CMS Just Handed Every State a 173-Page ABA Playbook. Your Medicaid Agency Will Copy It. \| StreamABA [ ![StreamABA](https://streamaba.com/build/assets/logo-dark-Bta4omRy.svg) ](/) [Home](https://streamaba.com) [Blog](https://streamaba.com/blog) [ Log in ](https://streamaba.com/login) [ Goto the Live Demo ](#get-started) [Home](https://streamaba.com) [Blog](https://streamaba.com/blog) [Log in](https://streamaba.com/login) [ Goto the Live Demo ](#get-started) 1. [Blog](https://streamaba.com/blog) 2. / 3. CMS Just Handed Every State a 173-Page ABA Playbook. Your Medicaid Agency Will Copy It. compliance CMS Just Handed Every State a 173-Page ABA Playbook. Your Medicaid Agency Will Copy It. ========================================================================================= CMS's August 2026 State Medicaid & CHIP ABA Toolkit tells states how to tie ABA to a confirmed autism diagnosis, justify high-intensity hours, set 1-2:10 supervision ratios, and flag fraud. What ABA practices should change now. 9 min read August 7, 2026 StreamABA Team Share [ ](https://x.com/intent/tweet?url=https%3A%2F%2Fstreamaba.com%2Fblog%2F2026%2F08%2Fcms-aba-toolkit-state-medicaid-playbook&text=CMS+Just+Handed+Every+State+a+173-Page+ABA+Playbook.+Your+Medicaid+Agency+Will+Copy+It.) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fstreamaba.com%2Fblog%2F2026%2F08%2Fcms-aba-toolkit-state-medicaid-playbook) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fstreamaba.com%2Fblog%2F2026%2F08%2Fcms-aba-toolkit-state-medicaid-playbook) compliance medicaid industry-news federal-policy audits supervision practice-management ![](/images/blog/2026/08/cms-aba-toolkit-state-medicaid-playbook.jpg) 173 Pages, No New Rules, and Every State Reading It --------------------------------------------------- On Tuesday, August 4, CMS published the *State Medicaid & Children’s Health Insurance Program Applied Behavior Analysis Toolkit*. It runs 173 pages. It covers clinical standards, benefit design, payment models, provider credentialing, utilization management, and program integrity, and it ends with a checklist of recommendations written for state Medicaid directors to work through line by line. The number driving it is on page 14: Medicaid and CHIP paid about **$1.94 billion for ABA in 2021 and $10.1 billion in 2025**, an increase of **421%**. Over the same period, the number of children with an autism diagnosis receiving ABA grew 189%, and the number of beneficiaries with an autism diagnosis receiving any Medicaid service grew 67%. Spending outran utilization, and utilization outran diagnosis. That gap is the whole rationale for the document. CMS Administrator Dr. Mehmet Oz framed it plainly in the release: “Every dollar lost to fraud or waste is a dollar that cannot reach a child who genuinely needs it.” HHS Secretary Robert F. Kennedy Jr. said the agency is “helping states shut down fraud schemes that exploit children with autism.” The toolkit establishes no new federal requirements. It doesn’t mandate a coverage model, and it doesn’t cap hours. Behavioral Health Business described it accurately: guidance that “lacks prescriptive authority” but spells out federal expectations. Don’t let “guidance” lull you. In April, CMS told all 50 states to submit [provider revalidation plans within 30 days](/blog/2026/04/cms-50-state-medicaid-revalidation-aba), with autism therapy named as a high-risk area. Now those same states have a federal document telling them what “good oversight” of ABA looks like, with best-practice callout boxes and state spotlights they can cite in a rulemaking notice. The next provider bulletin in your state is going to borrow language from this toolkit. The only question is which chapters. Here are the five levers that matter most for a practice, and what to change before your state pulls them. Lever 1: No Confirmed Diagnosis, No Sustained ABA ------------------------------------------------- The toolkit’s diagnosis chapter sets the tone: “Best practice is to initiate comprehensive ABA only after a qualified, independent clinician has confirmed an ASD diagnosis. States should tie sustained ABA coverage to a confirmed ASD diagnosis.” There’s a carve-out. Under EPSDT, states may authorize “limited, time-bound” ABA when there’s strong clinical suspicion of autism and a full evaluation is pending, but those interim services “should be tightly defined and not substitute for diagnosis-driven treatment.” Two more details deserve attention: - **Independence of the diagnostician.** The toolkit invokes the Stark Law’s logic and suggests states require disclosure of any financial or ownership relationship between the diagnosing clinician and the ABA provider receiving the referral. If your organization diagnoses and treats, expect scrutiny of that pipeline. - **Diagnostic re-evaluation.** Citing the literature, the toolkit suggests re-evaluating the diagnosis periodically, around one year for children diagnosed at 2 or 3, and at transitions like starting school. **What to change now:** Audit every active client file for the diagnostic report itself: who issued it, their credential, the date, and whether it’s a full evaluation or a screening. Any client receiving ongoing treatment on a provisional or “rule-out” basis should have a documented plan and date for the full evaluation. If you have any financial relationship with a diagnosing practice, get it written down and disclosed before someone asks. Lever 2: High-Intensity Hours Must Be Earned, Case by Case ---------------------------------------------------------- This is the section most practices will read first, and it cuts both ways. The good news: the toolkit does not endorse a federal hour cap. It says outright that “there is no consensus on a set number of hours recommended for treatment,” and it notes that under EPSDT, utilization thresholds “should not operate as absolute caps” when more medically necessary services are needed. The less good news, from page 37: “Services at higher intensity levels should not be authorized by default and should only be authorized based on the ITP’s documentation of needs and goals that warrant extensive treatment.” The toolkit adds that high-intensity schedules “can easily take on the characteristics of respite care and childcare.” That sentence will show up in denial letters. The toolkit also lists documentation patterns it considers flags for potentially improper billing, including excessive hours that continue without documented improvement, identical documentation across clients, re-evaluations that don’t reflect progress or change the plan, group therapy exceeding 10% of treatment time, and lack of caregiver engagement. It recommends states require ITP re-evaluation at specific intervals for a child to keep coverage, and that plan updates use established outcome measures rather than provider-created ones. We covered how [approved hours erode at renewal](/blog/2026/06/aba-authorization-utilization-why-payers-cut-hours) when delivery lags authorization. The toolkit adds a second pressure: even fully delivered hours need a written clinical case, per child, that a reviewer can check against standardized outcome data. **What to change now:** For every client authorized above roughly 25 hours a week, read the treatment plan as a skeptical reviewer would. Does it tie the dosage to specific deficits and goals? Does it cite a standardized assessment? Does the last re-evaluation show movement, and if not, does it change the plan? Rewrite boilerplate intensity rationales now, on your schedule, rather than at the next renewal on the payer’s. Lever 3: Every Claim Traceable to a Named, Qualified Person ----------------------------------------------------------- The toolkit is blunt about who delivers the service: “All ABA providers should have their own NPI, even those billing under a supervisor.” It asks states to settle whether technicians must enroll, register, or be linked to a supervising provider, and how “supervision relationships are documented for oversight and billing purposes.” Its program-integrity checklist asks whether states verify “that rendering and supervising providers hold required licenses, certifications, registrations, or other qualifications before claims are paid,” and whether billed codes, modifiers, and “rendering provider types” match state policy. Session-level documentation, it says, should demonstrate that “the rendering provider and, where applicable, supervising clinician meet program requirements.” It goes further on verification. CMS recommends states consider extending electronic visit verification (EVV) to ABA, capturing service type, date, time, location, rendering provider, and recipient, and then reconciling claims against EVV data. Put those together and the direction is clear: a claim that says only “Agency X billed 97153” is on its way out. States want to see which technician sat with the child, which BCBA supervised, and that both were credentialed on that date of service. **What to change now:** Confirm every RBT on your roster has an individual NPI. Confirm your claims populate the rendering provider on each line, not just the billing NPI. Map each technician to a named supervising BCBA in your records. If you serve clients in the home, start treating clock-in and clock-out with location as mandatory session data. If your state adopts EVV for ABA, you’ll want a year of clean history, not a scramble. Lever 4: The Supervision Math Just Got Stricter ----------------------------------------------- This is the number most owners will miss, because it’s in the checklist at the back. Among its recommendations to states: “Ensure supervision ratios are 1 to 2 hours of supervision for every 10 hours of direct treatment (1-2:10), or 1 to 2 hours of supervision per week if direct treatment is 10 hours or less per week.” That’s **10% to 20%** of direct hours. The BACB’s minimum for RBTs is 5%. Massachusetts already assessed partial overpayments against providers supervising between 5% and 10% of direct hours, and demanded full 97153 recoupment below 5%, a play we broke down in [our supervision audit-proofing guide](/blog/2026/06/rbt-supervision-audit-proofing-five-percent-rule). The federal toolkit now points states at a ratio two to four times higher. The telehealth language tightens it further. The toolkit says supervision “should not be performed solely via telehealth,” that state policies “should include a minimum of in-person supervision,” and it recommends states “reduce over-reliance on telehealth for supervision.” It also suggests BCBAs retain at least 25% of the supervision across their caseload when BCaBAs share the load. And the analytics chapter tells states exactly what to look for. Its list of ABA-specific risk indicators includes: - High service hours per beneficiary (the toolkit’s example: 32 units per day, 160 units per week) - Technician-to-supervisor ratios that exceed expected norms - Rapid billing growth following enrollment - Claims clustering around supervision codes or modifiers - **High-volume providers billing the maximum number of hours for 80% or more of patients with limited credentialed supervisory staff** - Excessive use of telehealth or supervision via telehealth Read that fifth bullet twice. It’s a pattern a state can compute from claims data alone, without opening a single chart. If most of your caseload sits at the authorized maximum and your BCBA headcount is thin, you look like the profile, whatever your clinical reasons. **What to change now:** Calculate your actual supervision percentage by RBT and by client for the last six months: 97155 and other supervision time over 97153 time. If you’re at 5% to 7%, you meet the BACB floor and sit well below the toolkit’s recommendation. Decide now whether your staffing model can reach 10%, because that’s where state standards are likely to land. Then compute the share of clients billed at their authorized maximum. If it’s above 80%, make sure your BCBA-to-client ratio and your documentation can explain why. Lever 5: Enrollment and Revalidation as a Standing Audit -------------------------------------------------------- Federal rules already require states to revalidate every Medicaid provider’s enrollment at least every five years under 42 CFR 455.414. The toolkit reinforces that and layers on more. It says ABA enrollment should verify identity, NPI, licensure and certification, education, ownership disclosures, and exclusion-list checks. It notes managed care plans often add “more frequent recredentialing cycles.” And it flags ownership changes as a trigger for risk-based revalidation, targeted audits, site visits, and “review of supervision capacity and staffing.” It also recommends states consider requiring organizational accreditation and a “well-designed corporate structure,” and devotes a section to corporate ownership structures of ABA agencies. **What to change now:** Build a credential calendar: every RBT certification, BCBA certification, state license, and payer enrollment with its expiration or revalidation date. Keep ownership disclosures current with every payer. If you’re mid-acquisition or recently changed hands, assume you’ll get a site visit and prepare supervision and staffing records accordingly. What This Means If You’re Not Being Investigated ------------------------------------------------ Most practices reading this aren’t committing fraud. The toolkit isn’t written to distinguish you from those that are, at least not at first. It’s written to give states screens: diagnosis on file or not, intensity justified or not, rendering provider identified or not, supervision ratio inside the band or not, enrollment current or not. You can’t argue with a screen. You can only pass it. States have been moving on their own. [Nebraska cut its prior-authorization-free threshold to 20 hours](/blog/2026/07/nebraska-aba-school-billing-ban-20-hour-cap) and added in-person supervision minimums. Federal auditors have documented recurring [documentation failures by CPT code](/blog/2026/03/oig-audit-trail-documentation-failures-by-cpt-code) across state after state. The toolkit collects those moves in one place and puts CMS’s name on them. States that were waiting for cover now have it. Practices have a few months of lead time, maybe less. The ones that use it will treat the toolkit’s program-integrity checklist as a self-audit and run it on themselves before their state does. Where Software Fits, Honestly ----------------------------- Software won’t write your clinical rationale for a 35-hour plan. That’s BCBA work, and it’s the part of this toolkit no system can do for you. What a system can do is make the screens easy to pass. In StreamABA, each billed line carries its rendering provider, session notes tie to the billed units, and authorizations are tracked from request through unit burn-down and renewal. Supervision notes live alongside session data, and a supervision compliance dashboard shows each RBT’s supervision position before the month closes. Credential expiration alerts fire before a lapsed certification contaminates a month of claims. When your state’s version of this toolkit arrives, the practices in the best position will be the ones that can answer each screen with a report instead of a project. --- Want to check your supervision ratios and max-hours share against the toolkit’s thresholds before your state does? Reach out at **hello@streamaba.com**. Follow us on [LinkedIn](https://www.linkedin.com/company/stream-aba) and [X](https://x.com/streamaba) for more industry updates. Sources ------- - [CMS: State Medicaid & Children’s Health Insurance Program Applied Behavior Analysis Toolkit (August 2026, PDF)](https://www.medicaid.gov/medicaid/downloads/autism-services-aba-toolkit.pdf) - [CMS: CMS Launches New State Toolkit to Protect Children with Autism, Strengthen Oversight of Applied Behavior Analysis Services (August 4, 2026)](https://www.cms.gov/newsroom/press-releases/cms-launches-new-state-toolkit-protect-children-autism-strengthen-oversight-applied-behavior) - [Behavioral Health Business: CMS Lays Out New Guidance for ABA Medicaid Benefits (August 5, 2026)](https://bhbusiness.com/2026/08/05/cms-lays-out-new-guidance-for-aba-medicaid-benefits/) - [Cornell LII: 42 CFR 455.414, Revalidation of enrollment](https://www.law.cornell.edu/cfr/text/42/455.414) [ All posts ](https://streamaba.com/blog) ![]() Related posts ------------- [Browse all posts](https://streamaba.com/blog) - [ ![](/images/blog/2026/04/cms-50-state-medicaid-revalidation-aba.jpg) compliance ### CMS Gave All 50 States 30 Days to Submit Medicaid Fraud Plans. Autism Therapy Was Named. On April 21, 2026, CMS Administrator Dr. Oz announced that letters are going to all 50 governors and state Medicaid directors demanding two-year provider revalidation strategies. States have 10 days to notify CMS and 30 days to submit a full plan. Oz named autism therapy specifically as a program area where federal authorities have already addressed fraud. Non-compliance is a threat multiplier: CMS has already frozen $243 million in Minnesota Medicaid payments over fraud concerns. Apr 24, 2026 9 min read ](https://streamaba.com/blog/2026/04/cms-50-state-medicaid-revalidation-aba) - [ ![](/images/blog/2026/06/rbt-supervision-audit-proofing-five-percent-rule.jpg) compliance ### The 5% Rule Just Became an Audit Weapon: How to Make Your RBT Supervision Defensible MassHealth ran a ratio check on every 2024 ABA claim in the state and sent six-figure recoupment letters to providers whose 97153-to-97155 ratios exceeded 20:1. No chart review. No records request. Just math. How the 5% supervision rule became a clawback trigger, and the monthly self-audit that keeps your practice off the list. Jun 22, 2026 8 min read ](https://streamaba.com/blog/2026/06/rbt-supervision-audit-proofing-five-percent-rule) - [ ![](/images/blog/2026/06/aba-authorization-utilization-why-payers-cut-hours.jpg) billing ### Approved for 30 Hours, Delivering 19: Why Your ABA Renewal Came Back Lower Payers don't need to audit you to cut your hours. Your own claims data does the talking at every renewal, and if your practice chronically delivers 60-70% of what's authorized, the reviewer reads that as proof a smaller authorization would have been enough. How payers track utilization, what a defensible rate looks like, and the weekly loop that closes the gap. Jun 5, 2026 6 min read ](https://streamaba.com/blog/2026/06/aba-authorization-utilization-why-payers-cut-hours) Live demo · No sales call Ready to Streamline your practice? ------------------------------------ Get instant access to a live demo of the all-in-one ABA platform built by clinicians, for clinicians. No sales call. HIPAA compliant · Signed BAA · Built for ABA Website Work email Goto the Live Demo ![](https://streamaba.com/build/assets/icon-BglRoXWC.svg) [ ![StreamABA](https://streamaba.com/build/assets/logo-dark-Bta4omRy.svg) ](/) The all-in-one practice management platform built specifically for ABA therapy providers. Website Work email Get Demo [ ](https://x.com/streamaba) [ ](https://www.linkedin.com/company/stream-aba) [ ](https://instagram.com/streamaba) [ 👍 ](https://www.facebook.com/people/Stream-ABA/61587347484176/) #### Product - [Intake](https://streamaba.com/features/intake) - [Communication](https://streamaba.com/features/communication) - [Pipeline Boards](https://streamaba.com/features/pipeline-boards) - [Tasks & Automation](https://streamaba.com/features/tasks-automation) - [Integrations](https://streamaba.com/features/integrations) - [Analyst Scorecard](https://streamaba.com/features/analyst-scorecard) - [Practice Marketing](https://streamaba.com/aba-practice-marketing) #### Resources - [Free ABA resources](https://streamaba.com/resources) - [ABA Medicaid rates](https://streamaba.com/tools/aba-medicaid-rates) - [Revenue Calculator](https://streamaba.com/tools/aba-revenue-calculator) #### Company - [Blog](https://streamaba.com/blog) #### Contact - [ Contact Support ](https://streamaba.com/support) © 2026 STREAM ABA LLC. All rights reserved. [Privacy Policy](https://streamaba.com/legal/privacy-policy) [Terms of Service](https://streamaba.com/legal/terms-of-service)