PASA Requirements in Colorado: What a Program Approved Service Agency Must Document

Short answer: A Program Approved Service Agency (PASA) is an agency approved to deliver Medicaid waiver services to people with intellectual and developmental disabilities in Colorado, under the HCBS-DD, SLS, CES and CHRP waivers. Approval takes two applications to two state agencies: CDPHE surveys you, and HCPF enrolls you and gives final approval. After that, what you must document is set by the Medicaid rule at 10 CCR 2505-10, Section 8.7400: service notes with start and end times and the specific tasks performed, a Provider Care Plan built from each member's Person-Centered Support Plan, incident reports to the case manager within 24 hours for critical incidents and two business days for the rest, medication records, a personnel file for everyone who works with members, and a written grievance procedure. Records are kept for seven years.

This guide is written against the version of the rule in effect since August 14, 2026. Rules change. Check the section number against the Secretary of State's current version before you rely on any checklist, including this one.

A note on the name

"PASA" is what providers say, and it is what CDPHE still calls its program. The current Medicaid rule uses a different term, Provider Agency: "an Agency certified by the Department and which has a contract with the Department to provide one or more of the services listed at Section 8.7500." The rules for HCBS providers now sit in the 8.7000 series of 10 CCR 2505-10. If a checklist you are using cites sections in the 8.500 range, it predates the current rule.

Becoming a PASA: two applications, two agencies

CDPHE describes the path plainly. You submit one application to CDPHE, which verifies your qualifications and conducts an onsite survey, and a second to HCPF, which is your actual Medicaid enrollment. HCPF has final approval authority. You do not have to wait for CDPHE to finish before filing with HCPF, but the information on the two applications must match.

On the CDPHE side, the sequence runs:

1. A letter of intent, after which you receive the current application.
2. The application and its supporting documents.
3. A readiness call, where the survey team decides whether you are prepared for an onsite survey.
4. The onsite initial survey.
5. If no deficiencies are cited, CDPHE sends its certification recommendation to HCPF. If any are, you submit a plan of correction and CDPHE confirms the fixes in a desk revisit first.

HCPF then issues final approval to the provider, to CDPHE and to case management agencies. The rule is explicit about order: Provider Agencies "shall obtain Certification prior to rendering or billing for services" (§ 8.7403).

The practical point: the survey tests your documentation system before you have served anyone. The policies, forms and file structure below have to exist on day one.

What a PASA must document

Four of these deserve more than a table row.

Service notes: the task has to match the service definition

The rule does not ask for "notes." It asks for "the exact nature of the specific tasks performed that align with the service definition(s) in 8.7500." A note that says "supported client in the community, good day" records that a shift happened. It does not show which billed service was delivered. Notes get read against the service definition and the units billed, and a mismatch is a documentation problem even when the care was good.

Two habits prevent most of it. Describe the task in the service definition's own terms. And record start and end times when they happen, not reconstructed at the end of the week, because those times have to agree with the units you bill.

Incidents: two clocks, and the second one is not yours

A critical incident must reach the member's case manager within 24 hours of discovery. Every other reportable incident has two business days. The list of reportable incidents is broad: deaths, hospitalizations, medical emergencies, allegations of mistreatment, abuse, neglect or exploitation, injuries, damaged or stolen property, medication errors, a missing person, criminal activity.

Which of those count as critical needs care. The provider rule points to § 8.7201.L.5, which names allegations of mistreatment, abuse, neglect and exploitation, and injuries that need emergency treatment or lead to hospitalization or death, "including but not limited to." The rule's general definition of a critical incident is wider and also names medication mismanagement, property damage or theft, a lost or missing person and criminal activity. When the two readings differ, treat the incident as critical and report within 24 hours.

The case management agency then has its own clock: 24 hours or one business day to enter critical incidents in the state's system. If your report is late or incomplete, theirs is too. Each report must carry 15 data points, from the member's Medicaid ID to the person responsible for follow-up. An incident form that does not ask for all of them will produce reports that miss some.

None of this replaces mandatory reporting. The rule also cites Colorado's mandatory-reporter statutes (C.R.S. 18-6.5-108, 19-3-304 and 26-3.1-102). Make sure staff know which report goes where.

Rights modifications: you keep a copy, and the reviews are dated

Any restriction of a member's rights, including the HCBS Settings Rule protections such as privacy, access to food at any time or control of their own schedule, must rest on a specific assessed need and be justified in the Person-Centered Support Plan. That documentation records the right being modified, the need, the less intrusive methods already tried, a plan for collecting data on whether the modification is still needed, and the member's informed consent on the Department's form. Any Provider Agency implementing the modification must keep a copy.

Two review cycles run on it. The modification must be reviewed and updated with reassessment at least every 12 months (§ 8.7001.B.4). And the Human Rights Committee, which the case management agency runs, must see that the member and their team review continued modifications at least every six months (§ 8.7202.Q). The daily data those reviews depend on comes from the provider.

Staff files: what expires

Before hiring, the rule requires a criminal background check, reference checks and a check of the federal exclusion list. Background checks are then repeated at least every five years for everyone who provides direct care (§ 8.7409.E). A CAPS check is also required, and some substantiated findings bar a worker from direct care. Staff who are not otherwise authorized by law to give medication must pass the QMAP competency evaluation before they assist with or monitor medications (§ 8.7409.C). And training comes before an employee has unsupervised contact with members. It covers person-centered practice, the needs of the members they will support and your own policies (§ 8.7409.D).

None of this is difficult on the day you hire. It gets difficult in year four, when nobody tracked the five-year date.

What we could not confirm

Two questions providers often ask that we could not tie to a current primary source, so we will not guess:

• How often CDPHE resurveys a PASA. We found no current published interval for PASAs that are not licensed facilities. Ask CDPHE.
• Exactly which DD, SLS and CES services require EVV. The rule applies EVV to services mandated by the 21st Century Cures Act and to those it adds itself. Check HCPF's current EVV service list for each service you bill.

Where OutcomeGrid fits

OutcomeGrid is documentation software for Colorado I/DD providers, so this is the problem we build for. Session notes are written against the member's goals. Incident reports are structured, with notification tracking and follow-up. Credential tracking sends expiration alerts. And every change sits in an audit trail. Software does not make an agency compliant. A clear system makes the rule's requirements the default instead of something reconstructed the week before a survey.

See how waiver documentation works end to end on our I/DD HCBS waiver software page, or how staff credentials are tracked on credential and license tracking.

Sources: 10 CCR 2505-10, Sections 8.7000 and 8.100 (Colorado Secretary of State, versions effective August 14, 2026), and CDPHE's Program Approved Service Agency pages. This article is general information, not legal advice.