Autism therapy audits flagged every month they sampled. Auditors at HHS’s Office of Inspector General examined Medicaid payments for autism therapy in 4 states, most of it applied behavior analysis, known as ABA. Each audit drew 100 enrollee-months, meaning 1 child’s claims for 1 month. Every sampled month in all 4 states held at least 1 claim line that was improper or potentially improper.
The spending behind those claims has grown fast. Medicaid and CHIP paid about $1.94 billion for ABA in 2021 and $10.1 billion in 2025, according to the CMS ABA toolkit. The number of children with an autism diagnosis receiving ABA grew 189% over the same years. Spending grew 421%.
The response arrived in 2026. Minnesota kept new providers out of its autism program while federal prosecutors charged providers with paying parents to bring their children in. CMS published an ABA toolkit for states in August. The control we think the program still lacks comes at the end.
Key takeaways
- Every sampled month was flagged. All 100 sampled enrollee-months in each of 4 OIG audits had at least 1 improper or potentially improper claim line.
- The money at stake is large. OIG asked the 4 states to refund about $123 million in federal funds. It asked them to review about $242 million more.
- Most errors were records and staffing. Missing assessments and thin session notes led the findings. Staff without required credentials turned up in every state.
- Spending outran the children served. ABA spending in Medicaid and CHIP grew 421% from 2021 to 2025. The number of children with autism receiving ABA grew 189%.
- Minnesota showed the fraud end of the range. Prosecutors have charged autism providers with paying kickbacks to parents.
- States reached for blunt tools. Nebraska cut its technician rate by 48%. Indiana set a lifetime cap of 4,000 hours.
- CMS issued guidance rather than a rule. Its August toolkit urges prior authorization and electronic visit verification for ABA.
- We think the claim should come from the session. A claim built from a verified session record would block most of the errors the auditors found before any money moved.
What the audits found
OIG has now audited fee-for-service autism therapy payments in 4 states. Each audit drew a statistical sample of 100 enrollee-months and checked it against federal and state rules. Each then projected its findings to the state’s total payments for the years under review.
| State | Report issued | Years audited | Improper payments, at least | Federal share to refund |
|---|---|---|---|---|
| Indiana | December 2024 | 2019 to 2020 | $56 million | $39.4 million |
| Wisconsin | July 2025 | 2021 to 2022 | $18.5 million | $12.3 million |
| Maine | January 2026 | 2023 | $45.6 million | $28.8 million |
| Colorado | February 2026 | 2022 to 2023 | $77.8 million | $42.6 million |
Across the 4 audits, OIG asked the states to refund about $123 million in federal funds. It also estimated about $242 million more in federal share that was potentially improper. Those are payments where the records raised questions OIG could not settle from the file. OIG asked each state to review them and return what it could not support.
The figures have limits. They are projections from samples, and they cover fee-for-service payments only. In Nebraska, most ABA spending runs through managed care plans, according to Behavioral Health Business. Audits like these do not test those payments.
The same errors in every state
The findings repeat from state to state. Maine’s OIG summary shows that 81 of the 100 sampled months included a comprehensive assessment that was missing or lacked a required signature. Session notes fell short of requirements in 64 months. In 92 months the billed time appeared to include time that was not therapy, which OIG counted as potentially improper.
The Indiana audit found that 97 of the 100 sampled months had at least 1 claim line that failed state or federal rules. The problems included thin session notes and staff without the right credentials. Some children lacked a required diagnostic evaluation or referral. Wisconsin’s auditors found billed hours that included meals and naps. That state had not run a statewide postpayment review since its ABA benefit began in 2016, according to Benesch.
Colorado’s audit found care from technicians without credentials. It also found payments for children without an official autism diagnosis, according to the Colorado Sun. The state disputed the refund, saying OIG had not given it the claim-level detail needed to support the amount.
None of this proves fraud. Most of these findings are documentation failures, the kind our piece on honest waste described. A missing signature does not mean a session did not happen. But a payment system that cannot tell a missing signature from a missing session will pay for both.
Prior authorization did not stop them
Indiana and Colorado both used contractors to authorize ABA before it was paid. OIG recommended that Indiana review how its contractor verified the diagnostic evaluation behind each request, in its Indiana report. It made a similar recommendation in its Colorado report.
That finding matters to anyone who runs review. An authorization that approves hours without checking the diagnosis is not review. It is a permission slip. The claims that follow look legitimate because they match an approval, even when the approval had no basis.
Authorization also looks forward. It sets a ceiling on hours before care is delivered. It does not check whether the hours billed were spent on therapy by the right person. That question sits with the claim, and the claim is where no one was looking.
How fast the spending grew
The audits arrived as spending soared. National ABA spending in Medicaid and CHIP rose 421% in 4 years, according to CMS. The state figures below show the same climb.
| Program | Earlier year | Later year |
|---|---|---|
| Indiana ABA, fee-for-service | $14.4 million in 2017 | $101.8 million in 2020 |
| Wisconsin ABA, fee-for-service | $39.9 million in 2018 | $53.7 million in 2022 |
| Colorado ABA, fee-for-service | $60.1 million in 2019 | $163.5 million in 2023 |
| Maine autism services, fee-for-service | $52.2 million in 2019 | $80.6 million in 2023 |
| Nebraska ABA, all Medicaid | $4.6 million in 2020 | $85 million in 2024 |
| Minnesota autism program claims | More than $600,000 in 2018 | More than $400 million in 2025 |
| Medicaid and CHIP nationally | $1.94 billion in 2021 | $10.1 billion in 2025 |
The rows come from different sources and measure different things. Nebraska’s figure was reported by Nebraska Public Media. Minnesota’s was reported by the Justice Department.
What the growth does not prove
Growth alone is not evidence of fraud. CMS told states in a 2014 bulletin that Medicaid’s benefit for children, known as EPSDT, must cover medically necessary treatment for children with autism. More children are also being diagnosed. Medicaid and CHIP enrollees with an autism diagnosis who received any service rose 67%, from 1.15 million in 2021 to 1.92 million in 2025, according to CMS.
But the CMS data show ABA growing faster than the population it serves. Children with autism receiving ABA grew 189% while spending grew 421%. Average weekly ABA hours per enrollee rose 22% to 17.33 hours in 2025. CMS also found that $1.47 billion of 2025 ABA spending, about 14.5%, was for conditions other than autism.
Growth is where the audits looked, and each OIG report cites how fast the state’s payments had risen. Growth is a reason to look. It is not a finding until someone reads the records.
How states responded in 2026
States moved quickly in 2026. Some acted under federal pressure while others acted on their own. Minnesota faced the hardest case.
Minnesota’s autism program
Minnesota shows the far end of the range. The state’s autism benefit, known as EIDBI, dates to 2017, according to the Justice Department. Claims grew from more than $600,000 in 2018 to more than $400 million in 2025.
Federal prosecutors filed the first charge in the program in September 2025. The charging announcement described monthly cash payments to parents of $300 to $1,500 per child. It also described claims for maximum hours when children received a fraction of that time or none. In May 2026, a Minnesota takedown charged 2 defendants in the program over about $46.6 million. Prosecutors alleged kickbacks to parents and diagnoses made regardless of need. Those charges are allegations, not findings of guilt.
Kickbacks to parents defeat a control that most programs rely on. A family is usually the best witness to whether a session happened. When the family is paid, that witness is gone. A check has to rest at least partly on evidence that neither the provider nor the family controls.
The state moved on several fronts. Its Department of Human Services (DHS) raised the program’s fraud risk level to high in spring 2025. DHS stopped enrolling new autism providers in November 2025, according to its October 2026 update. It began enhanced prepayment review of high-risk claims in December 2025. In January 2026 it hired private auditors to examine billing outliers in the program. Providers in 13 high-risk services, the autism program among them, also had to revalidate their enrollment.
The state’s own oversight drew criticism. In March 2026, Minnesota’s legislative auditor found that DHS had more authority than it believed to act on kickback allegations. In 3 of the 25 complaints the auditor reviewed, DHS had wrongly said it lacked authority to investigate, according to MPR News. CMS rejected the state’s first corrective action plan in January 2026. It has since announced deferrals of federal funds for 3 quarters, according to a Georgetown timeline.
Rates and hour limits
Other states pulled the levers they control directly. Nebraska’s ABA spending rose from $4.6 million for 169 families in 2020 to about $85 million for more than 1,500 families in 2024. In August 2025 the state cut its rates. The rate for direct therapy by a technician fell 48%, to $18.70 per 15 minutes, according to Nebraska Public Media. The state also set a 30-hour weekly limit per child. Its Medicaid director said the new rates remained above national averages. Providers warned that children could go without care if they could not find another provider.
Indiana changed its benefit in April 2026. It cut the maximum rates for individual ABA services by 6%, with a further 4% cut to all ABA codes due in April 2027. It also set a lifetime cap of 4,000 hours, counted from April 2026, according to Hall Render. Children who reach the cap can still receive up to 15 hours a week when the care is medically necessary.
North Carolina took a review approach instead. ABA plans above 16 hours a week now need approval from the state or the member’s managed care plan, renewed every 3 months, according to the CMS toolkit. Colorado sought an emergency rule change in December 2025 and withdrew it after parents and providers objected.
Rate cuts and caps act on every provider at once. They lower spending for honest providers and dishonest ones alike. They cannot tell a child who needs 30 hours from a child who needs 10.
Enrollment and ownership
A second set of tools works on who may bill. CMS asked governors in April 2026 to quickly revalidate providers at high risk of fraud, according to its letter to Vermont. CMS left the definition of high risk to each state. It said the definition should include any provider without a National Provider Identifier.
New York announced a 6-month pause on new Medicaid enrollments in July 2026 for 6 provider categories, ABA among them. The pause also halts changes of ownership, according to Ropes & Gray. Illinois updated its ABA licensure law to require that practices be owned by licensed providers, starting in January 2027, according to Holland & Knight.
Congress has joined in. The House Energy and Commerce Committee expanded its Medicaid fraud investigation in March 2026 with letters to 10 states. Its letter to Nebraska cited the state’s ABA spending growth, according to Nebraska Public Media. Our review of the 2026 fraud takedown found that Medicaid schemes accounted for 295 of the defendants.
What the CMS toolkit asks
CMS released its ABA toolkit for state Medicaid and CHIP programs in August 2026. It runs more than 170 pages and creates no new federal requirements. It also says it does not reduce what states owe children under EPSDT.
Its recommendations read like a utilization management manual. According to a summary by Barnes & Thornburg, the toolkit urges states to take these steps.
- Authorize before treatment starts. States should require prior authorization before ABA begins and reauthorize near the end of each approved period. Hours should follow an individual treatment plan, not a standard package.
- Confirm the diagnosis independently. Comprehensive ABA should start only after a qualified independent clinician confirms the autism diagnosis.
- Supervise in person. Clinical guidelines call for 1 to 2 hours of supervision for every 10 hours of direct treatment, with a meaningful in-person part. Telehealth should support in-person ABA, not replace it.
- Verify visits electronically. States should extend electronic visit verification to ABA. They should add prepayment edits that match claims to authorizations and catch overlapping services.
- Watch for outliers. Providers that bill maximum hours for 80% or more of their patients deserve closer scrutiny. So do providers whose billing jumps soon after they enroll.
- Measure progress. Treatment plans should use at least 1 validated outcome instrument instead of measures the provider invented.
The toolkit also says that 40 hours of ABA a week is not a best practice. Its red flags for reviewers include identical documentation across children and reevaluations that show no progress. Those flags mirror what the OIG audits found.
What it leaves to the states
The toolkit is guidance. States choose whether to adopt any of it, and they pay for the systems it implies. Prepayment edits need claims systems that can see authorizations and sessions together. That is a systems project, not a policy memo.
The toolkit also leaves the hardest tradeoff to the states. It warns against standard hour packages. It also warns against limiting access to medically necessary care. A state that cuts hours across the board risks the second failure. A state that approves every request risks the first.
The outlier tests need care as well. Our piece on anomaly scores argued that a red flag is a lead, not a finding. A provider that bills maximum hours for most of its patients may be serving the children with the greatest needs. The flag tells a reviewer where to look. It should not decide the case.
Build the claim from the session
The audits point to a single weakness. A claim is a summary written after the fact. It says how many units a provider delivered and who delivered them. Nothing in the payment system checks that summary against the session itself until an auditor pulls the file years later.
We think the order should flip. The session record should come first, and the claim should be built from it. Electronic visit verification would set the start and end of each session. The payment system would then match the finished claim to the authorization before paying it. The table shows how the errors in the audits map to checks a session-built claim would make.
| What the auditors found | What a session-built claim would check |
|---|---|
| Units the session notes did not support | Units computed from the recorded start and end times |
| Missing signatures from staff or parents | A session that cannot close until the required signatures are in |
| Services by staff without credentials | The technician’s credential, checked against the registry when the session opens |
| Billed time that covered meals and naps | Non-therapy time logged separately and kept off the claim |
| Children without a required diagnostic evaluation | An authorization that cannot issue without an independent diagnosis on file |
| Overlapping session times | An automatic check for the same child or technician in 2 places at once |
A claim built from the session cannot bill for more than the session held.
A claim that fails a check would go to a person, not to an automatic denial. Most failures will be honest. A signature may be a day late, or a credential may be in renewal. A reviewer can clear those in minutes. Our piece on prepayment review argued that a screen should be judged like a diagnostic test, by how often it is right when it fires. The same standard applies here.
What it would cost
The approach has real costs. Electronic visit verification in a family’s home records time and location, which raises fair privacy questions. The data should confirm that a visit happened, and it should not be used to track a family. Small providers would need time and help to adopt the software.
It would not stop every scheme. A provider and a family that collude can still record a session that did not happen. Analytics across providers can catch some of what a single record cannot. So can an independent diagnosis, because it puts a clinician with no stake in the hours at the front of the case.
Most of what OIG found was not collusion, though. It was ordinary billing that no system checked. A session-built claim would stop those errors before payment. Audits could then spend their time on the cases that need an investigator.
Where Redlake stands
Redlake builds tools that health plans use in utilization review. A machine can say yes, but only a person can say no. Every recommendation our tools make shows its reasons, and every decision can be reconstructed. Here is how we would apply those rules to ABA.
Check the claim against the session before paying. Most of the errors OIG found could be caught by matching each claim to an authorization and a verified session. Payment should wait for that match, not for an audit years later.
Keep the diagnosis independent. The clinician who confirms autism should not profit from the hours that follow. The CMS toolkit makes the same recommendation.
Let renewals follow measured progress. Software can approve a renewal when a validated measure shows progress. A reduction in hours should come from a qualified clinician who has read the treatment plan and can explain the decision to the family. Our piece on peer-to-peer review made that case for denials generally.
Prefer review to blanket cuts. Rate cuts and lifetime caps reduce spending for every child at once. Review can reduce the hours that lack a basis while leaving the rest alone.
Audit the authorizer. OIG asked Indiana and Colorado to review their prior authorization contractors. A review program should be tested the way claims are, with a sample checked against the full record.
Count both kinds of error. A program that measures only overpayments will drift toward cutting care. States should also track children who lost services they needed. Our piece on Medicaid program integrity made the same argument about eligibility.
What to watch in the rest of 2026
- Minnesota. Watch whether CMS defers more federal payments while the state’s court case is paused.
- New York. Watch whether the state lifts its enrollment pause on schedule in early 2027.
- More audits. Watch for OIG reports on ABA payments in more states.
- Toolkit adoption. Watch which states extend electronic visit verification to ABA or add prepayment edits.
- Refunds. Watch whether Colorado’s dispute over its $42.6 million refund is resolved.
- Managed care. Watch whether states begin testing ABA claims paid by managed care plans, which the federal audits did not cover.
About this analysis
Method. The 4 HHS-OIG audits of Medicaid autism therapy payments issued from December 2024 to February 2026 are the core sources, with state actions and federal guidance reported through October 2026 added. Dollar figures are as published. Federal share totals are our sums of the figures in each report.
Data notes. OIG’s estimates are projections from samples of 100 enrollee-months. They cover fee-for-service payments only. Potentially improper payments are not confirmed overpayments. State spending figures come from different sources and are not comparable across states. Criminal charges described here are allegations.
Sources. HHS-OIG report A-09-22-02002 on Indiana (December 2024). HHS-OIG report A-06-23-01002 on Wisconsin (July 2025). HHS-OIG report A-01-24-00006 on Maine (January 2026). HHS-OIG report A-09-24-02004 on Colorado (February 2026). CMS State Medicaid and CHIP ABA Toolkit (August 2026). CMS letter to governors on provider revalidation (April 2026). Justice Department releases (September 2025 and May 2026). Minnesota DHS news update (October 2026). MPR News on the Minnesota legislative auditor (March 2026). Georgetown Center for Children and Families timeline (September 2026). Nebraska Public Media (September 2025 and March 2026). Behavioral Health Business (July 2025). Hall Render on Indiana (April 2026). Ropes & Gray on New York (July 2026). Holland & Knight (August 2026). Barnes & Thornburg (August 2026). Colorado Sun (March 2026). Benesch (August 2025). CMCS informational bulletin on autism services (July 2014).
Frequently asked questions
What is applied behavior analysis?
ABA is a therapy that uses structured teaching and reinforcement to build skills in children with autism. Behavior analysts design the plan, and technicians deliver most sessions under their supervision.
Does Medicaid have to cover autism therapy for children?
Under EPSDT, Medicaid must cover services that are medically necessary for children under 21. CMS has said that includes treatment for autism. States decide how to define and authorize the benefit.
What did the OIG audits find?
All 100 sampled enrollee-months in each of the 4 audited states had at least 1 improper or potentially improper claim line. Together the audits estimated nearly $200 million in improper payments.
Is an improper payment the same as fraud?
No. An improper payment is one that did not meet program rules, often because the records were incomplete. Fraud requires intent to deceive. Most of what OIG found was documentation and staffing failures.
Why did Minnesota stop enrolling new autism providers?
The state classified its autism program as high risk for fraud in spring 2025. Federal prosecutors filed the first charges in September 2025, and the state stopped enrolling new providers that November.
What is electronic visit verification?
It is a system that records when and where a service was delivered. The caregiver usually checks in on a device at the start and end of each visit. Federal law already requires it for Medicaid personal care and home health services, and the CMS toolkit recommends extending it to ABA.