CMS Just Released a New ABA Toolkit. Here’s What It Includes and What It Could Mean for Medicaid
- Ashleigh Evans (BCBA)
- 2 days ago
- 17 min read
The Centers for Medicare & Medicaid Services (CMS) recently released a new State Medicaid & Children’s Health Insurance Program Applied Behavior Analysis Toolkit, giving states a framework for evaluating and managing ABA services.
This 173-page toolkit covers everything from ABA clinical standards and appropriate levels of care intensity to documentation and fraud, waste, and abuse prevention.
For ABA providers, the most important takeaway is that this is not a new federal set of requirements. Instead, the toolkit outlines recommendations from the federal government that states can take into consideration as they develop, oversee, and evaluate their ABA therapy programs.
As Medicaid utilization grows, CMS is signaling a stronger focus on individualized care, measurable outcomes, documentation quality, provider oversight, and program integrity.
So, what does that mean for ABA providers, practice owners, BCBAs, and clinical leaders? Here’s what the new CMS ABA Toolkit includes, and what it could mean for the future of Medicaid-funded ABA.
CMS ABA Toolkit: Quick Guide
02 · Key Areas of Focus | |
What the toolkit is, why CMS created it, and what it does not change → |
What providers should consider in their clinical and operational practices → | Additional resources → |
What Is the New CMS ABA Toolkit?
The State Medicaid & Children’s Health Insurance Program Applied Behavior Analysis Toolkit was published by CMS in August 2026. CMS describes the toolkit as a resource for state Medicaid and CHIP agencies to use when developing, implementing, and overseeing ABA services for beneficiaries with autism.
The toolkit comes at a time of increased federal scrutiny of Medicaid ABA spending. Recent federal and state audits have identified improper payments and compliance concerns related to ABA services, including problems with documentation, medical necessity, provider qualifications, and billing. The HHS Office of Inspector General’s ongoing ABA audits have examined these issues across multiple states.
The toolkit is organized into seven chapters:
Applied Behavior Analysis Overview
Applied Behavior Analysis Clinical Standards
Medicaid and CHIP Policy and Coverage to Treat Autism Spectrum Disorder
Medicaid Payment Approaches for Applied Behavior Analysis
Applied Behavior Analysis Provider Qualifications, Credentialing, Enrollment, and Ownership
Applied Behavior Analysis Utilization Management
Preventing Applied Behavior Analysis Fraud, Waste, and Abuse
It also includes state checklists, suggested practices, CPT rates by state, and more.
Important: What the Toolkit Does Not Do
Before getting into the details, it’s important to understand what the toolkit does not do.
The toolkit does not create new federal requirements for ABA providers, establish a national standard of care, or automatically change how Medicaid covers or reimburses ABA services. Instead, it offers recommendations and considerations that states may use when developing or evaluating their own Medicaid ABA programs.
A recommendation in the toolkit doesn't automatically become a requirement for providers. Any changes to Medicaid coverage, authorization, documentation, utilization management, or other requirements would depend on actions taken by individual states. Keep this distinction in mind as you review the recommendations that follow.
That said, providers shouldn't dismiss the toolkit simply because it doesn't establish new mandates. The recommendations offer a window into the issues CMS believes deserve greater attention as ABA spending and utilization continue to increase.
For practice owners and leaders, the toolkit is worth reviewing as a potential preview of where state Medicaid oversight could be headed.
Utilization Trends: ABA Spending Is On The Rise
One of the clearest themes throughout the CMS toolkit is the rapid growth in Medicaid spending on ABA services.
In 2025 alone, Medicaid paid approximately $10.11 billion for ABA services, an increase of approximately 421% since 2021 (CMS, 2026, p. 15).
Interestingly, $1.47 billion (14.5%) of total Medicaid ABA spending was associated with services provided to beneficiaries with conditions other than autism (CMS, 2026, p. 16).
What's Driving the Increase?
The growth in spending isn't necessarily evidence of widespread inappropriate utilization. CMS acknowledges several factors contributing to the increase, including:
ABA being a mandated service for fully insured, state-regulated health plans
ABA-specific CPT code creation
CMS' 2014 guidance clarifying that ABA, among other treatment modalities, should be covered by Medicaid to treat ASD
Increasing numbers of children diagnosed with ASD
Increased awareness and demand for ABA
At the same time, the toolkit highlights that expenditures are also influenced by how many hours are being prescribed and for how long, with stakeholders expressing concerns that hours are getting prescribed as a standard approach, rather than individualized to the learner (CMS, 2026, p. 17).
Which States Have The Highest ABA Spending?
Data on statewide ABA spending from 2023-2025 shows that Florida accounted for substantially more Medicaid ABA spending than any other state—nearly 5 billion more than the next-highest state, Indiana (CMS, 2026, p. 16).
Florida: $6.57 billion
Indiana: $1.65 billion
North Carolina: $1.53 billion
Georgia: $1.36 billion
Pennsylvania: $1.25 billion
A Rising Number of ABA Providers
The number of ABA providers who rendered and billed ABA services has significantly increased over the last few years.
In 2025, 134,186 providers delivered ABA services, up from 29,293 in 2021.
Annual Payments for ABA
On average in 2025, Medicaid spent $21,203 per recipient for ABA therapy. This figure has climbed over recent years, up from $8,093 per person in 2021.
Tying ABA Services to a Confirmed ASD Diagnosis
One area where CMS is calling for greater oversight is the connection between an individual’s diagnosis, functional needs, and eligibility for ABA services. The toolkit recommends that states require a diagnostic evaluation confirming an autism diagnosis before initiating ABA services.
CMS acknowledges that there are currently no universally established standards for diagnostic reevaluations. However, the toolkit suggests that states consider requiring reevaluations “to ensure that services and treatment are appropriate” (CMS, 2026, p. 26).
Individualized Treatment Plans
If there's one theme that runs throughout the toolkit, it's the expectation that ABA services should be both individualized and supported by clinical documentation. Recent audits have highlighted many documentation deficiencies in session notes. The CMS toolkit extends that scrutiny to the quality of the treatment plan itself.
This is where ABA providers may want to take note! While it's important to reiterate that the toolkit doesn't establish new standards of care, it does offer insight into the types of documentation and clinical decision-making that CMS believes states should consider when developing and overseeing their ABA programs.
Providers may want to use these recommendations as an opportunity to evaluate whether their own treatment plans clearly demonstrate why the recommended services are medically necessary, how they are individualized to the learner, and how progress will be measured.
What Should an ABA Treatment Plan Include?
According to CMS, an appropriate treatment plan should include:
Assessment results and a reassessment schedule
Measurable, functionally relevant goals for the child and caregiver, with mastery criteria that target core ASD-related deficits; baselines should be established at the initial assessment
Planned treatment activities and hours (defined as direct ABA hours per week, excluding supervision, caregiver training, and other services), as well as any necessary equipment; caregiver training should be documented separately
Anticipated treatment duration (to prevent open-ended authorizations without time-bound goals), as well as a description of a transition plan
A plan to monitor progress and modify goals as needed while avoiding the use of ABA as a custodial, respite, or educational substitute
Updates to the plan should:
Describe the child’s response to activities using established outcome measures, not provider-created measures
Identify when a child’s goals are completed or when progress stalls, and
Indicate when a caregiver makes progress in, or has challenges with, meeting goals (CMS, 2026, p. 34).
Treatment Plan Red Flags
CMS also identifies several treatment plan red flags that states may consider potential indicators of erroneous or improper billing, including:
Overlapping treatments
Lack of adaptation to personal needs
Excessive service hours and excessive service hours that continue without documented improvement in outcomes
Identical documentation across individuals by provider or clinic
Reevaluations that do not reflect progress or without adjustment to care plan
Participation in group therapy that accounts for more than 10 percent of treatment time
Interventions and goals that are inappropriate for the age of the individual
High staffing ratios without clinical justification (e.g., two ABA providers working with one child at a time)
Lack of parent/caregiver engagement (CMS, 2026, p. 34).
Key Takeaway: Avoid “Cookie-Cutter” Treatment Plans
Person-Centered Planning
CMS also highlights the importance of person-centered planning. The toolkit notes that person-centered planning is not consistently required within state ABA programs and connects the absence of such requirements with the potential for “cookie-cutter” approaches, including assigning a default number of treatment hours rather than tailoring services to the individual's needs (CMS, 2026, pp. 35–36). Individualization should be visible within the record.
Intensity of Care
The appropriate intensity of ABA has been a central topic of discussion across the field, particularly around the use of a standard prescription of 30–40 hours of ABA per week. The question of how many hours of ABA an individual should receive is also a focus of the CMS toolkit.
40 Hours is Not Best Practice
One of the most notable statements in the toolkit is CMS's position that 40 hours of ABA per week shouldn't be considered a default best practice.
The toolkit states:
"Forty hours of ABA per week is not a best practice because it places states and managed care plans at risk of negative audit findings or other financial review penalties because children must be allowed time for activities of daily living such as toileting, napping, and eating, among others." (CMS, 2026, p. 36)
Key Takeaway: High-hour requests may face greater scrutiny. Providers should be prepared to demonstrate why the requested intensity is medically necessary for the individual, how it connects to treatment goals, and why that level of care is appropriate given the individual's other daily activities and needs.
Factoring in Non-Therapy Activities
The toolkit also recommends that states consider whether high-intensity ABA schedules allow individuals adequate time for activities outside of treatment. CMS identifies several practices that states and managed care plans could consider addressing, including:
Establishing a policy that prohibits more than a specified number of consecutive units of ABA from being delivered without a break
Considering whether to prohibit consolidated billing, in which multiple 15-minute units are billed under a single claim line (CMS, 2026, pp. 36–37)
For providers, this is a reminder that the total authorized hours is only part of the equation. How those hours are scheduled and delivered is likely to receive more attention as states evaluate ABA utilization.
How Should ABA Hours Be Determined?
The toolkit acknowledges a lack of an established consensus on the appropriate number of ABA hours per week. However, it provides examples of how treatment intensity could be aligned with the levels of support needs identified during an individual's diagnostic evaluation:
Level 1: 10 hours/week
Level 2: 20 hours/week
Level 3: 30 hours/week (CMS, 2026, p. 37)
It's worth noting that this framework lacks scientific backing. The level of support needs is not sufficient to indicate a specific learner would benefit from a set number of hours.
The big takeaway was that higher-intensity services shouldn't be authorized by default and should include supporting documentation. The toolkit states:
"Services at higher intensity levels should not be authorized by default and should only be authorized based on the ITP’s documentation of needs and goals that warrant extensive treatment. These high-intensity weekly treatment schedules leave virtually no time for nontreatment activities like schooling and family time and can easily take on the characteristics of respite care and childcare." (CMS, 2026, p. 38)
Key Takeaway: Hours Should Follow Clinical Need
The broader message for providers is that ABA hours should be driven by the individual's documented clinical needs. When requesting a high number of hours, providers should be prepared to clearly connect the requested hours to the individual's functional needs, treatment goals, progress data, and expected outcomes, while demonstrating that the proposed schedule allows adequate time for nontreatment activities.
The Average # of Hours Per Client
In 2025, the average number of hours delivered to Medicaid beneficiaries with an ASD diagnosis was 17.33/week.
2021: 14.24/week
2022: 15.65/week
2023: No data provided
2024: 17.37/week
2025: 17.33/week (CMS, 2026, p. 40).
ITP Reevaluations
CMS recommends that states establish specific time points for treatment plan re-evaluation as a condition of continued ABA coverage. In addition to regular intervals, they recommend additional reevaluations be completed in certain circumstances, including:
When treatment stalls
When the maximum number of hours is requested, but the client's severity doesn't align with that request
When the individual's medical condition changes (CMS, 2026, p. 41)
Evidence-Based Outcome Assessments for ABA
The toolkit covers a section on outcome assessment for ABA services. They recommend that the best practice is for states to require the use of at least one of these outcome assessments to evaluate progress. CMS refers to these as standardized assessments. However, they're actually criterion-referenced skill assessments.
ABLLS-R: Ages 0-12
AFLS: Ages 2 and up
Essential for Living: Children and adults
PEAK: Ages 2 and up
VB-MAPP: Ages 0-48 months (CMS, 2026, p. 42)
ABA in Schools
The CMS toolkit also addresses ABA services provided in school settings, emphasizing the need for states to clearly define when school-based ABA can be billed to Medicaid and how those services should be coordinated with services funded through the education system.
Fee-For-Service versus Value-Based
Another area to watch is how ABA services are paid for. The toolkit notes that fee-for-service (FFS) payment models can create incentives that encourage service volume (e.g., a high number of hours) rather than outcomes. Conversely, value-based care (VBC) models tie some portion of reimbursement to quality, performance, or outcomes.
The toolkit provided a few ideas for how VBC arrangements could look in ABA. These include:
Provider training & certification: Higher payments to providers who achieve specific milestones may create incentives for providers to add to their professional skills, leading to a more prepared and competent workforce.
Process measures: States could reward providers for meeting process measures. They would expect states to evolve from rewarding ABA providers for foundational process measure reporting to outcomes and quality measure reporting.
Episodes of care: This would entail diagnosis-based pre-established payment amounts for certain services provided in a specified period of time. That would require using expert panel clinical standards to define the diagnoses, included services, and treatment time limits.
Risk-sharing models: Rewarding providers with gainsharing rewards when they achieve savings and meet performance targets. On the opposite end of this model, agencies could impose penalties when costs exceed pre-established targets (CMS, 2026, pp. 74-75).
What Could This Mean for ABA Providers?
A greater emphasis on outcomes could eventually change how value is demonstrated in ABA. If states begin asking not only how many service hours were delivered, but what outcomes those services produced, providers will need reliable ways to measure, document, and communicate meaningful progress.
Provider Licensure
Provider qualifications and oversight are another area where CMS recommends greater state-level oversight. CMS recommends that states require state licensure for independent ABA providers, with BACB certification serving as a baseline prerequisite (CMS, 2026, p. 83).
For providers and practice owners in states without licensure, this is worth watching because state licensure requirements could create additional compliance obligations in states that don't currently have them.
Guidance on Supervision Hours
also provides recommendations for the amount of clinical supervision provided relative to direct treatment. CMS recommends one to two hours of case supervision for every 10 hours of direct treatment, or approximately 10–20% (CMS, 2026, p. 85). For providers using a three-tier model of care, CMS recommends that the BCBA maintain a minimum of 25% of supervision across their caseload.
They call out the following as reasons additional supervision may be needed:
Rapid progress or a lack of progress that requires the treatment plan to be adjusted
Barriers to accessing care that require additional clinical problem-solving or adaptation of the treatment plan
Severe behavior or other clinical complexities
The early stages of assessment or treatment
Transitions within the treatment plan
Changes in direct treatment hours that increase the need for clinical oversight (CMS, 2026, p. 87).
The Use of Telehealth
Telehealth is another area where state Medicaid policies vary. CMS reports that 22 state Medicaid programs currently allow telehealth for ABA without major restrictions. The other 28 impose conditional access, such as requiring an in-person assessment before allowing telehealth. Their recommendations for telehealth as a delivery modality of ABA include:
Diagnostic and treatment authorization visits should still occur in person
Telehealth should be primarily used for caregiver coaching, supervision, and team meetings or progress reviews
Direct care via telehealth should be limited to older kids with strong attending skills and programs that don't rely on physical engagement or prompting.
Supervision policies should include a minimum in-person supervision requirement (CMS, 2026, pp 91-93).
Agency Accreditation
The ABA toolkit identifies accreditation as a best practice, noting that accreditation can promote greater transparency and consistency in the quality of services provided. They highlight the Autism Commission on Quality (ACQ) as the only active ABA-specific accreditor for practices (CMS ABA Toolkit, p. 96).
For practice owners, this is another recommendation worth watching. Some states, such as Massachusetts, have already announced upcoming requirements for ABA providers to be accredited. Practice owners may want to familiarize themselves with the standards and evaluate how their policies, documentation, and processes compare.
Key Takeaway: Accreditation could gain importance
Private Equity On The Rise
A commonly echoed concern across the industry has been the rapid increase in private equity-owned chains of ABA providers. CMS reports that the 12 largest of these chains employ at least 30,000 employees across 1,300 locations (CMS, 2026, p. 97). The toolkit notes concerns raised by stakeholders about whether rapid organizational growth and financial incentives could create risks for quality of care, appropriate utilization, and clinical oversight.
Utilization Reviews
The toolkit devotes significant attention to utilization management, outlining the factors states should consider when determining whether requested ABA services are medically necessary and appropriate.
According to CMS, utilization reviews should consider whether:
The diagnostic evaluation documents the individual’s functional impairments in communication, behavior, and social skills, and is completed by a provider qualified to administer assessment tools and interpret the results.
A diagnosis or identified clinical condition is supported by the diagnostic evaluation, and any ASD diagnosis is based on criteria in the DSM-5-TR296 and made by a qualified provider acting in the scope of their practice.
ABA is clinically appropriate for the identified needs of the individual and the proposed ITP is consistent with generally accepted standards of care for ASD.
The requested services are tied to the functional needs of the individual rather than the diagnosis alone.
The ITP is appropriate and based on the treatment goals and expected functional outcomes for the individual with ASD.
The ITP identifies the proposed level, intensity, duration, and setting of services and includes baseline assessments and individualized, measurable goals based on identified functional deficits (CMS, p. 106).
They further state that best practice is for states to establish a comprehensive utilization managenment process that includes:
Prior auth before services begin,
Concurrent review while services are being delivered, and
Reuthorization near the end of the approved period (CMS, 2026, p. 111).
Key takeaway: Expect increased scrutiny and be prepared to share your clinical rationale.
Safeguarding Against Fraud, Waste, and Abuse
The final chapter focuses heavily on fraud, waste, and abuse, and how states can strengthen program integrity without restricting medically necessary care from those who need it.
Importantly, CMS acknowledges that not all improper payments are considered fraud. Errors, like a lack of sufficient documentation, may not be blatant fraud, but rather a sign of a systems failure (CMS, 2026, p. 117).
CMS recommended that states systematically analyze claims and utilization data to shift from reactive models, where a practice is audited and required to payback funds to a preventive model. Data analytics can tell an important story in identifying patterns when it comes to high-frequency and long-duration treatment (CMS, 2026, p. 119).
What Could Trigger Additional Scrutiny?
According to CMS, potential indicators for aberrant billing include:
High service hours per beneficiary (i.e., 32 units per day/40 hours per week)
Technician-to-supervisor ratios that exceed expected norms
Rapid growth in billing following provider enrollment
Claims clustering around supervision codes or modifiers
High-volume providers (i.e., maximum number of hours are billed for 80% or more of patients) with limited credentialed supervisory staff
Excessive use of telehealth or supervision conducted via telehealth (CMS, 2026, pp. 120-121)
Prepayment Safeguards
CMS outlines several safeguards states can use to prevent improper payments, including
Authorization matching: verifying that a submitted claim has a corresponding and valid prior authorization on file.
Automated hour limits: system edits that automatically pend claims exceeding a reasonable daily or weekly hour limit.
Service overlap edits: controls that detect duplicate claims or when claims indicate a provider is providing services in two places at once.
Coding integrity: States are required by the Affordable Care Act to incorporate the methodologies of the National Correct Coding Initiative (NCCI) to promote national correct coding methodologies and control improper coding. NCCI includes several types of automated edits:
Procedure-to-Procedure (PTP) edits to prevent improper payment when certain procedures are billed together
Medically Unlikely Edits (MUEs) that define a maximum number of units of service that can be reported for a single code on a single day
Add-on Code Edits to ensure proper payment with their corresponding primary procedure codes (CMS, 2026, pp. 122-123)
EVV as a Potential Safeguard
CMS encourages states to utilize electronic visit verification (EVV) to validate that services were delivered as billed. Currently, federal law only requires EVV to be implemented for personal care services and home health services (CMS, 2026, pp. 123-124).
Clinical Documentation
Documentation is a major focus of the toolkit. CMS recommends that states establish minimum documentation requirements that include:
A comprehensive treatment plan tied to assessment results and medical necessity determinations
Detailed progress notes that document the services rendered, including the date, duration of session, and activities performed
Supervision logs verifying oversight and compliance (CMS, 2026, p. 124).
Worth Clarifying: The toolkit points to recent federal and state audits that identified documentation deficiencies as a significant source of improper payments. However, there is an important distinction to make here.
The toolkit states that some audits found that 100% of claims were lacking documentation. However, the underlying OIG audit referenced by CMS does not establish that 100% of all claims lacked documentation (CMS, 2026, p. 125). The OIG report actually states that all 100 sampled enrollee-months included payments for one or more claim lines that were improper or potentially improper. This means that every sampled month contained at least one potentially improper claim line; it does not mean that every claim reviewed lacked documentation (OIG, 2026).
CMS encourages states to establish more guidance on documentation expectations and what constitutes billable ABA services, and ensure providers receive training on these requirements.
According to the toolkit, session documentation should provide enough detail to demonstrate that:
The service was provided, with a date, duration, and location
The service delivered was consistent with the TP
The services billed are supported by the documentation
The rendering provider and supervising clinician meet program requirements (CMS, 2026, p. 125)
Is Your Documentation Audit-Ready?
Now is the time to make sure your documentation meets the standards and requirements payors expect to see.
Brellium helps ABA providers identify documentation gaps before they become compliance issues.
Every note is automatically measured against your payor policies, regulatory requirements, and internal quality standards, helping you maintain a defensible, audit-ready record.
Post-Payment Audits
CMS highlights robust auditing to detect and correct improper payments, including:
Review of complete medical records and supporting documentation
Validation of medical necessity and alignment with authorized services
Verification of provider credentials and supervision requirements
Reconciliation of claims with EVV and other service verification data, where applicable (CMS, 2026, p. 128).
Key takeaway: Post-payment audits are likely to rise. Ensure your documentation is audit-ready!
Top Takeaways for ABA Providers
The CMS ABA Toolkit provides a clear indication of where Medicaid ABA oversight is likely headed. While no new requirements are established as an immediate result of this toolkit, providers can use this information to proactively strengthen their practices.
Top takeaways include several areas providers may want to prioritize:
Strengthen medical necessity: Ensure treatment plans clearly connect services to the individual’s needs, goals, and measurable outcomes.
Improve documentation quality: Make sure clinical documentation supports the services billed and demonstrates ongoing progress. Conduct regular internal audits to ensure nothing slips through the cracks.
Review utilization: Monitor service intensity, trends, and outliers to ensure care remains appropriate and individualized. If you have clients receiving a high number of weekly hours, ensure the level of care is clinically justified, supported by documentation, and regularly reassessed based on the individual’s progress and needs.
Note: Avoid cookie-cutter hour prescription policies. Service intensity should be based on each client’s individual clinical needs, goals, progress, and response to treatment, not a blanket 30-40 hours of care for everyone.
Strengthen provider oversight: Maintain clear supervision, credentialing, and clinical oversight processes across the care team.
Prioritize program integrity: Regularly review billing and operational practices for compliance gaps before they become larger issues.
For ABA providers, the opportunity is to get ahead of these changes rather than wait for new requirements, audits, or payment policies to force them. Practices that can clearly demonstrate why services are needed, how they're being delivered, and what outcomes they produce may be better positioned as Medicaid programs evolve.
The toolkit may be guidance today, but the practices it emphasizes could shape the future of Medicaid ABA.
Additional Resources for ABA Providers
CASP ASD Practice Guidelines: Guidelines from CASP on the standards of care in ABA for providers delivering care to autistic individuals.
ABA Practice Toolkit for ABA Providers & Clinical Leaders: 10 resources for ABA providers to guide quality operations, from compliance to supervision resources.
ABA Compliance Checklist: Ensure audit-readiness with this compliance checklist.
ABA Claim Denial Prevention Checklist: Catch denials and the source.
EVV Compliance Guide: A practice guide to electronic visit verification.
Sign up for email updates from ABA Resource Center
References
Centers for Medicare & Medicaid Services. (2026). State Medicaid & Children’s Health Insurance Program applied behavior analysis toolkit. U.S. Department of Health and Human Services. https://www.medicaid.gov/medicaid/downloads/autism-services-aba-toolkit.pdf
U.S. Department of Health and Human Services, Office of Inspector General. (2026). Audits of Medicaid applied behavior analysis for children diagnosed with autism. https://oig.hhs.gov/reports/work-plan/browse-work-plan-projects/srs-a-25-029/
Partnership & Transparency Disclaimer
The content we share on ABA Resource Center is reader-supported. This means that if you click on certain links and make a purchase, we may earn a small referral fee. Rest assured, we only recommend tools, resources, and services that we genuinely believe add value to the ABA field.
Comments