Autism Therapy Under The Microscope: Federal Guidance Signals Heightened Enforcement Focus On ABA Services

On Aug. 4, the Centers for Medicare & Medicaid Services (CMS) released its Medicaid & CHIP Applied Behavior Analysis (ABA) Toolkit — a comprehensive 173-page resource designed to help state Medicaid agencies address rising concerns around autism therapy services. The toolkit arrives amid intensifying scrutiny of an industry that has seen Medicaid spending grow fivefold, from roughly $2 billion in 2021 to $10.1 billion in 2025. 

ABA — a behavioral intervention often used for individuals with autism spectrum disorder (ASD) — has become one of the fastest-growing categories of Medicaid spending, and the trajectory of that growth forms the essential backdrop for the government’s focus. Between 2021 and 2025, Medicaid and CHIP spending on ABA services increased by more than 420%. This growth rate far outpaced the 189% increase in children diagnosed with ASD who were receiving services during the same period.

A Convergence of Audits, Investigations, and Media Scrutiny 

CMS’s issuance of the toolkit represents the federal government’s response to an accumulation of findings from multiple oversight bodies, along with ongoing investigative coverage of the sector. Federal and state audits have collectively identified at least $198.4 million in improper Medicaid payments for ABA and related autism services across several states, including Colorado, Indiana, Wisconsin, Maine, Massachusetts, Nebraska, and Nevada. 

Health and Human Services, Office of the Inspector General (HHS-OIG) audits have revealed consistent patterns across states. In Indiana, auditors found at least $56.5 million in improper ABA payments (e.g., claims that entirely failed to meet documentation requirements) and identified another $76.7 million in potentially improper payments (e.g., claims that lacked sufficient detail and contained potential nontherapy time). HHS-OIG recommended the state refund $39.4 million (the federal share of the identified improper payments) to the federal government. In Maine, at least $45.6 million in improper payments for autism-related rehabilitative and community support services were identified for 2023 alone. Wisconsin’s audit found at least $18.5 million in improper fee-for-service Medicaid payments for ABA (e.g., claims in which session notes did not support corresponding CPT codes billed), with an additional $94.3 million identified as potentially improper (e.g., claims containing incomplete session descriptions and potential nontherapy time). Colorado’s audit documented at least $77.8 million in improper fee-for-service Medicaid payments for ABA provided to children. 

Across these audits, common vulnerabilities emerged: weak session-note documentation, billing for non-billable or non-therapy time, services furnished by unqualified or insufficiently supervised staff, inadequate diagnostic and functional assessments, and limited routine post-payment review. 

Criminal enforcement has accompanied these civil and administrative developments. The CMS toolkit references prosecutions and convictions related to kickbacks and harm to children as part of the backdrop motivating its release. States have also begun taking independent action. North Carolina passed legislation requiring enhanced review of treatment plans that exceed 16 hours per week and mandating that such plans be updated and reapproved every three months. Other states are similarly evaluating their oversight frameworks. 

This convergence of federal audits, congressional attention, investigative journalism, criminal enforcement, and state legislative action has laid the groundwork for CMS’s efforts to provide greater guidance in this area. 

What the CMS Toolkit Says, and What It Signals for Behavioral Health Providers 

CMS has been careful to emphasize that the toolkit does not establish new federal requirements. Nevertheless, the toolkit’s practical effect may extend well beyond its formal legal status. It provides a detailed framework that state Medicaid agencies, managed care organizations, and auditors are likely to consult when developing policies, evaluating claims, and conducting investigations. The toolkit draws on Medicaid data analysis, peer-reviewed literature, and extensive stakeholder engagement, including a targeted review of more than 264 literature sources, an assessment of more than 240 publicly available state-level Medicaid coverage and policy references, and qualitative input from state agencies, providers, advocates, and other stakeholders. 

Treatment Intensity

The toolkit takes direct aim at the practice of prescribing high-hour ABA regimens as a default approach. CMS states explicitly that 40-hour weekly treatment schedules are “not a best practice,” noting that “intervention intensity and frequency are not correlated with improvement in outcomes.” The guidance emphasizes that treatment hours should be individualized based on each child’s clinical needs rather than applied as a standardized package. Children require time for “activities of daily living such as toileting, napping and eating,” and treatment plans should include explicit tapering strategies for high-intensity cases.

Utilization Management

The toolkit places substantial emphasis on utilization management as a tool for ensuring that services are medically necessary and appropriately tailored. States are encouraged to require prior authorization before ABA services begin, concurrent review while services are being delivered, and reauthorization near the end of the approved period. Authorization decisions should be tied to individualized treatment plans rather than “standardized hour packages or preset treatment levels.” CMS recommends that states give heightened scrutiny to providers who bill maximum hours for 80% or more of their patients or who show rapid growth in billing following enrollment in the Medicaid program — patterns that the toolkit identifies as potential indicators of financial incentives overriding clinical judgment. 

Telehealth

The toolkit establishes that supervision of technicians should include a meaningful in-person component, with clinical practice guidelines recommending one to two hours of supervision for every 10 hours of direct treatment. Telehealth should be treated “as a limited adjunct to, not a substitute for, in-person ABA.” While telehealth may be appropriate for caregiver coaching, treatment supervision, data review, and team meetings, it “should not be used to establish an ASD diagnosis or complete the initial comprehensive assessment or care plan.” Direct technician-delivered ABA via telehealth raises concerns about “treatment fidelity and clinical appropriateness,” and intensive daily treatment blocks should generally occur in person.

Provider Qualifications and Ownership Structure

The toolkit recommends state licensure for ABA providers, using national credentials such as BACB certification as a baseline prerequisite for licensure rather than as a substitute for state oversight. CMS expresses concern about financial conflicts of interest, particularly when diagnosing and treating entities are financially linked. The toolkit notes the growing footprint of private equity firms in the autism therapy business and recommends that states monitor ownership changes and that companies “avoid structures where financial pressures override clinical judgment.” Diagnosing clinicians should not be compensated based on the volume or value of their referrals to treatment providers. 

Clinical Documentation and Outcomes

The toolkit provides that states should require individualized treatment plans that include measurable, functionally relevant goals with established baselines, treatment activities tied to those goals, expected treatment duration with explicit transition planning, and a process for monitoring progress. Static treatment plans that exhibit a “copy-and-paste approach” across patients are flagged as a potential indicator of problematic practices. CMS recommends that states require at least one validated standardized outcome instrument — such as ABLLS-R, VB-MAPP, or PEAK — rather than allowing reliance on provider-created measures that may lack reliability or comparability. 

Fraud Prevention and Program Integrity

CMS recommends that states implement prepayment safeguards, including automated claims edits, authorization matching, and service overlap detection. Electronic visit verification should be extended to ABA services to validate that services were delivered as billed. States should conduct risk-based audits, incorporate findings into continuous improvement processes, and participate in CMS’s Healthcare Fraud Prevention Partnership (HFPP) and the new Medicaid Emerging Vulnerability Intelligence and Actions (MEVIA) dashboard. The toolkit describes a comprehensive enforcement framework including overpayment recovery, corrective action plans, payment suspension for credible fraud allegations, and referral to law enforcement when warranted. 

Practical Considerations for Behavioral Health Providers 

For providers operating in this space, the CMS toolkit should be understood as a signal of what is to come in further policy-making and government enforcement — both at the state and federal level. While implementation will vary across states, the guidance establishes a framework that auditors, managed care organizations, and enforcement authorities are likely to reference. Providers would be well-served to evaluate their current practices against this emerging standard rather than waiting for state-specific requirements to take effect. 

1. Treatment intensity warrants immediate attention. Providers should evaluate whether their prescribed treatment hours reflect genuine, individualized clinical determinations or whether high-hour regimens have become a de facto standard practice. Documentation should clearly justify the prescribed intensity based on each child’s functional needs, and treatment plans should include explicit strategies for tapering intensity over time as appropriate. Providers who routinely prescribe 30-40 hours per week across their patient populations should anticipate heightened scrutiny and ensure that clinical justification is thoroughly documented.
2. Documentation and outcome measurement practices should be evaluated comprehensively. Individualized treatment plans should be updated at each authorization period with measurable goals and demonstrated progress. Treatment plans that remain static over extended periods, or that appear substantially similar across multiple patients, may be viewed as indicators of custodial rather than therapeutic services. Adopting validated standardized assessment instruments will position providers favorably as states move toward requiring such tools for authorization decisions.
3. Supervision and telehealth arrangements merit careful review. Providers should assess whether their supervision practices include adequate in-person observation and whether the ratio of supervision to direct treatment hours aligns with the clinical practice guidelines referenced in the toolkit. Telehealth-delivered components of service should be evaluated to determine whether they will survive the heightened scrutiny that states are likely to apply — particularly for supervision conducted entirely remotely or by providers located outside the state.
4. Billing practices should be subject to internal self-audit with particular attention to patterns that the toolkit identifies as red flags: billing for non-therapeutic time such as travel, meals, or playground activities; identical or substantially similar documentation across different patients; excessive units billed without corresponding documented outcomes; and high percentages of patients receiving maximum billable hours. Providers should also ensure that billing codes accurately reflect the services rendered and that session documentation is sufficient to substantiate each billed unit.
5. Organizational structure and referral relationships should be examined for compliance with self-referral principles. Providers should review whether any financial relationships exist between entities that diagnose patients and entities that provide treatment, and whether compensation arrangements could be viewed as tied to referral volume. Ownership disclosures should be current and accurate, and providers operating under private equity ownership or management service organization arrangements should assess whether their governance structures adequately insulate clinical decision-making from financial pressures.
6. Operationally, providers should begin building workflows to support the more rigorous utilization management processes that states are likely to implement. This includes preparing for timely prior authorization submissions with complete supporting documentation, developing processes for concurrent review responses, and anticipating electronic visit verification requirements. Monitoring state-specific implementation will be essential, as states will translate the CMS guidance into specific policy requirements through state plan amendments, provider manual updates, and managed care contract modifications. 

Looking Ahead 

The CMS ABA Toolkit represents the federal government’s most significant guidance on Medicaid-funded autism therapy oversight to date. While it does not establish binding regulatory requirements, it provides a comprehensive framework that will likely shape state policy, managed care practices, and enforcement priorities for the foreseeable future. The toolkit reflects a fundamental shift in how federal regulators view this rapidly growing sector — from one that warranted limited oversight to one that requires systematic attention to clinical appropriateness, financial integrity, and protection of vulnerable children.