(1) A pharmacy benefit manager, a carrier, or an entity acting on behalf of a pharmacy benefit manager or a carrier that audits a pharmacy shall:

(a) Give the pharmacy at least seven days' written notice prior to commencing an audit;

(b) Conduct the audit by or in consultation with a licensed pharmacist to the extent the audit requires the application of clinical or professional judgment;

(c) Not use extrapolation or other statistical expansion techniques in calculating the amount of a recoupment or penalty resulting from an audit of a pharmacy;

(d) Allow the pharmacy to produce additional claims documentation using any commercially reasonable method, including facsimile, mail, or electronic claims submission, if an audit results in the dispute or denial of a claim;

(e) Establish a written appeals process that includes procedures to allow a pharmacy to appeal to the pharmacy benefit manager or the carrier the preliminary reports resulting from the audit and any resulting recoupment or penalty; and

(f) Not subject a pharmacy to the recoupment of funds when an audit results in the identification of a clerical error in a required document or record unless the error results in actual financial harm to the pharmacy benefit manager, a health benefit plan providing prescription drug benefits that are managed by the pharmacy benefit manager, or a consumer.

(2) A pharmacy may use verifiable statements or records, including medication administration records of a nursing home, assisted living facility, hospital, physician, or other authorized practitioner, to validate the pharmacy record and delivery.

(3) Any legal prescription may be used to validate claims in connection with prescriptions, refills, or changes in prescriptions, including medication administration records, faxes, electronic prescriptions, or documented telephone calls from the prescriber or the prescriber's agent.

(4) The time period covered by an audit may not exceed twenty-four months from the date that the prescription was submitted to or adjudicated by the entity, unless a longer period is required by state or federal law.

(5) The time periods specified are waived for audits of pharmacy records when fraud or other intentional or willful misrepresentation is indicated through review of claims data, statements, physical review, or other investigative methods. The pharmacy benefit manager, carrier, or entity acting on behalf of the pharmacy benefit manager or carrier shall deliver to the pharmacy at the time of the audit a written or verbal explanation of the information that led to the conclusion that there is an indication of fraud or other intentional or willful misrepresentation. The explanation is not required if law enforcement has intervened due to the indication of fraud.

(6) As used in this section, "pharmacy" includes any entity authorized under article 42.5 of title 12, C.R.S., to dispense prescription drugs.