Colorado Medicaid: RAC Program Overhauled with Enhanced Transparency, Greater Provider Protections, and Increased Oversight

In June 2025, Colorado passed a new law that makes significant changes to the state’s Medicaid Recovery Audit Contractor (RAC) program. Colorado has one of the most aggressive RAC programs in the country that has been rife with issues for years. The Colorado Department of Health Care Policy and Finance (Department) oversees the RAC program, under which the state contracts with a third-party vendor to review paid Medicaid claims, identify overpayments and underpayments, and recover any overpayments. 

Effective August 6, 2025, Senate Bill 25-314 (SB25-314) aims to improve the Colorado RAC program by: (1) reducing administrative burden, (2) improving audit fairness, (3) enhancing transparency, and (4) increasing oversight and accountability of RAC vendors and the RAC program. 

SB25-314 was designed in response to a May 2024 report published by the Colorado Office of the State Auditor, which found, among other things, that the RAC program imposed excessive administrative burdens on Medicaid providers and the Department needed to improve contract oversight and program management. 

Key Changes to the RAC Program 

Reduce Administrative Burden

• Providers may be subject to no more than three complex audits and four automated audits per calendar year. 
  • A “complex audit” means an RAC audit that requires a provider to submit medical records to be audited, which are then individually reviewed by the Department or an RAC vendor.
  • An “automated audit” means an RAC audit that reviews a provider’s application of coding rules and does not require a provider to submit medical records to be audited.
  • RAC audits may only review claims that are no more than three years past the expiration date of the timely filing period, unless a longer lookback period is required by a federal audit.
  • Medical record requests, which previously had no limitation, will be capped between 10-600 records based on a provider’s Medicaid revenue. For instance, an RAC vendor can request up to 600 medical records from a hospital with more than US$250 million in Medicaid revenue.

Improve Audit Fairness 

• If the RAC vendor identifies preliminary findings during an audit, it is required to send the provider a report within a reasonable time that details the preliminary findings, including the rationale and methodology used to calculate and determine overpayments.
• RAC vendors must offer an optional exit conference to providers following preliminary findings in complex audits to discuss the preliminary findings and to resolve concerns prior to undergoing an informal reconsideration of the preliminary findings.
• A provider must participate in an informal reconsideration before formally appealing an audit determination. The Department and RAC vendor are required to review a provider’s informal reconsideration submission prior to an informal reconsideration meeting.
• The Department may not recover alleged overpayments until the informal and formal appeal processes are complete.
• Audits must apply only the billing standards in effect at the time of service.

Enhance Transparency 

• The Department will be required to publish RAC contracts, scopes of work, and oversight responsibilities on its website.
• The Department will be required to publish RAC audit activity reports for each RAC audit and a summary of the findings for RAC audits completed the year prior.
• The Department must also publish the number of informal reconsideration meetings, the associated percentage of findings that were upheld, the number of appeals, and corresponding determinations.

Increase Contractor Oversight and Accountability 

• RAC vendor compensation will be capped at 16% of recovered payments, which are defined as the amount of overpayment recovered by the Department. The Department must ensure compliance with the cap through monitoring and enforcement of the RAC vendor’s performance.
• The Department must submit an annual report to the state’s Joint Budget Committee outlining audit activities, findings, and RAC vendor performance.
• By January 1, 2026, the Department must publish educational materials and guidance for providers to improve understanding and audit readiness and must conduct trainings for providers at least quarterly.
• The Department must verify that RAC vendor staff conducting audits are appropriately licensed pursuant to industry standards, including that the RAC vendor hire qualified coders and that the RAC vendor’s staff who make RAC audit findings have knowledge of Medicaid billing and coding rules and guidance adopted by the Department.
• The Department must monitor RAC vendor performance and enforce compliance with contract terms.

The passage of SB 25-314 represents a substantial update to Colorado’s RAC program. For Medicaid providers, the law aims to reduce administrative burden by limiting the number of audits and standardizing medical record requests, while also introducing procedural safeguards intended to promote fairness in the audit process. Increased transparency and reporting requirements may improve public visibility into RAC operations, and enhanced oversight of RAC vendors, and the RAC program, is designed to ensure greater accountability in how audits are conducted and overpayments are recovered.

If you are a Medicaid provider and have specific questions regarding the new changes to the RAC program, please reach out to the authors, your Foley relationship partner, our Health Care Practice Group, or our Health Care & Life Sciences Sector to discuss. 

Special thanks to Alina Mueller, a summer associate in Foley’s Denver office, for her contributions to this article.