Client Alert: Centers for Medicare & Medicaid Services Releases Applied Behavior Analysis Toolkit: Key Takeaways for ABA Service Providers

The Centers for Medicare & Medicaid Services (CMS) has put Applied Behavior Analysis (ABA) providers on notice: autism services remain protected, but the oversight environment is changing quickly. On August 4, 2026, CMS released its State Medicaid and Children's Health Insurance Program (CHIP) ABA Toolkit, a 173-page guidance document aimed at helping state Medicaid and CHIP agencies evaluate ABA coverage, clinical standards, utilization controls, provider qualifications, payment models, and program integrity safeguards.

The bottom line for providers is straightforward: the Toolkit does not create new federal requirements, but it gives states a ready-made roadmap for tighter documentation expectations, more aggressive billing oversight, and greater scrutiny of whether services are individualized, medically necessary, and properly supervised.

Key message: ABA providers should treat the Toolkit less like a new rulebook and more like a preview of the questions state Medicaid agencies, auditors, and payors are likely to ask next.

Background

CMS frames the Toolkit as a response to rapid growth in Medicaid and CHIP ABA spending, inconsistent clinical practices, and fraud concerns involving autism services. The agency points to sharp increases in ABA spending that outpaced growth in the number of children receiving autism-related services, creating pressure on states to better understand where dollars are going and whether services are clinically appropriate.

For providers, the important point is not that every state will adopt the Toolkit wholesale. Rather, the Toolkit gives state agencies a menu of levers—clinical documentation, benefit design, enrollment and credentialing, utilization management, payment methodology, and program-integrity analytics—that can be used to tighten oversight over time.

 In practical terms, providers should expect more questions about: whether treatment hours are individualized, whether progress is objectively measured, whether supervision is properly documented, whether claims match schedules and Electronic Visit Verification (EVV) data, and whether billing patterns can be explained before an auditor asks.

Key Takeaways for ABA Providers

1. Legal Status: Guidance, Not a Mandate

CMS is clear that the Toolkit does not establish new federal requirements, reduce Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) obligations, endorse a single ABA treatment approach, or direct states to restrict medically necessary care. That said, providers should not dismiss it as merely informational. State agencies may rely on the Toolkit when revising coverage criteria, documentation rules, prior authorization standards, audit protocols, and reimbursement policies.

2. Clinical Standards and Documentation

The Toolkit's clinical focus is simple: ABA services should be individualized, measurable, and supported by records that tell the full story of medical necessity. Providers should pay particular attention to:

• Diagnostic reevaluations: CMS suggests states consider requiring periodic reevaluations "to ensure that services and treatment are appropriate."
• Individualized intensity: Treatment hours should be individualized to the learner, not prescribed as a standardized approach.
• Measurable progress: CMS emphasizes measuring progress throughout treatment rather than relying on vague statements such as "patient improved." Consistent outcome data strengthens clinical records and prepares practices for value-based payment models.

3. Provider Enrollment, Credentialing, and Supervision

CMS also highlights operational details that can become audit vulnerabilities if they are treated as back-office housekeeping rather than compliance priorities:

• Providers must revalidate Medicaid enrollment at least every five years and maintain current ownership disclosures.
• Rendering-provider data hygiene is critical: claims must identify which specific technician delivered each session and which Board Certified Behavior Analyst (BCBA) supervised it during the authorization period.
• Supervision ratios are flagged for scrutiny, and states are encouraged to verify credentials and maintain site visit programs.

4. Utilization Management and Individualized Care

CMS emphasizes that treatment intensity should be tied to each child's clinical needs—not to a default number of hours, a diagnosis alone, or a standardized program model. Reauthorization requests should be prepared before the end of each approved period and should clearly show continued medical necessity, progress toward measurable goals, and the clinical rationale for any requested change in intensity.

5. Program Integrity and Fraud Indicators

The Toolkit identifies billing and utilization patterns that may trigger closer review. Providers should understand these indicators before they appear in a payor inquiry, audit request, or data-mining report:

• High-volume providers billing maximum hours for the more than 80 percent of patients with limited credentialed supervisory staff
• Excessive use of telehealth or supervision conducted via telehealth
• Rapid billing growth and claims/scheduling overlaps

Compliance takeaway: Providers should be able to reconcile claims against schedules, EVV records, authorization limits, supervision documentation, and treatment-plan requirements. If those records do not tell the same story, auditors may fill in the gaps themselves.

6. Payment Methodology and State-Level Actions

The Toolkit also points toward payment reform. CMS discusses risk-sharing models, including gainsharing rewards and penalties tied to cost and performance targets. Several states modified ABA rate structures in 2026, and CMS permanently placed ABA Current Procedural Terminology (CPT) codes 97151–97158, 0362T, and 0373T on the Permanent CMS Telehealth List effective January 1, 2026, with audio-only delivery permanently authorized for certain behavioral health services. As states reassess Medicaid reimbursement more broadly, providers should anticipate more emphasis on outcomes, documentation quality, and defensible utilization patterns.

The Broader Enforcement Landscape

The Toolkit did not arrive in a vacuum. It lands in the middle of a broader enforcement push focused on Medicaid spending, autism services, provider ownership, and billing integrity:

• Payment deferrals: On July 21, 2026, CMS deferred $1 billion in payments to Minnesota and California after identifying "high-risk" Medicaid claims.
• Department of Health and Human Services-OIG audits: The Office of Inspector General found at least $56 million in improper fee-for-service ABA payments in Indiana and $18.5 million in Wisconsin.
• State audits: A 2026 Maine audit found at least $45.6 million in improper Medicaid payments for autism-related services, with problems identified in all 100 sampled cases.
• Congressional investigations: The House Energy and Commerce Committee and the Committee on Education and the Workforce are pursuing investigations into fraudulent activity.
• Provider moratoriums: New York Medicaid instituted a six-month moratorium for new ABA enrollments and changes of ownership.

CMS has described a "troubling number of investigations, prosecutions, and convictions related to kickbacks and harm to children." Providers should therefore read the Toolkit as part of a larger enforcement storyline: federal and state agencies are not only looking at whether services were billed correctly, but also whether services were clinically justified, properly supervised, and supported by reliable documentation.

Recommended Action Steps

ABA providers do not need to wait for formal state policy changes to prepare. The following steps can help reduce risk now and position providers for a more data-driven oversight environment:

1. Audit documentation practices. Ensure treatment plans are individualized with measurable goals, progress is documented with objective data, and diagnostic reevaluations are conducted at clinically appropriate intervals.
2. Review billing and claims data. Proactively identify patterns that mirror the fraud indicators outlined in the Toolkit, including claims/scheduling overlaps, high per-patient utilization, and supervision ratio anomalies.
3. Confirm provider enrollment and credentialing. Verify that all rendering providers are properly enrolled, revalidation timelines are met, and supervision documentation is complete and accurate.
4. Understand payor requirements. Review documentation, billing, and other requirements for each payor with which you contract to ensure you are complying with the standards.
5. Monitor state-level developments. Track legislative and regulatory changes in each state where services are rendered, particularly regarding rate structures, telehealth requirements, and prior authorization processes.
6. Strengthen compliance programs. Review and update compliance training, internal controls, and anti-kickback policies. Ensure that EVV data reconciles with claims submitted.
7. Prepare for value-based payment. The Toolkit's emphasis on measurable outcomes and risk-sharing models signals a shift toward value-based reimbursement. Providers should begin building the outcome-tracking infrastructure that these models require.

Conclusion

The CMS ABA Toolkit does not impose binding requirements, but it is likely to influence how states, payors, and enforcement agencies evaluate ABA services going forward. The message for providers is clear: individualized care, measurable progress, clean enrollment data, accurate supervision records, and claims that reconcile with the underlying documentation will matter more in the months ahead. Providers that use this moment to strengthen documentation, billing controls, and compliance infrastructure will be better positioned to respond to state policy changes, payor audits, and value-based payment expectations.

Please reach out to Daphne Kackloudis or a member of the Shumaker Health Care team for more information.