Applied behavior analysis (ABA) therapy for autism has become one of the fastest-growing service categories in Medicaid — and is increasingly an enforcement target for federal and state regulators.
The structural features of the ABA industry have created conditions that federal auditors and prosecutors now characterize as an environment conducive to fraud, waste, and abuse (FWA). To support state Medicaid and Children’s Health Insurance Program (CHIP) agencies’ decision making regarding ABA services, the Centers for Medicaid and Medicare Services (CMS) recently released the “Applied Behavioral Analysis Toolkit” (“Toolkit,” linked here.). Providers and their investors should understand why the industry presents a risk for FWA, as well as CMS’ guidance on the topic.
In this series, we’ll present the context for the recent increase in enforcement in the ABA space, some recent federal and state enforcement actions, CMS’ recent guidance on relevant topics, and what providers and investors should be aware of to achieve and monitor compliance in their own clinics.
Rising Demand, Expanding Coverage
Demand for ABA therapy has grown in step with an increase in autism diagnoses over the past two decades. CMS estimates that 5% of children with Medicaid or CHIP coverage have an Autism Spectrum Disorder (“ASD” or “autism”) diagnosis, significantly higher than children covered by private insurance. Medicare and CHIP spent over $10.1 billion on ABA services in 2025, representing a 420% growth over the last five years.
In a 2014 informational bulletin, CMS clarified that states are required to cover medically necessary autism treatment for Medicaid-eligible children under 21, including ABA, which accelerated the growth in the industry. In Minnesota, one of the first states to offer Medicaid coverage under the Early Intensive Developmental and Behavioral Intervention (EIDBI) benefit, claims increased from $600,000 in 2018 to over $400 million by 2025.
High Demand and Reimbursement; Low Barrier to Entry
Unlike virtually every other healthcare discipline billing Medicaid at this scale, ABA providers are not subject to a government- mandated facility accreditation standard. The Behavior Analyst Certification Board (BACB) certifies individual practitioners, and the Commission on Accreditation of Rehabilitation Facilities (CARF) offers voluntary accreditation for behavioral health programs, but no federal or state agency requires facility-level accreditation as a condition of Medicaid enrollment or billing for ABA clinics.
While failure to have obtained accreditation does not equate to a provider being a fraudster, experience has shown that when the government does not adopt defined basic standards, it results in a provider market characterized by variable credentialing infrastructure, inconsistent documentation practices, and low barriers to entry. This gap can result in consequences including, unfortunately, bad actors.
State Audits Have Identified Issues
In 2022, HHS-OIG announced a series of audits of Medicaid ABA payments in eight states. The results so far from four states share a single remarkable finding: in every state reviewed, all 100 sampled enrollee-months included payments for one or more claim lines that were improper or potentially improper.
- The Indiana audit, concluded in December 2024, estimated at least $56.6 million in improper payments, including payments where documentation requirements were not met, the provider lacked appropriate credentials, or there was no underlying diagnosis or treatment referral.
- The Wisconsin audit, concluded in July 2025, estimated at least $18.5 million in improper payments, including session notes that did not support the CPT code billed, the number of units billed, the date of service, and did not include signatures of rendering providers.
- The Maine audit, concluded in January 2026, estimated at least $45.6 million in improper payments, including where the claim did not include a comprehensive assessment, did not meet documentation requirements, did not include a treatment plan, or the provider lacked appropriate credentials.
- The Colorado audit, concluded in March 2026, estimated at least $77.8 million in improper payments, including documentation not supporting the claim, the provider lacked appropriate credentials, and there was no underlying diagnosis or treatment referral.
Several deficiencies were common across all four states: claims by uncredentialed or unqualified behavioral technicians, services billed but not rendered, missing or inadequate session notes, incomplete individualized treatment plans, and absent supervisory sign-offs. OIG announced that there will be 8 audits in the series, meaning at least four audits remain pending, though which states are being audited has not been announced.
These audit findings are just the beginning and. They establish the factual predicate for enforcement. The next post in this series will examine the criminal and administrative enforcement actions that have followed — and what is still to come.
* * * *
If you have questions, please reach out to the author(s).
The Commercial Litigation Update blog is currently edited by Jennifer O'Connor and Adam Paine.
