Colo. Rev. Stat. § 25.5-4-301 – Recoveries - overpayments - penalties - interest - adjustments - liens - review or audit procedures - cash fund - rules - definitions.

(1)
1. (a)
  1. (I) Except as provided in section 25.5-4-302 and subsection (1)(a)(III) of this section, a member or estate of the member is not liable for the cost or the cost remaining after payment by medicaid, medicare, or a private insurer of medical benefits authorized by Title XIX of the federal Social Security Act, by this title 25.5, or by rules promulgated by the state board, which benefits are rendered to the member by a provider of medical services authorized to render the service in the state of Colorado, except those contributions required pursuant to section 25.5-4-209 (1). However, a member may enter into a documented agreement with a provider under which the member agrees to pay for items or services that are nonreimbursable under the medical assistance program. Under these circumstances, a member is liable for the cost of the services and items.
  2. (II) The provisions of subsection (1)(a)(I) of this section apply regardless of whether medicaid has actually reimbursed the provider and regardless of whether the provider is enrolled in the Colorado medical assistance program.
  3. (II.5)
    1. (A) A provider of medical services who bills or seeks collection through a third party from a member or the estate of a member for medical services authorized by Title XIX of the federal Social Security Act in an amount in violation of subsection (1)(a)(I) of this section is liable for and subject to the following: A refund to the member of any amount unlawfully received from the member, plus statutory interest from the date of the receipt until the date of repayment; a civil monetary penalty of one hundred dollars for each violation of subsection (1)(a)(I) of this section; and all amounts submitted to a collection agency in the name of the medicaid member. When determining income or resources for purposes of determining eligibility or benefit amounts for any state-funded program under this title 25.5, the state department shall exclude from consideration any money received by a member pursuant to this subsection (1)(a)(II.5). The imposition of a civil monetary penalty by the state department may be appealed administratively.
    2. (A.5) A provider of medical services who, within thirty days of notification by the state department, or longer if approved by the state department, voids the bill, returns any amount unlawfully received, and makes every reasonable effort to resolve any collection actions so that the member or the estate of the member has no adverse financial consequences is not subject to the provisions of subsection (1)(a)(II.5)(A) of this section.
    3. (B) In order to establish a claim for the civil monetary penalty established by subsection (1)(a)(II.5)(A) of this section, a member or the estate of a member, or a person acting on behalf of a member or the estate of a member, shall notify the state department.
    4. (C) The provisions of this subsection (1)(a)(II.5) do not apply to a long-term care facility licensed pursuant to section 25-3-101.
    5. (D) The provisions of subsection (1)(a)(II.5)(A) of this section do not apply if a member knowingly misrepresents the member's medicaid coverage status to a provider of medical services and the provider submits documentation to the state department that the member knowingly misrepresented the member's medicaid coverage status and the documentation clearly establishes a good cause basis for granting an exception to the provider.
    6. (III)
      1. (A) When a third party is primarily liable for the payment of the costs of a member's medical benefits, prior to receiving nonemergency medical care, the member shall comply with the protocols of the third party, including using providers within the third party's network or receiving a referral from the member's primary care physician. Any member failing to follow the third party's protocols is liable for the payment or cost of any care or services that the third party would have been liable to pay; except that, if the third party or the service provider substantively fails to communicate the protocols to the member, the items or services are nonreimbursable under this article 4 and articles 5 and 6 of this title 25.5 and the member is not liable to the provider.
      2. (B) A member may enter into a written agreement with a third party or provider under which the member agrees to pay for items provided or services rendered that are outside of the network or plan protocols. The member's agreement to be personally liable for nonemergency, nonreimbursable items must be recorded on forms approved by the state board and signed and dated by both the member and the provider in advance of the services being rendered.
2. (b) Member income applied pursuant to section 25.5-4-209 (1) does not disqualify any member, as defined in section 26-2-103 (8), from receiving benefits pursuant to this article 4, article 5 or 6 of this title 25.5, or public assistance pursuant to article 2 of title 26, and does not disqualify an individual from receiving child care assistance pursuant to part 1 of article 4 of title 26.5. If, at any time during the continuance of medical benefits, the member gains possession of property having a value in excess of that amount set by law or by the rules of the state department or receives any increase in income, the member shall notify the county department and the county department may, after investigation, either revoke the medical benefits or alter the amount of medical benefits, as the circumstances may require.
3. (c) Any medical assistance paid to which a member was not lawfully entitled is recoverable from the member or the estate of the member by the county as a debt due the state pursuant to section 25.5-1-115, but no lien may be imposed against the property of a member on account of medical assistance paid or to be paid on the member's behalf under this article 4 or article 5 or 6 of this title 25.5, except pursuant to the judgment of a court of competent jurisdiction or as provided by section 25.5-4-302.
4. (d) If any medical assistance was obtained fraudulently, interest must be charged and paid to the county department on the amount of the medical assistance calculated at the legal rate and calculated from the date that payment for medical services rendered on behalf of the member is made to the date the amount is recovered.
(2) Any overpayment to a provider, including those of personal needs funds made pursuant to section 25.5-6-206, are recoverable regardless of whether the overpayment is the result of an error by the state department, a county department of human or social services, an entity acting on behalf of either department, or by the provider or any agent of the provider as follows:
1. (a)
  1. (I) If the state department makes a determination that such overpayment has been made as a result of the provider's false representation, the state department may collect the overpayment, plus a civil monetary penalty equal to one-half the amount of the overpayment, and interest on the sum of the two amounts accruing at the statutory rate from the date the overpayment is identified, by the means specified in this subsection (2). Such sum may be collected for up to the amount of time prescribed in section 13-80-103.5, C.R.S., after the overpayment is identified. Amounts remaining uncollected for more than the time period prescribed in section 13-80-103.5, C.R.S., after the last repayment was made may be considered uncollectible. For the purposes of this subparagraph (I), false representation means an inaccurate statement that is relevant to a claim for reimbursement and is made by a provider who has actual knowledge of the truth of false nature of the statement or by a provider acting in deliberate ignorance of or with reckless disregard for the truth of the statement. A provider acts with reckless disregard for truth if the provider fails to maintain records required by the department or if the provider fails to become familiar with rules, manuals, and bulletins issued by the department, board, or the department's fiscal agent.
  2. (II) If the state department makes a determination that the overpayment has been made for some other reason than a false representation by the provider specified in subsection (2)(a)(I) of this section, the state department may collect the amount of overpayment, plus interest accruing at the statutory rate from the date the provider is notified of the overpayment, by the means specified in this subsection (2). Pursuant to the criteria established in rules promulgated by the state board, the state department may waive the recovery or adjustment of all or part of the overpayment and accrued interest specified in this subsection (2)(a)(II) if it would be inequitable, uncollectible, or administratively impracticable; except that no action shall be taken against a member of medical services initially determined to be eligible pursuant to section 25.5-4-205 if the overpayment occurred through no fault of the member. Amounts remaining uncollected for more than five years after the last repayment was made may be considered uncollectible.
2. (b) In order to collect the amounts specified in paragraph (a) of this subsection (2), the state department may withhold subsequent payments to which the provider is or becomes entitled and apply the amount withheld as an offset. The state board shall establish in rules the rate at which an overpayment may be offset, with provision for a reduction of such rate upon a good cause shown by the provider that the rate at which payment will be withheld will result in an undue hardship for the provider. In determining whether to grant a good cause reduction, the state department shall consider the impact of collecting the amount provided by state board rules on the quality of patient care and the financial viability of the provider. The state department may also take such other steps administratively as are available for the collection of the amounts specified in paragraph (a) of this subsection (2).
3. (c) If a provider defaults on repayment of the amounts specified in paragraph (a) of this subsection (2), the state department may bring a suit against the provider in the appropriate court. Court costs shall not be assessed against the state department but shall be assessed against the provider if the court finds in favor of the state department. Any costs collected by the state department shall be paid into the registry of the court. Once the amount has been reduced to judgment, the state department may proceed with all available postjudgment remedies.
4. (d) Repealed.
5. (e) Any provider adversely affected by actions taken pursuant to this subsection (2), except when a suit is filed against the provider pursuant to paragraph (c) of this subsection (2), may appeal the determination of the state department pursuant to the provisions in section 24-4-105, C.R.S.
6. (f) If the state department, either directly or through a contracting agent, undertakes a review or an audit of a provider to determine whether an overpayment has been made to that provider, the review or audit shall be subject to the procedures required in subsection (3) of this section.
(3)
1. (a) A review or audit of a provider is subject to the following procedures:
  1. (I) The reviewer or auditor shall conduct a review or audit in accordance with applicable state and federal law.
  2. (II) The reviewer or auditor shall apply uniform standards and procedures to each class of providers subject to a review or an audit to determine an overpayment.
  3. (III) The reviewer or auditor shall prepare findings for the entire period under review or audit, and a provider shall be subject to only one demand for repayment in connection with the review or audit.
  4. (IV) Prior to a review or audit requiring an inspection of a provider's records, the reviewer or auditor, or a qualified agent contracted with the state department pursuant to subsection (3)(b) of this section, shall confirm the provider's contact information with the provider. After confirming the provider's contact information, the reviewer or auditor, or qualified agent, shall notify the provider of additional information concerning the review or audit, including instructions, correspondence timelines, and a state department contact for the provider to notify if the provider does not receive the written request for records. The reviewer or auditor shall initiate each review or audit requiring an inspection of the provider's records by delivering to the provider not less than ten business days prior to the commencement of the audit a written request through both email and certified mail describing in detail such records and offering the provider the option of providing either a reproduction of such records or inspection by the reviewer or auditor at the provider's site. The request must also clearly define milestone dates pertaining to records' requested due dates, permissible extensions of dates, the timelines for informal reconsideration, and deadlines for requesting a formal appeal. The records subject to the request must be limited to records directly related to claims for reimbursement submitted by the provider. Prior to a qualified agent commencing any review or audit, the state department shall ensure providers understand the relationship between the state department and the qualified agent and how to contact the qualified agent. In the event such records are available from a county department of human or social services or another agency, subdivision, or contractor of the state, the reviewer or auditor shall request such records from such other agencies as may be appropriate prior to making a request to the provider. The reviewer or auditor shall conduct on-site inspections at reasonable times during regular business hours, and the reviewer or auditor shall make arrangements necessary for the reproduction of such records on site. If the provider chooses to provide a reproduction of the records requested by the reviewer or auditor instead of on-site inspection, the reviewer or auditor shall give the provider a reasonable period of time, not less than forty-five days, to provide such records, taking into account the scope of the request, the time frame covered, and the reproduction arrangements available to the provider.
  5. (IV.5) At the request of the provider, the reviewer or auditor shall conduct an in-person or telephonic interview with the provider prior to the preparation of a preliminary draft of the report of the reviewer or auditor at which the reviewer or auditor and the provider shall discuss:
    1. (A) The findings of the reviewer or auditor;
    2. (B) Any documentation useful for the provider to refute the findings of the reviewer or auditor; and
    3. (C) The next steps in the review or audit process.
    4. (V) A physician's record or other order for health-care services, drugs, or medicinal supplies in a form transmitted electronically shall be sufficient to validate the provider's records regarding the ordering of the health-care services, drugs, or medicinal supplies.
    5. (VI) Whenever possible, the reviewer or auditor shall base a determination of an overpayment to a provider upon a review of actual records of the department, its agents, or the provider. In the event sufficient records are not available to the reviewer or auditor, an overpayment determination may be based upon a sampling of records so long as the sampling and any extrapolation therefrom is reasonably valid from a statistical standpoint and is in accordance with generally accepted auditing standards.
    6. (VII) If a reviewer or auditor determines that there has been an overpayment to the provider, then, at the time demand for repayment is made, the state department shall offer the provider an informal reconsideration of the review or audit findings. The state department shall notify the provider in writing of the right to an informal reconsideration prior to implementing any recovery of an overpayment and give the provider an opportunity to request an informal reconsideration. In the event informal reconsideration is requested or a formal appeal is filed pursuant to subparagraph (VIII) of this paragraph (a), the state department shall not implement recovery of the overpayment until such informal reconsideration or formal appeal has been completed. Within forty-five days after the request for an informal reconsideration, the state department shall render a decision on the request and notify the provider of the decision. The notification shall include information concerning requesting a formal appeal, including informing the provider that the request must be filed within thirty days after the date of the state department's decision on the request for an informal reconsideration. If the state department is unable to render a decision on the request for informal reconsideration within forty-five days after the request, within forty-five days after the request, the state department shall notify the provider of its inability to complete the decision and shall include information concerning requesting a formal appeal, including informing the provider that the request must be filed within thirty days after the receipt of the notification that the state department is unable to render a decision. For purposes of this subparagraph (VII), an informal reconsideration shall be considered final thirty days after the earlier of the date on which the provider withdraws its request or the date on which the state department issues a written decision on the request.
    7. (VIII) In accordance with paragraph (e) of subsection (2) of this section, any provider adversely affected by the actions of the state department or its contracting agent in connection with a review or an audit, including whether the state department or its contracting agent adhered to the provisions of this subsection (3) in making an overpayment determination, may appeal such actions pursuant to the provisions of section 24-4-105, C.R.S.
    8. (IX) Repealed.
    9. (a.5) Any additional review or audit procedures shall be adopted by rule of the state board and shall be specifically referenced in any contract with a provider.
2. (b) The state department is authorized to engage the services of a qualified agent through a competitive contract issued pursuant to the state's procurement code for the purpose of conducting a review or audit of a provider to assist in determining whether there has been an overpayment to a provider and the amount of that overpayment. In addition to such terms and conditions as the state department may deem necessary, any contract shall be subject to the requirements for conducting a review or an audit in accordance with paragraph (a) of this subsection (3). The state department is further authorized to enter into a contract with a qualified agent for the purpose of conducting a review or an audit of a provider that provides that the compensation of the contracting agent shall be contingent and based upon a percentage of the amount of the recovery collected from the provider. A contract issued by the state department for the purpose of conducting a review or an audit of a provider to determine whether the provider has received an overpayment shall also be subject to the following conditions:
  1. (I) The compensation paid to the contracting agent under a contingency-based contract shall not exceed eighteen percent of the amount finally collected from the provider overpayment, and the state department may establish a limit on the amount of annual compensation that may be paid to a contracting agent under a contingency-based contract and may further establish a limit on the amount that may be paid to a contracting agent under a contingency-based contract for recovery from any one provider.
  2. (II) Reimbursement of the contracting agent's costs in performing the review or audit under a contingency-based contract shall be deemed included in the percentage compensation due the agent under the contract.
  3. (III) No employee or agent of the contracting agent involved in the performance of a contingency-based contract shall be compensated by the contracting agent based upon the amount recovered under the contract.
  4. (IV) The state department shall retain all authority for providing notice and otherwise making demand upon a provider for recovery of an overpayment, and the state department shall review and approve any written demand, request, or determination by the contracting agent regarding a review or an audit of a provider under this subsection (3).
  5. (V) In any contingency-based contract authorized pursuant to this paragraph (b), the state of Colorado shall not be obligated to pay the contracting agent for amounts not actually collected from the provider.
  6. (3.3)
    1. (a) As used in this subsection (3.3), unless the context otherwise requires:
      1. (I) Automated audit means a RAC audit that reviews a provider's application of coding rules and does not require a provider to submit medical records to be audited.
      2. (II) Complex audit means a RAC audit that requires a provider to submit medical records to be audited, which are individually reviewed by a representative of the state department or the state department's RAC vendor.
      3. (III) Denial rate means the percentage of reviewed claims ultimately determined to involve improper payments after all administrative processes are complete, including the resolution of an appeal.
      4. (IV) RAC audit means a recovery audit contractor audit conducted pursuant to the federal Social Security Act, 42 U.S.C. sec. 1396a (a)(42)(B).
      5. (V) RAC vendor means a vendor who meets the requirements of 42 CFR 455.508 and contracts with the state department to perform recovery audit contractor audits of providers on behalf of the state department.
    2. (b) The state department may solicit the services of a RAC vendor through a contract issued pursuant to the Procurement Code, articles 101 to 112 of title 24, and pursuant to the federal requirements detailed in 42 CFR 455.508, for the purpose of conducting RAC audits of providers to identify possible medicaid overpayments and underpayments.
    3. (c)
      1. (I) The contract described in subsection (3.3)(b) of this section must state that the RAC vendor's compensation is contingent upon the amount of overpayments the state recovers from a provider. At the expiration of the current contract between the state department and the RAC vendor, the state department shall establish contingency fee rates based on market rates determined by the results of a competitive procurement process and may negotiate lower rates as the market provides, with contingency rates not to exceed sixteen percent of recovered payments. The state department shall ensure that the contingency fee requirements are adhered to through effective monitoring and enforcement of the RAC vendor's performance. For contracts entered into after the expiration of the contract that established contingency fee rates for RAC vendor payments, the state department shall structure the RAC vendor compensation based on a tiered payment system that corresponds to the required work unless doing so conflicts with federal directives in medicaid guidance pursuant to 42 CFR 455, subpart F, or results in an unfavorable impact to the state's general fund.
      2. (II) When the state department enters into a contract pursuant to subsection (3.3)(b) of this section, the state department must publish on its website a copy of the contract, scope of the work, and information regarding supervision of contractor deliverables.
      3. (III) The contract described in subsection (3.3)(b) of this section must require the RAC vendor to:
        (A) Conduct informal conferences or phone calls with providers or provider associations to discuss the RAC program, processes, and findings;
        (B) Conduct provider outreach and education activities, including notifying providers of audit policies, protocols, and common billing errors;
        (C) Respond to provider questions and requests for information within two business days after receiving the question or request for information;
        (D) Return, within thirty days, the contingency fee associated with inaccurate audit scenarios that resulted in provider refunds as prescribed by the state department; and
        (E) Provide preliminary RAC audit findings to a provider within a reasonable period following receipt of any requested medical records, as determined by the state department in collaboration with the provider advisory group, created in subsection (3.5)(c)(I) of this section.
    4. (d) The RAC contract described in subsection (3.3)(b) of this section may include an option to pay the RAC vendor to identify underpayments for consideration in future state department budget requests.
    5. (e)
      1. (I) The state department shall implement a process to verify that the RAC vendor's staff who make clinical RAC audit findings are appropriately licensed pursuant to industry standards and federal requirements, including that the RAC vendor hire qualified coders and that the RAC vendor's staff who make billing RAC audit findings have knowledge of medicaid billing and coding rules and guidance adopted by the state department.
      2. (II) The state department must ensure that qualified coders have relevant credentials for the type of medical services being reviewed, in accordance with industry standards.
      3. (III) Any complex audit that requires a review of medical records must be conducted by licensed clinical staff with training and competency in the specific type of complex audit being conducted, in accordance with industry standards. Providers must make all relevant medical records and information related to claims reviewed during the complex audit available to the RAC vendor within the time limits specified in the initial medical records request.
      4. (IV) The state department shall fully inform the RAC vendor of any changes to the state billing standards and ensure that the vendor only applies billing standards that were in effect at the specified date of service. The state department is responsible for monitoring compliance with this requirement and taking appropriate action to ensure the RAC vendor's compliance.
      5. (V) The state department shall ensure that the RAC vendor complies with the contract requirements described in subsection (3.3)(b) of this section and conducts RAC audits in a fair and consistent manner.
      6. (VI) The state department shall ensure that the RAC vendor incorporates into each audit scenario, whether an automated audit or a complex audit, the following information:
        (A) Federal statutes and billing rules and standards that are applicable to the specific provider during the specified dates of service for each audit;
        (B) State statutes, billing rules and standards, and policies as documented in the state department's provider billing manuals and provider bulletins, as well as in program guidance and directives effective for the specific provider during the specified dates of service for each audit; and
        (C) Input from the state department's RAC staff and medical director, as well as any other necessary state department staff based on the staff's or medical director's review of the audit scenario.
      7. (VII) When auditing claims to make RAC audit findings, the state department must ensure that the RAC vendor follows all relevant and appropriate federal billing guidelines, requirements set by the medicaid billing manual, standard clinical guidelines, and any other applicable state or federal rules and regulations.
    6. (f) The state department shall comprehensively review all audit types proposed by the RAC vendor and must approve, adjust, or reject each audit type before the RAC vendor conducts the RAC audit. Within eighteen months of the rollout of a new audit, if the state department, in collaboration with providers and the provider advisory group created in subsection (3.5) of this section, determines that the audit is inaccurate, the state department must refund providers who submitted repayments based on inaccurate audit findings and require the RAC vendor to return the contingency fee associated with the payments within thirty days.
    7. (g) The state department shall regularly review active RAC audits to ensure compliance with federal and state regulation changes and policy updates and discontinue a RAC audit if and when appropriate due to a change in federal or state regulation or policy updates.
    8. (h) Consistent with 42 CFR 455.508 (f), RAC audits and reviews conducted pursuant to this section must not review claims more than three years after the expiration of the timely filing period. The state department may conduct a RAC audit for a claim filed more than three years after the expiration of the timely filing period if required by a federal audit that would otherwise result in costs to the general fund or, if directed by the federal centers for medicare and medicaid services, the United States department of health and human services, or any other federal agency. If a RAC audit is initiated in response to a federal directive, the state department must provide notice to an impacted provider and include the reason for the RAC audit and any relevant information about the federal requirement in the notice.
    9. (i)
      1. (I) The RAC vendor shall not require a provider to undergo more than three complex audits per calendar year. Hospitals must be grouped for complex audits based on their total medicaid reimbursement in the previous fiscal year, and groupings must be determined using state data and published annually by the state department.
      2. (II) The maximum number of medical record requests a provider may receive each month must be clearly communicated to providers and reviewed annually by the state department. The RAC vendor shall not request more than the following number of medical records per hospital per month:
        (A) Six hundred for hospitals with over two hundred fifty million dollars in medicaid revenue;
        (B) Four hundred for hospitals with between seventy million dollars and two hundred forty-nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;
        (C) Two hundred for hospitals with between forty million dollars and sixty-nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;
        (D) One hundred for hospitals with between twenty million dollars and thirty-nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;
        (E) Fifty for hospitals with between ten million dollars and nineteen million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;
        (F) Twenty-five for hospitals with between one million dollars and nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;
        (G) Twenty for hospitals with under one million dollars in medicaid revenue; and
        (H) Ten for out-of-state facilities.
      3. (III) The requirements of this subsection (3.3)(i) do not apply if:
        (A) Federal medicaid directives required pursuant to 42 CFR 455, subpart F, require a higher level of claim audits;
        (B) An agency of the federal government requires, in writing, the state department to initiate additional audit activity; or
        (C) A federal audit identifies additional provider findings that impact the state general fund and that should be appropriately recovered from that provider through an additional RAC audit and its recoupments.
    10. (j)
      1. (I) The RAC vendor shall not require a provider to undergo more than four automated audits per calendar year. Providers must be grouped for automated audits based on their total medicaid reimbursement in the previous fiscal year, and groupings must be determined using state data and published annually.
      2. (II) The maximum number of provider claims across all of a provider's locations for a given calendar year that undergo automated audits must not exceed:
        (A) 2.92 percent for providers with over ten million dollars in medicaid revenue;
        (B) 2.50 percent for providers with between four million dollars and ten million dollars in medicaid revenue;
        (C) 2.08 percent for providers with between one million dollars and three million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue; and
        (D) 1.67 percent for providers with less than one million dollars in medicaid revenue.
      3. (III) After the administrative process is exhausted, if the state department identifies a denial rate of forty percent or higher for a specific provider on a specific audit type, the state department shall audit no more than an additional twenty-five percent of the claim percentages stated in subsection (3.3)(j)(II) of this section associated with that audit type.
      4. (IV) The requirements of this subsection (3.3)(j) do not apply if:
        (A) Federal medicaid directives required pursuant to 42 CFR 455, subpart F, require a higher level of claim audits;
        (B) An agency of the federal government requires, in writing, the state department to initiate additional audit activity; or
        (C) A federal audit identifies additional provider findings that impact the state general fund and that should be appropriately recovered from that provider through an additional RAC audit and its recoupments.
    11. (k) When conducting audits, the RAC vendor must:
      1. (I) Request provider records that are relevant to the claims being audited and that do not duplicate information already provided;
      2. (II) Not audit the validity of a provider's prior authorization received from the state department; and
      3. (III) For a complex audit, not audit claims that are on the federal centers for medicare and medicaid services inpatient-only list at the date of service for a level-of-care determination.
    12. (l)
      1. (I) If the RAC vendor identifies preliminary findings during the RAC audit, the RAC vendor must send the provider a notice of preliminary audit findings detailing the preliminary findings, the rationale for the preliminary findings, and the methodology for how the dollar amounts associated with the preliminary findings were calculated and determined.
      2. (II) For a complex audit, a provider may request an exit conference to discuss the preliminary findings with the RAC vendor and the state department medical director, or the state department medical director's designee, prior to participating in an informal reconsideration. The provider may provide additional information supporting the provider's claims at the exit conference. A provider must request an exit conference no later than thirty days after the provider receives a notice of preliminary audit findings from the RAC vendor, and if an exit conference is requested, the state department or the RAC vendor must schedule the exit conference within sixty days of receiving the request and on a mutually agreed upon date and time.
      3. (III) Within thirty days of the exit conference, the state department must notify the provider on whether the state department will dismiss the preliminary findings or will issue a notice of informal reconsideration. The notice of informal reconsideration must include details on the preliminary findings, the rationale for the preliminary findings, and the methodology for how the dollar amount associated with the preliminary findings were calculated and determined. If an exit conference occurred, the notice must include information on why the state department did not agree with the provider's approach.
      4. (IV) Unless the preliminary findings are accepted by the provider, dismissed by the state department following an exit conference, or the period for a provider to request an exit conference has expired, a provider who receives a notice of preliminary findings, the state department, and the RAC vendor must participate in an informal reconsideration before the provider may formally appeal the state department's determination. To participate in an informal consideration, the following requirements must be satisfied:
        (A) Within sixty days of receiving the notice of informal reconsideration, the provider must submit all medical records relevant to the claims and the reasoning for the provider's disagreement concerning the preliminary audit findings. The medical records must substantiate the provider's argument to dispute any preliminary findings to allow the state department and the RAC vendor to reconsider the findings, and the department and the RAC vendor must review medical records prior to the informal reconsideration meeting;
        (B) The state department must schedule an informal reconsideration meeting between mutually agreed upon participants from the state department, RAC vendor, and provider representatives at a mutually agreed upon date and time within ninety days of issuing the notice of informal reconsideration, although either party may request a sixty-day extension; and
        (C) All agreed upon attendees must participate in the informal reconsideration meeting in good faith in an effort to resolve the dispute.
      5. (V) If a claim remains in dispute after the informal reconsideration meeting, the state department must issue a notice of adverse action within sixty days of the informal reconsideration meeting. The notice of adverse action must include the basis of the alleged overpayment, the rationale for the alleged overpayment, the methodology used to calculate the alleged overpayment, and information on why the state department did not agree with the provider's approach.
      6. (VI) Within thirty days of receiving a notice of adverse action, the provider may request a formal appeal, which must include an explanation of the basis of the appeal in accordance with rules adopted by the state department.
      7. (VII) The state department must not recover an overpayment identified in the preliminary findings from a provider until the informal reconsideration process, and subsequent formal appeal, if filed, are complete.
      8. (VIII) If the state department has not issued a notice of adverse action one hundred twenty days following the informal reconsideration meeting, the state department waives its right to recover the state share of the overpayment.
    13. (m) Providers are subject to all state and federal medicaid fraud, waste, and abuse laws and must comply with all applicable program integrity requirements. Failure to comply may result in removal from the state medical assistance program, financial penalties, civil lawsuits, or criminal prosecution pursuant to 42 U.S.C. sec. 1320a-7k(d), 42 U.S.C. sec. 1320a-7, 31 U.S.C. secs. 3729-3733, sections 24-31-808, 25.5-4-301, 25.5-4-303.5 to 25.5-4-310, and 10 CCR 2505-10, sec. 8.076. By participating in the medical assistance program, providers acknowledge and accept their obligation to adhere to all state and federal laws governing medicaid fraud, waste, and abuse, and program integrity.
    14. (n)
      1. (I) The state department shall publish and maintain on its website a RAC audit activity report for each RAC audit and review completed in the preceding year summarizing the findings of those RAC audits and reviews. The information posted on the state department's website concerning each RAC audit must include the following information:
        (A) A summary of the audit scenario, the state department's billing practices, and policy guidelines being reviewed by the RAC vendor;
        (B) The error rates identified during the RAC vendor's review;
        (C) The number and amounts of overpayments and underpayments identified by the RAC vendor;
        (D) The recoveries collected by the state department on identified overpayments;
        (E) The number of claims appealed as a result of the audit; and
        (F) Details on the audit scenarios and billing standards used by the RAC vendor and policy guidance on proper billing practices.
      2. (II) In addition to the information required by subsection (3.3)(n)(I) of this section, the state department shall publish and maintain on its website information on the number of informal reconsideration meetings the state department participated in and the associated percentage of findings that were upheld, the number of appeals, and corresponding determinations.
    15. (o) On or before January 1, 2026, the state department shall publish on its website provider education information; resources to assist providers in understanding the state department's medicaid billing manual and rules; and procedures related to RAC audits, including documentation requirements and the process for resolving disputes.
    16. (p) At least quarterly, the state department shall:
      1. (I) Conduct medicaid billing training for providers and hold meetings with providers to gather feedback on the RAC audit process. The state department shall publish meeting dates and times on the state department's website at least two weeks prior to the meetings.
      2. (II) Conduct trainings for providers and hold stakeholder meetings regarding audits and reviews, during which the state department and RAC vendor must identify common billing errors identified by the RAC vendor in the previous quarter and provide clarification on the billing errors.
    17. (q) The state department shall work with small or rural providers in order to identify and implement opportunities to reduce administrative burdens and better support compliance with medicaid billing practices, as adopted in the state department's medicaid billing manual, and experience with RAC audits.
    18. (r) The state department must submit an annual report to the joint budget committee that includes a description of the following:
      1. (I) The divisions of the state department that are included in the review and approval of RAC audit scenarios and the roles and responsibilities of each division;
      2. (II) The RAC vendor's compliance with the response requirement described in subsection (3.3)(c)(III)(C) of this section;
      3. (III) The state department's oversight and enforcement of the contractual requirement that the RAC vendor conduct informal conferences or phone calls with providers or provider associations to discuss the RAC program, appeal processes, and findings;
      4. (IV) The training materials prepared by the RAC vendor after each RAC audit that identify and address the common errors and issues identified during the audit and the content and materials the RAC vendor used to educate providers to prevent errors in the future;
      5. (V) A summary of the RAC vendor's outreach and education activities;
      6. (VI) A summary of the state department's written policies, procedures, and guidance that establish processes for the state department to log provider communications, provide direction on how state department staff must respond to communications in a timely and relevant manner, and how the state department instituted routine analysis of provider communications to inform decisions on program improvements; and
      7. (VII) The total amount of alleged overpayments identified by the RAC vendor, the proportion of those overpayments that were recovered, and the total amount paid to the RAC vendor.
    19. (s) All recoveries collected by the state department on identified overpayments pursuant to this subsection (3.3) must be transmitted to the state treasurer, who shall credit the same to the recovery audit contractor recoveries cash fund, which fund is created in the state treasury and referred to in this subsection (3.3)(s) as the cash fund. The cash fund consists of money credited to the cash fund pursuant to this subsection (3.3) and any other money that the general assembly may appropriate or transfer to the cash fund. Subject to annual appropriation by the general assembly, the state department may expend money from the cash fund to offset the need for appropriations for medical services and to pay the RAC vendor. The state treasurer shall credit all interest and income derived from the deposit and investment of money in the recovery audit contractor recoveries cash fund to the cash fund.
    20. (t) The state department may adopt rules, as necessary, to implement the requirements of this subsection (3.3).
    21. (3.5)
      1. (a) Prior to the start of a contract to review or audit providers, the state department is encouraged to meet with organizations or associations of providers to educate providers on the review or audit process and the responsibilities of both the providers and the state department throughout the review or audit process. The state department is also encouraged to prepare an annual report on common findings following a contract to review or audit providers and distribute the report to organizations or associations of providers. The annual report should include information to prevent similar findings in future reviews or audits and should direct providers to resource information.
      2. (b) Repealed.
      3. (c)
        (I) The state department shall create a provider advisory group for recovery audits consisting of employees of the state department and members from different provider types, including physicians, hospitals, and any other provider types directly impacted by audits conducted pursuant to this section, appointed by the executive director. The provider advisory group shall meet at least quarterly to review quarterly activity reports required by subsection (3.3)(n) of this section and advise the state department on issues providers experience with audits of the recovery audit contractors program.
        (II) The state department and the RAC vendor shall provide the provider advisory group with the opportunity to review RAC audit scenarios during the provider advisory group's quarterly meetings.
        (III) The state department shall give providers the opportunity to anonymously describe RAC audit scenarios they are experiencing and ask questions about billing practices. The state department shall include RAC vendor staff and the relevant state department division staff in these discussions. If the discussions lead the state department to determine that an audit scenario was inaccurate, the state department must work with the RAC vendor to rescind the RAC audit.
        (3.7) Repealed.
(4) If medical assistance is furnished to or on behalf of a member pursuant to the provisions of this article 4 and articles 5 and 6 of this title 25.5 for which a third party is liable, the state department has an enforceable right against the third party for the amount of medical assistance, including the lien right specified in subsection (5) of this section. Whenever the member has brought or may bring an action in court to determine the liability of the third party, the state department, without any other name, title, or authority to enforce the state department's right, may enter into appropriate agreements and assignments of rights with the member and the member's attorney, if any. Any agreement must be filed with the court in which the action is pending. The attorney named in the agreement upon designation as a special assistant attorney general by the attorney general shall prove both the member's claim and the state department's claim. The state department, without any other name, title, or authority, may take any necessary action to determine the existence and amount of the state department's claims under this section, whether the claims are founded on judgment, contract, lien, or otherwise, and take any other action that is appropriate to recover from third parties. To enforce the right, the attorney general, pursuant to section 24-31-101, on behalf of the state department, may institute and prosecute, or intervene of right in legal proceedings against the third party having legal liability, either in the name of the state department or in the name of the member or the member's assignee, guardian, personal representative, estate, or survivors. When the state department intervenes in legal proceedings against the third party, the state department is not liable for any portion of the attorney fees or costs of the member.
(5)
1. (a) When the state department has furnished medical assistance to or on behalf of a member pursuant to the provisions of this article 4 or articles 5 and 6 of this title 25.5 for which a third party is liable, the state department has an automatic statutory lien for all medical assistance. The state department's lien is against any judgment, award, or settlement in a suit or claim against the third party and is in an amount that is the fullest extent allowed by federal law as applicable in this state, but not to exceed the amount of the medical assistance provided.
2. (b) No judgment, award, or settlement in any action or claim by a member to recover damages for injuries in which the state department has a lien is satisfied without first satisfying the state department's lien. Failure by any party to the judgment, award, or settlement to comply with this section makes each party liable for the full amount of medical assistance furnished to or on behalf of the member for the injuries that are the subject of the judgment, award, or settlement.
3. (c) Except as otherwise provided in this article 4, the entire amount of any judgment, award, or settlement of the member's action or claim, with or without suit, regardless of how characterized by the parties, is subject to the state department's lien.
4. (d) When the action or claim is brought by the member alone and the member incurs a personal liability to pay attorney fees, the state department shall pay the state department's reasonable share of attorney fees not to exceed twenty-five percent of the state department's lien. The state department is not liable for costs.
5. (e) The state department's right to recover under this section is independent of the member's right.
(6) When the applicant or member, or the applicant's or member's guardian, executor, administrator, or other appropriate representative, brings an action or asserts a claim against any third party, the person shall give the state department written notice of the action or claim by personal service or certified mail within fifteen days after filing the action or asserting the claim. Failure to comply with this subsection (6) makes the member, legal guardian, executor, administrator, attorney, or other representative liable for the entire amount of medical assistance furnished to or on behalf of the member for the injuries that gave rise to the action or claim. The state department may, after thirty days' written notice to the person, enforce the state department's rights under subsection (5) of this section and this subsection (6) in the district court of the city and county of Denver; except that liability of a person other than the member exists only if the person had knowledge that the member had received medical assistance or if excusable neglect is found by the court. The court shall award the state department its costs and attorney fees incurred in the prosecution of any such action.
(7) When a legally responsible relative of the member agrees or is ordered to provide medical support or health insurance coverage for the member's dependents or other persons, and the dependents are applicants for, members of, or otherwise entitled to receive medical assistance pursuant to this article 4 and articles 5 and 6 of this title 25.5, the state department is subrogated to any rights that the responsible persons may have to obtain reimbursement from a third party or insurance carrier for the cost of medical assistance provided for such dependents or persons. When the state department gives written notice of subrogation, any third party or insurance carrier liable for reimbursement for the cost of medical care shall accord to the state department all rights and benefits available to the responsible relative that pertain to the provision of medical care to any persons entitled to medical assistance pursuant to this article 4 and articles 5 and 6 of this title 25.5 for whom the relative is legally responsible.
(8) All members of medical assistance under the medicaid program are deemed to have authorized the member's attorneys, all third parties, including but not limited to insurance companies, and providers of medical care to release to the state department all information needed by the state department to secure and enforce its rights under subsections (4) and (5) of this section.
(9) Nothing in part 6 of article 4 of title 10 limits the right of the state department to recover the medical assistance furnished to or on behalf of a member as the result of the negligence of a third party.
(10) No action taken by the state department pursuant to subsection (4) of this section or any judgment rendered in the action bars any action upon the claim or cause of action of the applicant or member or the member's guardian, personal representative, estate, dependent, or survivors against the third party having legal liability, nor shall any action or judgment operate to deny the applicant or member the recovery for that portion of the member's medical costs or other damages not provided as medical assistance under this article 4 or article 5 or 6 of this title 25.5.
(11)
1. (a) The state department may recover any amount of medical assistance paid on behalf of a member because:
  1. (I) The trustee of a trust for the benefit of the member has used the trust property in a manner contrary to the terms of the trust; or
  2. (II) A person holding the member's power of attorney has used the power for purposes other than the benefit of the member.
2. (b) To enforce the right under this subsection (11), the county or state department may institute or intervene in legal proceedings against the trustee or person holding the power of attorney. Any amount of medical assistance recovered pursuant to this subsection (11) shall be distributed between the state and county in proportion to the amount of medical assistance paid by each respectively, if any.
3. (c) No action taken by the county or state department pursuant to this subsection (11) or any judgment rendered in an action or proceeding bars any action upon the claim or cause of action of the member or the member's guardian, personal representative, estate, dependent, or survivors against the trustee or person holding the power of attorney.
(12)
1. (a) An entity that provides managed care, as defined in section 25.5-5-403, that has entered into a risk contract with the state department shall have the same rights of the department set forth in this section except with respect to the rights described in subsections (5) and (6) of this section. In addition, the attorney general may not enforce the rights set forth in this subsection (12). Venue for an action brought by or on behalf of an entity pursuant to this subsection (12) shall be governed by the Colorado rules of civil procedure.
2. (b) Within fifteen days after filing an action or asserting a claim against a third party, a member under a managed care plan or a guardian, executor, administrator, or other appropriate representative of the member shall provide to the entity that administers the managed care plan written notice of the action or claim. Notice must be by personal service or certified mail.
3. (c) In cases where the state department has recovery rights against a third party pursuant to subsections (4) and (5) of this section and an entity that provides managed care has subrogation rights against the same party pursuant to paragraph (a) of this subsection (12), the recovery rights of the state department shall take precedence over the rights of the managed care plan.
(13) To the extent allowable under federal law, the state department shall recover from the sponsor of a lawfully residing individual all medical assistance paid on behalf of the sponsored lawfully residing individual who is enrolled in the medical assistance program.
(14) Notwithstanding any provision of this section to the contrary:
1. (a)
  1. (I) The state department, or the state department's designated agent, shall conduct pre-enrollment and post-enrollment site visits of providers who are designated as moderate or high categorical risks to the medicaid program. The purpose of the site visit is to verify that the information submitted to the state department is accurate and to determine compliance with federal and state enrollment requirements.
  2. (II) As established in rules promulgated by the state board, the state department may waive pre-enrollment and post-enrollment site visits of providers if the site visits are conducted by medicare or other federally designated entities.
  3. (III) A provider is designated as a limited, moderate, or high categorical risk pursuant to the medicare program and federal regulations. If a provider is not designated in a risk category pursuant to the medicare program and federal regulations, the provider's risk category shall be established pursuant to rules promulgated by the state board.
2. (b) A provider enrolled in the medicaid program shall permit the federal centers for medicare and medicaid services or its agent or designated contractors and the state department or its agent to conduct unannounced, on-site inspections of any and all provider locations. Payment for any agent designated by the state department to perform on-site inspections shall not be based on any recoveries paid to the state department by a provider for violations discovered as a result of the on-site inspection.
(15)
1. (a) The state department may request a written response from any provider who fails to comply with the rules, manuals, or bulletins issued by the state department, state board, or the state department's fiscal agent, or from any provider whose activities endanger the health, safety, or welfare of medicaid members. The written response must describe how the provider will come into and ensure future compliance. If a written response is requested, a provider has thirty days, or longer if approved by the state department, to submit the written response.
2. (b) If the provider does not agree with the state department's findings that resulted in the request issued pursuant to subsection (15)(a) of this section, then the provider's written response must include an explanation and specific reasons for the provider's disagreement.
(16)
1. (a) The state department may suspend the enrollment of a provider, including a children's basic health plan provider, only if:
  1. (I) The state department identifies that the provider is participating in an alleged and ongoing organized crime or organized fraud scheme that impacts the state medical assistance program, this article 4 and articles 5 and 6 of this title 25.5, or the children's basic health plan, article 8 of this title 25.5; and
  2. (II) The state department documents in writing that at least three of the following factors are met:
    1. (A) The provider has been enrolled in the state medical assistance program or children's basic health plan for less than three years;
    2. (B) At least three providers are involved in the organized crime or organized fraud scheme;
    3. (C) The collective billing amount identified in the organized crime or organized fraud scheme exceeds one million dollars;
    4. (D) The provider's billing indicates a pattern of abuse or noncompliance;
    5. (E) The volume of claims or billing amount has increased at a significant rate and there is no other reasonable explanation for the increase;
    6. (F) The federal centers for medicare and medicaid services has approved a provider enrollment moratorium for the provider type involved in the organized crime or organized fraud scheme; or
    7. (G) The state department has notified law enforcement of the organized crime or organized fraud scheme.
2. (b) The state department shall notify the provider of the suspension in writing and include the reasons for the suspension.
3. (c) The state department may suspend a provider's enrollment pursuant to subsection (16)(a) of this section for an initial period of six months while the state department conducts a review of the organized crime or organized fraud scheme. After the state department's review is complete, regardless of whether the six-month period has ended, the state department must reinstate the provider's enrollment if the state department determines the provider did not engage in an organized crime or organized fraud scheme. If the state department's review cannot be completed during the initial six-month period, the state department may extend the review period in additional six-month increments if the state department documents in writing the necessity for extending the review.
4. (d) As used in this subsection (16):
  1. (I) Organized crime or organized fraud scheme means a provider is allegedly participating in a coercive, fraudulent, extortionary, criminal, or otherwise illegal coordinated scheme or operation that repeatedly or consistently defrauds the state medical assistance program or children's basic health plan that may put members' health, safety, or welfare at immediate risk.
  2. (II) Suspend means temporarily prohibiting a provider from participating in the state medical assistance program or children's basic health plan, from rendering services or supplies to a member, and from submitting claims to the state department for any services or supplies rendered to a member.
5. (e) This section does not apply to a provider that has been enrolled in the state medical assistance program, including the children's basic health plan, for three years or more and that has consistently rendered services and received payment for those services during the provider's enrollment.

Source: L. 2006: Entire article added with relocations, p. 1829, § 7, effective July 1; (1)(a)(II.5) added, p. 107, § 1, effective January 1, 2007. L. 2007: (3)(a)(IV) and (3)(a)(VII) amended and (3)(a)(IV.5), (3)(a.5), and (3.5) added, pp. 1467, 1469, 1468, §§ 1, 3, 2, effective May 30. L. 2009: (5)(a) and (5)(c) amended, (HB 09-1191), ch. 100, p. 372, § 1, effective August 5. L. 2010: (2)(a)(II) amended, (SB 10-167), ch. 296, p. 1378, § 7, effective May 26. L. 2013: (14) added, (HB 13-1068), ch. 119, p. 405, § 1, effective April 8. L. 2017: (1)(a)(II.5)(A) and (1)(a)(II.5)(B) amended and (1)(a)(II.5)(A.5), (1)(a)(II.5)(D), and (15) added, (HB 17-1139), ch. 376, p. 1942, § 2, effective June 6. L. 2018: IP(2), IP(3)(a), and (3)(a)(IV) amended, (SB 18-092), ch. 38, p. 444, § 110, effective August 8. L. 2021: (2)(d) repealed, (SB 21-055), ch. 12, p. 78, § 14, effective March 21; (3)(a)(IV) amended, (SB 21-022), ch. 167, p. 931, § 1, effective September 7. L. 2022: (13) amended, (HB 2-1289), ch. 399, p. 2841, § 13, effective June 7; (1)(b) amended, (HB 22-1295), ch. 123, p. 848, § 76, effective July 1. L. 2023: (3)(a)(IX), (3.5)(c), and (3.7) added, (HB 23-1295), ch. 299, p. 1801, § 2, effective June 1; (14)(b) amended, (HB 23-1301), ch. 303, p. 1829, § 46, effective August 7. L. 2024: (16) added, (HB 24-1146), ch. 5, p. 10, § 1, effective February 20; (1), (2)(a)(II), (4), (5), (6), (7), (8), (9), (10), (11)(a), (11)(c), (12)(b), and (15)(a) amended, (SB 24-176), ch. 152, p. 633, § 31, effective August 7. L. 2025: (3)(a)(IX) repealed, (3.3) added, and (3.5)(c) amended, (SB 25-314), ch. 384, p. 2128, § 1, effective August 6.

Editor's note: (1) This section is similar to former § 26-4-403 as it existed prior to 2006.

(2) Subsection (1)(a)(II.5) was enacted as § 26-4-403 (1)(a)(II.5) in House Bill 06-1079 but was relocated due to its harmonization with this section as it appeared in Senate Bill 06-219.

(3) Subsection (3.5)(b)(II) provided for the repeal of subsection (3.5)(b), effective July 1, 2011. (See L. 2007, p. 1468.)

(4) Subsection (3.7)(c) provided for the repeal of subsection (3.7), effective July 1, 2025. (See L. 2023, p. 1801.)

Cross references: For the legislative declaration in SB 10-167, see section 1 of chapter 296, Session Laws of Colorado 2010. For the legislative declaration in HB 17-1139, see section 1 of chapter 376, Session Laws of Colorado 2017. For the legislative declaration in SB 18-092, see section 1 of chapter 38, Session Laws of Colorado 2018. For the legislative declaration in HB 22-1289, see section 1 of chapter 399, Session Laws of Colorado 2022. For the legislative declaration in HB 23-1295, see section 1 of chapter 299, Session Laws of Colorado 2023.