HCBS Software in Colorado: A Buyer's Checklist for I/DD Agencies

Short answer: Buying HCBS software in Colorado is less about the length of the feature list than about whether the system follows the state's rules where your agency carries the risk. Before the demo, get answers on eight things: how visits reach the state's Sandata aggregator, how the case management agency's plan and prior authorization reach your schedule, whether notes carry what the PASA rule asks for, how incidents and medications are reported on the clock, whether goals connect plan, note and review, what the system checks before a claim leaves, where the data lives and how you get it out, and whether a lapsed credential stops a caregiver from being scheduled. The table near the end gives the question and a good answer for each.

Start from the rules, not the feature list

A Colorado I/DD agency answers to two state agencies and one rule book. CDPHE surveys a Program Approved Service Agency (PASA); HCPF enrolls it, pays its claims and writes the Medicaid rule at 10 CCR 2505-10, Section 8.7400, that sets what must be documented. Since July 1, 2024, a contracted Case Management Agency (CMA) writes each member's Person-Centered Support Plan and submits the prior authorization request. And every EVV-required visit has to reach the state's Sandata aggregator before the claim can match it.

Any rule the software ignores becomes work your staff do by hand. The eight checks below follow those rules in the order a service moves through your agency.

1. EVV: which path, and who fixes a broken visit

Colorado offers two paths. The State EVV Solution is free and run by Sandata for HCPF. A Provider Choice system is EVV you buy from a vendor, and it sends every visit to the same aggregator. Each EVV-required visit records six data elements: service type, member, caregiver, date, location, and start and end time.

Ask whether the system transmits as a Provider Choice system, what happens to a visit the aggregator rejects, and whether the clock-in also creates the service note, the payroll hours and the claim line. If staff key the same visit into two systems, the two copies will drift apart. Our comparison of Provider Choice and Sandata direct walks through the trade-off.

2. The CMA, the plan and the prior authorization

Since the case management redesign, Medicaid case management for HCBS in Colorado is done by contracted CMAs, one per defined service area. The CMA's case manager writes the Person-Centered Support Plan and submits the prior authorization request (PAR); your agency delivers against it.

Ask how the authorized services, units and dates reach your schedule, and whether staff see a warning before they schedule past the authorization. A schedule that does not know the PAR is how agencies deliver care they cannot bill. More in CCB to CMA: what case management redesign changes for providers.

3. Notes that carry what the PASA rule asks for

Section 8.7400 asks for service notes with start and end times and the specific tasks performed, and for a Provider Care Plan built from each member's Person-Centered Support Plan.

Ask to see a finished note, not a blank form. It should hold the times and the tasks as fields, without free-text workarounds, and it should point to the plan it delivers against. Our guide to PASA requirements in Colorado lists the rest of what the rule expects.

4. Incidents and medications on the clock

Critical incidents go to the case manager within 24 hours, other incidents within two business days, and the clock starts when someone notices something, not when the paperwork reaches the office. In a group home, the medication administration record and the shift handoff carry the rest of the risk.

Ask where an incident report starts (on the caregiver's phone at the time, or on paper later), who is notified, and whether a refused medication at night is on the client record when the day shift arrives. See group home documentation: shift handoffs, incidents and med logs.

5. Goals that connect plan, note and review

A goal holds up in a review when three things connect: a goal written so it can be measured, notes that say what was done toward it on each visit, and reviews that show results over time.

Ask whether the caregiver documents progress inside the service note, against the goal, or in a separate goals screen that nobody opens during a shift. More in ISP goal tracking that survives an audit.

6. What it checks before a claim leaves

Most denials are mechanical. The claim arrived after the filing limit (365 days from the date of service in Colorado), the prior authorization did not match, the member was not eligible on that date, the provider's enrollment or affiliation was not current, or the visit behind the claim was never verified.

Ask which of the five the system checks before it builds the claim, and whether claims for EVV-required services are built from verified visits rather than from the schedule. The details are in the five Medicaid denials that cost Colorado agencies the most.

7. Where the data lives, and how you get it out

Some agencies need the client file to stay in the building: a county IT policy, a board decision, a data-residency requirement. Ask where records are hosted, whether an on-premise or air-gapped deployment exists, and what it would ask of your IT team in patching, backups and moving EVV and claim files across the gap. Running HCBS software air-gapped explains what that costs.

Then ask the exit question before you sign: can you export every historical record, note, attachment and audit entry in a usable format, how long does it take, and is it in the contract? Switching from Therap shows why the answer matters when the day comes.

8. Credentials at the point of scheduling

A credential tracker that only reports finds lapses at audit time. Ask whether the system warns before a credential expires, blocks scheduling a caregiver whose required credential has lapsed, and keeps the dated source document with a change history. See caregiver credential tracking.

The checklist at a glance

Questions to bring to the demo

• Show one visit from clock-in to claim, with nothing typed twice.
• Show a visit the aggregator rejected, and who fixed it.
• Show a member whose authorization runs out next week.
• Show an incident entered on a phone, and the notification it sent.
• Show the export a departing customer receives.

Where OutcomeGrid fits

OutcomeGrid was built around this list for Colorado I/DD agencies. A caregiver clocks in on their phone and documents the service against the client's goals, and that one verified record feeds EVV transmission to Colorado's Sandata aggregator as a Provider Choice system, the payroll hours and the Medicaid claim. Incident reports, goals, scheduling and credential tracking live on the same client record, and the platform runs in our managed private cloud, on your own server, or fully air-gapped. Our Colorado software hub has the details. If you want to go through this checklist with your own programs, we will do it with you.

Sources: HCPF Electronic Visit Verification program pages; 10 CCR 2505-10, Section 8.7400 (current version effective August 14, 2026); HCPF case management redesign pages; Health First Colorado General Provider Information Manual. This article is general information, not legal advice.