Penguin Health

Colorado · Health First Colorado · Applied behavior analysis

What a Colorado ABA session note has to prove

In February 2026 the HHS Office of Inspector General finished auditing Colorado's Medicaid payments for ABA. Every one of the 100 enrollee-months it sampled had a claim it called improper or potentially improper, and most of the problems were in the session note. This page turns the audit and Colorado's own rules into a checklist for what goes in the note. Penguin loads the matching Colorado rule set into your organization during pilot setup, and we keep it current: when Colorado changes a requirement, the rule changes with it.

See it on your Colorado notes Get a demo account Jump to the checklist

Included in your pilotColorado ABA · twelve rules · maintained by Penguin · reviewed Sep 24, 2026

Improper payments, 2022 to 2023$77.8M

OIG's low estimate. Colorado was asked to refund the $42.6M federal share.

Potentially improper payments$207.4M

Set aside for the state to review claim by claim.

Sampled enrollee-months with a problem100 of 100

Across 47 ABA facilities and 96 children.

Colorado's Medicaid ABA spend$230M

In 2024, up from $60M in 2019.

OIG audit A-09-24-02004

Where the 100 sampled months failed

OIG pulled 100 enrollee-months from 47 facilities, worth $610,933, and asked for four things behind every unit paid: the prior authorization, the diagnostic evaluation and referral, the treatment plan, and the session notes. Then it read the notes.

Counts are enrollee-months out of 100. Most months failed more than one way. Hover or tab to a bar for what OIG actually saw.

Improper93 of 100Payments OIG says did not comply with federal or Colorado requirements. These drive the refund.

Note did not support the CPT code billed72
72 months, 38 facilitiesAlmost all 97155 billed with no protocol modification in the note. One facility's notes read "Maintain current protocol without modification." Others billed parent meetings and reassessment work under 97155.
Note did not support the units billed63
63 months, 30 facilitiesOne facility billed 799 units of 97153 in a month; its notes supported 195. Another billed 64 units of 97155 with no start or end times. Nap time billed. Notes signed up to 1 hour 44 minutes before the session ended.
Session notes missing26
26 months, 17 facilitiesNotes could not be produced for one or more paid dates. For 3 months at two facilities OIG received nothing at all, including from a facility whose acquirer had closed every Colorado location.
No valid provider signature22
22 months, 17 facilitiesUnsigned notes, notes signed by someone other than the provider, and signature images that billing staff pasted on before claiming. Printed electronic notes did not state that signatures were applied electronically.
Staff lacked the credential the code requires18
18 months, 11 facilities97155 delivered by assistant analysts, RBTs, or uncredentialed technicians. At one facility 378 of 581 units billed as 97155 were delivered by staff who were not BCBAs.
No diagnostic evaluation or treatment referral7
7 months, 7 facilitiesPrior authorizations were approved anyway. In one case the contractor had mistaken the facility's own treatment plan for the diagnostic evaluation.
EVV record missing for a home or community visit1
1 month10 sessions on 8 dates by 4 providers, 113 units, with no electronic visit verification record.

050100

Potentially improper100 of 100Payments OIG could not verify from the note. Set aside for Colorado to review, and the state has agreed to.

Note did not fully describe the service96
96 months, 44 facilitiesMost notes were a brief summary plus data. Some 8-hour days listed only goal data with no narrative. Some notes were a chart of units and provider initials with no indication of what ABA was provided or where.
Described academic, recreational, day-care, or custodial activity88
88 months, 40 facilitiesSight words, tracing letters, counting. A 5-hour session at a recreation center: snack, story time, coloring, swimming, a water slide, pizza, and gym, with no times on any ABA activity.
Included nontherapy time such as naps, meals, breaks76
76 months, 38 facilitiesABA billed continuously for 7.5 to 8 hours a day. One child's 90-minute nap was billed straight through by five staff, 8:00 to 3:00, with no start or end time for the nap.
Described group activity but billed one-to-one67
67 months, 34 facilities"Raises hand in group", "responds to group instruction", "circle time". 97153 is defined as face-to-face with one patient; group treatment is 97154.

050100

Source: OIG A-09-24-02004, Findings and Appendix D. "Improper" and "potentially improper" are OIG's categories. 9 of the 100 months had one allowable line each, an assessment or reassessment, worth $862 in total.

View as a table

OIG category	Finding	Enrollee-months	Facilities
Improper	Session notes or EVV records did not meet documentation requirements (any of the rows below)	93	46
Improper	Note did not support the CPT code billed	72	38
Improper	Note did not support the units billed	63	30
Improper	Session notes missing	26	17
Improper	No valid provider signature	22	17
Improper	EVV record missing for a home or community visit	1	1
Improper	Staff lacked the credential the code requires	18	11
Improper	No diagnostic evaluation or treatment referral	7	7
Potentially improper	Note did not fully describe the service	96	44
Potentially improper	Described academic, recreational, day-care, or custodial activity	88	40
Potentially improper	Included nontherapy time	76	38
Potentially improper	Described group activity but billed one-to-one	67	34

The checklist

Ten things a Colorado note has to show

Colorado's rule is short. Records must be legible, complete, and accurate, created at the time of service, and must fully disclose the basis for the type, frequency, extent, duration, and delivery of what was billed (10 CCR 2505-10 § 8.130.2). Policy memo PM 25-005 says what that means for an ABA note: patient information, a narrative summary of the treatment provided, and a detailed summary of behavior targets, intervention types, and other relevant data.

Here is that requirement as a technician's note for a home session, with each element tied to the rule that requires it and the finding that shows what happens without it. The client, staff, and data are fictional.

Session note97153 · Adaptive behavior treatment by protocol

Client: J. M. · Health First Colorado ID A987654 · DOB 03/14/2019 1
Date of service: 04/22/2026 1
Place of service: 12 Home, Aurora, CO · EVV visit recorded 2
Rendering: Priya Natarajan, RBT 3
Supervising BCBA: Marcus Bell, M.A., BCBA 10
Time: 8:30 am to 11:45 am. Snack 9:45 to 10:00 not billed. 12 units billed. 4
Protocol: ITP dated 02/10/2026 · PAR approved through 08/09/2026 5

Targets and interventions 6

Manding for preferred items. Discrete trial training, 3 blocks. 18 of 24 independent (75%); 62% on 04/20. 7
One-step instructions. Natural environment training in the kitchen. 8 of 10 with a gestural prompt.
Transitions. Behavior plan, differential reinforcement with a first-then visual. 2 drops to the floor, about 1 minute each; both recovered.

Narrative 8

J. was alert and engaged for the session. The RBT ran mand training with J.'s train set, fading the vocal model after the second block; J. now mands for "train" independently in 3 of 4 opportunities. During NET in the kitchen J. followed "put it in" on the first prompt 8 times while his mother was present. Two drops during the transition from the table to the playroom, each about one minute; the RBT used the first-then visual and J. transitioned without a third drop. Data was taken continuously except for the 15-minute snack, which is not billed. No protocol changes; the drop data was sent to the BCBA.

Signed electronically: Priya Natarajan, RBT · 04/22/2026 11:52 am 9

Supervisor review: Marcus Bell, M.A., BCBA · signed electronically 04/23/2026 10

1
Who and when
Client, Medicaid ID, and date of service on every note, and they have to be right.
Colorado PM 25-005 "basic patient information" · 10 CCR 2505-10 § 8.130.2(A)
96 monthsNotes carried the wrong child's name, the wrong therapist, or the wrong date. Two identical BCBA notes both cited February 28 on a claim for April.
2
Where
The place of service on the note matches the claim. Home (12) and community (99) visits also need an EVV record: client ID, who provided the service, start and end time, the service, the date, and the location.
Colorado 10 CCR 2505-10 § 8.001 · PBT Billing Manual place-of-service table
1 month113 units across 10 home or community sessions with no EVV record. Other notes gave no location at all.
3
Who delivered it, with the credential the code requires
97153 is delivered by a technician, and since April 2025 an RBT is the minimum for a child with autism. 97155, 97151, and 97158 are delivered by a BCBA or equivalent.
Colorado PM 25-005 Credentials · 10 CCR 2505-10 § 8.130.40
18 months97155 delivered by assistant analysts, RBTs, or uncredentialed technicians. One facility: 378 of 581 units.
4
Treatment time, not the day
Start and end of the ABA actually delivered. Units equal those minutes. Naps, meals, breaks, and another provider's treatment time are named and left out.
Colorado § 8.130.2(A)(1) "duration" · PM 25-005: nap time and another modality's time are not billable and are subject to recoupment

63 monthsUnits above the time in the notes. One facility billed 799 units in a month and documented 195.

76 monthsABA billed straight through 7.5 to 8 hour days, naps included.
5
The protocol it implements
97153 is treatment by a protocol the BCBA designed in advance, so the note points at the current treatment plan and authorization. Co-treatment counts only when it is in the plan and the PAR, and only for the minutes the provider is treating.
Colorado PBT Billing Manual co-treatment matrix · PM 25-005 Co-Treatment
63 monthsTwo technicians paid for the same child at the same time with no co-treatment approval. Co-treatment notes that never described the technician interacting with the child.
6
Targets and intervention types
Which techniques, on which behavior targets, and what happened. Discrete trial training, natural environment training, mand training, modeling: name the one used.
Colorado PM 25-005 "a detailed summary of behavior targets, intervention types, and other relevant data"
96 months"No indication of what ABA was provided." Notes that were a chart of units and initials.
7
Data next to the narrative
Trial counts, percentages, frequencies, and how they compare with the last session. Data on its own is not a note, and a narrative with no data does not show response to treatment.
Colorado PM 25-005: session notes are "documentation of response to treatment"
96 monthsEight-hour days documented as goal data only, with no narrative.
8
A narrative only this session could have
Written for this child on this day, with no reused text. Only ABA activities. When the session passes through a snack, circle time, or a classroom task, the note says which technique was used, for how long, and whether it was one-to-one.
Colorado Criteria for Behavioral Therapies excludes custodial, day-care, educational, and recreational care · CMS guidance on cloned notes

88 monthsSight words, tracing letters, a recreation-center day with a water slide, none of it timed.

67 months"Circle time" and "responds to group instruction" billed as 97153, which is face-to-face with one patient.
9
Signed and dated by the person who delivered it
After the session ends. Electronic signatures are marked as applied electronically. No stamps and no signature images pasted on by billing staff. Every signature is in place before the claim goes out.
Colorado 10 CCR 2505-10 § 8.130.2(F) and (G) · Provider Participation Agreement § 4.3 · PM 25-005 Documentation
22 monthsUnsigned spreadsheets, pasted signature images, printed e-notes with no electronic-signature statement, and notes signed up to 1 hour 44 minutes before the session ended.
10
Supervision you can see
The supervising BCBA is named on the technician's note, and the BCBA's direction is documented in its own 97155 note that shows a real protocol modification, not a signature alone.
Colorado Emergency rule, September 2025: training, certification, and supervision standards for PBT staff
OIG conclusionNotes "were not reliable or detailed enough to support ... whether the behavior technicians providing ABA were properly supervised."

Before the first note counts

A signed comprehensive diagnostic evaluation from the last 12 months and a referral from a physician, physician assistant, nurse practitioner, or licensed psychologist.

7 monthsNo evaluation or referral on file, and the authorization was approved anyway.

An approved PAR that covers the date

Prior authorizations run up to six months. The request carries the treatment plan, and the assessment or progress notes behind it can be no more than 60 days old.

Documentation to the CASP minimum

The billing manual requires clinical ABA documentation to meet the Council of Autism Service Providers' minimum standards, and links to the CASP templates.

Billable time

A day is not a session

Colorado pays 97153 in 15-minute units of face-to-face treatment. The most common pattern OIG found was a note with the start and end of the child's day and units to match, as if every minute between were therapy. The note has to show the minutes that were.

An illustration, not a sampled case. Snacks, meals, naps, and another provider's treatment time are not billable, so this day supports 21 units of 97153, not 32. In 76 of the 100 sampled months, ABA was billed straight through the day. In one, a 90-minute nap was billed by five different staff.

The 97155 problem

The code that failed in 72 of 100 months

97155 is adaptive behavior treatment with protocol modification: a BCBA, face-to-face with the child, resolving a problem with the treatment protocol. It is 23 percent of Colorado's ABA spend and the single most common reason a payment was called improper. Colorado did not publish guidance beyond the code definition, and industry guidance said observing a technician was enough. OIG disagreed, because 97153 already pays for treatment "under the direction of" a BCBA.

Supports 97155

A BCBA or equivalent delivered it, and is the rendering provider on the claim.
The child was present, and the note says so.
A problem with the protocol is named: a target that stalled, a prompt level that is not fading, a reinforcement schedule that stopped working.
A change was made during the session, and the note says what changed and how the child responded.
The time matches the minutes the BCBA spent doing that, with the technician's 97153 time documented separately if both were billed.

Does not support 97155

Watching the technician and writing "maintain current protocol without modification."
Meeting with parents about goals and progress. Family guidance is 97156, which Colorado does not cover.
Assessment, data analysis, and report writing. That is 97151, billed once per 365 days, with 97151 TJ for reassessment at two units per 365 days.
Time after the child left, or any time the note does not place the child in the room.
A copy of yesterday's note. Cloned 97155 notes were what made several months unreliable.

97155 documents a protocol modificationFAIL

applies_when: procedure code contains 97155
rule_text: Pass when the narrative names a problem with the current protocol, the change the BCBA made, and shows the client was present. Fail for observation only, caregiver meetings, or assessment work.
modification_made: false
rationale: Narrative states "Observed RBT run DTT; maintain current protocol." No change described.

What the reviewer gets: the finding, the BCBA's educational email, and the action steps to amend or rebill, pre-filled with the date of service.

In your pilot

Twelve Colorado rules, loaded during pilot setup

Penguin loads the Colorado ABA set into your organization during pilot setup. Edit any rule afterward, or add your own alongside them. Penguin reads session notes from CentralReach and runs the set on every note. Deterministic rules compare fields. Plain-English rules are read by the AI, which returns a pass or fail and a one-sentence reason.

The set is maintained by Penguin. When Colorado changes a requirement, we change the rule, cite the document that changed it, and date the review, so every organization on the set is running the current rules without rebuilding them.

Rules libraryPenguin Health app

Colorado ABAMaintained by Penguin

Twelve rules for Health First Colorado pediatric behavioral therapy, each with QA guidance by program code.

reviewed: Sep 24, 2026
sources: HCPF PM 25-005 · PBT Billing Manual, rev. Jul 15, 2026 · 10 CCR 2505-10 § 8.130 and § 8.001 · OIG A-09-24-02004
watching: Final PBT regulations from HCPF · HSAG prior-authorization review, Oct 2026

Included in your pilotIncludes all twelve rules and their QA guidance. Edit any rule afterward, or add your own alongside them.

Colorado requirement	What Penguin checks on every note	Colorado source	How
Units equal treatment timeChecklist item 4	Billed minutes equal the note's start to end, less the exclusions it documents. No tolerance.	10 CCR 2505-10 § 8.130.2(A)(1) · PM 25-005	Deterministic
No nontherapy time in the billed windowItem 4	Reads the narrative for naps, meals, breaks, or another provider's session inside the billed times. Context-aware: "wanted a nap" passes, "slept 12:30 to 2:00" fails.	PM 25-005 Co-Treatment: nap time and another modality's time not billable	AI
97155 is a protocol modificationThe 97155 problem	The narrative names the change made and places the client in the session. Observation only, caregiver meetings, and assessment work fail. A 97156 billed, or parent training described under 97155, flags.	PM 25-005 Credentials · CPT 97155 definition · OIG finding, 72 months	AI
97153 is one-to-oneItem 8	Group language in a 97153 note, "circle time", "group instruction", "with peers", flags for review against 97154.	CPT 97153 definition · OIG finding, 67 months	AI
ABA activities onlyItem 8	Academic, recreational, day-care, or self-care content with no ABA technique and duration attached flags.	Health First Colorado Criteria for Behavioral Therapies, exclusions · OIG finding, 88 months	AI
Techniques, targets, response, dataItems 6 and 7	The narrative names intervention types and targets, tracked data appears in the note, and the length meets a floor that scales with units billed, two sentences per hour. A near miss passes when the content is there, and the reviewer sees why.	PM 25-005 Documentation: session-note contents	Both
Written for this sessionItem 8	An exact duplicate of any narrative anywhere in the organization in the last seven days fails, across clients, staff, and codes.	10 CCR 2505-10 § 8.130.2(A)(1) · CMS guidance on cloned notes	Deterministic
Signed by the rendering provider, after the sessionItem 9	The provider on the appointment, on the claim, and on the signature are the same person, with credentials, initials, and titles tolerated. Signed no earlier than five minutes before the billed end time.	10 CCR 2505-10 § 8.130.2(F) and (G) · Provider Participation Agreement § 4.3	Both
Credential matches the codeItem 3	97155, 97151, and 97158 require a BCBA on the note; 97153 requires an RBT. Checked against the credential stated on the note.	PM 25-005 Credentials · 10 CCR 2505-10 § 8.130.40	Deterministic
Supervisor named and signedItem 10	The supervisor named on the note matches the supervisor signature, credentials tolerated. A different person signing fails.	Emergency rule, Sep 2025: supervision standards · BACB supervision requirements	AI
Location matches the claimItem 2	The location in the note matches the billed place of service, with telehealth and school sessions handled by their own rules.	PBT Billing Manual place-of-service table · 10 CCR 2505-10 § 8.001	AI
Finalized on timeItem 9	The note is converted within your window after the date of service. One client uses eight days.	10 CCR 2505-10 § 8.130.2(A)(2): records created at the time of service	Deterministic

Every failure ships with the fix for that program code: the educational email, numbered action steps, and the escalation email pre-filled with the date of service and staff name. Each reviewer action is written to a write-once audit log with seven-year retention, which is the record you hand an auditor next time. And because the rules live in the library rather than in a template, an update from Penguin reaches every organization using the set. Billing Medicaid in more than one state? The rules library covers sixteen, including Texas and Missouri.

Maintained by Penguin

We watch Colorado so the rules never go stale

Colorado has changed its ABA documentation and billing rules several times since April 2025 and has more changes in progress. The Colorado set is tied to those documents, not to a template written once. Here is how it stays current, and what each change so far did to the set.

Watch

HCPF's policy memo series, Medical Services Board rulemaking including emergency rules, the PBT Billing Manual revision log, OIG and HCPF program-integrity reports, and the CASP documentation standards the manual points to.

Update

We rewrite the affected rule, cite the document that changed it, and date the review. The set shows its sources and review date, so you can see it is current without asking us.

Re-run

An updated rule runs in the next scheduled validation and on demand against notes you have already reviewed, so a changed requirement shows you exactly which past notes it touches.

Apr 15, 2025
Policy memo PM 25-005 takes effect
What a session note must contain, signature rules, nap and co-treatment time declared not billable, RBT as the minimum for 97153 and BCBA as the minimum for 97155.
LibraryNontherapy time, techniques and targets, signed after the session, and credential matches the code all cite this memo.
Jul 2025
PM 25-005 is published and OIG shares its findings with the state
The memo closes with a reminder that OIG had just audited members' PBT treatment, including provider documentation.
Sep 29, 2025
Emergency rule for PBT providers
Training, certification, and supervision standards for staff who deliver ABA, so that Colorado does not lose the federal share of every PBT dollar.
LibrarySupervisor named and signed. We are watching the permanent rule for supervision ratios and will add Colorado to the supervision library when it publishes.
Dec 2025
ABA postpayment reviews begin
Colorado told OIG it would add statewide postpayment reviews of ABA, including medical-record review, to its program-integrity plan, to recover payments and educate providers.
LibraryThe twelve rules ask what a postpayment reviewer asks, so a failed rule today is a finding you fix before the state's reviewer sees it.
Feb 2026
OIG issues the final report
Colorado had said updated regulations, billing manuals, and memos on session-note contents, signatures, billable time, and credentialing were planned for the same month.
Library97155 is a protocol modification, 97153 is one-to-one, and ABA activities only come straight from the report's three largest findings.
Sep 24, 2026
Colorado set reviewed
Checked against PM 25-005, the PBT Billing Manual as revised July 15, 2026, and the OIG final report. Current.
Watching
Final PBT regulations and the October 2026 prior-authorization review
HCPF told OIG that final regulations on session-note contents, signatures, billable time, and credentialing were planned, and the next independent review of the prior-authorization contractor is scheduled for October 2026. When either publishes, the set is updated and every organization using it gets the change.

Next step

Run a month of Colorado notes through Penguin

Bring one month of 97153 and 97155 notes. We load the Colorado set into your pilot, run it, show every finding beside the OIG category it maps to, and hand your QA lead the fix for each one. Or get a demo account and click through Penguin on your own time first.

Book a demo Get a demo account

This page summarizes public documents for ABA providers in Colorado and is not legal or billing advice. Requirements change; everything here, and the Colorado ABA set Penguin loads into pilots, was reviewed against the sources below on September 24, 2026. When a source changes, the set is updated and the review date moves with it. The example note, its client, staff, and data are fictional. CPT is a registered trademark of the American Medical Association.

HHS OIG, Colorado Made at Least $77.8 Million in Improper Fee-for-Service Medicaid Payments for Applied Behavior Analysis Provided to Children, A-09-24-02004, February 2026 (findings, counts, examples, requirements cited, and Colorado's response)
Colorado HCPF Policy Memo PM 25-005, Pediatric Behavioral Therapy Policy Clarification, effective April 15, 2025 (session-note contents, signatures, co-treatment and nap time, credentials, EVV data elements)
Colorado HCPF Pediatric Behavioral Therapies Billing Manual (referral sources, place-of-service codes, procedure codes, PAR requirements, CASP documentation minimum)
10 CCR 2505-10 § 8.130.2 (provider records and signatures), § 8.130.40 (credentials at the time of service), § 8.001 (electronic visit verification), and § 8.076 (recovery of overpayments), as quoted in sources 1 and 2
Colorado HCPF, Emergency Rule: Pediatric Behavioral Therapy Providers Stakeholder Meeting, September 29, 2025
CMS, Documentation Matters fact sheet, Medicaid Documentation for Behavioral Health Practitioners, December 2015 (cloned notes), as cited in source 1