The Case Every Payer Will Be Citing for Years
On May 21, the Department of Justice announced charges against 15 defendants in Minnesota for schemes targeting more than $90 million in Medicaid funds. At the center of the takedown: a ten-count federal indictment against Shamso Ahmed Hassan and Hanaan Mursal Yusuf, who allegedly billed Minnesota’s EIDBI autism program $46.6 million through two companies – Smart Therapy Center LLC and Star Autism Center LLC – and collected roughly $21.1 million of it.
DOJ says it’s the largest autism fraud scheme the department has ever charged. HHS Secretary Robert F. Kennedy Jr. flew to Minneapolis for the announcement and called it “the largest autism fraud bust in American history.” CMS Administrator Dr. Mehmet Oz was there too.
Stop on that detail for a second. The two most powerful health officials in the federal government showed up in person for a state-level autism fraud indictment. That’s not how routine enforcement gets announced. That’s how a policy agenda gets a face.
If you run an ABA practice that bills Medicaid, this case is now part of your operating environment whether you’re in Minnesota or not. Every rate cut, every prior authorization tightening, every audit letter your state sends over the next two years will be justified, implicitly or explicitly, by what these two companies allegedly did.
So here is exactly what they allegedly did.
What the Indictment Actually Alleges
The grand jury returned the indictment on May 20 (U.S. v. Hassan, No. 26-cr-00099, D. Minn.): one count of conspiracy, seven counts of health care fraud, and two counts of money laundering. The defendants are presumed innocent, and everything below is an allegation. But the allegations are specific, and they describe a business that was never a therapy practice at all.
Paying parents to enroll their kids. The indictment alleges the companies paid parents cash kickbacks of $300 to $1,500 per child, per month for enrolling their Medicaid-eligible children in EIDBI services. The amount allegedly scaled with the level of services the state authorized – higher authorization, bigger kickback. To hide the payments, checks were allegedly written to employees and family members, who cashed them and delivered the money to parents. Internally, the payments went by a code word: “computer.”
3,000+ hours of training billed to one family. Between April 2023 and October 2024, Smart Therapy allegedly billed Minnesota for more than 3,000 hours of family and caregiver training provided to a single recipient’s family. That works out to over five hours of training, every single day, for 19 straight months. According to the indictment, the family received none of it.
Billing under the names of providers who never worked there. The companies allegedly submitted claims for services rendered by people who weren’t employed at either business at the time of service. Some had worked briefly and left; the billing continued under their names. Others attended a single training session, never got hired, and were enrolled with the state as providers anyway, with claims filed under their identities and without their knowledge.
Concealed ownership. Hassan allegedly held ownership interests in both companies and never disclosed them to the Minnesota Department of Human Services, as required.
This wasn’t the first charge out of the EIDBI investigation, either. Asha Farhan Hassan, the registered owner of Smart Therapy, was charged in September 2025 and pleaded guilty in December – the first EIDBI fraud conviction. DOJ has said publicly that EIDBI enforcement continues through 2026. More indictments are coming.
None of This Was Hard to See in the Data
Every alleged behavior in this indictment leaves a signature in claims data that a first-year program integrity analyst could find. If you run a legitimate practice, that cuts two ways: the analytics that catch fraud are the same analytics reading your numbers.
The impossible-utilization signature. One family, 3,000+ hours of a single service line in 19 months. Family training is a low-volume service in any real practice: a few hours a month per family, tied to treatment plan goals. A single recipient consuming 40x the plausible ceiling is a spike on a chart, not a subtle anomaly.
The phantom-provider signature. A provider whose name appears on claims but who has no payroll records, no timesheets, no supervision logs, no session notes in their own hand, and (in some alleged cases here) no idea they were enrolled. Cross-reference rendering-provider claims against employment records and the scheme falls apart in an afternoon.
The enrollment-pattern signature. When parents are allegedly being paid $300-$1,500 a month to enroll, and the payment scales with authorization level, you get a caseload where every child is authorized at or near the maximum. Uniform maximum authorizations across an entire census is exactly the outlier pattern payers built task forces to find. It’s what Centene’s ABA task force said it was flagging back in February.
The uncomfortable question is why it took $21.1 million in paid claims over four-plus years before the indictment landed. The answer is that Minnesota’s front-end controls didn’t catch it, so the back end (data analytics, whistleblowers, a federal investigation) did. Every state Medicaid director is drawing the same policy lesson from that: make enrollment, authorization, and payment much harder up front.
For providers, that means the tighter controls land on everyone who bills the program, not just on the people who defrauded it.
This Indictment Is the Fuel for the Crackdown You’re Already Living Through
If the past six months of ABA Medicaid news felt like it was building toward something, this is the something.
CMS froze $243 million in Minnesota Medicaid payments over fraud concerns before a single one of these charges was announced. In April, CMS sent letters to all 50 states demanding two-year provider revalidation plans and named autism therapy specifically as a high-risk area. The House Energy and Commerce Committee is demanding ABA fraud records from 10 states. The OIG audit series has found documentation failures in every state it has sampled.
All of that pressure needed a proof case. Now it has one, complete with cash kickbacks, a code word, and a Cabinet secretary at the podium.
Expect three downstream effects:
-
States will treat autism programs as presumptively high-risk. Enrollment screening, site visits, ownership disclosure enforcement, and pre-payment review are the standard toolkit for high-risk provider categories. Autism services just earned that designation nationally, on camera.
-
Revalidation sweeps will check exactly what this indictment describes. Does every enrolled provider actually work where the claims say they work? Do ownership disclosures match reality? The two-year revalidation plans CMS demanded from all 50 states in April will be executed with this fact pattern in mind.
-
Utilization outliers get less benefit of the doubt. A practice with unusual family-training volume, uniformly maxed authorizations, or rendering providers with thin employment records will get flagged first and asked questions later. The burden of proof has functionally shifted to the provider.
What Separates a Real Practice From a Target
The good news buried in all of this: the alleged scheme was crude, and it collapsed the way crude schemes collapse – there was no real clinical operation behind the claims. Which means the defense for a legitimate practice is simply being able to prove the operation exists, quickly and in writing.
Run this five-point check against your own practice:
1. Every claim traces to a real session. For any billed unit, you should be able to produce the scheduled appointment, the session note with time in and time out, the rendering provider’s signature, and the data collected – in minutes, not weeks. If your schedule, your clinical documentation, and your claims live in three disconnected systems, that trace is where audits go sideways.
2. Your rendering-provider roster matches your payroll. Every NPI on your claims should belong to someone with a current employment record, current credentials, an active payer enrollment, and timesheets that line up with the sessions billed under their name. A provider who left three months ago should have stopped appearing on claims the day they walked out.
3. Your utilization has a clinical explanation. Pull your family/caregiver training hours per client. Pull your authorization levels across your census. If anything looks uniform where clinical need is variable, or high where the service is normally low-volume, you want to understand why before a reviewer asks.
4. Nobody at your practice can bill more hours than exist in a day. Run an impossible-day check: any provider whose combined billed time exceeds their scheduled and worked hours is either a documentation error or a problem. Either way, find it yourself.
5. Your ownership and enrollment disclosures are current. Undisclosed ownership was one of the alleged violations here, and it’s one of the first things a revalidation sweep verifies. If your corporate structure has changed since you enrolled, fix the paperwork now.
This is the ordinary discipline of running a real practice, made non-negotiable by an enforcement climate that this indictment just supercharged.
The Bottom Line
The alleged Smart Therapy scheme will be the reference case for autism Medicaid fraud for the next decade. It will show up in state legislative hearings, payer policy memos, and audit training materials. Practices that do real work for real kids didn’t create this problem, but they will absorb the scrutiny it generates.
The practices that absorb it easily are the ones whose operations are legible: schedule, session, note, signature, claim – one connected record that proves the work happened. If assembling that proof for any given claim would take your team days of digging across systems, that’s the gap to close, starting now.
StreamABA connects scheduling, clinical documentation, credential tracking, and billing in one system – so every claim carries its own audit trail, credential and enrollment expirations get flagged before they become claim problems, and your utilization data is something you can actually see. Questions about what this enforcement environment means for your practice? Reach out at [email protected].
