Executive Summary
CMS’s new ABA toolkit signals increased scrutiny of whether Medicaid and CHIP services are individualized, properly supervised and supported by complete documentation. State agencies, managed care organizations and providers should use the guidance to strengthen oversight, reduce audit risk and align program growth with appropriate care.
State Medicaid and CHIP programs have expanded coverage for Applied Behavior Analysis (ABA) services in recent years. By many measures, that expansion is a success: more children with autism are receiving therapy than ever before. State agencies and provider organizations may view rising enrollment and spending as evidence that the benefit is working as intended.
The Centers for Medicare & Medicaid Services (CMS) has added an important qualification to that view. On August 4, 2026, CMS released the State Medicaid and CHIP Applied Behavior Analysis (ABA) Toolkit. Its data draws a clear distinction: increased spending does not necessarily mean that care is appropriate and well documented. Between 2021 and 2025, ABA spending in Medicaid and CHIP grew 421%, while the number of children receiving services grew only 67%. The toolkit is designed to help close that gap.
Why This Matters
Total ABA spending reportedly rose from roughly $2 billion in 2021 to an estimated $10 billion in 2025, while the median cost per child increased from about $8,903 to $21,203. CMS has linked at least $198.4 million in improper ABA payments across seven states to documentation and oversight gaps. Enforcement related to ABA billing has also increased, including cases involving inflated hours, technicians billing under a supervisor’s credentials without proper oversight and therapy authorized at the maximum intensity regardless of clinical need.
A state’s ABA coverage policy may appear complete on paper while the services delivered under that policy tell a different story. The toolkit asks states, managed care organizations and providers to close the gap between written policy and actual care.
Where the Toolkit Points
Treatment Intensity Without Individualization
The toolkit recognizes that appropriate ABA intensity can range from roughly five to forty hours per week. However, it discourages using the maximum as a standard authorization. Excessive therapy hours can interfere with a child’s daily activities and create audit risk. Authorized hours should reflect each child’s functional needs rather than a standard service model.
Supervision That Exists on Paper Only
The toolkit identifies billing under a supervising BCBA’s or BCaBA’s credentials without meaningful, documented involvement as a potential fraud pattern. A supervision plan created at intake is not enough. Records should show that qualified supervision continued throughout treatment.
Coverage Without a Confirmed Diagnosis
Ongoing ABA coverage should be tied to a confirmed autism spectrum disorder diagnosis based on standardized diagnostic tools. Only limited, time-bound services should be permitted while an evaluation is pending. The toolkit specifically flags open-ended authorization before the diagnostic process is complete.
Referral Relationships That Create Conflicts
The toolkit encourages states to use conflict-of-interest screening similar to safeguards under the Stark Law. This screening should examine relationships between clinicians who diagnose autism spectrum disorder and the ABA providers who later deliver services, particularly when those referral relationships may create financial incentives.
What CMS Is Really Looking For
When CMS and state program integrity units review ABA programs, they are likely to seek evidence that:
- Prior authorization and treatment plans reflect each child’s functional needs rather than a standard service model
- Supervision is active and documented rather than nominal
- Provider qualifications, credentials and organizational accreditation are verified and current
- Unusually high service levels are reviewed rather than automatically approved
- Electronic visit verification, prepayment review and post-payment audit processes work as intended
Moving From Benefit Growth to Program Integrity
Well-prepared state agencies, managed care organizations and provider groups are using the toolkit as a starting point for self-assessment rather than treating it as a formality. Key questions include: Do our prior authorization criteria distinguish medical necessity from a standard service model? Do our records show who supervises each case and how? Would our billing patterns appear consistent with individualized care during a state or federal review? Are provider credentialing and conflict-of-interest safeguards documented rather than assumed?
How Windham Brannon Can Help
Windham Brannon’s Healthcare Advisory Services team helps state agencies, managed care organizations and ABA providers align coverage policies with the care delivered. We assess prior authorization and utilization management criteria, provider credentialing, supervision, conflict-of-interest safeguards and claims and documentation patterns that may create audit risk.
We also help organizations turn the toolkit into practical monitoring tools, provider education and corrective action strategies. Expanding access and protecting Medicaid funds are not competing goals. For ABA programs, strong policies are only the starting point for effective compliance. If you have questions or would like support, contact Denise Gaulin or your Windham Brannon advisor.
Frequently Asked Questions
What is the main purpose of the CMS ABA toolkit? It helps states and providers assess whether ABA services are medically necessary, individualized and properly documented.
What oversight risks does the toolkit highlight? Key risks include excessive service hours, nominal supervision, incomplete diagnoses and conflicts in referral relationships.
Who should use the toolkit? State Medicaid and CHIP agencies, managed care organizations and ABA providers can use it to review policies and operational practices.
What should organizations do next? They should evaluate authorization, supervision, credentialing, billing and monitoring processes for gaps that may create audit risk.
