Senate Bill 25-314

BY SENATOR(S) Kirkmeyer and Bridges, Amabile, Catlin, Frizell, Lundeen, Mullica, Snyder;

also REPRESENTATIVE(S) Bird and Sirota, Taggart, Boesenecker, Brown, Lindstedt.

Concerning changes to the recovery audit contractor program, and, in connection therewith, making and reducing an appropriation.

Be it enacted by the General Assembly of the State of Colorado:

SECTION 1.  In Colorado Revised Statutes, 25.5-4-301, amend (3.5)(c); repeal (3)(a)(IX); and add (3.3) as follows:

25.5-4-301.  Recoveries - overpayments - penalties - interest - adjustments - liens - review or audit procedures - cash fund - rules - definitions - repeal. (3) (a)  A review or audit of a provider is subject to the following procedures:

(IX)  For audits conducted pursuant to 42 CFR 455.506, at least quarterly, the state department shall publish on its website an audit activity report detailing current and recently completed audits and reviews and summaries of the findings of such audits and reviews, including the number and amounts of overpayments and underpayments found, the number and results of appeals, the amounts collected, and the error rates identified. At least quarterly, the state department shall conduct trainings for providers and hold stakeholder meetings regarding audits and reviews. In addition, when the state department enters into contracts pursuant to this subsection (3)(a), the state department shall publish on its website a copy of the contract, scope of work, and information regarding supervision of contractor deliverables.

(3.3) (a)  As used in this subsection (3.3), unless the context otherwise requires:

(I)  "Automated audit" means a RAC audit that reviews a provider's application of coding rules and does not require a provider to submit medical records to be audited.

(II)  "Complex audit" means a RAC audit that requires a provider to submit medical records to be audited, which are individually reviewed by a representative of the state department or the state department's RAC vendor.

(III)  "Denial rate" means the percentage of reviewed claims ultimately determined to involve improper payments after all administrative processes are complete, including the resolution of an appeal.

(IV)  "RAC audit" means a recovery audit contractor audit conducted pursuant to the federal "Social Security Act", 42 U.S.C. sec. 1396a (a)(42)(B).

(V)  "RAC vendor" means a vendor who meets the requirements of 42 CFR 455.508 and contracts with the state department to perform recovery audit contractor audits of providers on behalf of the state department.

(b)  The state department may solicit the services of a RAC vendor through a contract issued pursuant to the "Procurement Code", articles 101 to 112 of title 24, and pursuant to the federal requirements detailed in 42 CFR 455.508, for the purpose of conducting RAC audits of providers to identify possible medicaid overpayments and underpayments.

(c) (I)  The contract described in subsection (3.3)(b) of this section must state that the RAC vendor's compensation is contingent upon the amount of overpayments the state recovers from a provider. At the expiration of the current contract between the state department and the RAC vendor, the state department shall establish contingency fee rates based on market rates determined by the results of a competitive procurement process and may negotiate lower rates as the market provides, with contingency rates not to exceed sixteen percent of recovered payments. The state department shall ensure that the contingency fee requirements are adhered to through effective monitoring and enforcement of the RAC vendor's performance. For contracts entered into after the expiration of the contract that established contingency fee rates for RAC vendor payments, the state department shall structure the RAC vendor compensation based on a tiered payment system that corresponds to the required work unless doing so conflicts with federal directives in medicaid guidance pursuant to 42 CFR 455, subpart F, or results in an unfavorable impact to the state's general fund.

(II)  When the state department enters into a contract pursuant to subsection (3.3)(b) of this section, the state department must publish on its website a copy of the contract, scope of the work, and information regarding supervision of contractor deliverables.

(III)  The contract described in subsection (3.3)(b) of this section must require the RAC vendor to:

(A)  Conduct informal conferences or phone calls with providers or provider associations to discuss the RAC program, processes, and findings;

(B)  Conduct provider outreach and education activities, including notifying providers of audit policies, protocols, and common billing errors;

(C)  Respond to provider questions and requests for information within two business days after receiving the question or request for information;

(D)  Return, within thirty days, the contingency fee associated with inaccurate audit scenarios that resulted in provider refunds as prescribed by the state department; and

(E)  Provide preliminary RAC audit findings to a provider within a reasonable period following receipt of any requested medical records, as determined by the state department in collaboration with the provider advisory group, created in subsection (3.5)(c)(I) of this section.

(d)  The RAC contract described in subsection (3.3)(b) of this section may include an option to pay the RAC vendor to identify underpayments for consideration in future state department budget requests.

(e) (I)  The state department shall implement a process to verify that the RAC vendor's staff who make clinical RAC audit findings are appropriately licensed pursuant to industry standards and federal requirements, including that the RAC vendor hire qualified coders and that the RAC vendor's staff who make billing RAC audit findings have knowledge of medicaid billing and coding rules and guidance adopted by the state department.

(II)  The state department must ensure that qualified coders have relevant credentials for the type of medical services being reviewed, in accordance with industry standards.

(III)  Any complex audit that requires a review of medical records must be conducted by licensed clinical staff with training and competency in the specific type of complex audit being conducted, in accordance with industry standards. Providers must make all relevant medical records and information related to claims reviewed during the complex audit available to the RAC vendor within the time limits specified in the initial medical records request.

(IV)  The state department shall fully inform the RAC vendor of any changes to the state billing standards and ensure that the vendor only applies billing standards that were in effect at the specified date of service. The state department is responsible for monitoring compliance with this requirement and taking appropriate action to ensure the RAC vendor's compliance.

(V)  The state department shall ensure that the RAC vendor complies with the contract requirements described in subsection (3.3)(b) of this section and conducts RAC audits in a fair and consistent manner.

(VI)  The state department shall ensure that the RAC vendor incorporates into each audit scenario, whether an automated audit or a complex audit, the following information:

(A)  Federal statutes and billing rules and standards that are applicable to the specific provider during the specified dates of service for each audit;

(B)  State statutes, billing rules and standards, and policies as documented in the state department's provider billing manuals and provider bulletins, as well as in program guidance and directives effective for the specific provider during the specified dates of service for each audit; and

(C)  Input from the state department's RAC staff and medical director, as well as any other necessary state department staff based on the staff's or medical director's review of the audit scenario.

(VII)  When auditing claims to make RAC audit findings, the state department must ensure that the RAC vendor follows all relevant and appropriate federal billing guidelines, requirements set by the medicaid billing manual, standard clinical guidelines, and any other applicable state or federal rules and regulations.

(f)  The state department shall comprehensively review all audit types proposed by the RAC vendor and must approve, adjust, or reject each audit type before the RAC vendor conducts the RAC audit. Within eighteen months of the rollout of a new audit, if the state department, in collaboration with providers and the provider advisory group created in subsection (3.5) of this section, determines that the audit is inaccurate, the state department must refund providers who submitted repayments based on inaccurate audit findings and require the RAC vendor to return the contingency fee associated with the payments within thirty days.

(g)  The state department shall regularly review active RAC audits to ensure compliance with federal and state regulation changes and policy updates and discontinue a RAC audit if and when appropriate due to a change in federal or state regulation or policy updates.

(h)  Consistent with 42 CFR 455.508 (f), RAC audits and reviews conducted pursuant to this section must not review claims more than three years after the expiration of the timely filing period. The state department may conduct a RAC audit for a claim filed more than three years after the expiration of the timely filing period if required by a federal audit that would otherwise result in costs to the general fund or, if directed by the federal centers for medicare and medicaid services, the United States department of health and human services, or any other federal agency. If a RAC audit is initiated in response to a federal directive, the state department must provide notice to an impacted provider and include the reason for the RAC audit and any relevant information about the federal requirement in the notice.

(i) (I)  The RAC vendor shall not require a provider to undergo more than three complex audits per calendar year. Hospitals must be grouped for complex audits based on their total medicaid reimbursement in the previous fiscal year, and groupings must be determined using state data and published annually by the state department.

(II)  The maximum number of medical record requests a provider may receive each month must be clearly communicated to providers and reviewed annually by the state department. The RAC vendor shall not request more than the following number of medical records per hospital per month:

(A)  Six hundred for hospitals with over two hundred fifty million dollars in medicaid revenue;

(B)  Four hundred for hospitals with between seventy million dollars and two hundred forty-nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;

(C)  Two hundred for hospitals with between forty million dollars and sixty-nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;

(D)  One hundred for hospitals with between twenty million dollars and thirty-nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;

(E)  Fifty for hospitals with between ten million dollars and nineteen million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;

(F)  Twenty-five for hospitals with between one million dollars and nine million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue;

(G)  Twenty for hospitals with under one million dollars in medicaid revenue; and

(H)  Ten for out-of-state facilities.

(III)  The requirements of this subsection (3.3)(i) do not apply if:

(A)  Federal medicaid directives required pursuant to 42 CFR 455, subpart F, require a higher level of claim audits;

(B)  An agency of the federal government requires, in writing, the state department to initiate additional audit activity; or

(C)  A federal audit identifies additional provider findings that impact the state general fund and that should be appropriately recovered from that provider through an additional RAC audit and its recoupments.

(j) (I)  The RAC vendor shall not require a provider to undergo more than four automated audits per calendar year. Providers must be grouped for automated audits based on their total medicaid reimbursement in the previous fiscal year, and groupings must be determined using state data and published annually.

(II)  The maximum number of provider claims across all of a provider's locations for a given calendar year that undergo automated audits must not exceed:

(A)  2.92 percent for providers with over ten million dollars in medicaid revenue;

(B)  2.50 percent for providers with between four million dollars and ten million dollars in medicaid revenue;

(C)  2.08 percent for providers with between one million dollars and three million nine hundred ninety-nine thousand nine hundred ninety-nine dollars in medicaid revenue; and

(D)  1.67 percent for providers with less than one million dollars in medicaid revenue.

(III)  After the administrative process is exhausted, if the state department identifies a denial rate of forty percent or higher for a specific provider on a specific audit type, the state department shall audit no more than an additional twenty-five percent of the claim percentages stated in subsection (3.3)(j)(II) of this section associated with that audit type.

(IV)  The requirements of this subsection (3.3)(j) do not apply if:

(A)  Federal medicaid directives required pursuant to 42 CFR 455, subpart F, require a higher level of claim audits;

(B)  An agency of the federal government requires, in writing, the state department to initiate additional audit activity; or

(C)  A federal audit identifies additional provider findings that impact the state general fund and that should be appropriately recovered from that provider through an additional RAC audit and its recoupments.

(k)  When conducting audits, the RAC vendor must:

(I)  Request provider records that are relevant to the claims being audited and that do not duplicate information already provided;

(II)  Not audit the validity of a provider's prior authorization received from the state department; and

(III)  For a complex audit, not audit claims that are on the federal centers for medicare and medicaid services inpatient-only list at the date of service for a level-of-care determination.

(l) (I)  If the RAC vendor identifies preliminary findings during the RAC audit, the RAC vendor must send the provider a notice of preliminary audit findings detailing the preliminary findings, the rationale for the preliminary findings, and the methodology for how the dollar amounts associated with the preliminary findings were calculated and determined.

(II)  For a complex audit, a provider may request an exit conference to discuss the preliminary findings with the RAC vendor and the state department medical director, or the state department medical director's designee, prior to participating in an informal reconsideration. The provider may provide additional information supporting the provider's claims at the exit conference. A provider must request an exit conference no later than thirty days after the provider receives a notice of preliminary audit findings from the RAC vendor, and if an exit conference is requested, the state department or the RAC vendor must schedule the exit conference within sixty days of receiving the request and on a mutually agreed upon date and time.

(III)  Within thirty days of the exit conference, the state department must notify the provider on whether the state department will dismiss the preliminary findings or will issue a notice of informal reconsideration. The notice of informal reconsideration must include details on the preliminary findings, the rationale for the preliminary findings, and the methodology for how the dollar amount associated with the preliminary findings were calculated and determined. If an exit conference occurred, the notice must include information on why the state department did not agree with the provider's approach.

(IV)  Unless the preliminary findings are accepted by the provider, dismissed by the state department following an exit conference, or the period for a provider to request an exit conference has expired, a provider who receives a notice of preliminary findings, the state department, and the RAC vendor must participate in an informal reconsideration before the provider may formally appeal the state department's determination. To participate in an informal consideration, the following requirements must be satisfied:

(A)  Within sixty days of receiving the notice of informal reconsideration, the provider must submit all medical records relevant to the claims and the reasoning for the provider's disagreement concerning the preliminary audit findings. The medical records must substantiate the provider's argument to dispute any preliminary findings to allow the state department and the RAC vendor to reconsider the findings, and the department and the RAC vendor must review medical records prior to the informal reconsideration meeting;

(B)  The state department must schedule an informal reconsideration meeting between mutually agreed upon participants from the state department, RAC vendor, and provider representatives at a mutually agreed upon date and time within ninety days of issuing the notice of informal reconsideration, although either party may request a sixty-day extension; and

(C)  All agreed upon attendees must participate in the informal reconsideration meeting in good faith in an effort to resolve the dispute.

(V)  If a claim remains in dispute after the informal reconsideration meeting, the state department must issue a notice of adverse action within sixty days of the informal reconsideration meeting. The notice of adverse action must include the basis of the alleged overpayment, the rationale for the alleged overpayment, the methodology used to calculate the alleged overpayment, and information on why the state department did not agree with the provider's approach.

(VI)  Within thirty days of receiving a notice of adverse action, the provider may request a formal appeal, which must include an explanation of the basis of the appeal in accordance with rules adopted by the state department.

(VII)  The state department must not recover an overpayment identified in the preliminary findings from a provider until the informal reconsideration process, and subsequent formal appeal, if filed, are complete.

(VIII)  If the state department has not issued a notice of adverse action one hundred twenty days following the informal reconsideration meeting, the state department waives its right to recover the state share of the overpayment.

(m)  Providers are subject to all state and federal medicaid fraud, waste, and abuse laws and must comply with all applicable program integrity requirements. Failure to comply may result in removal from the state medical assistance program, financial penalties, civil lawsuits, or criminal prosecution pursuant to 42 U.S.C. sec. 1320a-7k(d), 42 U.S.C. sec. 1320a-7, 31 U.S.C. secs. 3729-3733, sections 24-31-808, 25.5-4-301, 25.5-4-303.5 to 25.5-4-310, and 10 CCR 2505-10, sec. 8.076. By participating in the medical assistance program, providers acknowledge and accept their obligation to adhere to all state and federal laws governing medicaid fraud, waste, and abuse, and program integrity.

(n) (I)  The state department shall publish and maintain on its website a RAC audit activity report for each RAC audit and review completed in the preceding year summarizing the findings of those RAC audits and reviews. The information posted on the state department's website concerning each RAC audit must include the following information:

(A)  A summary of the audit scenario, the state department's billing practices, and policy guidelines being reviewed by the RAC vendor;

(B)  The error rates identified during the RAC vendor's review;

(C)  The number and amounts of overpayments and underpayments identified by the RAC vendor;

(D)  The recoveries collected by the state department on identified overpayments;

(E)  The number of claims appealed as a result of the audit; and

(F)  Details on the audit scenarios and billing standards used by the RAC vendor and policy guidance on proper billing practices.

(II)  In addition to the information required by subsection (3.3)(n)(I) of this section, the state department shall publish and maintain on its website information on the number of informal reconsideration meetings the state department participated in and the associated percentage of findings that were upheld, the number of appeals, and corresponding determinations.

(o)  On or before January 1, 2026, the state department shall publish on its website provider education information; resources to assist providers in understanding the state department's medicaid billing manual and rules; and procedures related to RAC audits, including documentation requirements and the process for resolving disputes.

(p)  At least quarterly, the state department shall:

(I)  Conduct medicaid billing training for providers and hold meetings with providers to gather feedback on the RAC audit process. The state department shall publish meeting dates and times on the state department's website at least two weeks prior to the meetings.

(II)  Conduct trainings for providers and hold stakeholder meetings regarding audits and reviews, during which the state department and RAC vendor must identify common billing errors identified by the RAC vendor in the previous quarter and provide clarification on the billing errors.

(q)  The state department shall work with small or rural providers in order to identify and implement opportunities to reduce administrative burdens and better support compliance with medicaid billing practices, as adopted in the state department's medicaid billing manual, and experience with RAC audits.

(r)  The state department must submit an annual report to the joint budget committee that includes a description of the following:

(I)  The divisions of the state department that are included in the review and approval of RAC audit scenarios and the roles and responsibilities of each division;

(II)  The RAC vendor's compliance with the response requirement described in subsection (3.3)(c)(III)(C) of this section;

(III)  The state department's oversight and enforcement of the contractual requirement that the RAC vendor conduct informal conferences or phone calls with providers or provider associations to discuss the RAC program, appeal processes, and findings;

(IV)  The training materials prepared by the RAC vendor after each RAC audit that identify and address the common errors and issues identified during the audit and the content and materials the RAC vendor used to educate providers to prevent errors in the future;

(V)  A summary of the RAC vendor's outreach and education activities;

(VI)  A summary of the state department's written policies, procedures, and guidance that establish processes for the state department to log provider communications, provide direction on how state department staff must respond to communications in a timely and relevant manner, and how the state department instituted routine analysis of provider communications to inform decisions on program improvements; and

(VII)  The total amount of alleged overpayments identified by the RAC vendor, the proportion of those overpayments that were recovered, and the total amount paid to the RAC vendor.

(s)  All recoveries collected by the state department on identified overpayments pursuant to this subsection (3.3) must be transmitted to the state treasurer, who shall credit the same to the recovery audit contractor recoveries cash fund, which fund is created in the state treasury and referred to in this subsection (3.3)(s) as the "cash fund". The cash fund consists of money credited to the cash fund pursuant to this subsection (3.3) and any other money that the general assembly may appropriate or transfer to the cash fund. Subject to annual appropriation by the general assembly, the state department may expend money from the cash fund to offset the need for appropriations for medical services and to pay the RAC vendor. The state treasurer shall credit all interest and income derived from the deposit and investment of money in the recovery audit contractor recoveries cash fund to the cash fund.

(t)  The state department may adopt rules, as necessary, to implement the requirements of this subsection (3.3).

(3.5) (c) (I)  The state department shall create a provider advisory group for recovery audits consisting of employees of the state department and members from different provider groupstypes, including physicians, hospitals, and any other provider types directly impacted by audits conducted pursuant to this section, appointed by the executive director. The provider advisory group shall meet at least quarterly to review quarterly activity reports required by subsection (3)(a)(IX)subsection (3.3)(n) of this section and advise the state department on issues providers experience with audits of the recovery audit contractors program.

(II)  The state department and the RAC vendor shall provide the provider advisory group with the opportunity to review RAC audit scenarios during the provider advisory group's quarterly meetings.

(III)  The state department shall give providers the opportunity to anonymously describe RAC audit scenarios they are experiencing and ask questions about billing practices. The state department shall include RAC vendor staff and the relevant state department division staff in these discussions. If the discussions lead the state department to determine that an audit scenario was inaccurate, the state department must work with the RAC vendor to rescind the RAC audit.

SECTION 2.  Appropriation adjustments to 2025 long bill. (1)  To implement this act, appropriations made in the annual general appropriation act for the 2025-26 state fiscal year to the department of health care policy and financing for medical and long-term care services for medical-eligible individuals are adjusted as follows:

(a)  The cash funds appropriation from recoveries and recoupments is decreased by $20,900,588;

(b)  The cash funds appropriation from the recovery audit contractor recoveries cash fund created in section 25.5-4-301 (3.3)(s), C.R.S., is increased by $20,900,588.

SECTION 3.  Act subject to petition - effective date. This act takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly; except that, if a referendum petition is filed pursuant to section 1 (3) of article V of the state constitution against this act or an item, section, or part of this act within such period, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2026 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.