The short version. On May 21, 2026, the Department of Health and Human Services announced AERO, an AI-led review of at least five years of Single Audit records across HHS-funded health programs in all 50 states. The pressure reaches ABA practices through state Medicaid agencies, not directly. The five priorities to act on this week: a 5-year Medicaid documentation completeness scan, an RBT supervision audit, a re-authorization stress test, moving insurance verification upstream into intake, and tightening parent-training and school-consultation session notes.

What HHS's AERO Initiative Means For ABA Providers

AERO is an audit-enforcement program, not a claim-scanning fraud model. A fraud model flags one suspicious claim at a time, and an audit-enforcement program asks whether your state Medicaid agency is meeting its federal reporting obligations and whether providers taking federal pass-through dollars can document that those dollars were spent appropriately. The lookback is where the teeth are. HHS is examining at least five years of audit history, so a finding today can reach back into sessions, authorizations, and supervision records from 2021.

The financial backdrop makes the move predictable. CMS's Payment Error Rate Measurement program put Medicaid improper payments at roughly $37 billion in fiscal year 2025, and more than three-quarters of that traces to insufficient documentation rather than fraud. Sit with that distinction: an auditor does not have to prove you did anything wrong, only that the paperwork does not prove you did it right. HHS also said hundreds of grantees are late on required audits, some by more than two years, and named its enforcement levers: payment holds, cost disallowances, award suspension or termination, debarment proceedings, and withholding future funds. Debarment is the one to fear, because it ends federal billing eligibility. The announcement followed a national anti-fraud task force in March 2026 and a May freeze on new home health and hospice Medicare enrollments.

I have watched this pattern before; when federal pressure reaches a state Medicaid program, it does not absorb the cost quietly, instead, it pushes that cost downstream inside a single quarter, through tighter supervision rules, stricter session-note requirements, and harder evidence demands at re-authorization. Practices running clean file new forms. Practices running loose lose contracts. AERO scales that across every state at once.

Why Federal Audit Pressure Helps Disciplined ABA Practices

I want to push back on the doomsday framing that will dominate ABA-industry coverage over the next two weeks. Federal audit enforcement is not the enemy of a practice doing the work right. It is the enemy of practices cutting corners on supervision logs, re-authorization documentation, and parent-training notes, the same practices that have undercut the disciplined ones on price for years. A serious audit cycle reprices that competition for the operators who already earned it. The compliance work that protects you here is invisible in a normal billing cycle, which is exactly why undisciplined practices skip it and disciplined ones do not.

5 Priorities For ABA Owners Before The Audit Lookback Reaches You

If I were running a multi-location ABA practice this week, here is the punch list my team and I would work through:

1. Run a five-year documentation completeness scan of your Medicaid claims.

AERO's lookback is at least five years. Pull the report on which claims from 2021 to today have complete supervision documentation, authorization coverage, and session notes. Where you find gaps, document each one and its remediation plan before someone else finds it for you. Ongoing payer and claims monitoring turns this from an annual fire drill into a standing report.

2. Audit your supervision documentation against billed RBT hours.

Pick a random week from last quarter. For every billed RBT session, can you produce the BCBA supervision note that supports your state's ratio requirement? I watched a four-location owner run this exercise on a Wednesday and surface seven figures of documentation exposure by Friday; this is the single most common ABA audit finding I see, and the most fixable.

3. Stress-test your re-authorization process.

The re-auth cliff is well-known inside ABA and invisible to outsiders, including the state auditors about to learn it. Commercial payers typically authorize in six-month blocks; many state Medicaid plans run tighter, on three-month or even monthly cycles. Whatever your shortest cycle is, that is the one that bites you.

Build the prior authorization workflow that flags expiring auths thirty days out and routes the clinical packet to the BCBA before the auth lapses. Track every authorization span date so units billed always match an active span. Re-auth is where I see the most expensive losses: the session happened, the clinical work was good, the auth had lapsed, the claim is dead.

4. Move insurance verification upstream into intake.

A practice cannot bill cleanly if eligibility was confirmed three days into care. A five-year lookback will catch claim patterns where eligibility verification timestamps trail service dates, and that reads as a control failure even when the care was sound. A multi-location ABA enterprise we work with made exactly that shift, moving every intake call through automated verification at the front door before booking; they scaled call volume materially with no new admin hires, and the verification timestamp on every claim now sits cleanly ahead of the service date.

5. Document parent training and school consultation with the same rigor as direct therapy.

In my experience these codes draw scrutiny fastest, because the rendering provider, the participants, and the goal addressed are easy to leave vague in a note. A federal reviewer pattern-matches against exactly that vagueness. If a note does not name who delivered the service, who took part, the goal, and the duration, the claim is exposed.

The Bottom Line For ABA Operations

AERO will make the next eighteen months noisy for state Medicaid agencies, and that noise reaches ABA providers through new documentation requirements, faster audit cycles, and tighter scrutiny on re-authorization patterns.

Practices that have moved verification, authorization, and supervision tracking into AI-driven front-office workflows built for ABA will treat this as a normal quarter. Nevertheless, practices still running these workflows on spreadsheets and shared inboxes will spend the year on the back foot. The work that pays back here pays back in every environment: clean intake, tight authorizations, documented supervision. Federal audit enforcement just raised the price of skipping it.