(1) As used in this section, unless the context otherwise requires:

(a) "Committee" means the legislative audit committee created in section 2-3-101 (1).

(b) "Contracted individual" means an individual currently or formerly acting under a contract, purchase order, or other similar agreement for the procurement of goods and services with a state agency; except that "contracted individual" does not include individuals or entities that provide services or receive benefits under Title XIX or Title XXI of the federal "Social Security Act".

(c) "Employee" means an individual currently or formerly employed by a state agency; except that "employee" does not include individuals or entities that provide services or receive benefits under Title XIX or Title XXI of the federal "Social Security Act".

(d) "Fraud" means occupational fraud or the use of one's occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization's resources or assets. The definition of fraud specified in this subsection (1)(d) is used exclusively for purposes of the fraud hotline to be administered by the state auditor in accordance with this section and shall not be construed to apply to any other section of the Colorado Revised Statutes.

(e) "Fraud hotline" or "hotline" means the system created and maintained by the state auditor pursuant to subsection (2)(a) of this section.

(f) "Hotline call" means a report of information to the fraud hotline regardless of whether such report is made by telephone, fax, email, or another internet-based format.

(g) "Investigation" means an investigation of a report to the fraud hotline of an allegation of fraud committed by an employee or a contracted individual. "Investigation" does not constitute acriminal investigation.

(h) "State agency" or "agency" means all departments, institutions, and agencies of state government, including the office of the governor, institutions of higher education, and the legislative and judicial departments of the state.

(i) "State auditor" means the state auditor or his or her designee.

(2) (a) The state auditor shall establish and administer a telephone number, fax number, email address, mailing address, or internet-based form whereby any individual may report an allegation of fraud committed by an employee or a contracted individual.

(b)

(I) The state auditor may request that an individual submitting an allegation to the fraud hotline provide his or her name and contact information, but no person who submits an allegation to the hotline is required to provide his or her name and contact information. In addition, in accordance with federal laws and regulations, nothing in this section permits an employee of a financial institution to disclose personally identifiable or confidential information when making a report to the hotline.

(II) The state auditor shall not disclose publicly, or when making a referral to another state agency in accordance with subsection (3)(b) of this section, the identity of any individual who contacts the fraud hotline unless the individual grants the state auditor express permission to make such disclosure. The restrictions imposed by this subsection (2)(b)(II) shall not apply when the state auditor makes a disclosure to a law enforcement agency, a district attorney, or the attorney general, in connection with a criminal investigation, or to the department of health care policy and financing or the attorney general in accordance with subsection (3)(a)(II) of this section.

(c) The state auditor is responsible for administering the hotline, including the screening of hotline calls and, in accordance with subsection (3)(b) of this section, consulting and coordinating with state agencies to refer allegations of fraud by an employee or a contracted individual that are reported to the hotline.

(d) The state auditor shall staff the hotline with one or more individuals who possess professional knowledge and expertise in the areas of fraud prevention and detection, fraud examination, forensic accounting, or another related field. The state auditor may also contract with any private entity to assist in the execution of his or her powers and duties under this section. The state auditor shall consult and use accepted professional guidelines and best practices, such as those established by other state audit organizations or the association of certified fraud examiners, when developing internal operating policies and procedures for carrying out activities of his or her office in connection with the hotline.

(e) The state auditor shall publicize the existence and purpose of the hotline on the official website of the office of the state auditor and through other means as determined by the state auditor.

(f)

(I) The state auditor shall prepare and maintain workpapers for the purpose of documenting the activities of his or her office in connection with hotline calls and investigations.

(II) All workpapers prepared or maintained by the state auditor in connection with hotline calls must be held as strictly confidential by the state auditor and not for public release. The restrictions imposed by this subsection (2)(f)(II) shall not prevent communication by and among the state auditor, a state agency, the governor, the committee, a law enforcement agency, a district attorney, or the attorney general in accordance with the requirements of this section. Notwithstanding any other provision of law, all workpapers prepared or maintained by the state auditor in connection with hotline calls shall not constitute public records for purposes of the "Colorado Open Records Act", part 2 of article 72 of title 24.

(3) (a) (I) Upon receiving a hotline call, the state auditor shall conduct an initial screening of the call to determine whether the matter being reported constitutes an allegation of fraud committed by an employee or a contracted individual.

(II) The state auditor shall forward all hotline calls alleging fraud by a medicaid recipient to the department of health care policy and financing and all calls alleging fraud by a medicaid provider or contractor to the medicaid fraud control unit of the office of the attorney general.

(b) If the state auditor determines through the initial screening that a hotline call constitutes an allegation of fraud committed by an employee or a contracted individual, the state auditor shall consult and coordinate with management or management's designee of the affected state agency or, in the case of alleged fraud involving a gubernatorial appointee, the governor's office for the purpose of referring the hotline call and any related workpapers to the affected agency. Upon receiving a referred hotline call from the state auditor, the state agency is responsible for determining and taking appropriate action to respond to the referred hotline call and reporting back to the state auditor in accordance with subsection (4) of this section. In determining appropriate action, the state agency may request either the assistance of the state auditor to participate in an investigation or request that the state auditor conduct the entire investigation.

(c) When, at the request of a state agency, the state auditor either participates in or conducts an investigation of a hotline call pursuant to subsection (3)(b) of this section, the following additional requirements apply:

(I) The state auditor has access at all times to all of the books, accounts, reports, vouchers, or other records or information maintained by the agency that are directly related to the scope of the investigation.

(II) The state auditor shall report the results of the investigation to the head of the affected agency or, in the case of alleged fraud involving a gubernatorial appointee, to the governor's office. The state auditor shall also provide any workpapers prepared or maintained by the state auditor during the investigation.

(III) If the investigation finds evidence that the amount of the alleged fraud exceeds one hundred thousand dollars, the state auditor shall also report the results of the investigation to the committee and, with the approval of the committee, to the governor.

(IV) If the investigation finds evidence of apparently illegal transactions or misuse or embezzlement of public funds or property, the state auditor shall immediately report the matter to a law enforcement agency, a district attorney, or the attorney general, as appropriate. The state auditor shall also provide any workpapers prepared or maintained by the state auditor during the investigation.

(4) When a state agency is referred a hotline call by the state auditor pursuant to subsection (3)(b) of this section and has not requested that the state auditor either participate in or conduct the entire investigation, the state agency shall report back to the state auditor within ninety days on the disposition of the referral, including action the agency has taken to respond to the fraud allegation and the results of any subsequent investigation by the agency. If the state agency has not reached a disposition of the referred hotline call within ninety days, the agency shall report to the state auditor the current status of the referral as of the ninety-day deadline. This reporting requirement continues every ninety days thereafter until the agency has reached a disposition of the referred hotline call.

(5) Commencing with state fiscal year 2018-19, the state auditor shall prepare an annual report to the committee summarizing, in the aggregate, activity relating to the fraud hotline during the preceding state fiscal year, such as the number, type, nature, and disposition of reports made to the hotline. The annual report shall not contain detailed information, confidential or otherwise, about any specific reports made to the hotline or that would enable the identification of either any specific individual involved in a matter reported to the hotline or any subsequent investigation. The annual report must be accessible to the public and posted on the official website of the office of the state auditor.