Inside the CMS ABA Toolkit: Why These Changes Matter

Treatment documentation flags for potentially erroneous or improper billing.A federal audit found $77.8 million in improper ABA payments in Colorado. Four completed OIG audits have recovered money using the documentation patterns CMS has now issued as guidance for every state. Those patterns include overlapping treatments, hours that do not taper as outcomes improve, identical notes across clients, group therapy exceeding 10% of treatment time, staffing ratios without clinical justification, and limited caregiver engagement. The findings were $56 million in Indiana, $18.5 million in Wisconsin, and $45.6 million in Maine. With Colorado included, the total is nearly the same as the $198.4 million cited in the CMS toolkit.

Confirmed improper payments are one part of the audit findings. Auditors also identify payments they cannot confirm as either proper or improper. Colorado's audit found an additional $207.4 million in potentially improper payments, bringing its combined figure to $285.2 million. Wisconsin found another $94.3 million. Using HHS-OIG's combined reporting of improper and potentially improper payments, the total is $599.8 million, roughly three times the confirmed figure most reporting has cited.

Massachusetts isn't part of that $198.4 million. Its Inspector General independently found $17.3 million in overpayments tied to unmet supervision requirements in 2024. Nebraska and Nevada round out the toolkit's list of seven states under review. The U.S. House Energy and Commerce Committee has also opened its own investigation into 11 states over ABA program integrity, mostly a different set than the seven already audited.

State auditors identified these patterns in completed cases and recovered improper payments before CMS formalized them as guidance. The toolkit consolidates findings developed independently by seven state audit teams and makes them available to every state.

The guidance also targets a failure point that was already costly for clinics. In a collaboration with a16z, Camber analyzed ABA claims and found that roughly 72% go through clean, while the remaining 28% require additional work from the clinic. Documentation and information gaps are the largest cause of that rework, accounting for close to 20% of denied dollars and exceeding coverage and credentialing issues. CMS formalized guidance around a problem that was already driving denials and administrative cost.

Source: a16z and Camber

Frequency and intensity of ABA services.CMS recommends weekly thresholds of 10 hours for DSM-5 severity level 1, 20 hours for level 2, and 30 hours for level 3. No previous federal document has tied ABA intensity to a clinical severity scale. States and providers have generally relied on clinical judgment or a flat cap.

The toolkit also addresses two billing practices. It recommends breaks between consecutive treatment units rather than back-to-back sessions running all day. It also discourages consolidated billing, where every 15-minute unit from a full day appears under one claim line and obscures how the hours were delivered.

Together, these recommendations address the 40-hour weekly caseload CMS now calls "not a best practice." Four states acted before CMS issued its guidance. North Carolina requires reapproval every three months above 16 hours a week. Virginia requires activity-by-activity justification past 20. Indiana capped hours in 2026 and proposed a lifetime limit. Nebraska also imposed a cap. CMS used those states' experience to develop a severity-linked framework that others can adopt.

Validating service delivery with Electronic Visit Verification.Electronic Visit Verification is a system that captures the who, what, when, and where of a home-based visit automatically, service type, date and time, location, the specific provider, the specific patient, instead of relying on a provider's self-reported notes. Federal law has only ever required it for personal care and home health services. The toolkit recommends, without mandating, that states extend it to home-based ABA too, given how much of that care happens in the home rather than a clinic.

Colorado and Florida both introduced EVV for in-home behavioral therapy in 2020, but their programs developed differently. Colorado has denied claims without a matching visit record since 2022. Florida suspended its pilot that year after a provider sued over claims invalidated after submission. States considering EVV now have an active operating model in Colorado and a record of Florida's legal and implementation problems.

Telehealth and telehealth supervision.The toolkit sets three specific rules where states previously had one general telehealth policy. Diagnosis should happen in person, except in narrow, well-justified cases. Direct treatment delivered by an RBT over video should be permitted less freely than in-person care. Supervision by telehealth has to be live video, not a recorded check-in, and can't be the only form of supervision a BCBA provides.

The toolkit's June 2026 count found loose telehealth rules in 22 states and more restrictive rules in 28. That count predates the new CMS guidance. Most states had covered diagnosis, direct treatment, and supervision under one general telehealth policy; CMS now provides a separate standard for each activity.

Access state-by-state telehealth requirements alongside reimbursement data in Camber's Payer Rates Data tool.

ABA provider qualifications.CMS recommends state licensure rather than accepting BACB certification as a substitute, an individual NPI for every provider even when billing under a supervisor, and at least 25% of each caseload's supervision personally provided by a BCBA. In 39 states plus D.C., BACB certification and state registration are currently sufficient to bill Medicaid independently.

North Carolina departed from the prevailing approach in 2026 by barring out-of-state BCBA supervisors from enrolling in NC Medicaid. Minnesota is developing a provisional organizational license that ties Medicaid participation to state inspection authority and mandatory ownership disclosure, a requirement that also supports the toolkit's focus on ownership transparency. Because licensing changes may proceed administratively, this requirement could spread faster than reforms that require legislation.

Credentialing gaps are already the second-largest driver of claims rework in specialty care billing data, right behind documentation. Tightening who's allowed to bill raises the compliance bar and presses directly on a friction point clinics are already paying for on every claim cycle.

Organizational accreditation requirements.CMS calls third-party accreditation through ACQ, CARF, or the Joint Commission a best practice for ABA agencies. Some payer networks already require it for participation or higher reimbursement. About 50 ABA organizations currently hold ACQ accreditation nationwide, while two states have made accreditation mandatory.

Two states have imposed deadlines on enrolled providers, while only about 50 ABA organizations currently hold ACQ accreditation nationwide. CMS calls accreditation a best practice, but Massachusetts and Indiana already treat it as a requirement. Other states may consider similar mandates.

Corporate ownership structures.CMS reports that 12 private equity-backed chains have acquired 574 ABA sites since 2015 and employ more than 30,000 workers. This is the first time those consolidation figures have appeared in a federal document. CMS did not take a position on private equity ownership itself.

CMS quantifies the trend without recommending direct limits on private equity ownership. Instead, it calls for disclosure within 35 days of an ownership change, OIG exclusion screening for new owners, revalidation after an acquisition, and monitoring of staffing and caseload growth. Minnesota's provisional licensure is the only comparable state mechanism currently in development.

Self-referral safeguards.CMS recommends that states require disclosure of financial or ownership ties between the clinician who diagnoses a child and the ABA provider who treats them, prohibit compensation tied to referral volume, and monitor referral patterns for outliers, applying Stark Law's self-referral logic to ABA for the first time. No state has an ABA-specific self-referral rule yet, so this guidance is largely prospective.

Implementation may not require a lengthy statutory process. Stark Law already governs Medicaid broadly, so states could extend an existing framework instead of creating new authority. Together, the self-referral and ownership guidance indicates that CMS expects financial relationships between diagnosing clinicians and treating providers to be documented and monitored.

CMS emerging-vulnerability analytics.CMS set MEVIA's outlier thresholds at 32 units a day and 160 units a week. These are the first federal figures defining an ABA billing outlier. The dashboard launched in June 2026 to flag providers that cross them.

CMS has not published which states have opted in. HFPP and MEVIA participation is voluntary, but states have a financial incentive to participate: those that decline may have to fund comparable fraud-detection analytics themselves.

At 15 minutes a unit, 32 units a day equals 8 hours and 160 units a week equals 40 hours. That is the same caseload CMS calls not a best practice, yet it exceeds North Carolina's 16-hour reapproval threshold, Virginia's 20-hour justification threshold, and CMS's own 30-hour ceiling for level 3 severity. MEVIA's automated threshold is higher than each of those clinical review thresholds.

Prepayment medical review.Zero states run a named, ABA-specific prepayment review program today. CMS cites Medicare's Targeted Probe and Educate model as a possible reference, although it was designed for a different program.

Michigan's 2026 prior-authorization overhaul offers a partial comparison. It requires standard decisions within seven calendar days but allows faster denials when documentation is incomplete. A true prepayment hold could have substantial cash-flow effects because payment would be withheld pending review.

Camber's analysis with a16z shows that claims rework already has material financial effects. After a single resubmission, clinics ultimately recoup less than half of the claim's value. After three or four rounds of review, that falls to roughly a quarter, often months after the service was delivered. A prepayment hold could shift those cash-flow effects earlier in the process.

Evidence-based outcome assessments.Florida requires full Vineland-3 and BASC-3 scoring reports with every prior authorization request and does not accept provider-built tracking tools instead. Georgia now bases reauthorization on measurable progress data rather than clinical narrative alone.

Neither state has gone as far as the CMS toolkit, which names five acceptable instruments, ABLLS-R, AFLS, Essential for Living, PEAK, and VB-MAPP, and excludes provider-created measures. Still, Florida and Georgia required standardized outcome data before CMS issued its recommendations, providing early state precedents.

Value-based approaches.No state currently runs a fully bundled ABA payment model or partial pilot. North Carolina is reviewing quality and sustainability reforms in this area, while noting that it does not yet have the standardized quality measures a value-based model requires.

Implementation depends on standardized outcome data. CMS's four proposed mechanisms, tiered credential pay, process bonuses, episode-of-care rates, and risk-sharing, all require it. Because Florida and Georgia already collect such data, they may be better positioned than other states to test value-based payment.

Managed care oversight.Most of the program integrity tools discussed so far, the documentation checklist, the hour caps, and the audit thresholds, were built around fee-for-service claims: a provider bills the state directly, and the state's systems see every line of it. Managed care works differently. States pay an MCO a fixed amount per member, and the MCO decides how to pay providers and review claims within its own network. As a result, state fraud and audit tools built for fee-for-service claims may offer less direct visibility into an MCO's book of business.

MCO-delivered ABA spend nearly doubled in 2025, while fee-for-service spend fell. A growing share of ABA dollars is moving into managed care as CMS seeks stronger program-integrity controls. The toolkit directs states to require MCOs to apply the same documentation, audit, and fraud-referral standards used in fee-for-service, supporting more consistent oversight across payment models.

Texas, Missouri, and Florida represent three approaches to ABA managed care and its oversight. Texas has not published a comparable MCO-specific framework. Missouri avoids the visibility issue by retaining fee-for-service. Florida is testing whether expanded managed-care access can be paired with stronger ABA oversight. Its experience will provide evidence on whether equivalent oversight across managed care and fee-for-service can operate at scale.