally fall outside HIPAA as long as they stay in the maker's app. The law takes hold once a clinic collects that data to treat someone.
Regulators have tightened the device end of the chain. Since March 2023, federal law has required makers of connected medical devices to show, before a product goes on sale, how they'll find and patch security flaws. The FDA reissued its cybersecurity guidance for device makers in February 2026.
The server end has been slower. The HIPAA Security Rule was written in 2003. Encryption is listed as an "addressable" item, so an organization that documents its reasons can use another measure in its place. Regulators want to change that. Their proposal to strengthen the HIPAA Security Rule came out in January 2025, and it would expressly require encryption, with only limited exceptions.
That proposal isn't law yet. Lawyers at Nelson Mullins reported in July that the new Security Rule is delayed until 2027, and it's unclear what the final text will keep. Until then, a careful host goes past the legal minimum by choice, while a cheaper competitor may do less under the same label.
The gadgets, for their part, are picking up more sensors every year. Withings brought a handheld to CES 2024 that combines an ECG, a digital stethoscope, and a thermometer, and built it so a physician can receive the recordings. A recording of someone's heart and lungs arguably tells a stranger much more about them than a single blood pressure number would.
How to Check a Platform Before You Sign Up iStock
If you manage a practice or build one of these products, you'll need most of the paperwork you get from a vendor. Start by asking which company hosts the platform, and get a copy of the business associate agreement while you're at it. Also ask for a recent report from an independent auditor. People tend to forget about backups. Find out which data center holds the backup copies, and get the vendor to confirm in writing that those copies are encrypted.
Restore time deserves its own question. A billing system that's offline for a day mostly costs a practice money. A monitoring platform is different because alerts stop while it's down, and a patient whose oxygen level fell overnight won't know nobody saw it. So ask the vendor for the date of its last restore from backup and how long it took.
Two free references can help structure the review. NIST's resource guide for implementing the Security Rule is written for organizations of any size. The health department also publishes voluntary Cybersecurity Performance Goals. Multifactor authentication and strong encryption are on their essentials list, along with vendor security requirements, so you can compare a hosting contract line by line against that list.
Two companies usually share the security work, and they don't do the same jobs. The host's part is usually physical and low-level. It locks the building and maintains the network and servers. The vendor still decides who can log in to the monitoring app and which patients each user can see. Ask for that split of duties in writing. Otherwise, the gap may first show up during a breach investigation, which is an expensive time to find it.
Location is worth raising too. Federal guidance allows patient data to sit on servers outside the United States when the agreement is in place, with a warning that the risks vary by location. A Texas practice may not know which country holds its backups.
Vendors have homework as well. A startup that rents the cheapest servers it can find and plans to sort out compliance after its first big contract ties patients' records to its own fundraising calendar.
Patients can ask a shorter version of the same questions. GearBrain's survey of smart home and health technology listed data privacy among the obstacles to adoption, and the worry looks reasonable. Anyone handed a monitoring kit can ask the clinic which company runs the platform and whether a business associate agreement covers it.
Home monitoring is worth having. Say a patient's blood pressure creeps upward for two weeks. A clinic watching those numbers can change the prescription well before an emergency room visit becomes likely. That benefit depends on the platform being online and the numbers being right.
In a few years the cuff on the kitchen table will probably be swapped for a newer one. This morning's readings will outlast it by a long way, and they sit on a machine the patient never chose.
Is your practice about to sign with a monitoring vendor? Ask who hosts the data and which agreement that company has signed. The same question applies when your doctor sends you home with a kit. If nobody at the clinic can tell you, that's worth knowing before the first reading goes out.
GearBrain Compatibility Find Engine
A pioneering recommendation platform where you can research,
discover, buy, and learn how to connect and optimize smart devices.
Join our community! Ask and answer questions about smart devices and save yours in My Gear.
