Key Takeaways

Inside the CMS ABA Toolkit: What Operators Should Know

The CMS State Medicaid and CHIP ABA Toolkit is 170+ pages. Our Head of Policy, Joel Miller, read through the document and pulled out the key updates, what they mean for operators, and what to prepare for next.

We asked our Head of Policy where ABA operators should focus first given everything in the CMS toolkit. His answer: utilization management, documentation, and licensure. The common thread: all three are already seeing active enforcement, well ahead of most of the other recommendations in the toolkit.

Utilization management. States have moved fastest here, and CMS gave them the clearest benchmark with its DSM-5-linked hour bands. If a caseload is especially hour-heavy, it’s more likely to draw near-term scrutiny.
Documentation. CMS gave states a ready-made checklist with six red flags that closely mirror the patterns OIG has already used to recover more than $198M across seven states.
Licensure. Licensing requirements can spread quickly once one state makes a change, and North Carolina already has. Of the three, this may be the one most likely to show up in other states with little warning.

Read the key topics below for a closer look at the guidance, what is new, and the operational impact.

Search the key topics

Treatment Documentation Flags for Potentially Erroneous or Improper Billing

The Guidance: CMS lists six patterns it flags as improper billing: overlapping treatments, hours that do not taper as outcomes improve, identical notes across clients, group therapy over 10% of treatment time, staffing ratios with no clinical justification, and low caregiver engagement. (p. 34)
What's New vs. Precedent: Previously scattered across OIG reports and individual state audits. Now one published checklist. Federal and state audits in CO, IN, WI, ME, MA, NE, and NV identified improper payments, documentation gaps, or oversight weaknesses tied to ABA services.
What It Impacts: Every open ITP and progress note is auditable against a named public checklist. QA needs a pre-submission review step built around these six flags.

Frequency and Intensity of Applied Behavior Analysis Services

The Guidance: CMS calls 40 hours per week not best practice, ties recommended hours to DSM-5 severity at roughly 10, 20, and 30 hours for levels 1 through 3, wants breaks between consecutive units, and wants an end to billing a full day under one claim line. (pp. 36-37)
What's New vs. Precedent: No prior federal link between hours and severity level. States set caps independently. NC requires reapproval every three months for plans over 16 hours per week, VA requires activity-by-activity justification above 20 hours per week, and IN and NE moved to cap hours in 2026.
What It Impacts: Any authorization above roughly 20 hours per week becomes a default review trigger. Billing systems built around single-line daily billing need to itemize sessions with gaps.

Validating Service Delivery with Electronic Visit Verification

The Guidance: CMS recommends, but does not mandate, that states add Electronic Visit Verification for home-based ABA. (pp. 122-124)
What's New vs. Precedent: EVV has historically applied to personal care and home health rather than ABA. CO extended EVV requirements to qualifying in-home and community services, with claims enforcement following implementation. FL piloted EVV for behavior analysis, then delayed mandatory implementation.
What It Impacts: Every home visit needs a verified clock-in and clock-out tied to the specific RBT and child. Scheduling must reconcile actual visit time against authorized session length in real time.

Telehealth and Telehealth Supervision

The Guidance: Diagnosis should be in person except in rare, justified cases. Direct RBT treatment by telehealth should be limited. Supervision by telehealth must be live video and cannot be the only form of supervision. (pp. 26, 90-94)
What's New vs. Precedent: States currently allow broad telehealth use with no ABA-specific limits. In the toolkit's June 2026 review, 22 states permit ABA telehealth with few restrictions and 28 impose conditions such as requiring an in-person assessment first.
What It Impacts: Intake, direct treatment, and supervision by video each need separate review because the toolkit treats them differently. A single telehealth policy will not cover all three.

Applied Behavior Analysis Provider Qualifications

The Guidance: States should require state licensure, not just BACB certification. Every provider needs an individual NPI, even under a supervisor. BCBAs should carry at least 25% of the supervision load. (pp. 81-83, 88)
What's New vs. Precedent: Thirty-nine states plus D.C. currently accept BACB certification plus registration with no separate licensure. NC requires BCBAs serving in enrolled roles to satisfy NC licensure and Medicaid enrollment requirements, and MN is moving toward a provisional organizational license tied to Medicaid participation.
What It Impacts: Credentialing files built around BACB certification alone may not hold up where licensure becomes the standard. NPI enrollment and BCBA supervision-hour tracking become audit-line items.

Organizational Accreditation Requirements for Applied Behavior Analysis Agencies

The Guidance: The toolkit calls accreditation through ACQ, CARF, or the Joint Commission a best practice, noting some networks already require it for participation or higher reimbursement. (pp. 96-97)
What's New vs. Precedent: Accreditation has been voluntary in nearly every state. MA requires MCOs to contract only with accredited ABA providers, center-based by January 2027 and all others by January 2028. IN requires enrolled ABA groups to be accredited by October 2027.
What It Impacts: Unaccredited operators in MA or IN are already on a compliance timeline. Other states are watching this rollout closely, and the requirement may spread.

Prepayment Medical Review

The Guidance: States are encouraged to build risk-based prepayment review modeled on Medicare's Targeted Probe and Educate program. (pp. 125-126)
What's New vs. Precedent: Unlike post-payment audits, this holds cash before it moves. No state runs a named ABA-specific prepayment review program yet, though prior authorization and documentation requirements are tightening broadly.
What It Impacts: A flagged provider can have live claims held pending documentation review. This affects cash flow and AR aging directly, not just future recoupment risk.

CMS Medicaid Emerging Vulnerabilities Dashboard and State-Level Analytics

The Guidance: CMS is launching MEVIA in June 2026 and pushing states toward Healthcare Fraud Prevention Partnership participation. Named thresholds include 32 units per day and 160 units per week. (pp. 120-121)
What's New vs. Precedent: States had no shared federal dashboard or published thresholds for ABA before. State participation in HFPP and MEVIA is voluntary and is not publicly itemized yet.
What It Impacts: State systems will flag providers against these numbers automatically. Documentation needs to be ready to explain outliers in advance.

Corporate Structures Involved in the Ownership of Applied Behavior Analysis Provider Agencies

The Guidance: CMS takes no formal position on ownership structure, but sets monitoring expectations: 35-day disclosure of ownership or control changes, OIG exclusion screening on new owners, revalidation or targeted audits triggered by ownership change, and monitoring of staffing and caseload growth after acquisition. (pp. 97-100)
What's New vs. Precedent: No prior ABA-specific guidance on ownership monitoring. MN's provisional licensure requirement, tying ownership disclosure and inspection authority to Medicaid participation, is the closest state analog.
What It Impacts: Any acquisition or ownership change triggers a 35-day disclosure clock and likely revalidation or audit. M&A timelines need to build in this review window.

Self-Referral Safeguards for ASD Diagnosis and ABA Referral

The Guidance: States should apply a Stark Law-style standard to diagnosis-to-treatment referrals: disclose financial or ownership ties, prohibit compensation tied to referral volume, and monitor referral patterns through audits. (pp. 26, 35)
What's New vs. Precedent: No prior federal self-referral framework specific to ABA, though Stark Law applies to Medicaid generally under section 1903(s). No state has an ABA-specific self-referral rule yet.
What It Impacts: Any in-house or affiliated diagnosis-to-treatment pipeline needs documented compensation terms with no volume link, or it becomes an audit target.

Evidence-Based Outcome Assessments for Applied Behavior Analysis Services

The Guidance: CMS says states should require at least one standardized outcome instrument and should not accept provider-created measures. (pp. 42-43)
What's New vs. Precedent: No prior federal push on outcome methodology. FL requires standardized assessment reports with initial authorization and updated instruments at reassessment, while GA continued-treatment requests require current data, progress summaries, and measurable goals.
What It Impacts: Internally built rating scales may not satisfy reauthorization requests going forward. This touches EHR templates, clinician training, and reauthorization workflow.

Value-Based Approaches

The Guidance: CMS lays out four mechanisms: tiered pay for training or certification milestones, bonuses tied to process measures, episode-of-care rates, and gainsharing or risk-sharing tied to cost and quality targets. All require risk adjustment so providers are not incentivized to avoid higher-need children. (pp. 74-75)
What's New vs. Precedent: ABA payment today is almost entirely fee-for-service in 15-minute units. No state runs a fully bundled model. NC is reviewing quality, access, and sustainability reforms, though no standardized statewide quality measures exist yet.
What It Impacts: Contracts and RFPs in pilot states will ask for standardized outcome data as a condition of rate. The chosen mechanism determines which data operators need to build first.

Managed Care Oversight

The Guidance: States are directed to require MCOs to match fee-for-service-level documentation, audit, and fraud-referral standards. (pp. 132-134)
What's New vs. Precedent: MCO spend nearly doubled in 2025 while fee-for-service spend fell, and MCO oversight has lagged. TX directs managed-care members to their health plans for ABA access, MO publishes fee-for-service precertification requirements, and FL added behavior analysis services to SMMC 3.0.
What It Impacts: MCO contract renewals will likely add fee-for-service-level documentation and audit requirements.

Key Topic	The Guidance	What's New vs. Precedent	What It Impacts
Treatment Documentation Flags for Potentially Erroneous or Improper Billing	CMS lists six patterns it flags as improper billing: overlapping treatments, hours that do not taper as outcomes improve, identical notes across clients, group therapy over 10% of treatment time, staffing ratios with no clinical justification, and low caregiver engagement. (p. 34)	Previously scattered across OIG reports and individual state audits. Now one published checklist. Federal and state audits in CO, IN, WI, ME, MA, NE, and NV identified improper payments, documentation gaps, or oversight weaknesses tied to ABA services.	Every open ITP and progress note is auditable against a named public checklist. QA needs a pre-submission review step built around these six flags.
Frequency and Intensity of Applied Behavior Analysis Services	CMS calls 40 hours per week not best practice, ties recommended hours to DSM-5 severity at roughly 10, 20, and 30 hours for levels 1 through 3, wants breaks between consecutive units, and wants an end to billing a full day under one claim line. (pp. 36-37)	No prior federal link between hours and severity level. States set caps independently. NC requires reapproval every three months for plans over 16 hours per week, VA requires activity-by-activity justification above 20 hours per week, and IN and NE moved to cap hours in 2026.	Any authorization above roughly 20 hours per week becomes a default review trigger. Billing systems built around single-line daily billing need to itemize sessions with gaps.
Validating Service Delivery with Electronic Visit Verification	CMS recommends, but does not mandate, that states add Electronic Visit Verification for home-based ABA. (pp. 122-124)	EVV has historically applied to personal care and home health rather than ABA. CO extended EVV requirements to qualifying in-home and community services, with claims enforcement following implementation. FL piloted EVV for behavior analysis, then delayed mandatory implementation.	Every home visit needs a verified clock-in and clock-out tied to the specific RBT and child. Scheduling must reconcile actual visit time against authorized session length in real time.
Telehealth and Telehealth Supervision	Diagnosis should be in person except in rare, justified cases. Direct RBT treatment by telehealth should be limited. Supervision by telehealth must be live video and cannot be the only form of supervision. (pp. 26, 90-94)	States currently allow broad telehealth use with no ABA-specific limits. In the toolkit's June 2026 review, 22 states permit ABA telehealth with few restrictions and 28 impose conditions such as requiring an in-person assessment first.	Intake, direct treatment, and supervision by video each need separate review because the toolkit treats them differently. A single telehealth policy will not cover all three.
Applied Behavior Analysis Provider Qualifications	States should require state licensure, not just BACB certification. Every provider needs an individual NPI, even under a supervisor. BCBAs should carry at least 25% of the supervision load. (pp. 81-83, 88)	Thirty-nine states plus D.C. currently accept BACB certification plus registration with no separate licensure. NC requires BCBAs serving in enrolled roles to satisfy NC licensure and Medicaid enrollment requirements, and MN is moving toward a provisional organizational license tied to Medicaid participation.	Credentialing files built around BACB certification alone may not hold up where licensure becomes the standard. NPI enrollment and BCBA supervision-hour tracking become audit-line items.
Organizational Accreditation Requirements for Applied Behavior Analysis Agencies	The toolkit calls accreditation through ACQ, CARF, or the Joint Commission a best practice, noting some networks already require it for participation or higher reimbursement. (pp. 96-97)	Accreditation has been voluntary in nearly every state. MA requires MCOs to contract only with accredited ABA providers, center-based by January 2027 and all others by January 2028. IN requires enrolled ABA groups to be accredited by October 2027.	Unaccredited operators in MA or IN are already on a compliance timeline. Other states are watching this rollout closely, and the requirement may spread.
Prepayment Medical Review	States are encouraged to build risk-based prepayment review modeled on Medicare's Targeted Probe and Educate program. (pp. 125-126)	Unlike post-payment audits, this holds cash before it moves. No state runs a named ABA-specific prepayment review program yet, though prior authorization and documentation requirements are tightening broadly.	A flagged provider can have live claims held pending documentation review. This affects cash flow and AR aging directly, not just future recoupment risk.
CMS Medicaid Emerging Vulnerabilities Dashboard and State-Level Analytics	CMS is launching MEVIA in June 2026 and pushing states toward Healthcare Fraud Prevention Partnership participation. Named thresholds include 32 units per day and 160 units per week. (pp. 120-121)	States had no shared federal dashboard or published thresholds for ABA before. State participation in HFPP and MEVIA is voluntary and is not publicly itemized yet.	State systems will flag providers against these numbers automatically. Documentation needs to be ready to explain outliers in advance.
Corporate Structures Involved in the Ownership of Applied Behavior Analysis Provider Agencies	CMS takes no formal position on ownership structure, but sets monitoring expectations: 35-day disclosure of ownership or control changes, OIG exclusion screening on new owners, revalidation or targeted audits triggered by ownership change, and monitoring of staffing and caseload growth after acquisition. (pp. 97-100)	No prior ABA-specific guidance on ownership monitoring. MN's provisional licensure requirement, tying ownership disclosure and inspection authority to Medicaid participation, is the closest state analog.	Any acquisition or ownership change triggers a 35-day disclosure clock and likely revalidation or audit. M&A timelines need to build in this review window.
Self-Referral Safeguards for ASD Diagnosis and ABA Referral	States should apply a Stark Law-style standard to diagnosis-to-treatment referrals: disclose financial or ownership ties, prohibit compensation tied to referral volume, and monitor referral patterns through audits. (pp. 26, 35)	No prior federal self-referral framework specific to ABA, though Stark Law applies to Medicaid generally under section 1903(s). No state has an ABA-specific self-referral rule yet.	Any in-house or affiliated diagnosis-to-treatment pipeline needs documented compensation terms with no volume link, or it becomes an audit target.
Evidence-Based Outcome Assessments for Applied Behavior Analysis Services	CMS says states should require at least one standardized outcome instrument and should not accept provider-created measures. (pp. 42-43)	No prior federal push on outcome methodology. FL requires standardized assessment reports with initial authorization and updated instruments at reassessment, while GA continued-treatment requests require current data, progress summaries, and measurable goals.	Internally built rating scales may not satisfy reauthorization requests going forward. This touches EHR templates, clinician training, and reauthorization workflow.
Value-Based Approaches	CMS lays out four mechanisms: tiered pay for training or certification milestones, bonuses tied to process measures, episode-of-care rates, and gainsharing or risk-sharing tied to cost and quality targets. All require risk adjustment so providers are not incentivized to avoid higher-need children. (pp. 74-75)	ABA payment today is almost entirely fee-for-service in 15-minute units. No state runs a fully bundled model. NC is reviewing quality, access, and sustainability reforms, though no standardized statewide quality measures exist yet.	Contracts and RFPs in pilot states will ask for standardized outcome data as a condition of rate. The chosen mechanism determines which data operators need to build first.
Managed Care Oversight	States are directed to require MCOs to match fee-for-service-level documentation, audit, and fraud-referral standards. (pp. 132-134)	MCO spend nearly doubled in 2025 while fee-for-service spend fell, and MCO oversight has lagged. TX directs managed-care members to their health plans for ABA access, MO publishes fee-for-service precertification requirements, and FL added behavior analysis services to SMMC 3.0.	MCO contract renewals will likely add fee-for-service-level documentation and audit requirements.

Source: CMS State Medicaid & CHIP ABA Toolkit, released August 4, 2026, cross-checked against current state bulletins and industry reporting as of August 2026.