Colorado OIG Audit: $285 Million in Improper ABA Payments — The Largest Yet

$285 Million. 100% Failure Rate. Zero Surprises.

The Department of Health and Human Services’ Office of Inspector General just released its fourth state audit of Medicaid payments to ABA providers. This time: Colorado. The finding: at least $285.2 million in improper and potentially improper payments across 2022 and 2023.

That’s not a typo. That’s more than the first three audits combined.

And the hit rate is the same as every audit before it: 100 out of 100 sampled enrollee-months contained one or more improper or potentially improper claim lines. Four states audited. Four states with a 100% deficiency rate. The pattern isn’t emerging anymore — it’s confirmed.

The Running Scorecard

HHS OIG announced in 2022 that it would audit Medicaid ABA payments in seven states. Four are now complete:

Three more states remain. The project titles are still unpublished — OIG doesn’t reveal audit targets until reports are posted. But if the first four are any indication, every remaining audit will find the same thing.

What They Found in Colorado

The OIG’s findings follow the same pattern seen in Indiana, Wisconsin, and Maine. Colorado’s payments for ABA services did not fully comply with federal and state requirements. The specific deficiencies:

1. Session notes didn’t support the CPT codes billed. Providers billed CPT codes — primarily 97153 (adaptive behavior treatment by technician) and 97155 (treatment with protocol modification) — but the session documentation didn’t justify the specific code used.

2. Session notes didn’t support the number of units billed. Providers billed for more units than the documentation could substantiate.

3. Missing session notes entirely. For some dates of service, there were no session notes at all. Claims went out. Payment was received. Documentation didn’t exist.

4. Missing provider signatures. Session notes that did exist were missing the rendering provider’s signature — a basic federal requirement.

The OIG made five recommendations, including that Colorado refund $42.6 million to the federal government, provide additional guidance to ABA facilities on documentation and billing requirements, and conduct periodic post-payment reviews statewide.

Colorado disagreed with one recommendation, agreed with three, and partially agreed with one.

Why This Keeps Happening

The OIG report points to two systemic failures on the state side:

1. Colorado didn’t require providers to document how they resolved issues with or made changes to treatment protocols when providing one-to-one treatment. Without this requirement, there was no mechanism to verify that 97155 billing (protocol modification) reflected actual clinical decision-making.

2. Colorado didn’t perform post-payment reviews. The state was paying claims and never going back to check whether the documentation existed to support them. By the time OIG showed up, years of unchecked claims had accumulated.

But the state-level failures only explain why it wasn’t caught. The provider-level failures — missing notes, unsupported CPT codes, absent signatures — are the actual problem.

And this is where STAT’s 2022 investigation provides critical context. That investigation found that a rapid influx of private equity investment in ABA contributed to providers routinely overbilling while providing substandard treatment. The financial incentive structure rewarded volume over documentation quality. When your business model optimizes for billable hours and your compliance infrastructure doesn’t keep pace, this is what the data looks like when auditors arrive.

The Domino Effect Is Already Happening

Every OIG audit that drops gives state Medicaid agencies more ammunition to cut rates, cap hours, and tighten authorizations. This isn’t theoretical — it’s already playing out:

Nebraska explicitly cited the Indiana OIG report when it imposed a 30-hour-per-week cap and slashed reimbursement rates by up to 48%. ABA Medicaid spending in Nebraska had grown 1,700% in four years.

Indiana implemented a 30-hour weekly cap and formed a Governor’s working group recommending lifetime caps on care hours.

New York has legislation proposing 680-hour annual caps on ABA. A 25% rate reduction is being phased in — and 72% of providers surveyed said they’d exit Medicaid if the second cut takes effect.

North Carolina attempted a 10% provider payment cut after ABA Medicaid spending surged 423% in four years. Families sued.

Colorado was already facing provider and parent lawsuits over prior authorization requirements and rate reductions — before this $285 million audit dropped. This report hands the state a quarter-billion dollars worth of justification to accelerate those changes.

Idaho removed ABA from its behavioral health managed care program entirely.

And at the federal level, the One Big Beautiful Bill Act signed in July 2025 cut Medicaid funding by 15% over ten years. The CBO estimates 11.8 million people will lose Medicaid coverage. States that were already looking for ways to reduce ABA spending now have even less room in their budgets.

The Documentation Problems Are Specific and Fixable

Here’s what’s worth noting about every OIG audit in this series: the findings aren’t about whether ABA therapy is medically necessary. The OIG explicitly states it did not conduct medical reviews to evaluate clinical necessity. The findings are about documentation.

Session notes that don’t match CPT codes. Units billed without supporting records. Missing signatures. Missing notes for billed dates of service. Treatment modifications billed without documentation of what was modified or why.

These are process failures, not clinical failures. And they’re the kind of process failures that software is designed to prevent.

A system that requires session notes before a claim can be generated. That validates CPT code selection against the documentation entered. That flags unsigned notes before they leave the building. That connects treatment plan modifications to specific session documentation. That makes it structurally impossible to bill a date of service with no corresponding note.

This isn’t a feature wishlist. It’s the difference between surviving an audit and being the next state on this list.

Three More Audits Are Coming

OIG has three more states in the pipeline. We don’t know which ones. But we know, with 100% certainty based on every audit completed so far, that they will find improper payments.

The question for every ABA practice in the country isn’t whether your state will face scrutiny. It’s whether your documentation will hold up when it does.

The OIG auditors are methodical. They sample enrollee-months. They pull every claim line. They request session notes and match them to CPT codes, unit counts, dates of service, and signatures. They meet with the state agency to discuss what they expect to see.

If your session notes can’t survive that process, the time to fix it is before the audit letter arrives — not after.

Questions about whether your documentation practices would survive an OIG-style audit? Reach out at [email protected] — we’ll walk through it with you.

Follow us on LinkedIn and X for more industry updates.