The direct answer
Ohio Senate Bill 315 took effect on October 6, 2026. It makes a validated EVV record a condition of payment for services subject to EVV, spells out what counts as a "credible allegation of fraud" (including falsified check-ins, impossible travel patterns, and double billing), and requires Ohio Medicaid to suspend payments and put claims on prepayment review when the Attorney General or Auditor of State submits such an allegation with evidence. If your visit data and your claims do not agree, you are now exposed in a way you were not a month ago.
Why this matters now
Ohio already had payment suspension on the books. What changed is how specific the law got, and how many of the listed examples are things an ordinary agency's data can produce by accident.
A caregiver who forgets to clock out and has a supervisor fix it the next day. A DSP whose phone logs a check-in at the office instead of the client's home. A claim that goes out for a day the client was admitted to the hospital. None of these are fraud. All of them now look a lot like the patterns the statute names.
A payment suspension can hit before you know an investigation exists. Federal rules let the state suspend without prior notice, and notice can be delayed up to 90 days at law enforcement's request. For a small agency running on two weeks of cash, that is the whole ballgame.
What the law actually says
Payment suspension (ORC 5164.36). The section keeps the federal definition of "credible allegation of fraud" from 42 CFR 455.2 and adds examples. Under the amended section, a credible allegation includes falsified or fake check-ins, forged paperwork, double billing, identity misuse, impossible travel patterns, claims overlapping a hospital stay that are not provided under an authorized individual service plan, and coordinated billing rings.
Two tracks matter:
- When ODM determines there is a credible allegation of fraud with a pending investigation, it must suspend the provider agreement and all Medicaid payments, unless an exception applies.
- When the Attorney General or Auditor of State submits a credible allegation with evidence, ODM must suspend payments "in whole, in part, or as applied to targeted payments" and require prepayment review of the provider's claims, except as 42 CFR 455.23 provides otherwise.
The allegation can be against the provider or its owner, officer, agent, manager, or employee. One bad employee can trigger it.
Exceptions and notice. ODM may not suspend if the provider shows in writing that it did not directly or indirectly sanction the employee's conduct, or shows good cause not to suspend. Notice is due within five days of suspension, unless law enforcement asks for a delay, which can run in 30-day increments up to 90 days. The notice must name the general allegations, the affected claim types or business units, and how the suspension ends. You have 30 days from receiving notice to request reconsideration.
Federal floor (42 CFR 455.23). Federal good-cause exceptions include: law enforcement asks that no suspension be imposed, other remedies protect funds better, the provider's written evidence persuades the state, or beneficiary access would suffer because the provider is a sole source of essential specialized services or serves a large number of members in a federally designated underserved area. The state can also suspend only part of payments when the allegation is limited to a specific claim type or business unit. Suspensions are temporary and must be referred to the Medicaid Fraud Control Unit.
Managed care (ORC 5167.23). MCOs can now place providers on prepayment review or claims payment suspension on "credible indicators of fraud, waste, or abuse," with ODM or Attorney General approval and written notice to the provider. Providers go through the MCO grievance process, then can appeal to ODM.
EVV as a condition of payment (ORC 5164.42). Claims for services subject to EVV must be backed by a validated EVV record. In-home care providers must clock in and clock out "when physically present at the location where services are being provided," and GPS-based verification is required, except for a family caregiver who lives in the same residence as the person served. ODM may deny, suspend, defer, or recoup payment on claims without a validated record, but must first give notice, training, and technical assistance. ORC 5164.42 appears to exclude waiver services to people with developmental disabilities, along with daily-rate residential, habilitation, and transportation services, from this new in-home clock-in and GPS standard, but any service already subject to EVV still needs a valid EVV record behind every claim.
Family caregivers and agencies (ORC 5164.41). ODM must set up added oversight for family caregivers on HCBS waivers. It may require a family caregiver it considers high risk, or who repeatedly violates requirements, to work through a waiver agency instead of as an independent provider.
Prior authorization (ORC 5164.12 and 5164.13). ODM must require prior authorization for all therapeutic behavioral services. Personal care services need prior authorization when requests exceed the plan of care, though that personal care rule excludes DODD-administered waivers.
Enrollment and payer checks. New HCBS providers get an in-person review or site inspection before ODM signs a provider agreement, then every three years (ORC 5164.302). Before any claim is paid, it must be screened for other primary coverage such as Medicare or commercial insurance (ORC 5162.19).
A separate trigger worth knowing. Claim volume is not a listed example in 5164.36. But a different new section, ORC 5164.332, requires ODM to temporarily suspend payments and investigate a new provider with a "suspicious increase" in claims in its first 60 days, and to flag providers whose monthly claims more than double without a matching rise in members served.
What specifically goes wrong
These are common failure modes, and they map most directly to the statute's examples.
- Manual edits as a habit. Caregivers forget to clock out, coordinators fix it in the EVV portal, and nobody documents why. A high manual-entry rate is exactly what ODM's new EVV dashboard measures.
- Check-ins away from the client. Staff clock in from the parking lot, the office, or their own home. That is the raw material of an "impossible travel" pattern.
- Back-to-back visits that cannot both be true. Two clients 25 minutes apart, scheduled with zero travel time, both showing full duration.
- Billing during a hospital stay. The family does not call, the schedule keeps running, and claims go out for days the client was admitted.
- Duplicate claims. A rejected claim gets resubmitted while the original is still pending, or two billers touch the same week.
- Using the live-in exemption too broadly. The GPS exemption covers a family caregiver who lives with the person. It does not cover a relative who lives across town.
- Starting TBS without authorization. Behavioral health providers who are used to billing therapeutic behavioral services first and documenting later.
- Billing the wrong payer first. A member has Medicare or commercial coverage you did not check. Under 5162.19, that claim gets redirected anyway, and repeated misses look sloppy at best.
What experienced operators do
They treat EVV and billing as one record, not two departments. Every claim should point to a visit, and every visit should point to a claim or a documented reason it was not billed.
They review exceptions daily, not monthly. Unmatched visits, manual edits, and odd locations get a reason code and a supervisor sign-off within a day or two, while people still remember what happened.
They write down their policies and enforce them. A written policy on manual EVV edits, signed off by staff, is the kind of "written evidence" that supports the 5164.36(C) exception that the agency did not sanction an employee's conduct.
They keep a suspension response plan. Who calls counsel, who pulls records, where the cash reserve is. You have 30 days to request reconsideration, and you do not want to spend the first ten finding files.
What people commonly get wrong
"We're not committing fraud, so this doesn't apply to us." The statute lists patterns, and patterns come from data. Clean intent does not fix messy data.
"Our EVV vendor handles compliance." The vendor captures events. Whether those events match your claims, and whether edits are justified, is your problem.
"Family caregivers are exempt from EVV." They are exempt from GPS-based verification only when they live with the person served. Clock-in, clock-out, and timestamps still apply.
"Big claim jumps get us suspended under the fraud definition." Not under 5164.36. The volume triggers are in 5164.332 and focus on new providers and month-over-month doubling without more members. Still worth watching, but know which rule you are dealing with.
"A suspension means we're done." Not necessarily. There are good-cause exceptions, partial suspensions, and a reconsideration right. They work better when you can produce records fast.
How AgenciesForge helps
Software cannot make a bad visit legitimate or answer an investigator for you. It can check your data for the patterns the statute names, before someone else does.
- An SB 315 audit-readiness report. A PDF showing EVV GPS completeness at check-in and check-out, the share of visits with a supervisor manual override (above 5% is flagged as an audit concern), overrides by reason code, a 90-day EVV anomaly history by DSP, your prior-auth hit rate before submission, denials grouped by reason, and payer-suspension history. For NEMT, it flags reported mileage far off the straight-line distance.
- Visit integrity checks. Visits are flagged, never silently dropped, for impossible travel between a worker's consecutive visits (faster than about 80 mph), check-ins outside a roughly 500-meter geofence around the client's home (community-based services excepted), duplicate or overlapping visits for the same client and worker, and identical check-in and check-out coordinates, which usually means a phone was left at the site. Each worker gets a 0–100 fraud-risk score that combines these flags, override share, nightly collusion checks, and a monthly OIG exclusion (LEIE) check.
- Suspension alerts. Suspension patterns in incoming 277CA acknowledgments are logged automatically, and staff can record an ODM suspension notice on a form. Either way, the owner gets an email right away and an audit entry is written.
- Claims and hours tied together. Every claim links to its visit, and EVV/claim mismatches surface the same day. Codes that need prior authorization are flagged before submission. A weekly reconciliation compares each clinician's clocked hours, EVV-billed hours, signed notes, and scheduled appointments.
What it will not do: it does not detect hospital stays, so checking claims against hospital admissions is still a manual step. It cannot stop a staff member from deciding to falsify a visit, and it does not replace a lawyer if you receive a suspension notice.
The checklist
- Confirm every service you bill that is subject to EVV has a validated record behind every claim.
- Pull your manual EVV edit rate for the last 90 days. Write a policy for edits if you do not have one.
- Audit check-in locations against client addresses. Retrain anyone clocking in off-site.
- Document which family caregivers live with the person served, and keep proof on file.
- Build a hospital-admission notification step into intake and family communication.
- If you provide therapeutic behavioral services, confirm your prior authorization workflow is in place.
- Run eligibility and other-coverage checks before billing.
- Write a one-page suspension response plan: counsel, records owner, cash reserve, 30-day reconsideration deadline.
This post is for general information and is not legal advice. Talk to Ohio health care counsel about your specific situation.