How to Survive an ABA Payer Audit: Clawbacks, Cloned Notes, and Pre-Billing Review

Why ABA is under audit pressure right now

The HHS Office of Inspector General (OIG) is running a coordinated series of audits of state Medicaid payments for applied behavior analysis, launched because, in the OIG's words, "some Federal and State agencies have identified questionable billing patterns by some ABA providers as well as Federal and State payments to providers for unallowable services." Four state audits in the series have been completed — Indiana, Wisconsin, Colorado, and Maine — with four more active. The published findings are severe: in both the Indiana and Colorado audits, every one of the 100 sampled enrollee-months contained at least one claim line that was improper or potentially improper.

The OIG is not the only actor. Section 6411 of the Affordable Care Act requires every state (absent a CMS-granted exception) to operate a Medicaid Recovery Audit Contractor (RAC) program, codified at 42 CFR Part 455, Subpart F. Medicaid RACs are paid contingency fees drawn only from the overpayments they recover, which means the auditor's revenue is a percentage of your clawback. On the commercial side, payers operate special investigations units (SIUs); California, for example, requires every admitted insurer to maintain a unit that investigates suspected fraudulent claims under Insurance Code section 1875.20. ABA's billing structure amplifies the exposure: the 97151–97158 CPT codes, adopted as Category I codes effective January 1, 2019, are billed largely in 15-minute units at high weekly intensities, producing exactly the high-volume per-client unit patterns that claims data mining is built to surface.

What triggers an ABA audit

Payer audits rarely begin with a human reading your notes; they begin with a database query. Claims data alone can reveal utilization far outside peer norms, sessions that overlap for the same technician, billed hours that exceed a plausible workday, and services rendered under lapsed credentials — all without anyone requesting a single chart. Once the data flags a provider, the records request follows.

Cloned documentation deserves special emphasis because ABA is unusually vulnerable to it. Payers define cloned documentation as entries "worded exactly like or similar to the previous entries," whether across dates of service for one client or from client to client. The stated consequence in payer manuals is blunt: cloned documentation "does not meet medical necessity requirements for coverage of services rendered due to the lack of specific, individual information," and its identification "will lead to denial of services for lack of medical necessity and recoupment of all overpayments made." Templated goal language plus a copy-pasted narrative across a week of 97153 sessions reads as cloned even when every session genuinely happened.

• Statistical outliers: units or hours per client, per technician, or per week far above peer providers.
• Cloned documentation: identical or near-identical session narratives across dates or across clients.
• Impossible schedules: overlapping sessions for one rendering provider, or daily billed hours no one could work.
• High units per client: 15-minute-unit codes like 97153 make dosage anomalies easy to spot in claims data.
• Credential gaps: claims under providers whose certification or payer enrollment was inactive on the date of service.
• Complaints and referrals: SIUs exist specifically to receive and investigate tips about suspected fraud.

What auditors request: the record set for sampled dates of service

A typical audit letter identifies a sample of clients and dates of service and asks for everything needed to re-adjudicate those claims. Expect to produce the complete package below for every sampled date, and expect reviewers to fail the claim if any element is missing rather than ask you to clarify.

The OIG's state audits show where files actually fail. The Indiana audit specifically cited signature requirement violations and session notes with insufficient detail to support the services billed, and the OIG recommended that states issue enhanced guidance on CPT coding, signatures, and session note requirements — a preview of what your reviewers will hold you to.

The three-way match: authorization, documentation, claim

Every billed line must survive a three-way match: the authorization, the clinical documentation, and the claim must tell the same story. The units on the claim cannot exceed the units the note supports, and the units the note supports cannot exceed the units the authorization allows for that code in that date span. The rendering provider on the claim must be the person who signed the note, and that person must have held an active, payer-enrolled credential permitted to deliver that code on that day.

Auditors work line by line, and each mismatch is independently recoupable: a 97155 claim rendered by a technician, a note whose times support three units on a claim billing four, a session dated after the authorization lapsed. None of these requires the payer to question whether therapy occurred — the paperwork disagreement alone is the overpayment. Building the three-way match into your pre-billing workflow, rather than reconstructing it under audit deadlines, is the single highest-leverage control an agency can adopt.

Extrapolation: how a small sample becomes a seven-figure clawback

Auditors do not need to review every claim to recoup on every claim. Under statistical sampling, a reviewer audits a random sample, calculates the error rate, and projects that rate across the entire universe of your paid claims — the projected figure, not the sampled figure, becomes the demand. Medicare's rules for this live in Chapter 8 of the CMS Program Integrity Manual, which directs contractors to use statistical sampling for overpayment estimation when there is a sustained or high level of payment error or where documented educational intervention has failed to correct it, and requires the sampling methodology to be reviewed and approved in writing by a statistician or a person with equivalent expertise in probability sampling and estimation methods.

The OIG's ABA audits show the arithmetic in practice: samples of 100 enrollee-months produced projected findings of $56 million in Indiana and $77.8 million in Colorado. A 30 percent documentation error rate in a small sample is not a small problem — applied to two years of claims, it is an existential one. Extrapolation methodology is challengeable on appeal, and flawed sampling design is one of the most common grounds for reducing a demand, but that is a fight you wage with healthcare counsel and your own statistician, not a reason to relax about documentation.

The federal 60-day rule: returning overpayments you identify

Federal law imposes a repayment duty that operates even when no auditor ever contacts you. Section 1128J(d) of the Social Security Act, added by the Affordable Care Act, requires any person who has received an overpayment of Medicare or Medicaid funds to report and return it by the later of 60 days after the date the overpayment was identified or the date any corresponding cost report is due. An overpayment retained past that deadline becomes an "obligation" under the False Claims Act, exposing the agency to treble damages and per-claim penalties on top of the repayment itself.

The implementing Medicare regulation, 42 CFR 401.305, now provides that a person has identified an overpayment when the person "knowingly receives or retains" it — a standard that includes actual knowledge, reckless disregard, and deliberate ignorance. The regulation allows the 60-day clock to be suspended while you conduct a timely, good-faith investigation into related overpayments, but for no more than 180 days after the initial overpayment was identified. It also imposes a six-year lookback: an overpayment must be reported and returned if identified within six years of the date it was received. The practical consequence for ABA agencies is sharp — once an audit or self-review teaches you that a category of claims was billed in error, deliberately not looking at the similar claims outside the sample is precisely the conduct the knowing-retention standard targets.

Prevention: the four controls that survive audits

Every deficiency category in the OIG's ABA audits — inadequate session notes, signature violations, credential problems — is detectable before the claim goes out the door. Agencies that survive audits are the ones that run the payer's checks on themselves first.

Pre-billing documentation review means no claim is released until the three-way match passes: note complete, individualized, and signed; times supporting the billed units; code and units inside an active authorization; rendering provider credentialed and enrolled on the date of service. Supervision must be documented, not just delivered — the BACB requires RBTs to receive supervision for a minimum of 5% of the hours they spend providing behavior-analytic services each calendar month, and payer contracts may layer additional requirements on top; an undocumented supervision month is indistinguishable from an unsupervised one in an audit file. Credential hygiene means tracking certification and payer-enrollment dates so that no session is ever scheduled, let alone billed, under a lapsed credential. Finally, adopt a self-audit cadence: pull your own random sample of paid claims on a recurring schedule and re-adjudicate them the way a RAC would. The OIG recommended that state Medicaid agencies conduct periodic statewide post-payment reviews of ABA claims — assume your payers will implement that recommendation, and get there first.

When the audit letter arrives

Do not panic, and do not improvise. Read the letter completely and calendar every deadline it contains — response windows are short, they are enforceable, and an incomplete or late production is scored as a failure, not an extension request. Engage healthcare counsel experienced in payer audits before you respond; counsel can protect the internal review under privilege, manage communications with the payer or contractor, and evaluate whether the sampling frame and extrapolation methodology are sound.

Never alter, backdate, or "complete" records after the request arrives — a documentation gap is a recoupable claim, but an altered record is potential fraud. Assemble the full record set for every sampled date of service, organized so a reviewer can find each element without hunting. When findings arrive, use every appeal level available, and challenge extrapolation methodology where it is weak. Then close the loop: adopt a written corrective action plan that names the root causes and the controls added, because payers and regulators treat a credible corrective action plan as evidence of a compliance program rather than a pattern. Finally, assess your 60-day rule exposure — audit findings can put you on notice about similar claims outside the sample, and the 180-day investigation window in 42 CFR 401.305 exists precisely so you can quantify and return related overpayments in good faith.

A final word: this guide is educational information for ABA providers, not legal advice. If an audit letter has already arrived, engage qualified healthcare counsel before you respond.

Frequently asked questions