The CMS ABA Toolkit, Read as a Provider: What States Were Just Handed, and What They Will Ask You For

What the toolkit is, and the four things CMS says it is not

The toolkit is guidance, in the specific regulatory sense: it carries no force of law, imposes no condition on federal financial participation, and changes nothing about what a state must cover today. CMS states the boundaries directly — the toolkit does not establish new federal requirements, does not reduce EPSDT obligations, does not endorse any single treatment approach to ABA, and does not direct states to limit access to medically necessary care.

Those disclaimers are not decorative and they are worth quoting back when needed. The EPSDT one in particular is load-bearing: for Medicaid-eligible children under 21, states remain obliged to cover medically necessary treatment, and the toolkit's own utilization-management checklist asks states whether their policies "do not impose hard limits, automatic terminations, or other limits that could restrict medically necessary EPSDT services." A state that cites the toolkit while installing a hard hour cap is citing a document that tells it not to.

What the toolkit does do is organize, in one place and with CMS's name on it, the full range of levers a state can pull: how to define medical necessity, how to structure prior authorization and concurrent review, how to set provider qualifications and supervision standards, how to pay, and how to detect and recover improper payments. Before August 4, a state contemplating an ABA rewrite had to assemble that from other states' bulletins and audit reports. Now it has a federal starting document, with checklists.

The 421 percent, and what that number actually measures

The figure driving coverage of the toolkit is real and comes from CMS's own claims data. Using T-MSIS analytic files across all fifty states, Washington DC, Puerto Rico, the US Virgin Islands and Guam, CMS reports that Medicaid and CHIP payments for ABA services rose from approximately $1.94 billion in 2021 to $10.1 billion in 2025 — an increase of 421 percent. The sentence CMS puts that figure in also carries its companion: over the same period there was a 189 percent increase in the number of children with an ASD diagnosis who received ABA services. Those two belong together, and the arithmetic between them is the number nobody is quoting — spending per child actually receiving ABA rose about 80 percent from 2021 to 2025.

The toolkit contains a third growth figure, and pairing it with the spending number is the most common error in coverage of this document. In a separate chapter CMS reports that beneficiaries with an autism diagnosis who received any Medicaid or CHIP service grew 67 percent, from 1.15 million to 1.92 million, and it notes explicitly that of these beneficiaries only a small proportion received ABA. That figure describes the diagnosed population, not the treated one. Divide 421 by 67 and you get the six-to-one claim in circulation; divide it by 189, the growth in children who actually received ABA, and the gap is closer to two-to-one. If a state official quotes six-to-one at you, the toolkit's own executive summary is the answer.

The pairing has a traceable origin, and it is not the trade press. The CMS press release announcing the toolkit reports that ABA spending increased 421 percent, "far outpacing the 67% growth in the number of children with an autism spectrum disorder (ASD) diagnosis receiving services." The 189 percent figure does not appear in that press release at all. So the comparison behind every six-to-one headline was assembled in the announcement, and the document being announced disagrees with it twice: the toolkit places 189 and 421 in a single sentence, and it says of the 67 percent population that only a small proportion received ABA. The phrase "receiving services" in the press release is doing the damage, because in the toolkit that population is receiving any Medicaid or CHIP service, not ABA. Anyone repeating six-to-one is quoting the announcement faithfully and the toolkit inaccurately — which matters, because in a rate hearing the document a state cites is the toolkit.

Even the correct ratio has more than one cause behind it. Growth in spend per treated child can come from more hours per child, from rate increases, or from changes in service mix — and CMS attributes part of the overall growth to structural causes it names itself, including state insurance mandates, the creation of ABA-specific CPT codes, and CMS's own 2014 guidance identifying ABA as an option for states to cover.

One decomposition in the toolkit deserves more attention than it has received. CMS reports that in 2025, $1.47 billion — 14.5 percent of all Medicaid and CHIP ABA spending — was paid for ABA services delivered to treat conditions other than autism spectrum disorder, such as ADHD. An agency whose caseload is ASD-only should understand that roughly one in seven ABA dollars in the national figure is not describing its business at all.

The toolkit also states the concern behind the number in plain terms: that high service hours may be prescribed as a standard approach rather than tied to individual clinical need and outcomes. That framing, more than the percentage, is what will show up in state policy — expect scrutiny aimed at hour levels that look like a default rather than a determination.

The documentation standard, written out

The most directly operational passage in the toolkit is its description of clinical documentation, because it is the passage states are most likely to lift verbatim into provider manuals. CMS frames documentation as "the primary evidence that services were delivered and medically necessary" and "the foundation for audit findings, potential recoupment, and administrative actions," and says it must be sufficient, accurate, timely, and organized so that independent reviewers can validate services and replicate findings.

CMS then sets a minimum. Documentation should include comprehensive individualized treatment plans tied to assessment results and medical necessity determinations; detailed progress notes documenting services rendered, including date, duration, and activities performed; and supervision logs demonstrating appropriate oversight and compliance with supervision requirements. Note the third item — supervision logs are named as a documentation category in their own right, not as a byproduct of session notes.

It also sets what the documentation has to accomplish: substantiate each billed service, support medical necessity determinations, verify provider qualifications and supervision, and provide a clear audit trail for review and any recoupment decisions. At session level, the record must show that the service was provided including date, duration and location; that what was delivered is consistent with the treatment plan; that what was billed is supported by the documentation; and that the rendering provider and, where applicable, the supervising clinician meet program requirements.

The urgency behind that specificity is stated bluntly a few lines later: federal and state audits have found insufficient session notes and unclear definitions of billable time to be key drivers of improper payments, and CMS notes that in some states audits found 100 percent of claims were lacking documentation or had incomplete documentation. That is not a claim about fraud. It is a claim that the paperwork did not survive review — which is a different problem with the same financial outcome.

• Every billed session shows date, duration, location, and the activities actually performed — not a restatement of the goal.
• Every session ties visibly to a current individualized treatment plan, and the plan ties to assessment results and a medical-necessity determination.
• Supervision is logged as its own record, sufficient to demonstrate compliance with whatever ratio the state imposes.
• The rendering provider's qualifications, and the supervising clinician's, are verifiable as of the date of service — not as of today.
• Billable and non-billable time are distinguishable on the face of the record, because unclear definitions of billable time are named as a driver of improper payments.

Electronic visit verification is coming for ABA, and CMS said so first

The 21st Century Cures Act requires electronic visit verification for personal care services and home health services. It has never required EVV for ABA, and that has been the accurate answer to the question for years.

The toolkit changes the direction of travel. CMS writes that although federal law only requires EVV for personal care and home health, "states should consider extending EVV to ABA," and argues that applying EVV to home-based ABA "would address an extensive vulnerability given the high volume and decentralized nature of service delivery." It goes on to specify what effective ABA EVV requirements look like: monitoring provider compliance and identifying noncompliant providers, establishing data-completeness thresholds such as the percentage of claims matched to EVV records, implementing corrective action including education, payment holds, or sanctions for persistent noncompliance, and integrating EVV data with claims, clinical documentation and provider credential data to detect discrepancies.

It also names the use: a best-practice callout tells states to use EVV data as part of claims processing and preliminary investigations under 42 CFR 455.14. That is the regulation governing what a state does when it receives a complaint of Medicaid fraud or abuse — so CMS is not describing EVV as a scheduling convenience but as investigative evidence.

For an agency delivering home-based services, the planning implication is straightforward and does not depend on predicting any particular state. Visit-level location and time proof is now something a state can adopt with federal encouragement behind it, and the data cannot be created retroactively. An agency already capturing verified check-in and check-out has nothing to do when its state moves; an agency capturing neither has a gap it cannot close backwards.

The state checklists, flipped into what you will be asked to prove

Appendix A of the toolkit is six checklists — clinical standards, ABA and ASD coverage, payment approaches, provider enrollment and qualifications, utilization management, and program integrity — written as questions a state asks itself. Read from the provider side, each question that a state answers "no" to today is a requirement it may write tomorrow. A few carry unusually direct operational consequences.

On authorization, the toolkit asks states whether "authorization and reauthorization decisions are tied to the ITP rather than standardized hour packages or preset treatment levels," and whether concurrent review looks beyond diagnosis to progress data, treatment response, and delivered versus authorized hours. Delivered versus authorized hours is a comparison many agencies cannot produce quickly, and it is now a named review input.

On diagnosis, the clinical-standards checklist asks whether diagnostic evaluations use at least two assessment tools — one caregiver-report instrument and one provider-observation measure — with direct observation and a structured caregiver interview using a validated standardized instrument. Agencies that accept outside diagnoses should expect the sufficiency of those evaluations to become a coverage question rather than a clinical courtesy.

On ownership, the provider checklist asks whether states monitor post-acquisition risk indicators — rapid growth, staff turnover, reduced supervision, unusual billing patterns — and whether they require prompt reporting of ownership changes. Private-equity-backed and recently acquired ABA organizations should read that section as being about them specifically. The clinical-standards checklist separately raises Stark Law conformance for referrals.

On supervision, the checklist asks whether states have established minimum standards for BCaBAs, RBTs and technicians covering supervision frequency, direct observation, and documentation expectations, whether they have clarified which supervision activities are billable, and — for school-based delivery — whether remote supervision satisfies on-site requirements and how ratios apply across multiple classrooms or buildings. That last one has no settled answer in most states today.

Prepayment review is the part that touches cash, not just compliance

Most program-integrity guidance describes what happens after payment. This toolkit gives roughly equal weight to what happens before it. CMS recommends that states implement targeted, risk-based prepayment medical review for higher-risk ABA claims: identifying high-risk services, providers or billing patterns through analytics and prior audit findings, requesting supporting documentation before payment, and holding or pending claims until review is complete.

The distinction matters for an agency's finances more than for its compliance posture. A post-payment audit is a liability that arrives later and can be contested with time. A prepayment review is a delay in receiving money for work already delivered and payroll already run. An agency selected for prepayment review does not lose an argument; it loses the timing of its cash flow, and it recovers that timing only by producing complete documentation on request, quickly.

CMS does temper the design: it tells states to balance review against timely reimbursement and beneficiary access, to set clear timelines for submission and decisions, and to involve staff with appropriate clinical expertise. It also points states toward Medicare's Targeted Probe and Educate model, which pairs focused review cycles with provider education rather than penalty alone. The realistic expectation is not a wall but a filter — with selection driven by outlier utilization, rapid growth, and high-risk codes, all of which are patterns an agency can see in its own data before a state does.

What supervision guidance the toolkit actually endorses

The toolkit is careful to separate two things that ABA agencies routinely conflate, and the distinction is useful regardless of what any state does with it.

The first is a credentialing minimum. Under BACB requirements, a Registered Behavior Technician must receive ongoing supervision equal to at least 5 percent of the hours that RBT spends providing services in a calendar month. CMS is explicit that this percentage is calculated on the RBT's service-delivery hours rather than the supervisor's, and that it is a minimum credentialing requirement rather than a recommended level of case oversight.

The second is a clinical guideline. Citing the Council of Autism Service Providers' practice guidelines, the toolkit describes recommended supervision of roughly 10 to 20 percent relative to direct treatment hours — one to two hours of supervision for every ten hours of direct treatment, or one to two hours per week where direct treatment is ten hours or less — and says explicitly that providers are encouraged not to restrict supervision to the minimum, because individual need varies. It lists conditions warranting more supervision, including rapid progress or lack of progress, severe behaviors, early treatment or assessment periods, transitions, and increases in direct treatment hours; and conditions where less may suffice, such as planned step-down or maintenance.

On billability, the toolkit offers a clean test and then tells you to go check locally. The general guideline is whether the supervision activity is a direct, medically necessary individual service — billable — as against training, employment supervision, or administrative process, which is not. Billable supervision activities typically include in-person observation for clinical decision-making, live clinical direction to the BCaBA or RBT, and caregiver training and treatment guidance, associated with 97153, 97155 and 97156. But CMS states that whether a given supervision activity is billable should be determined from the specific state's Medicaid ABA provider manual, and that is still the operative answer.

What to do with this in the next ninety days

Nothing in the toolkit requires an agency to do anything. The reason to act now is that every control it describes depends on data captured at the time of service, and none of it can be reconstructed after a state adopts a rule. The work below is worth doing on its own merits and happens to be exactly what the toolkit points states toward.

Treat the checklists as a self-assessment. Take the provider-qualifications and utilization-management lists, answer each question about your own agency rather than about a state, and the gaps that surface are the ones a reviewer would find. That exercise costs an afternoon and requires no prediction about which state moves next.

• Pull a recent month of session notes at random and test them against the four session-level criteria CMS names: service provided with date, duration and location; consistent with the treatment plan; billed amount supported; rendering and supervising clinician qualified on that date. Score the failures rather than the intentions.
• Produce delivered-versus-authorized hours for your ten highest-utilization clients. If that takes more than an hour, it will take longer under a concurrent-review request.
• Compute each technician's supervision percentage for last month on the technician's service hours, and check both the BACB 5 percent minimum and where you sit against the 10-to-20 percent clinical guideline.
• Confirm you can evidence, per date of service, that the rendering provider held the required credential on that date — historical credential status, not current.
• If you deliver home-based services, establish verified visit location and time capture now, while it is a planning decision rather than a compliance deadline.
• Check whether your documentation distinguishes billable from non-billable supervision time on its face, since unclear definitions of billable time are specifically named as a driver of improper payments.
• If your organization has changed ownership recently or grown quickly, review the ownership-disclosure and post-acquisition risk questions, because those indicators are named as monitoring triggers.