ABA Therapy Billing Red Flags: What Federal Oversight Means for Your Family

ABA therapy billing red flags became a national story this month, and if you’re a parent whose child is mid-program, the coverage was probably more alarming than clarifying. Federal auditors found four specific billing patterns, the new federal guidance changes less than the headlines implied, and there are a handful of things you can check yourself without becoming an expert in medical billing.

Start with the reassurance. None of this means your child’s therapy is in question, and none of it changes your child’s entitlement to medically necessary care. Most ABA providers are doing honest work. Knowing the red flags is what lets you tell an honest team from a bad one.

Why this is suddenly everywhere

On August 4, 2026, CMS released a 173-page ABA toolkit for state Medicaid and CHIP agencies. The trigger was a spending pattern: between 2021 and 2025, ABA expenditures across Medicaid and CHIP rose 421%, while the number of children with autism receiving services grew 67%.

Running alongside that, the HHS Office of Inspector General has been working through a multi-state audit series on Medicaid ABA payments, announced back in 2022. Four are complete, covering Indiana, Wisconsin, Maine, and Colorado, and four more are still open. Across those four states, auditors identified close to $200 million in improper Medicaid payments, as Disability Scoop reported.

Auditors found problems in every sample they pulled, in all four states. That points to a pattern in how some providers bill rather than a few outliers.

What auditors actually found

Four patterns came up repeatedly:

Therapy delivered by staff who lacked the required credentials. The person in the room wasn’t qualified to be billed at the rate that was charged, or at all.

Services delivered without the required evaluation or referral. Children were receiving billed ABA without the diagnostic evaluation or physician order the program required first.

Time billed while children were napping, eating lunch, or doing other non-therapeutic activities. Therapy delivered during a meal can be perfectly legitimate when eating is the goal. These were billed hours when nothing therapeutic was happening at all.

Intensity untethered from clinical need. The CMS toolkit notes that appropriate ABA intensity varies from roughly 5 to 40 hours per week depending on the individual child, and cautions against treating high hours as a default.

Red flags you can check yourself

These all come down to noticing a mismatch between what you were told, what you observed, and what got billed. You don’t need to audit anyone.

Your explanation of benefits doesn’t match the calendar. Your EOB or claims portal lists hours or dates that don’t line up with sessions your child actually had. A missed session still billed, or 6 hours billed on a 3-hour day. Commercial and Apple Health families both get claim records, and this is the check worth running first. One exception starts in 2027: a new code, 97180, lets some insurers pay for BCBA planning work done without your child present, so a BCBA charge on a day with no session is not automatically wrong. Ask your provider whether they bill it. Our post on the 2027 ABA code changes explains it.

Nobody can tell you who was in the room. Ask what credential your child’s daily provider holds and who supervises them. RBTs delivering most direct sessions is normal and appropriate. Not being able to get a straight answer is not.

Supervision exists only on paper. A BCBA whose name is on the treatment plan but who has never observed a session is a real problem, and it’s the specific failure the CMS toolkit tells states to look for. Ask how many times per month the BCBA personally observes, in person or by live video, versus reviewing data remotely. Our post on what a BCBA credential means covers what to expect from that role.

The recommended hours arrived before your child was assessed. A number quoted on the intake call, before anyone observed your child, came from a business model. Hours should come out of an assessment and should change as your child changes. If hours only ever go up, ask why.

You’re never shown session notes or progress data. ABA generates data constantly. If you can’t see what’s being measured and how your child is trending, you can’t evaluate whether any of this is working.

Discharge is never discussed. Good ABA is designed to reduce over time as a child gains skills. A program with no concept of fading intensity or eventual discharge is worth asking hard questions about.

Someone offered you something to enroll. Gift cards, free childcare framed as therapy, waived costs in exchange for signing up, or a “referral bonus” for bringing another family. Kickback schemes are specifically what CMS flagged, and the family who accepts one is being used.

What the new guidance does not do

This part got lost in the headlines. In CMS’s own description, the toolkit does not:

• establish new federal requirements,
• reduce EPSDT obligations, the protection that entitles children under 21 to medically necessary care,
• endorse any single treatment approach to ABA, or
• direct states to limit access to medically necessary care.

It’s guidance to state agencies. Your child’s current authorization is not affected by its release.

The fair caveat is that states may adopt pieces of it over time. The toolkit encourages states to scrutinize telehealth use, weekly hour levels, and how much consecutive therapy is billed without a break for the child. Washington has not announced changes. If that shifts, you’ll see it in an authorization, and your provider should be telling you before you find out from a denial letter.

What good looks like

For contrast, a well-run program will readily tell you the credential of everyone working with your child, show you progress data without being asked twice, have a BCBA who has actually watched your child in session recently, recommend hours that changed after assessment, talk about fading and discharge as a goal rather than a threat, and give you a straight answer about what a session costs and what your plan pays.

Our list of questions to ask a new ABA provider is the longer version of that conversation, and it’s worth having before you sign, not after.

If something looks wrong

Start with your provider. Genuine billing errors are common and usually get corrected without drama. Ask for an itemized account of the dates and hours billed and compare it to your own record.

If the answer doesn’t resolve it, contact your insurer or, for Apple Health, your managed care plan. Suspected Medicaid fraud can be reported to the HHS OIG hotline. And if you conclude the relationship isn’t right, you can change providers; a new provider will need a current evaluation and will handle its own authorization. Our post on what to do when an ABA claim is denied covers the adjacent situation where the insurer, not the provider, is the problem.

For families on Apple Health specifically, how Medicaid covers ABA in Washington lays out the four-step pathway and what you should and shouldn’t be paying.

---

Orchid Academy runs BCBA-supervised ABA across Bellevue, Issaquah, Bothell, Sammamish, Covington, Federal Way, and East Wenatchee, in-home and center-based. We’ll tell you your child’s team by name and credential, how often the BCBA observes, and what your plan is billed. If you’re weighing a change from a provider that hasn’t felt right, request a call back or read what changes when ABA is done well.