Colorado § 10-16-122.5 - Pharmacy benefit manager - audit of pharmacies - time limits on on-site audits - enforcement - rules.

§ 10-16-122.5. Pharmacy benefit manager - audit of pharmacies - time limits on on-site audits - enforcement - rules.

(1) A pharmacy benefit manager, a carrier, or an entity acting on behalf of a pharmacy benefit manager or a carrier that audits a pharmacy shall:

(a) Give the pharmacy at least seven days' written notice prior to commencing an audit;

(b) Conduct the audit by or in consultation with a licensed pharmacist to the extent the audit requires the application of clinical or professional judgment;

(c) Not use extrapolation or other statistical expansion techniques in calculating the amount of a recoupment or penalty resulting from an audit of a pharmacy;

(d) Allow the pharmacy to produce additional claims documentation using any commercially reasonable method, including facsimile, mail, or electronic claims submission, if an audit results in the dispute or denial of a claim;

(e) Establish a written appeals process that includes procedures to allow a pharmacy to appeal to the pharmacy benefit manager or the carrier the preliminary reports resulting from the audit and any resulting recoupment or penalty;

(f) Not subject a pharmacy to the recoupment of funds when an audit results in the identification of a clerical error in a required document or record unless the error results in actual financial harm to the pharmacy benefit manager, a health benefit plan providing prescription drug benefits that are managed by the pharmacy benefit manager, or a consumer; and

(g) When subjecting a rural independent pharmacy to a recoupment of funds of more than one thousand dollars or a penalty of more than one thousand dollars as the result of an audit:

(I) Electronically notify the rural independent pharmacy of the rural independent pharmacy's rights to appeal pursuant to subsection (1)(e) of this section at least thirty days before the recoupment of funds;

(II) If the rural independent pharmacy does not respond to the electronic notification provided pursuant to subsection (1)(g)(I) of this section within thirty days after the electronic notification, again electronically notify the rural independent pharmacy of the rural independent pharmacy's rights to appeal pursuant to subsection (1)(e) of this section at least thirty days before the recoupment of funds; and

(III) If the rural independent pharmacy does not respond to the second electronic notification provided pursuant to subsection (1)(g)(II) of this section within thirty days after the second electronic notification, serve process on the rural independent pharmacy notifying of the rural independent pharmacy's rights to appeal pursuant to subsection (1)(e) of this section at least thirty days before the recoupment of funds.

(2) A pharmacy may use verifiable statements or records, including medication administration records of a nursing home, assisted living facility, hospital, physician, or other authorized practitioner, to validate the pharmacy record and delivery.

(3) Any legal prescription may be used to validate claims in connection with prescriptions, refills, or changes in prescriptions, including medication administration records, faxes, electronic prescriptions, or documented telephone calls from the prescriber or the prescriber's agent.

(4) The time period covered by an audit may not exceed twenty-four months from the date that the prescription was submitted to or adjudicated by the entity, unless a longer period is required by state or federal law.

(5) The time periods specified are waived for audits of pharmacy records when fraud or other intentional or willful misrepresentation is indicated through review of claims data, statements, physical review, or other investigative methods. The pharmacy benefit manager, carrier, or entity acting on behalf of the pharmacy benefit manager or carrier shall deliver to the pharmacy at the time of the audit a written or verbal explanation of the information that led to the conclusion that there is an indication of fraud or other intentional or willful misrepresentation. The explanation is not required if law enforcement has intervened due to the indication of fraud.

(5.5) Except under circumstances specified in subsection (5) of this section, on or after July 6, 2021, a pharmacy benefit manager, a carrier, or an entity acting on behalf of a PBM or a carrier shall not conduct an on-site audit of a pharmacy for which the PBM, carrier, or entity acting on behalf of a PBM or a carrier has conducted an on-site audit within the immediately preceding twelve months.

(5.7) With regard to the requirements of this section applicable to pharmacy benefit managers, the commissioner has the authority to enforce this section and to impose a penalty or other remedy against a pharmacy benefit manager that fails to comply with this section.

(5.9) The commissioner may adopt rules to implement and enforce this section.

(6) As used in this section, "pharmacy" includes any entity authorized under article 280 of title 12 to dispense prescription drugs.

Source: L. 2013: Entire section added, (HB 13-1221), ch. 118, p. 403, § 1, effective August 7. L. 2019: (6) amended, (HB 19-1172), ch. 136, p. 1655, § 47, effective October 1. L. 2021: (5.5) added, (HB 21-1297), ch. 452, p. 2993, § 4, effective July 6. L. 2023: (5.7) and (5.9) added, (HB 23-1227), ch. 160, p. 696, § 4, effective August 7. L. 2025: (1)(e) and (1)(f) amended and (1)(g) added, (HB 25-1222), ch. 259, p. 1329, § 5, effective August 6.

Cross references: For the legislative declaration in HB 21-1297, see section 1 of chapter 452, Session Laws of Colorado 2021. For the legislative declaration in HB 25-1222, see section 1 of chapter 259, Session Laws of Colorado 2025.