Regulatory watch
Colorado EVV requirements under rule 8.001
- 10 CCR 2505-10 § 8.001, the EVV rule, in the Secretary of State’s current text (version effective July 10, 2026)
- HCPF’s draft revision of the rule, updated July 22, 2026 and not yet adopted
- The EVV program manual (last updated July 1, 2026)
- The EVV FAQ (updated August 14, 2025)
- HCPF’s EVV page, its EVV overview and its page on EVV systems
One rule, one claim check, one proposal
Most of Colorado’s EVV program sits in a single rule. Claims have been checked against it for years, and HCPF has a revision out for comment.
| Layer | Where it stands | Scope | Source |
|---|---|---|---|
| The rule | In force since August 3, 2020. | Which services use EVV, the six data points, the two system routes and the limits. | § 8.001 |
| Claim check | Denials since February 1, 2022. | From February 1, 2022, claims missing an EVV record, or with an incomplete one, are denied (EOB 3054), per the Medicaid EVV manual’s quote of Operational Memo 21-075. | Program manual |
| Edit thresholds | Not set. | How many corrected records an agency may carry before an audit; for now, edited and hand-keyed visits are reviewed after payment. | Program manual |
| Draft revision | Proposed, not adopted. | Adds school-setting therapies and renames edited records “Modified EVV”. HCPF anticipates an effective date of March 2, 2027. | July 2026 draft |
Statuses reflect the sources as read on October 12, 2026.
The draft is the only moving part. HCPF took comments until September 1, 2026 and lists a public rule review meeting for November 11, 2026. HCPF expects it before the Medical Services Board on December 11, 2026. It anticipates that the changes will take effect March 2, 2027. Until the Board adopts it, the text in force is the one in the first row.
What rule 8.001 says, quoted
Four passages from the rule as read on October 12, 2026:
- On timing, section 8.001.3.C.1 as read on October 12, 2026: “All visit data points … must be completed at time of service delivery.”
- On hand entry, section 8.001.3.A.1.a.ii as read on October 12, 2026: “Manual Visit Entry must be used as the last alternative for recording the visit data.”
- On images, section 8.001.3.C.6.a: the department “will not allow or accept biometric data, pictures, video, or voice recordings to identify clients or substantiate Medicaid visit data.”
- On tracking, section 8.001.3.C.6.b: the department “will only accept location information at the beginning and/or end of a Medicaid visit.”
Sandata, or a system of the agency’s choosing
Colorado calls its setup a hybrid, or open-choice, model. The State EVV Solution is Sandata’s: a mobile app, a toll-free phone line and a web portal, free to providers. An agency may instead buy a Provider Choice System. Under section 8.001, as read on October 12, 2026, that system must meet the department’s technical specifications and send its data to the state, and HCPF’s Medicaid EVV program manual adds interface testing with Sandata. Either way, visits travel through Sandata’s data aggregator, where Provider Choice users get a read-only view. An agency can use only one of the two systems at a time.
Six data points, and how location is taken
Each visit carries the member’s Medicaid ID, the worker, the service, the date, the start and end times, and the location. The program manual lets that location be a mailing address, a GPS reading, or a place identified uniquely; “Doctor’s office” is its example of one that fails. HCPF’s FAQ, updated August 14, 2025, says the state’s app uses GPS and its phone line does not. When the place captured is wrong, agencies record an Alternate Location, and the manual counts a record changed only in that way as unmodified.
Office-entered and edited visits
The rule separates two kinds of after-the-fact record. A visit the office enters by hand is a Manual Visit Entry; a visit whose details change after the time of service is a Visit Modification, which produces an Edited EVV Entry. Under section 8.001.3.C, as read on October 12, 2026, agencies must keep the documentation behind each one and hand it over on request. The rule ties audits of these records to thresholds HCPF publishes, and the program manual, last updated July 1, 2026, says none has been set. For now the department reviews matched records after payment, and the manual says that exceeding thresholds persistently and intentionally may result in an HCPF audit.
Pictures and tracking are off the table
Colorado bars three things from visit data: images and recordings, continual GPS tracking, and geo-fencing. Under section 8.001.3.C.6, as read on October 12, 2026, visit data containing pictures, video, voice recordings or biometric data must not be submitted, and the FAQ adds that the state’s system has no way to accept a photo. The department also says it will not use a virtual perimeter to restrict where care is given.
What is fixed, and what is not
Firm ground first: the rule in force since August 3, 2020, the denial of claims with no matching visit since February 1, 2022, the Sandata hybrid, and the limits on pictures, tracking and geo-fencing. Three things remain open. The draft revision has not been adopted. HCPF has not published edit thresholds. And the program manual reports that the online route for submitting exemption paperwork, including live-in caregiver forms, was paused in November 2025 until HCPF revises the process.
LockProof’s lane, beside Colorado’s rule on pictures
So the two records do different jobs. Sandata’s visit data is what Health First Colorado pays against. A LockProof photo is the agency’s own file, for the family member or private-pay client who asks what happened on a given day. Agencies keeping both can read how visit-proof apps sit next to EVV, while caregiver visit records and their limits sets out what a photo record leaves unanswered.
Limits of this page
The rule text is the Secretary of State’s current version, and the rest are HCPF’s own pages and draft, all read on October 12, 2026; a later notice or the Board’s vote could change what is reported here. The full list of billing codes in the program manual’s appendix, and the operational memos it cites, were not reproduced. No agency’s contracts, waivers or exemption files were reviewed. Every covered state has a row in the hub of state EVV pages; the newest neighbor is Minnesota after its 2026 statute rewrite.
Common questions
Does Colorado make GPS part of EVV?
Not as a condition. The Department of Health Care Policy and Financing’s FAQ, updated August 14, 2025, tells you plainly that GPS is not required: the state’s mobile app uses it, and the telephone option does not. The program manual accepts a mailing address, a GPS reading or a uniquely identified place as the visit location. Section 8.001 of the rule also bars continual tracking during a visit and keeps location to the start and the end.
May a Colorado agency pick its own EVV vendor?
It may. Colorado calls its arrangement a hybrid model. Under section 8.001, read on October 12, 2026, an agency may use the State EVV Solution or pay for a Provider Choice System of its own, which has to send its data to the state, and an agency that cannot get a compatible system falls back to the state one. HCPF’s Medicaid EVV program manual, last updated July 1, 2026, says the state system is Sandata’s and free to providers, and it requires a Provider Choice System to pass interface testing with Sandata.
What happens to a Colorado claim with no EVV record?
Since February 1, 2022, it has been denied, according to HCPF’s Medicaid EVV program manual, last updated July 1, 2026, which quotes Operational Memo 21-075. The remittance advice shows code EOB 3054 with the words “EVV Record Required and Not Found”, a message the same Medicaid manual dates to February 1, 2022. Before that date the code appeared and the claim still paid.
Can visits be keyed in or corrected afterward?
Yes, within limits. Section 8.001 of the rule treats a visit entered by the office as a Manual Visit Entry and a later edit as a Visit Modification, and it makes manual entry the last resort when the app and phone line are unavailable. Agencies keep the papers that back each one. HCPF’s Medicaid EVV program manual, last updated July 1, 2026, says the department has set no threshold yet for how many such records an agency may have.
Is LockProof part of Colorado’s EVV program?
No. LockProof is not an EVV system, HCPF never approved it as a Provider Choice System, and nothing it records reaches Sandata or is matched to a claim. Section 8.001 of the rule also keeps pictures out of Medicaid visit data, so a LockProof photo has no place in a Colorado EVV record. Agencies that use it keep the photo in their own file, for questions from families or private-pay clients.
Does this page give legal advice?
It does not. It summarizes seven Colorado sources, all read on October 12, 2026 and all linked above: the rule, a draft revision and five pages from the Department of Health Care Policy and Financing. Whether a service, an exemption or a proposed change applies to one agency is a question for counsel or for the department’s EVV team.