TL;DR: In July 2026, the federal Office of Inspector General reported that an estimated 52 percent of Colorado's Medicaid personal care claims had Electronic Visit Verification compliance problems, and recommended the state refund $8.1 million with another $45.7 million set aside. Colorado disputed most of the findings, but five of the six recommendations land on providers rather than the state, which means agencies should expect tighter rules on manual entries, exception review, and documentation. We built Ankota's EVV workflow around catching those problems before submission rather than after a denial, and the checks below are the ones we would run first.
Most compliance articles start with a warning. This one starts with a number that should be reassuring and is not.
When federal auditors pulled 160 Colorado personal care claims and looked at them closely, they found that 91 of them had at least one Electronic Visit Verification problem. Extrapolated across the state's 1.3 million claim lines, that is roughly 682,947 claims, or 52 percent. Not 5 percent. Not 15. More than half.
The reassuring part is that the auditors did not find widespread fraud. They found paperwork and system gaps. The unreassuring part is that in Medicaid, paperwork gaps and fraud produce the same result when someone comes asking for records you cannot produce.
The OIG found that Colorado implemented an EVV system but did not verify that all personal care visits were actually recorded and verified in it. Of 160 sampled claim lines, 91 had at least one EVV compliance issue, and 39 were at least partially unallowable. The audit covered state fiscal year 2024, July 2023 through June 2024, and the full report is published on the OIG website as A-07-24-03260.
The EVV problems broke down into four categories. Sixty-two claim lines involved visits that were manually entered rather than captured live. Seventeen involved visits billed to Medicaid that were never entered into the EVV system at all. Sixteen had no documented service location. And sixteen had GPS exceptions that were flagged by the system and never reviewed or corrected.
Those four categories are worth memorizing, because they are the checklist. Every one of them is something an agency can measure in its own data this week.
Colorado's disagreement makes the situation more urgent for agencies, not less, because the state's cheapest path to closing the findings is to push verification duties onto providers rather than write a check. HCPF's public response disputed the sampling methodology and stated that the audit "does not demonstrate that payments were made for services that were not authorized or not rendered." Bonnie Silva, director of the Office of Community Living, told the Colorado Sun the sample was too small to represent 1.3 million claims.
Read the rest of that same response, though. The state also described corrective measures already underway: strengthened documentation expectations, EVV system remediation, provider monitoring, and additional prepayment safeguards. Three of those four are things that happen to agencies, not to the state.
This is the pattern we have watched play out in state after state. A state gets audited, disputes the dollar figure, and simultaneously tightens the controls that generated the finding. The dispute takes years. The controls arrive next quarter.
Of the six recommendations the OIG made, five require action at the provider level: limit manual entries, verify that every billed visit has a matching EVV record, capture and document service location, review and correct GPS exceptions, monitor reason code use, and confirm that the attendant named on the EVV record matches the one who signed the timesheet. Colorado agreed or partially agreed with six of the seven parts of that recommendation. The only part it rejected outright was the cap on manual entries.
Manual entries are the biggest risk because they are the largest single finding in the audit, they are currently unlimited in Colorado, and they are the easiest thing for the state to restrict with a system edit. Sixty-two of the 91 flagged claim lines involved manual entry, and the OIG's assessment was blunt: "Manual entries are not real-time verifications, and their use increases the risk that services were either inaccurately recorded or were not actually provided."
Two examples from the report show how far this drifts in practice. On one claim line, all seven EVV visits were manual, so the auditors pulled a full year of records for that same client and found that all 185 EVV records were manual entries. On another, 58 verified visits had all been entered under reason code 2, "staff forgot to clock in/out."
Nobody sets out to run an agency that way. It happens one shortcut at a time. A caregiver's phone dies, the office enters the visit, and the workaround becomes the workflow.
HCPF's own EVV Program Manual already states that the best practice is to collect EVV at the time of service delivery. There is currently no threshold enforcing that. The OIG has now told Colorado to add one, and the state's own remediation language points the same direction.
The practical move is to pull your manual entry percentage for last month before anyone asks you for it. Under 5 percent is healthy. Over 20 percent and we would start working on it now, while it is still a choice rather than a denial. Usually the root cause is one of three things: caregivers without reliable phones, clients whose service location moves, or an app annoying enough that people give up and call the office. All three are fixable.
In Colorado, it gets denied, and that has been true since February 1, 2022, when HCPF activated pre-payment claim review. Claims that do not match a verified EVV record do not pay. This is not a future risk for Colorado agencies, it is the current billing mechanic.
What surprised us in the audit was that the OIG still found 17 claim lines where one or more visits never made it into the EVV system. One claim line covered 29 dates of service and only 6 of those dates had a corresponding EVV record. According to the state, this can happen when claims contain multiple dates of service and the payment system does not match all the dates against EVV records before processing.
That is a reconciliation gap, and it is the kind of thing that only surfaces if someone is comparing what you billed against what you verified. If your EVV system and your billing system are separate products that talk to each other through exports, nobody owns that comparison. In Ankota, visits, EVV submissions, and claims live in the same record, so a billed visit without a verified EVV record is visible before the claim goes out rather than after the remittance comes back.
Agencies in Missouri learned this the hard way when MO HealthNet began denying any visit not properly registered in Sandata in April 2026. The lesson that transferred was simple: the moment EVV becomes a payment gate, your EVV data quality becomes your cash flow.
Colorado agencies should review and resolve GPS exceptions after the fact rather than blocking caregivers from clocking in, because HCPF explicitly prohibits geo-fencing and continual GPS tracking. This is where most national EVV advice is wrong for Colorado, and it is worth understanding before you follow a vendor's default recommendation.
The state's program manual is direct about it. HCPF will not accept visit data that includes continual GPS tracking during a visit, and it will not use geo-fencing to restrict where Health First Colorado services are delivered. Location is captured at the beginning and the end of a visit, and nowhere in between. The state also requires that a recorded location be uniquely identifiable. "Colorado State Capitol Building" is acceptable. "Doctor's office" is not.
At the same time, the OIG found 16 claim lines with GPS exceptions that were never reviewed. On one of them, all
So Colorado agencies are caught between two requirements: you cannot prevent an off-location clock-in, and you cannot ignore one. The answer is detection and review rather than prevention.
Here is how Ken describes the way we handle it:
In most states we do recommend geo-fencing a location. Colorado does not allow that, because of the privacy rules, so what we do instead is let the caregiver clock in from a location that is not within the geo-fence. But we still measure the distance and flag it to the office when they are not at one of the locations approved for that client. And an important thing to point out is that we allow a client to have multiple locations. If someone usually lives at their own home but sometimes spends time at their daughter's home, or gets picked up or dropped off at an adult day center, we handle all of those and treat them all as approved locations for that specific client.
That multiple-locations point is where a lot of EVV systems quietly fail Colorado agencies. Community visits are legitimate here. Doctor appointments, church, a park, a family member's house, an adult day program. A system that treats the client's home address as the only valid location will generate exceptions on perfectly compliant visits, which trains your office staff to dismiss exceptions as noise. Then the one exception that actually mattered gets dismissed along with the rest.
This is one of the places where working across home care and adult day services at the same time changes what you build. When you serve both, a client who gets picked up at 9 and dropped off at 3 is not an edge case in your data model, it is Tuesday.
The $8.1 million refund recommendation came mostly from documentation failures that have nothing to do with clock-in and clock-out. Of the 39 claim lines the OIG found at least partially unallowable, 23 involved missing or incomplete attendant background screening documentation, 14 involved units of service that exceeded what the plan of care authorized, 8 involved rates above the state-approved rate, and 4 involved a missing Attendant Support Management Plan.
Colorado requires attendants to clear a Colorado Bureau of Investigation criminal history check, provider-directed attendants to clear a Colorado Adult Protective Services registry check, and all consumer-directed attendants to be checked against the federal exclusion list. State regulation has required the exclusion list check before employment since March 16, 2024. In the sampled claims, the state either could not produce that documentation or produced an incomplete version of it.
The auditors were precise about the consequence. For those 23 claim lines they questioned only the units delivered by the attendants whose screenings were incomplete, not the entire claim. Precise, and expensive anyway.
The through-line across the whole audit is that the state was trusting that providers had this handled and could not prove it when asked. If your EVV data, your plan-of-care authorizations, your caregiver credentials, and your billing live in four different places, you are the one holding that proof together by hand. That works right up until someone asks for a specific visit from 18 months ago.
Six things, and none of them require buying anything.
Pull your manual entry percentage for the last full month and look at which caregivers and which clients drive it. Compare a month of billed personal care visits against verified EVV records and count the ones that do not match. Open your GPS exception queue and see how old the oldest unresolved item is. Check whether your system supports more than one approved location per client, and if it does, whether anyone has actually entered the second address for the clients who need it. Spot-check five attendants for complete CBI, CAPS, and exclusion list documentation dated before their first shift. And compare units billed against units authorized on the plan of care for your ten highest-volume clients.
If all six come back clean, the audit is a news story for you rather than a warning. If two or three do not, you now know where to spend the next quarter, and you found out on your own terms.
We would add one more piece of context. Colorado is the second state in a planned OIG series of EVV audits. Kansas was first, in August 2024. The methodology that produced these findings is going to be applied in more states, which means the standard being set in Colorado is the standard your peers in other states will be held to next. Regulation follows growth, and EVV oversight is following the money into every state that runs a personal care benefit.
Every finding in this audit is something software can catch before a claim goes out, and that is where we have put our effort. Our AI Approval Assistant came directly out of solving this problem for a Denver agency. Colorado had tied payments to Sandata acceptance, and on the surface about 99 percent of that agency's visits showed as accepted. When we looked closer, Sandata was marking some visits as approved at the handshake and quietly rejecting them behind the scenes.
We dug in, analyzed every error, and decoded the hidden exception rules. From there we built the AI Approval Assistant to spot and fix those issues before submission. Now our agencies get real-time accuracy, seamless billing, and more than 99 percent first-time payments, without ever logging into Sandata.
That agency, run by Irina in Denver, now runs at 99.5 percent first-time Sandata payment acceptance with no disruption to billing or payroll cycles. Her caregivers include a lot of live-ins who speak Spanish, and while live-in caregivers do not require EVV in Colorado, they still have to record tasks, capture signatures, and submit before payroll, often across several services with different CPT codes in one day. We turned that into a single check-in at the end of the pay period.
If you want to see how this works for your own operation, our EVV software handles Colorado's provider choice model end to end, from the caregiver app through the Sandata submission to the claim. The EVV reference guide covers the broader compliance picture if you are earlier in the journey, and our overview of third-party EVV software explains why an open vendor state like Colorado gives you more choice than most agencies realize. When you are ready to talk through your specific situation, contact us and we will walk your workflow with you. Not a demo, a working session.
Colorado has required Electronic Visit Verification for Medicaid personal care services since August 2020, after receiving a one-year good-faith-effort extension from the January 2020 federal deadline set by the 21st Century Cures Act. EVV applies to services that require an in-home visit by an attendant. Live-in caregivers are treated differently, though they still have documentation and task-recording obligations before payroll.
Can Colorado agencies use their own EVV system instead of Sandata?Yes. Colorado runs an open vendor model, sometimes called a hybrid model. You can use the free state EVV solution or a provider choice EVV system from a vendor of your own, as long as that system meets the technical and program requirements and interfaces with Sandata. Many agencies find a provider choice system easier to live with because it can combine EVV with scheduling, documentation, and billing in one place rather than making staff work in two systems.
Does Colorado allow geo-fencing for EVV?No. HCPF explicitly states that it will not use geo-fencing to restrict the location of Health First Colorado service delivery, and it will not accept visit data that includes continual GPS tracking during a visit. Location is captured at the start and end of the visit only. This means Colorado agencies cannot block an off-location clock-in the way agencies in some other states do. The compliant approach is to allow the clock-in, measure the distance from the client's approved locations, and flag anything unexpected for office review.
What is a reason code in Colorado EVV?A reason code is a standard code established by HCPF that explains or acknowledges an exception on a visit record. Examples include staff forgot to clock in or out, wrong service selected, and manual entry of EVV. Exceptions must be resolved in Visit Maintenance, or through your provider choice vendor, before a record becomes a verified visit eligible for claim matching. The OIG specifically told Colorado to require providers to monitor reason code use and confirm codes are being applied appropriately, so expect more scrutiny here.
Do live-in caregivers need EVV in Colorado?Live-in caregivers do not require Electronic Visit Verification in Colorado, but that does not mean there is no compliance obligation. They still need to record the tasks they completed, obtain signatures, and get everything submitted before payroll, and a single day of care can involve several services billed under different CPT codes. Agencies that handle this on paper tend to lose time at every pay period, which is why we built a task-based end-of-period check-in for live-in staff.
Will Colorado home care agencies have to repay the $8 million the OIG identified?The refund recommendation was directed at the state agency, not at individual providers, and Colorado has said it will contest the disputed findings during settlement negotiations with CMS. Those negotiations can take years. The realistic exposure for an individual agency is not a share of that $8 million, it is the tighter provider requirements, prepayment safeguards, and monitoring the state adopts to prevent the next audit from producing the same result.
How do I handle a client who receives care in more than one location?Set up every legitimate location as an approved location for that client rather than treating the home address as the only valid one. Clients who split time between their own home and a family member's home, or who attend an adult day program, will otherwise generate exceptions on perfectly compliant visits. Colorado also requires that a location be uniquely identifiable, so "Colorado State Capitol Building" works and "doctor's office" does not. Ankota supports multiple approved locations per client and only flags a visit when the caregiver is outside all of them.
Ankota's mission is to enable the Heroes who keep older and disabled people living at home to focus on care because we take care of the tech. If you need software for home care, EVV, I/DD Services, Self-Direction FMS, Adult Day Care centers, or Caregiver Recruiting, please Contact Ankota. And if you're ready to see how the most innovative agencies are using AI to empower their caregivers and automate the rest, meet your new companion at www.kota.care.