The OIG Audit Trail: What 4 State Audits Mean for Your ABA Practice's Documentation \| StreamABA [ ![StreamABA](https://streamaba.com/build/assets/logo-dark-Bta4omRy.svg) ](/) [Home](https://streamaba.com) [Blog](https://streamaba.com/blog) [ Log in ](https://streamaba.com/login) [ Goto the Live Demo ](#get-started) [Home](https://streamaba.com) [Blog](https://streamaba.com/blog) [Log in](https://streamaba.com/login) [ Goto the Live Demo ](#get-started) 1. [Blog](https://streamaba.com/blog) 2. / 3. The OIG Audit Trail: What 4 State Audits Mean for Your ABA Practice's Documentation compliance The OIG Audit Trail: What 4 State Audits Mean for Your ABA Practice's Documentation ===================================================================================== HHS OIG found documentation failures in 100% of sampled ABA claims across Indiana, Wisconsin, Maine, and Colorado. This post maps the five most common failures to specific CPT codes and explains what practice management software should be catching before claims are submitted. 9 min read March 11, 2026 StreamABA Team Share [ ](https://x.com/intent/tweet?url=https%3A%2F%2Fstreamaba.com%2Fblog%2F2026%2F03%2Foig-audit-trail-documentation-failures-by-cpt-code&text=The+OIG+Audit+Trail%3A+What+4+State+Audits+Mean+for+Your+ABA+Practice%27s+Documentation) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fstreamaba.com%2Fblog%2F2026%2F03%2Foig-audit-trail-documentation-failures-by-cpt-code) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fstreamaba.com%2Fblog%2F2026%2F03%2Foig-audit-trail-documentation-failures-by-cpt-code) compliance audits documentation billing medicaid cpt-codes ![](/images/blog/2026/03/oig-audit-trail-documentation-failures-by-cpt-code.jpg) The WSJ Just Made This Everyone’s Problem ----------------------------------------- On March 10, the *Wall Street Journal* published an investigation into Medicaid-funded ABA therapy that landed in every practice owner’s inbox. The headline: direct Medicaid payments for ABA more than tripled to **$2.2 billion** between 2019 and 2023. Federal auditors found documentation errors in **every single claim they sampled** across four states. One Indiana provider collected **$29 million in a single year** to treat 84 children — roughly $340,000 per patient — with hourly reimbursements that hit $640, sometimes for therapy delivered by workers with only a high school diploma. Within 48 hours, Benesch’s healthcare team published an advisory telling providers to “audit documentation, train staff, and review operational sustainability.” CASP issued a response acknowledging that “fraud, waste, and abuse occur in ABA — and it has to stop.” The *Journal*‘s investigation cited the same four HHS OIG audits we’ve been [tracking on this blog](/blog/colorado-oig-audit-285-million-improper-aba-payments). But here’s the gap: everyone is telling you to fix your documentation. Nobody is telling you specifically what the auditors found wrong, which CPT codes the failures map to, and what your systems should be catching before a claim ever leaves the building. That’s what this post does. Four States. 400 Samples. 400 Failures. --------------------------------------- HHS OIG announced in 2022 that it would audit Medicaid ABA payments in seven states. Four audits are now complete. In each one, the OIG pulled 100 enrollee-months and examined every claim line. The results are identical across all four: StateAudit PeriodImproper PaymentsPotentially ImproperTotalSamples with Deficiencies**Indiana**2019–2020$56M+—$56M+100/100**Wisconsin**2021–2022$18.5M$94.3M$112.8M100/100**Maine**2019–2023$45.6M—$45.6M100/100**Colorado**2022–2023$77.8M$207.4M$285.2M100/100 Four hundred sampled enrollee-months across four states. Four hundred with at least one deficiency. That’s not a regional problem. It’s an industry-wide documentation crisis — and the OIG has three more audits in the pipeline. The Five Documentation Failures That Show Up Everywhere ------------------------------------------------------- Read across the four audit reports and the same five categories of failure appear in every one. These aren’t edge cases. They’re the core findings. ### 1. Session Notes Don’t Support the CPT Code Billed This is the most common finding in every audit. Providers billed a specific CPT code, but the session documentation didn’t justify it. The most frequent version: a provider bills **CPT 97155** (adaptive behavior treatment with protocol modification by a BCBA) but the session note describes routine 1:1 treatment delivery — which is **97153** (adaptive behavior treatment by protocol, delivered by a technician). In Wisconsin, the OIG specifically noted provider confusion about when 97155 is appropriate. The state’s own guidance muddied the waters by saying 97155 could be billed when a supervisor merely *observes* a technician — even without a protocol modification. In Colorado, 96 out of 100 sampled enrollee-months included services that were “not fully described” in the documentation. The notes existed, but the content didn’t match the billing code. **What this looks like in practice:** A BCBA observes an RBT running a program. The BCBA bills 97155 because they were present and providing oversight. But the note doesn’t document any clinical decision-making, protocol adjustment, or treatment modification — just observation. The CPT code description for 97155 requires protocol modification. Observation alone is supervision, which falls under 97156. ### 2. Missing or Incomplete Provider Signatures Every state requires the rendering provider’s signature on session notes. Every audit found notes without them. This sounds like a trivial paperwork issue. It’s not. A missing signature means the note can’t be attributed to the provider who allegedly delivered the service. From an auditor’s perspective, an unsigned note is functionally the same as a missing note — it can’t be verified. In Indiana, missing signatures were called out as a specific deficiency category. In Colorado, the OIG found that session notes “did not include the rendering provider’s signature” across dozens of sampled enrollee-months. In Maine, missing signatures on required assessments were flagged alongside missing signatures on session notes. **What this looks like in practice:** An RBT runs a 3-hour session, writes the note at the end of the day, and forgets to sign it. The note sits unsigned for days or weeks. A claim is generated from the session. Nobody catches the missing signature because the billing workflow doesn’t check for it. ### 3. Non-Therapy Time Billed as ABA The OIG found providers billing for time that wasn’t therapeutic. The Indiana audit specifically identified billing “during nap time.” Colorado’s audit found that **76 out of 100** sampled enrollee-months included “potential non-therapy time” and **67 included potential group activities** billed as individual 1:1 treatment. CPT 97153 is 1:1 adaptive behavior treatment. It requires the technician to be actively implementing a treatment protocol with a single client. When a child is eating lunch, watching a movie, napping, or participating in a group recreational activity, that’s not 1:1 protocol implementation — regardless of whether a technician is present in the room. **What this looks like in practice:** A child is in a center-based program from 9 AM to 3 PM. The RBT bills 97153 for the entire block, including a 30-minute lunch and a 15-minute transition period where the child watches a video. The session note says “client ate lunch, then transitioned to afternoon program.” That note just documented non-therapy time being billed as ABA. In Colorado, the OIG flagged **88 out of 100** sampled enrollee-months for “potential unallowable activities or care.” ### 4. Credentialing Gaps Colorado’s audit uncovered that **18 out of 100** sampled enrollee-months involved providers who didn’t have appropriate credentials at the time of service. The OIG estimated that as many as **1,500 to 2,000 behavioral technicians** in Colorado may be working without the mandated 40-hour training, competency assessment, and supervision — even though the state lists more than 6,600 certified technicians overall. This is a compliance failure that sits upstream of documentation. If the provider delivering the service isn’t properly credentialed, every claim associated with that provider is potentially improper — regardless of how good the session note is. **What this looks like in practice:** A new RBT starts seeing clients before their RBT certification is finalized. Or an RBT’s certification lapses and nobody catches it for three months. Or a technician completes the 40-hour training but hasn’t passed the competency assessment. Claims go out for every session they deliver during that gap. Those claims are improper by definition. ### 5. Missing Assessments or Treatment Referrals Maine’s audit found children receiving ABA services without required diagnostic assessments. Colorado’s audit flagged **7 out of 100** sampled enrollee-months where there was no diagnosis or treatment referral on file. Without a qualifying diagnosis and a referral or order for treatment, the entire service authorization chain is broken. **What this looks like in practice:** A child is referred for ABA services. Intake paperwork is started but the diagnostic evaluation from the referring provider never makes it into the file. Or the evaluation is on file but expired — many states require evaluations within a specific timeframe. Treatment begins anyway. Six months of claims go out before anyone notices the missing document. Mapping Failures to CPT Codes ----------------------------- The OIG audits focus on a small set of CPT codes that account for the vast majority of ABA billing. Here’s where the five failure categories hit hardest: CPT CodeDescriptionCommon Audit Failures**97151**Behavior identification assessment (BCBA)Billed without clinical assessment documentation; technician data collection billed as assessment; missing BCBA involvement documentation**97153**Adaptive behavior treatment by protocol (technician, 1:1)Non-therapy time included in units; group activities billed as 1:1; session note doesn’t describe protocol implementation; missing technician signature**97155**Adaptive behavior treatment with protocol modification (BCBA)Billed for observation without protocol modification; note describes supervision, not clinical decision-making; confused with 97156**97156**Family adaptive behavior treatment guidance (BCBA)Billed without caregiver present; note doesn’t document caregiver training content; time overlap with 97155 on same date of service**97158**Group adaptive behavior treatment (technician)Individual 1:1 code (97153) billed instead when multiple clients present; group size exceeds state limits; note doesn’t identify all group participants The pattern across every audit: the CPT code requires specific clinical activity, and the session note either doesn’t describe that activity, doesn’t contain enough detail to verify it, or doesn’t exist. What Your Software Should Be Catching ------------------------------------- The Benesch advisory tells you to “audit documentation.” The MissionViewpoint analysis of the WSJ piece calls these findings “infrastructure failures, not deliberate schemes” — noting that providers “fail audits not because they intended to violate rules, but because documentation expectations were never clearly communicated.” Both are right. And both point to the same solution: your practice management system should be enforcing documentation compliance at the point of entry — not after a claim is submitted, and certainly not after an auditor requests your records. Here’s what that means for each failure category: **Session notes must validate against the CPT code before a claim generates.** If a session is billed as 97155, the system should require documentation fields specific to protocol modification — what was assessed, what was changed, and why. If those fields are empty, the claim shouldn’t generate. This is the single highest-impact guardrail because CPT code mismatch is the most common finding in every audit. **Unsigned notes should block claim generation.** This is binary. If the rendering provider hasn’t signed the session note, the note isn’t complete. If the note isn’t complete, no claim should be created from it. Every system should enforce this. Most don’t — they generate the claim and hope someone catches the missing signature in a retrospective review. **Session time validation should flag non-therapy activities.** If a technician logs 6 continuous hours of 97153, the system should prompt for break times, meal times, and transition periods. Time-based CPT codes require that every billed unit represent active treatment. A system that lets a technician bill a continuous 6-hour block without accounting for non-therapy time is setting the practice up for exactly the finding Colorado reported. **Credentialing status should be checked at the claim level.** Before a claim generates, the system should verify that the rendering provider held active, valid credentials on the date of service. If an RBT’s certification was expired, pending, or not on file for that date — the claim should be flagged, not submitted. Colorado’s finding of up to 2,000 uncredentialed technicians is a credentialing verification failure at scale. **Authorization prerequisites should gate service delivery.** If a client doesn’t have a qualifying diagnosis, a valid treatment referral, and a current assessment on file — the system should prevent sessions from being scheduled, or at minimum flag them before claims are generated. Missing assessments and referrals were found in every audit. These are upstream document requirements that should be verified before the first session happens, not discovered during an audit two years later. The Compliance Window Is Closing -------------------------------- Three more OIG audits are in the pipeline. The WSJ investigation just put this issue in front of every legislator, regulator, and payer executive in the country. Centene has [already built a dedicated ABA task force](/blog/centene-aba-crackdown-what-small-practices-need-to-know) to review utilization patterns. Massachusetts has [mandated accreditation](/blog/aba-accreditation-becoming-mandatory) as a condition of Medicaid participation. The findings across all four audits are not ambiguous. The OIG is testing the same things every time: Does the session note support the CPT code? Is it signed? Does the billed time represent actual therapy? Was the provider credentialed? Was the client properly assessed and referred? If your practice management system doesn’t enforce these checks before a claim goes out, you’re relying on individual staff members to never make a mistake — across every session, every note, every signature, every credential renewal, for every client, every day. That’s not a compliance strategy. That’s a bet. And four states have already shown us what happens when that bet doesn’t pay off. --- Questions about whether your documentation workflows would survive an OIG-style audit? Reach out at **hello@streamaba.com** — we’ll walk through it with you. Follow us on [LinkedIn](https://www.linkedin.com/company/stream-aba) and [X](https://x.com/streamaba) for more industry updates. [ All posts ](https://streamaba.com/blog) ![]() Related posts ------------- [Browse all posts](https://streamaba.com/blog) - [ ![](/images/blog/2026/03/colorado-oig-audit-285-million-improper-aba-payments.jpg) compliance ### Colorado OIG Audit: $285 Million in Improper ABA Payments — The Largest Yet The fourth HHS OIG audit just dropped. Colorado's Medicaid program made at least $285.2 million in improper and potentially improper ABA payments in 2022–2023. Every single sampled record had problems. Three more states are still coming. Mar 2, 2026 5 min read ](https://streamaba.com/blog/2026/03/colorado-oig-audit-285-million-improper-aba-payments) - [ ![](/images/blog/2026/02/centene-aba-crackdown-what-small-practices-need-to-know.jpg) compliance ### Centene Is Coming for ABA Outliers. Here's What That Means for Your Practice. Centene's CEO just told investors that behavioral health — driven by ABA — accounts for half their excess Medicaid costs. They've built a 29-state task force, they're hiring BCBAs to review your authorizations, and they've already cut outlier providers. Here's what they're looking for and how to make sure you're not on the list. Feb 14, 2026 7 min read ](https://streamaba.com/blog/2026/02/centene-aba-crackdown-what-small-practices-need-to-know) - [ ![](/images/blog/2026/02/aba-accreditation-becoming-mandatory.jpg) compliance ### ABA Accreditation Is Becoming Mandatory — Not Just Nice to Have Massachusetts is the first state to require accreditation for Medicaid-funded ABA providers. With $56M in federal fraud audits and a single unified accreditation body, the rest of the country is watching. Here's what practice owners need to know. Feb 12, 2026 5 min read ](https://streamaba.com/blog/2026/02/aba-accreditation-becoming-mandatory) Live demo · No sales call Ready to Streamline your practice? ------------------------------------ Get instant access to a live demo of the all-in-one ABA platform built by clinicians, for clinicians. No sales call. HIPAA compliant · Signed BAA · Built for ABA Website Work email Goto the Live Demo ![](https://streamaba.com/build/assets/icon-BglRoXWC.svg) [ ![StreamABA](https://streamaba.com/build/assets/logo-dark-Bta4omRy.svg) ](/) The all-in-one practice management platform built specifically for ABA therapy providers. Website Work email Get Demo [ ](https://x.com/streamaba) [ ](https://www.linkedin.com/company/stream-aba) [ ](https://instagram.com/streamaba) [ 👍 ](https://www.facebook.com/people/Stream-ABA/61587347484176/) #### Product - [Intake](https://streamaba.com/features/intake) - [Communication](https://streamaba.com/features/communication) - [Pipeline Boards](https://streamaba.com/features/pipeline-boards) - [Tasks & Automation](https://streamaba.com/features/tasks-automation) - [Integrations](https://streamaba.com/features/integrations) - [Analyst Scorecard](https://streamaba.com/features/analyst-scorecard) - [Practice Marketing](https://streamaba.com/aba-practice-marketing) #### Resources - [Free ABA resources](https://streamaba.com/resources) - [ABA Medicaid rates](https://streamaba.com/tools/aba-medicaid-rates) - [Revenue Calculator](https://streamaba.com/tools/aba-revenue-calculator) #### Company - [Blog](https://streamaba.com/blog) #### Contact - [ Contact Support ](https://streamaba.com/support) © 2026 STREAM ABA LLC. All rights reserved. [Privacy Policy](https://streamaba.com/legal/privacy-policy) [Terms of Service](https://streamaba.com/legal/terms-of-service)