Clinical Corner: What do I need to know about fraud and ABA billing?

I’ve been reading about the wave of Medicaid audits hitting ABA providers across the country, and I keep asking myself, could this happen to me? I run an ethical practice. I supervise carefully, document sessions, and try to stay current on billing requirements. But when I look for clear written standards from insurance providers, I find vague guidance spread across multiple documents, policies that contradict each other, and questions that go unanswered. What’s driving these audits, what are providers being cited for, and what can I do to protect my practice and the families we serve?

Answered by Hailu Jardines, CEO and Co-Founder
Office Puzzle, Practice Management Software for ABA Providers

Thank you for your question. We understand that these audits can feel confusing and scary for providers. We’re here to help dispel myths and provide you with some actionable tips that will boost your knowledge and confidence around audit readiness.

The Audit Wave Is Real, and It Is Not Slowing Down

Applied behavior analysis (ABA) has grown from a Medicaid afterthought to a nearly $2 billion annual program in roughly a decade. Medicaid, the joint federal-state program that covers healthcare for low-income Americans, has become the primary payer for autism therapy services across the country. The oversight infrastructure did not keep pace, and the enforcement cycle has arrived. The U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) launched a planned series of nine state-level ABA audits in 2022. Four are complete, and the pattern is consistent across all of them.

- - Indiana flagged at least $56 million in improper payments.
  - Wisconsin identified $18.5 million.
  - Maine came in at $45.6 million.
  - Colorado estimated at least $77.8 million, with an additional $207 million potentially improper.

Across all four states, the OIG recommended returning nearly $125 million to the federal government. On the back end, the process looks like this: State Medicaid programs run periodic audits where officials pull a sample of ABA billing records and check each claim against documentation requirements, session notes, and program rules. They flag any payment that should not have gone out, whether due to missing paperwork, incorrect billing codes, or services that weren’t properly authorized. And in each state audited, every sampled enrollee-month contained at least one improper or potentially improper claim. This means there were issues with the bill a provider submitted to Medicaid, requesting payment for a service delivered to a patient on a specific date.

The financial impact is concrete. Many ABA practices operate on thin margins. And when recoupment demands can be amplified by auditors through statistical extrapolation, where findings from a small sample are projected across a provider’s entire claims history, the results can be devastating. Cash flow can be disrupted in ways that force reduced Medicaid caseloads, location closures, and, in some cases, full practice shutdown. When a practice closes, low-income families lose access. For example, imagine an ABA center that serves 40 Medicaid-enrolled kids in a rural county with no other nearby providers; if an extrapolated recoupment demand forces them to close their doors, those 40 families could be left with no ABA provider within driving distance.

Fraud and Documentation Deficiencies Are Not the Same Thing
Real fraud exists in the ABA space. Providers billing for services never rendered, fabricating notes, and deliberately exploiting reimbursement structures are all cases that warrant enforcement. But fraud is not the dominant finding in the OIG audit series. The most common findings are documentation deficiencies: missing signatures, incomplete session notes, billing codes without sufficient documentation support, and supervision ratio disputes.

An improper payment is a Medicaid payment that does not comply with program requirements. Fraud requires intent. OIG audit reports classify findings as improper or potentially improper — a broader, less legally specific category than fraud. Conflating the two overstates provider culpability and obscures the role of unclear payor guidance in producing these gaps.

Consider a common scenario: a Board Certified Behavior Analyst (BCBA) supervises a Registered Behavior Technician (RBT) delivering a two-hour session. The RBT completes the session note the same day with treatment targets, client response, and duration all documented. The supervising BCBA reviews the note within 24 hours. But the BCBA’s co-signature is never added. From a clinical standpoint, the supervision happened. From an auditor’s standpoint, there is no documented evidence that a qualified supervisor reviewed the work. That claim is now at risk. Not because the service wasn’t provided, not because the note was fabricated, but because a single missing signature left the record unable to prove what everyone involved knows to be true.

BCBAs are already trained to collect precise, objective data on client behavior. The same rigor applies to session documentation. An auditor reviewing a claim is asking the same fundamental question a clinician asks of their data: what happened, and how do we know?

Why the Rules Are Genuinely Hard to Find

ABA providers billing Medicaid operate inside a complex, layered structure:

- - Federal Medicaid law establishes baseline requirements under the Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) benefit, which is the federal requirement ensuring children receive medically necessary services, including ABA.
  - Below this sit state Medicaid policy, Managed Care Organization (MCO) contracts (the insurance plans managing Medicaid benefits in most states), and payor-specific billing guidelines.
  - Requirements are distributed across provider contracts, reimbursement manuals, authorization policies, and portals that update without consistent notice.
  - States are home to multiple MCOs, each with requirements that frequently diverge from one another for the same billing codes.

In Massachusetts, for example, the state earlier this year directed its contracted MCOs to recover Medicaid payments from ABA providers that had not maintained a supervision ratio standard as a condition of payment. Provider associations pushed back immediately: The ratio had existed as a clinical guideline and had never been communicated as a condition of payment. Using it retroactively was not compliance enforcement. It was retroactive standard-setting. This underlying dynamic is not unique to Massachusetts.

What Providers Can Do Now

The honest answer to “Could this happen to me?” is yes, it could. Providers operating in good faith, documenting carefully, and supervising ethically may still face adverse audit findings when standards are not clearly written down in a form they can access or act on. That is not a reason to panic, but it is a reason to be deliberate. The providers best positioned to weather an audit are those who can demonstrate, through their records, that they took their obligations seriously. Strong documentation does not guarantee a clean audit. But it is the most defensible position available in the system as it currently exists.

For BCBAs, the documentation and supervision standards that matter in a Medicaid audit are not separate from existing professional obligations; they are an extension of them. The BACB Ethics Code already requires behavior analysts to supervise only within their scope of competence, to take on supervisory volume commensurate with their ability, and to maintain documentation of supervision contacts. A session note that clearly reflects what occurred, who delivered the service, and who reviewed it is not just a billing requirement. It is evidence of ethical practice.

Below are concrete steps you can take to improve compliance and protect your practice:

1. Audit your documentation against the most demanding payor requirements you can find in writing.
Do not aim for the average. Find the most specific, stringent documented standard in your payor mix and use it as your baseline. If your documentation passes the strictest written standard, it is more defensible against all of them. Where written standards don’t exist, documenting that you checked matters, too.

2. Request requirements in writing from every payor you contract with.

Ask your MCOs directly:

- - What elements are required in a valid session note for each Current Procedural Terminology (CPT) code you bill?
  - What supervision ratio is required as a condition of payment?
  - What are your RBT credentialing requirements?

Document every request, every response, and every non-response. If an audit ever challenges your documentation against a standard you tried to clarify and couldn’t get in writing, that record is directly relevant.

3. Build documentation habits that exceed minimum standards.

Complete session notes with all required elements, including supervisor co-signatures. Maintain supervision logs that capture dates, times, topics, and signatures for every supervision contact. Keep credentialing files current, not just at the BACB level, but by enrollment status at each individual plan. The gap between “credentialed” and “enrolled and current at this specific MCO” is where auditors find errors.

4. When you receive an audit notice, engage legal counsel immediately.

Appeal deadlines are strict, and the window to request a stay of recoupment is narrow — missing it can forfeit your right to contest findings. The moment an audit notice arrives, preserve all documentation:

- - session notes;
  - supervision logs;
  - credentialing records;
  - billing records;
  - prior authorization communications;
  - any written communications with payors about requirements; and
  - document every subsequent interaction with the payor or auditor.

Do not wait to see if the findings are significant before engaging counsel.

5. Advocate for audit clarity and fairness.

Provider associations can and do push back through legal channels when standards are applied retroactively or without adequate notice. The Massachusetts situation demonstrated this directly. Formal demand letters from provider associations create a record that shapes future policy. Joining associations, staying current on audit developments, and adding your voice to the industry conversation contribute to a system that is fairer for every provider — and ultimately, for every family depending on access to care.

We hope you found these suggestions helpful. Medicaid audits are not going away, and neither is the complexity of the system providers are expected to navigate. You cannot control every policy change or prevent every audit, but you can control how well your practice prepares. Clear documentation, careful supervision, written communication with payors, and routinely asking questions can make your practice more defensible when the rules seem unclear. Ultimately, audit readiness should not be about practicing defensively but being able to demonstrate that the services you provided was ethical, clinically appropriate, and properly documented.

Author note: Office Puzzle builds practice management software designed specifically for ABA providers navigating exactly these compliance demands. Learn more at officepuzzle.com.

References

Behavior Analyst Certification Board. (2020). Ethics code for behavior analysts. https://www.bacb.com/wp-content/uploads/2022/01/Ethics-Code-for-Behavior-Analysts-240830-a.pdf

Behavior Analyst Certification Board. (2026). Ethics codes. https://www.bacb.com/ethics-information/

Cato Institute. (2026, April 2). The Autism Therapy Gold Rush. https://www.cato.org/blog/autism-therapy-gold-rush

Centers for Medicare & Medicaid Services. (2014, July 7). Coverage of behavioral health services for children, youth, and young adults with significant mental health conditions (CIB-07-07-14). U.S. Department of Health and Human Services. https://www.medicaid.gov/sites/default/files/Federal-Policy-Guidance/Downloads/CIB-07-07-14.pdf

Centers for Medicare & Medicaid Services. (n.d.). Federal Policy Guidance. U.S. Department of Health and Human Services. https://www.medicaid.gov/federal-policy-guidance

Massachusetts Association for Behavior Analysis. (2016, October 16). Updated ABA performance specifications. https://www.massaba.net/wp-content/uploads/Updated-ABA-Perfomance-Specifications-Oct16.pdf.

North Carolina Department of Health and Human Service. https://medicaid.ncdhhs.gov/policy-paper-ensuring-person-centered-care-children-autism-spectrum-disorder-nc-medicaid-program/open

U.S. Department of Health and Human Services, Office of Inspector General. (2026, February). Colorado’s fee-for-service Medicaid payments for applied behavior analysis (Report No. A-0924-02004). https://oig.hhs.gov/documents/audit/11493/A-09-24-02004.pdf

U.S. Department of Health and Human Services, Office of Inspector General. (2023). Indiana made improper Medicaid payments for applied behavior analysis services (Report No. A-06-23-01002). https://oig.hhs.gov/documents/audit/10497/A-06-23-01002.pdf

U.S. Department of Health and Human Services, Office of Inspector General. (n.d.). Audits of Medicaid Applied Behavior Analysis for Children Diagnosed with Autism. https://oig.hhs.gov/reports/work-plan/browse-work-plan-projects/srs-a-25-029/

U.S. Department of Health and Human Services, Office of Inspector General. (2026, January 22). HHS OIG audit finds Maine made at least $45.6 million in improper Medicaid payments for autism services. https://oig.hhs.gov/newsroom/news-releases-articles/hhs-oig-audit-finds-maine-made-at-least-456-million-in-improper-medicaid-payments-for-autism-services/

Reference for this article:

Jardines, H. (2026). Clinical Corner: What do I need to know about fraud and ABA billing? Science in Autism Treatment, 23(10).

Related Articles:

What Do I Need to Know About Fraud and ABA Billing?