I have a habit with federal guidance documents: I read the appendices first.

The chapters tell you what an agency believes, while the appendices tell you what it plans to ask for. So when CMS put out its Applied Behavior Analysis tool kit this month, I skipped to the back, where six state checklists sit. I read them the way I would read requirements handed to an engineering team, because that is what they are. They are addressed to state staff, so they look like policy questions. They are queries, and the data they ask for lives with the provider.

A tool kit binds nobody; it is a design document for state Medicaid directors. Between 2021 and 2025, ABA spending across Medicaid and CHIP rose from roughly $1.94 billion to $10.1 billion, an increase of 421%. Over the same years, the number of children with an autism diagnosis receiving ABA services through Medicaid and CHIP grew 189%. When spending climbs that much faster than the treated population, agencies stop asking whether a service is covered and start asking whether each unit of it can be substantiated.

Every utilization and integrity audit is, at heart, a joint operation. Nearly every question in the utilization and integrity checklists ties a billed unit to an authorization, a treatment plan, a credential, a supervision span and a time stamp. Most ABA billing systems keep those five things in five places and introduce them to each other only when a denial forces it.

So here is what I would stress-test in my own stack.

Make Authorization Matching A Control In The Claim Path

One practice that reached out to me found a lapsed authorization 41 sessions after it expired. Nobody was careless; the authorization lived in the payer's portal, the sessions lived in the scheduler, and no system owned the job of noticing that one had ended while the other kept going.

CMS now hands states a menu of prepayment edits that would have been noticed: authorization matching, automated hour limits, service overlap detection, correct-coding edits. Where a state adopts them, those rules run against your claims whether or not you run them first. By the time a denial tells you the authorization was invalid, you have already lost the argument.

Reconcile Delivered Hours Against Authorized Hours Every Week

This is the number most operators cannot produce on demand. The tool kit suggests states use concurrent review to compare delivered hours against authorized hours and test whether intensity still tracks progress. Weekly hours per beneficiary receiving ABA averaged 17.33 in 2025, a 22% rise since 2021, and hour thresholds that trigger review are now a named feature of prior authorization design. That comparison runs between your scheduler and your authorization record, and in a monthly spreadsheet it is stale by the time anyone reads it. It belongs in a standing calculation, with an alert on it and a name attached to the alert.

Structure Session Notes So A Query Can Read Them

In a 2025 audit of Wisconsin, the HHS Office of Inspector General looked at 100 sampled enrollee-months. Every single one contained at least one improper or potentially improper claim line.

The tool kit shows how a practice gets there. It asks states whether provider instructions are clear on how session notes support billed units, procedure codes, staff credentials, supervision and the timing and location of the service. Free text cannot carry that weight, and asking clinicians to write more of it fixes nothing. Capture the auditable fields as structured data at the point of service, and let the clinicians go back to doing clinical work.

Treat Credentials And Supervision Status As A Live State

One line in the enrollment checklist asks whether provider records are updated promptly when supervision status, credentialing, enrollment status or ownership changes. That line is doing more work than it looks like.

A credential stored as a renewal date on a spreadsheet tab is a lookup somebody has to remember to perform. Nobody remembers on the Tuesday in March when a supervisor's registration lapses, and that is exactly the version of this that actually happens. Credential status needs to state your systems watch and can act on, including holding a claim.

Run Outlier Queries CMS Has Already Published

Here is the part I often see operators skip. CMS spells out the patterns states should flag: unusually high hours, overlapping services, duplicate billing, excessive units, rapid provider growth and billing that does not match a child's age or setting.

Diagnosis mix belongs on that list too. Payments for ABA delivered to beneficiaries without an autism diagnosis rose 1,789% between 2021 and 2025, reaching $1.47 billion. A regulator who publishes its detection logic in advance has handed you the test cases. Run them against your own data every month and be the first to find your own outlier.

The Bottom Line

Not every state will act on this, and the ones that do will start with six lines of it rather than 60. What has changed is that they now share a vocabulary for what to ask about ABA billing.

That is the argument for aligning authorization, delivery, documentation and credentials now, while it is still an architecture decision you make on your own schedule. The alternative is making it in the third week of an audit, with someone else's sampling frame deciding what your systems should have been able to answer.