Three Months From Audit to Statute
In February, the HHS Office of Inspector General released its Colorado audit: $77.8 million in improper and $207.4 million in potentially improper Medicaid ABA payments – the $285.2 million total that made it the largest finding in the seven-state audit series, with problems in 100 out of 100 sampled enrollee-months.
On April 28, HB26-1425 was introduced in the Colorado House. On June 2, Governor Jared Polis signed it. Thirty-five days from introduction to signature, effective immediately.
When we covered the audit in March, the open question was what Colorado would do with a quarter-billion dollars of justification. Now we know. The state didn’t reach first for rate cuts or hour caps, the way Nebraska and Indiana did after their audits. It reached for licensure.
Until June 2, Colorado had no licensure requirement for ABA providers. None. A BCBA certification from the national board, but no state license. No state oversight body with authority to suspend or revoke. No facility standards for ABA clinics. No mandatory background checks. HB26-1425 builds all of it.
What HB26-1425 Requires
The bill – “Concerning the regulation of applied behavior analysis services” – has three main pieces: professional licensure, facility licensure, and a Medicaid coverage guarantee. Prime sponsors were Representatives Lindsay Gilchrist and Kyle Brown, with Senators Lindsey Daugherty and Scott Bright carrying it in the Senate.
Professional Licensure for Behavior Analysts
HB26-1425 creates a behavior analyst licensing board inside the Department of Regulatory Agencies’ Division of Professions and Occupations. Beginning July 1, 2028, practicing as a behavior analyst or assistant behavior analyst in Colorado without a license is a class 2 misdemeanor.
To get licensed, an applicant must:
- Hold a valid certification from an approved certifying entity (for most applicants, the certification they already hold)
- Complete a fingerprint-based criminal history record check
- Carry professional liability insurance in an amount the board will set by rule (public employees with governmental immunity are exempt)
- For assistant behavior analysts: practice under the supervision of a licensed behavior analyst
The board gets full disciplinary authority – denial, suspension, revocation, probationary conditions, cease-and-desist letters, and injunctive action for unprofessional conduct. Until now, the strongest action Colorado could take against a problem provider was a Medicaid enrollment decision. Starting in 2028, the state can end a career.
One scope note: the professional license covers behavior analysts and assistant behavior analysts, not behavior technicians. Techs are regulated through two other channels in the bill – facility employee-qualification standards and a Medicaid certification requirement (below).
Facility Licensure for ABA Clinics
The Department of Human Services must establish and publish licensing standards for ABA clinics, covering local zoning compliance, licensing fees, and employee qualifications.
The deadlines here are much closer than 2028:
- August 1, 2026 – facilities meeting the amended “day treatment facility” definition must submit licensure applications
- August 1, 2027 – facility licensure must be complete
And one provision with no analog in any other state’s ABA rules: clinics that receive negative licensing actions must notify the families enrolled there. A deficiency finding is no longer a matter between the clinic and the regulator. Parents will know.
The Medicaid Guarantee – and the 45-Day Window
There’s a guarantee in here as well. The Department of Health Care Policy and Financing must reimburse ABA providers for services to Medicaid members with autism spectrum disorder – a statutory coverage floor at a moment when other states are cutting. It also requires temporary coverage periods of at least 45 days for non-certified behavior technicians who are pursuing certification, which protects billing continuity during the tech onboarding gap that every practice knows well.
The whole framework sunsets September 1, 2031, with a sunset review before then. Colorado will check whether licensure worked.
The Timeline
| Date | What Happens |
|---|---|
| June 2, 2026 | Signed; effective date |
| August 1, 2026 | Facility licensure applications due (amended day treatment facility definition) |
| August 1, 2027 | Facility licensure must be complete |
| July 1, 2028 | Behavior analyst / assistant behavior analyst licensure required; unlicensed practice is a class 2 misdemeanor |
| September 1, 2031 | Scheduled repeal; sunset review required first |
The Audit Wrote This Bill
The sponsors didn’t hide the causation. The legislative announcement cites the February OIG audit directly, alongside internal Colorado Department of Human Services reports documenting child abuse cases tied to inadequate ABA oversight. Representative Kyle Brown put it plainly: without the law, “ABA therapy will remain largely unregulated.”
The bill also aligns Colorado with Texas, Kentucky, and Washington – states that already license behavior analysts. Colorado wasn’t inventing a framework. It was adopting one that existed, at speed, because the audit made the status quo indefensible.
Read those two justifications together and the message to providers is uncomfortable but clear: the state’s case for regulating ABA wasn’t built on billing data alone. Documentation failures opened the door. Safety findings walked through it.
The Pipeline Is Proven: Audit, Then Statute
When the Colorado audit dropped, we wrote that every OIG report hands states justification to act. The prediction was rate cuts and utilization controls, because that’s what the first three audits produced – Nebraska’s 30-hour cap and 48% rate cut citing the Indiana report, Indiana’s own caps and provider moratorium, New York’s phased 25% reduction.
Colorado just demonstrated the other branch: structural regulation. Audit in February, bill in April, law in June. One legislative session, start to finish.
That should recalibrate expectations in the states already audited. Indiana ($56M+, December 2024), Wisconsin ($112.8M combined, July 2025), and Maine ($45.6M, January 2026) all have OIG findings on the record and legislatures that convene every year. North Carolina showed in April what a Medicaid coverage rewrite looks like when lawmakers decide to move – HB 696 went from oversight hearing to adopted conference report in six weeks. Colorado shows what a licensure regime looks like on a similar clock.
And three OIG audits are still unpublished. Whichever states they name will start this sequence with two proven templates already written: North Carolina’s coverage-policy overhaul and Colorado’s licensure statute. Legislators don’t draft from scratch when a neighbor has already passed the bill.
What Colorado Practices Should Do Before August 1
Determine your facility exposure first. The August 1, 2026 application deadline – less than seven weeks out – applies to facilities meeting the amended day treatment facility definition. If you operate clinic sites, get a read now on whether your locations fall under it, and don’t assume in-home-only operations are permanently outside the perimeter; CDHS rulemaking will draw the final lines.
Build a licensure file for every analyst. Certification status, expiration dates, liability insurance, and a completed fingerprint background check. July 2028 sounds distant, but board rules, fees, and application processing will consume much of that runway – and any analyst hired between now and then should be onboarded as if the requirement were live.
Put fingerprint checks into onboarding now. Every future licensee needs one. Running them at hire costs you nothing extra and means no scramble when applications open.
Watch the rulemaking. DORA’s board will set insurance amounts and application details; CDHS will set facility standards and fees. The statute is the skeleton – the rules will decide compliance cost. Assign someone to track both dockets.
Fix the documentation that started this. Licensure does not close the audit. The $42.6 million federal refund recommendation still stands, and the state committed to post-payment reviews. A licensed practice with session notes that don’t support its CPT codes is a licensed practice with a recoupment problem.
Documentation is where most of the operational risk still lives – and it’s the part software can carry. StreamABA tracks staff credentials, certification expirations, and background checks in one place, with alerts before anything lapses, and ties session documentation to the claims it supports. When the state starts asking practices to prove who is qualified and what was delivered, the answer should be a report, not a records hunt.
Colorado providers have 48 days until the first deadline. The practices that treat HB26-1425 as an operations project this summer – not a 2028 problem – are the ones that will clear it without drama.
Questions about how your credentialing files, background checks, or documentation would hold up under Colorado’s new requirements? Reach out at [email protected] – we’ll walk through it with you.
