Medicaid Integrity and ABA Services: Why Documentation, Oversight, and Clinical Accountability Matter

Applied behavior analysis has become a major part of publicly funded autism care in the United States, and the growth is large enough to show up in federal data. In its August 2026 State Medicaid & CHIP Applied Behavior Analysis Toolkit, the Centers for Medicare & Medicaid Services (CMS) reports that the number of children with autism receiving ABA through Medicaid and CHIP rose 189 percent between 2021 and 2025. Over the same period, total ABA payments climbed from about $1.94 billion to $10.1 billion, an increase of 421 percent. Payments grew more than twice as fast as the number of children served, a gap that helps explain why agencies and payers are looking closely at hours, rates, and records.

The scrutiny comes from several directions at once. CMS has published guidance for states, state auditors and inspectors general have reviewed their own ABA programs, Medicaid agencies are rewriting their clinical coverage policies, and leaders of a House committee have sent questions to ten states. For ABA organizations, the significance reaches beyond reimbursement compliance. These developments raise questions about how clinical services are documented, how organizations monitor their own operations, and how accountability can become part of everyday service delivery.

What recent oversight has identified#

CMS describes its toolkit as guidance for state Medicaid and CHIP agencies. The document states that it is not a regulation and that it should not be interpreted as establishing a standard of care. Holland & Knight expects states to use it when they revise ABA coverage policy, provider enrollment and credentialing rules, and payment rates, and Barnes & Thornburg expects states, managed care organizations, and auditors to draw on it as well. That expectation gives its contents practical weight even without the force of a rule.

The toolkit lists documentation patterns that CMS treats as possible signs of erroneous or improper billing. Examples include overlapping treatments, identical documentation across individuals within a provider or clinic, reevaluations that show no progress and no adjustment to the care plan, group therapy that accounts for more than 10 percent of treatment time, high staffing ratios without clinical justification, excessive service hours that continue without documented improvement, and a lack of parent or caregiver engagement. On intensity, the toolkit describes a range of roughly 5 to 40 hours per week and states that 40 hours per week is not a best practice.

State reviews add detail that national totals cannot. In March 2024 the Massachusetts Office of the Inspector General estimated that MassHealth overpaid as much as $17.3 million on claims in which providers did not supply the required supervision of paraprofessionals. The same review found claims for more than 24 hours of service in a single day and claims for services on major holidays, including Christmas and the Fourth of July. In September 2025 the Nebraska Auditor of Public Accounts reported that Medicaid spending on ABA grew from $4.6 million to $82.8 million over five years, while the number of companies delivering the service grew from 10 to 38. That audit found duplicate claims, incorrect claims filed with managed care organizations, providers who billed without the required credentials, inadequate supervision of lower-level staff at one company, a charge above the approved rate in one instance, and services that lacked proper documentation. The Nebraska Examiner, reporting on the full audit, adds that the provider named in the claim data differed from the actual provider in 87 of the 179 claims tested.

Across seven states (Colorado, Indiana, Wisconsin, Maine, Massachusetts, Nebraska, and Nevada), the toolkit summarizes oversight reviews that together reported at least $198.4 million in improper Medicaid payments. Those reviews came from different auditors and used different samples and time periods, so the total describes what the reviewers found in those states and cannot be extended to the country as a whole.

Congressional attention has followed. In early March 2026, Republican leaders of the House Energy and Commerce Committee sent letters to ten states (New York, California, Colorado, Massachusetts, Maine, Nebraska, Oregon, Pennsylvania, Vermont, and Washington) as part of an expanding Medicaid fraud, waste, and abuse inquiry. Material posted by the committee cites fraud involving children with autism and testimony about ABA services.

Improper payments and fraud are different findings#

An improper payment is a finding about the payment itself. It may result from inadequate documentation, eligibility or credentialing problems, billing errors, or services that fall outside coverage requirements. Fraud involves additional legal elements, including intentional deception, and an audit finding cannot establish those elements by itself. An accurate discussion of Medicaid program integrity depends on keeping the two categories apart.

Massachusetts shows how wide the gap between them can be. After the Inspector General's report, MassHealth directed its managed care organizations to recoup 2024 payments from providers that did not meet a 10-to-1 ratio of paraprofessional hours to licensed behavior analyst supervision hours, according to Behavioral Health Business reporting in May 2026. Provider associations answered with a legal demand letter. They argued that the ratio functions as a clinical guideline and that recoupment before appeals are exhausted is unfair. Tufts Health Plan said it could not determine ratios during claims processing without manual counts. That reporting indicates the effort had stalled as of May. Supervision ratios are a board matter before they are a payer one. Ethics Code 4.01 requires behavior analysts to know and comply with the supervision requirements that apply to them, including BACB rules. The RBT Handbook requires technicians to practice under ongoing supervision. Those rules are discussed with the Ethics Code below. A payer taking money back for its own hour ratio is a different kind of oversight, and it is still not a finding of fraud. A ratio calculation says nothing about intent.

The findings discussed here come from specific state programs and defined audit periods. They should not be extrapolated to all Medicaid-funded ABA services nationally.

Documentation is both a financial and a clinical responsibility#

Across these reviews, recurring concerns included insufficient session documentation, unsupported billing, questions about provider qualifications, and weaknesses in oversight. These deficiencies carry implications beyond financial recovery. A clinical record should establish what services occurred, why they were clinically appropriate, how they related to the treatment plan, and what information supports ongoing decisions.

The CMS toolkit describes what that record looks like at the treatment plan level. An individualized treatment plan includes assessment results, a reassessment schedule, measurable goals with mastery criteria, baselines, planned direct hours that exclude supervision and caregiver training, caregiver training documented separately, an anticipated duration, and a transition plan. North Carolina Medicaid asks for similar qualities in its July 2026 reminder on research-based behavioral health treatment: plans that are person-centered and individualized, that account for every other service a child receives, and that reduce intensity over time while generalizing skills and moving toward natural supports.

A protocol-modification service shows why the clinical substance matters. Documentation for 97155 should reflect the clinical activity that took place, consistent with the requirements of the payer being billed. In the Massachusetts dispute, providers pointed out that the billing definition counts protocol modification only when the BCBA is face to face with the technician and the client, while clinical supervision covers more ground than that. The same word therefore carried different meanings in the clinic, in the billing definition, and in the claims system, and the note is the record that shows which activity occurred. Supervision documentation likewise has to describe what happened in the specific encounter. Standardized language that reads identically from one encounter to the next gives a reviewer nothing to verify, and identical documentation across individuals appears on the CMS list of billing red flags.

The BACB Ethics Code for Behavior Analysts makes these expectations a professional obligation as well. Code 2.06 requires services to be described accurately on reports, bills, and reimbursement requests, with errors disclosed, corrected promptly, and documented. Under Code 3.11, records must be detailed and of high quality, supporting continuity of care, accountability, and legal and funder requirements. Code 4.01 requires behavior analysts to know and comply with applicable supervision requirements, including BACB rules, and the RBT Handbook requires technicians to practice under ongoing supervision. Supervision records fall under Code 4.05, which requires them to be accurate, complete, and transferable, with retention for at least seven years or longer where other rules require it.

Documentation serves several purposes at once. It supports continuity of care, informs clinical decision-making, carries information between professionals, and establishes the basis for reimbursement. When these functions come apart, an organization faces clinical and operational risk together. A note written only to satisfy a claim edit may leave the next clinician without the information needed to continue treatment, and a clinically rich note that omits the elements a payer requires can still lead to denial or recoupment.

Templates will need attention in 2027. The ABA Coding Coalition announced in October 2025 that the AMA CPT Editorial Panel had approved its code change application, with the changes taking effect January 1, 2027. They revise codes 97151 through 97158, add six new codes, and delete the existing T codes. Payers tie documentation expectations to specific codes, so templates, staff training, and claim edits all need review before that date.

Why organizational systems matter#

Billing integrity depends on systems that carry administrative requirements so that individual clinicians do not have to remember each one. Organizations need routines that make accurate documentation, credential verification, authorization management, and clinical review part of ordinary operations.

North Carolina shows how quickly requirements can move. NC Medicaid published a reminder of its research-based behavioral health treatment requirements on July 21, 2026, replaced it on August 5, and replaced the August 5 version in full on August 31. The current version requires paraprofessionals to hold a qualifying certification, either the Registered Behavior Technician credential from the BACB or the ABAT credential from QABA. Existing paraprofessionals have a 120-day grace period that began August 1, 2026 and, counted forward, runs to about November 29, and new paraprofessionals have 120 days from hire. During that period an uncertified paraprofessional must be supervised by a licensed qualified autism service provider for the services to be reimbursable. Telehealth is removed for paraprofessional services under 97152 through 97154. Treatment plans above 16 hours per week of research-based behavioral health treatment require reauthorization every three months. At least 10 percent of a paraprofessional's services must involve observation and direction by a licensed qualified autism service provider, and when a paraprofessional delivers more than 200 hours over six months, supervisor-to-paraprofessional hour ratios apply, with the ratio values left unspecified in the bulletin.

Meeting those rules means connecting certification dates, scheduled hours, supervision logs, and reauthorization dates, which often start out in separate places. A denial is a weak signal for these gaps. The claim is often paid, and the organization learns about a missing certification, a thin supervision log, or a missed reauthorization only later, when an audit takes the money back.

The link between appointments, delivered services, notes, and claims deserves the same attention. Nebraska's finding of 87 mismatches in 179 claims shows what happens when the provider named on a claim and the provider who delivered the service diverge, and the Tufts statement from Massachusetts shows that even a payer can lack a way to compute a requirement from claims data. An organization that reconciles these four records internally finds the discrepancies before an outside reviewer does.

A workable approach includes clear standards for service documentation, defined supervisory responsibilities, periodic record reviews, mechanisms for correcting errors, and ongoing education when payer requirements change. It also includes a dated record of which version of each payer's rule applied to each date of service, which matters when bulletins are replaced within weeks of one another.

An organization may have a written compliance policy and still see wide variation in how staff apply it. Monitoring therefore has to examine actual practice, for example by sampling notes from different clinicians and locations to see whether they contain the same required elements, in addition to reviewing policy documents.

The relationship between clinical quality and compliance#

Compliance and clinical quality overlap, and each can exist without the other. A properly documented service can still be ineffective, and clinically valuable treatment can still fail payment requirements when documentation or billing falls short. High-performing organizations address both.

Evidence on service hours shows why payers and clinicians need to discuss the two together. Samelson, Pfingston, and Sneed, writing in the Journal of Autism and Developmental Disorders in January 2026, analyzed records for 725 children aged 2 to 12 who received paraprofessional-delivered ABA through 118 agencies run by one U.S. nonprofit. Average monthly direct hours showed a very small positive association with goal attainment. Higher hours were associated with lower adaptive behavior composite and communication scores, which the authors suggest may reflect children with lower baseline abilities receiving more hours. Baseline communication predicted outcomes more consistently than hours did, and dangerous behavior declined over the year regardless of hours. The design is observational, the sample comes from a single organization, and hours were measured as billed hours per month. For those reasons the study cannot identify an optimal dose, and the authors call for a randomized trial and for more careful language about dosage in practice guidelines.

Payers are setting hour thresholds in the meantime. CMS says 40 hours per week is not a best practice, North Carolina requires reauthorization every three months above 16 hours per week, and Virginia's proposed state plan amendment 26-018 would set a limit of 20 hours per week, with an exception for individuals under 21 when additional hours are medically necessary under EPSDT. The amendment proposed an October 1, 2026 effective date, and providers should confirm its current status with the Department of Medical Assistance Services. With limits moving ahead of dose-response evidence, individualized clinical justification becomes the record that carries the case for any plan with high hours. Barnes & Thornburg advises providers to pair high-hour plans with documentation of individual need and tapering strategies.

The Ethics Code already expects behavior analysts to collect and use data to decide whether to continue, change, or end services (Code 2.17), and to evaluate interventions continually and investigate poor outcomes (Code 2.18). Payers now ask for the same information in their own formats. CMS suggests that states require treatment plans documenting measurable progress with reauthorization requests. TRICARE's Autism Care Demonstration authorizes ABA in six-month periods, requires four standardized outcome measures before services begin (the Pervasive Developmental Disorder Behavior Inventory, the Vineland Adaptive Behavior Scales, the Social Responsiveness Scale, and a parenting stress index), and repeats them every six or twelve months depending on the measure. A clinic whose routine data review already produces graphs, decisions, and rationales has most of what a reauthorization request asks for.

Clinical quality requires individualized assessment, meaningful treatment goals, appropriate supervision, data-informed decisions, and ongoing evaluation of outcomes. Program integrity requires accurate claims, qualified providers, sufficient records, and adherence to applicable coverage requirements. Each addresses a risk that the other leaves open, so an organization needs both.

Implications for ABA leadership#

Recent oversight suggests that ABA organizations should treat documentation and billing accuracy as core components of governance. Leaders can strengthen accountability by ensuring that clinical and operational teams share responsibility for identifying discrepancies, understanding payer requirements, and improving systems. The CMS red flag list works as a ready-made self-audit. A reviewer can sample notes for identical language across clients, check schedules for overlapping sessions, compare group time with the 10 percent line, and look at whether reevaluations produced changes to the plan.

Ownership and financial relationships are also entering the conversation. The toolkit suggests that states consider requiring disclosure of financial or ownership relationships between diagnosing clinicians and ABA providers, prohibiting compensation tied to referral volume, and monitoring outlier providers through audits. A JAMA Pediatrics study by Brown University researchers, reported by Disability Scoop in February 2026, counted 574 autism therapy centers in 42 states owned by private equity firms as of 2024, with most acquisitions occurring between 2018 and 2022. The study documents the scale and timing of ownership, and its authors describe care quality, billing, and therapy intensity as questions for future work. For governance, the practical point is that clinical decision-making authority and financial incentives will be examined together, so organizations of any ownership type benefit from being able to show how clinical decisions are made and reviewed.

Documentation should aim at accurate, clinically meaningful records that reliably represent the services delivered, with length and volume following from clinical need.

The broader lesson from Medicaid oversight is that growth in access to ABA services needs a matching investment in accountability. Long-term credibility for ABA rests on showing that services are reimbursable, delivered appropriately, documented accurately, and evaluated for meaningful clinical benefit.

This article reflects sources available on October 26, 2026. It is educational content for ABA professionals, and it is not legal, billing, or clinical advice.

References#

1. Centers for Medicare & Medicaid Services. State Medicaid & CHIP Applied Behavior Analysis Toolkit. August 2026.
2. Holland & Knight. CMS Issues Toolkit on Applied Behavior Analysis: What States and Providers Should Consider. August 13, 2026.
3. Barnes & Thornburg. Autism Therapy Under the Microscope. August 12, 2026.
4. Massachusetts Office of the Inspector General. OIG Issues 2024 Annual Report: MassHealth's Applied Behavior Analysis Program Service Providers. March 1, 2024.
5. Behavioral Health Business. Massachusetts Autism Therapy Providers Rattled by Contentious Medicaid Clawback Effort. May 1, 2026.
6. Nebraska Auditor of Public Accounts. DHHS Applied Behavior Analysis audit release. September 23, 2025.
7. Nebraska Examiner. Nebraska audit team probes state autism service expenses, notes deficiencies. September 23, 2025.
8. U.S. House Committee on Energy and Commerce. House's Medicaid fraud probe expands to 10 states. March 6, 2026.
9. NC Medicaid. Research-based behavioral health treatment service delivery requirements: July 21, 2026, August 5, 2026, and August 31, 2026.
10. Virginia Department of Medical Assistance Services. State Plan Amendment 26-018, Autism Spectrum Disorder Service Updates.
11. Samelson, D., Pfingston, B., and Sneed, L. Dosage in Applied Behavior Analysis: Effect on Adaptive Behavior, Goal Attainment, and Dangerous Behavior. Journal of Autism and Developmental Disorders, online January 9, 2026.
12. Disability Scoop. Private Equity Increasingly Taking Over Autism Therapy Centers. February 23, 2026.
13. TRICARE. Autism Care Demonstration. Page updated September 21, 2026.
14. ABA Coding Coalition, via the Council of Autism Service Providers. ABA Coding Coalition Announces AMA Approval of Code Change Application. October 8, 2025.
15. Behavior Analyst Certification Board. Ethics Code for Behavior Analysts. Effective January 1, 2022; updated August 2024.