CMS released the State Medicaid and CHIP Applied Behavior Analysis Toolkit on August 4. While the toolkit creates no new immediate federal requirements, doesn’t touch EPSDT obligations, and doesn’t endorse a single model of ABA, it serves as a blueprint for change that will fundamentally alter how your clinic operates.
The toolkit is a checklist written for state Medicaid agencies. It covers clinical standards, benefit design, payment methodology, provider enrollment, credentialing, utilization management, and program integrity. States were told to use it to assess their own ABA policies. Many are expected to follow suit.
Read it as a forecast of what your state Medicaid agency and your MCO contracts will ask for over the next 18 months.
The number driving this
ABA spending in Medicaid and CHIP rose 421% between 2021 and 2025. The count of children with an autism diagnosis receiving services rose 67% over the same window.
That gap is the whole argument. CMS is not saying children don’t need care. It’s saying the spending curve and the population curve stopped tracking each other, and nobody can currently explain the difference with clinical evidence.
Providers who can explain it will be fine. Providers who can’t will spend 2027 in audits.
The enforcement backdrop is already there. HHS OIG has recommended more than $123 million in federal recoupments across audits in Indiana, Wisconsin, Maine, and Colorado. The consistent finding was not that the therapy was wrong. It was that the documentation couldn’t prove the therapy happened, or that it was needed.
What states are likely to do
-
- Tighter prior authorization at initial request
-
- Real reassessment requirements at every reauthorization, not a copy-forward of the intake plan
-
- Expanded post-payment audits and claims monitoring
-
- Higher bar on supervision frequency and modality
-
- Stricter provider enrollment and credentialing screens
-
- New data reporting obligations tied to utilizations
MCOs will move faster than state agencies. Contract language is easier to change than a provider manual.
lutions.
Four shifts that land inside the clinic
Medical necessity becomes an ongoing burden of proof. Today most clinics build a strong intake packet and then coast on it. CMS is pointing states toward reauthorization as the control point. Your reassessment has to show what changed, what the data says, and why the current hour level is still the right one. A reassessment that reads like the original assessment with new dates is the exact document an auditor is looking for.
Standardized hour models are the target. Investigators found clinics billing 30 to 40 hours a week for nearly every child on the caseload. CMS is explicit that intensity should follow individual clinical needs. If your intake process recommends most kids to the same number, that pattern is visible in your claims data before anyone reads a single note.
Supervision moves back toward in person. The toolkit pushes states toward more frequent direct supervision of behavior technicians and less reliance on exclusively virtual oversight. For multi-site organizations, that is a staffing and scheduling problem, not a policy problem. Model the BCBA hours now.
Referral relationships get examined. Where a diagnostic provider also owns or benefits from the treatment organization, states are being told to look. The answer is not to unwind the model. It’s to make the diagnostic rationale defensible on its own terms, with standardized instruments, documented decision logic, and a record that reads the same whether the child goes to your clinic or someone else’s.
What to do before your state moves
Start with an internal audit of the documents that carry the most risk: your reassessments and your session notes. Pull twenty at random. Ask whether each one, read cold by someone with no context, proves medical necessity and proves the service was delivered.
Then look at your caseload distribution. Plot authorized hours across every active client. If the histogram has one tall spike, you have a story to prepare.
Then check your supervision records against what a stricter standard would require.
None of this is new work. It’s work most organizations deferred because growth was easier. The window to do it quietly, before an auditor sets the timeline, is open right now.
What your systems need to do
Regardless of your current system, the oversight environment ahead demands four things:
-
- Reassessments that carry clinical data forward, not text forward
-
- Hour recommendations that trace back to an individual child’s evidence, visible to an auditor
-
- Documentation captured during the session, not reconstructed at the end of the week
-
- A caseload-level utilization view you can hand to an MCO before they ask for it
Most organizations have some of this across three systems that don’t talk. That’s the gap that turns an audit into a fire drill.
Frontera is one system across all four needs. Diagnosis Builder standardizes the diagnostic record and the decision logic behind it. Assessment and Reassessment Builder carries longitudinal evidence into every reauthorization. AI Documentation captures the clinical record at the point of care and gives BCBAs and RBTs their evenings back. Outcomes and Analytics gives you the caseload view.
We make your clinical judgment legible to the people who pay for it.
See it against your own caseload
The fastest way to know whether your documentation holds up is to run your own cases through it.
Book a walkthrough and we’ll show you what audit-ready reassessment documentation looks like for a client you already treat.
