(a) The executive commissioner shall adopt rules that standardize the process by which a managed care organization collects alleged overpayments that are made to a health care provider and discovered through an audit or investigation the organization conducts secondary to missing electronic visit verification information. The rules must require that the organization:
(1) provide written notice to a provider:
(A) of the organization's intent to recoup overpayments not later than the 30th day after the date an audit is complete;
(B) of the specific claims and electronic visit verification transactions that are the basis of the overpayment;
(C) of the process the provider should use to communicate with the organization to provide information about the electronic visit verification transactions;
(D) of the provider's option to seek an informal resolution of the alleged overpayment;
(E) of the process to appeal the determination that an overpayment was made; and
(F) if the provider intends to respond to the notice, that the provider must respond not later than the 30th day after the date the provider receives the notice; and
(2) limit the duration of audits to 24 months.
(b) Notwithstanding any other law, a managed care organization may not attempt to recover an overpayment described by Subsection (a) until the provider exhausts all rights to an appeal.