EVV for ABA Therapy: State-by-State Requirements in 2026

What EVV is, and the six data points federal law requires

Electronic visit verification (EVV) is a system that electronically confirms a service visit actually happened. Section 12006 of the 21st Century Cures Act (Public Law 114-255, enacted December 2016) added subsection (l) to Section 1903 of the Social Security Act, codified at 42 U.S.C. § 1396b(l). The statute defines an EVV system as one under which visits are "electronically verified" with respect to six specific data points.

The statute deliberately avoids prescribing technology. Its rules of construction state that nothing in the section requires "the use of a particular or uniform electronic visit verification system," which is why GPS-stamped mobile apps, telephony (calling from the client's phone), and fixed in-home devices can all satisfy the mandate.

What the Cures Act actually mandates — and what it does not

The federal EVV mandate covers exactly two categories: Medicaid personal care services (PCS) and home health care services (HHCS) that require an in-home visit. States had to require EVV for PCS by January 1, 2020, and CMS granted most states a one-year good-faith-effort extension to January 1, 2021. The HHCS deadline was January 1, 2023.

The penalty for non-compliance falls on states, not providers. Under the statute, a non-compliant state's federal medical assistance percentage (FMAP) is reduced on an escalating schedule that starts at 0.25 percentage points and reaches a permanent 1-percentage-point cut (by 2023 for PCS, by 2027 for HHCS). States pass that pressure downstream by converting the mandate into provider-level claim edits. The statute also reimburses states 90 percent of the cost of designing a state-operated EVV system and 75 percent of operating it, which encouraged centralized state systems with room to grow beyond the federal minimum.

ABA is absent from the federal mandate. The statute defines HHCS as services under Section 1905(a)(7) of the Social Security Act and PCS as personal care under Section 1905(a)(24) and related waiver authorities. Adaptive behavior services billed under CPT codes 97151-97158 fall under neither definition, so there is no federal EVV floor for ABA.

How EVV reaches ABA: state extensions beyond the federal floor

Nothing stops a state from requiring EVV for additional services, and Colorado did exactly that. The Colorado Department of Health Care Policy and Financing (HCPF) states it "has expanded the scope of EVV in Colorado to other services similar in nature and service delivery," and its EVV-required list includes "Behavioral Therapies (provided in-home or community)" and Pediatric Behavioral Health — the benefit under which ABA codes 97151, 97153, 97154, 97155, and 97158 are billed.

The pressure behind extensions is fraud oversight of home-delivered services. The HHS Office of Inspector General is running a multi-state audit series of Medicaid ABA claims for children diagnosed with autism, citing "questionable billing patterns by some ABA providers"; audits covering Indiana, Wisconsin, Maine, and Colorado are complete, and the series runs through an estimated FY2027. Managed care adds a second channel: under the CMS "managed care plan choice" model, plans select and fund the EVV systems their network providers use, so verification expectations can differ plan by plan within a single state.

State-by-state status for ABA, as of mid-2026

The table below reflects primary sources checked in July 2026. Among the states reviewed, only Colorado currently enforces an EVV mandate on ABA services statewide; Florida built one and suspended it; Texas, Ohio, and Arizona apply EVV to personal care and home health, not ABA codes.

Treat this as a snapshot, not a guarantee. EVV service lists are living documents: states add codes by operational memo or provider notice, and managed care plans can move before the fee-for-service program does. Before relying on this table, check your state Medicaid agency's current EVV service code list.

Aggregator models: state-run vs. open and choice systems

CMS describes five EVV implementation models: provider choice, managed care plan choice, state-mandated in-house, state-mandated external vendor, and open vendor. In every choice or open model, the state operates a data aggregator — a central database that consolidates visit records from all approved EVV systems so claims can be matched against them.

The practical consequence for an ABA agency: in an open-model state, you may keep your own clinical platform if it can transmit compliant visit records to the state aggregator; in a state-mandated model, staff must log visits in the state's system regardless of what the agency uses internally.

What EVV compliance looks like inside an ABA agency

Where EVV applies to ABA, the workflow is concrete: the RBT or BCBA clocks in when the session starts and clocks out when it ends, using a method that captures all six statutory data points — most commonly a mobile app that stamps GPS coordinates, with telephony or a fixed device as fallback where the state allows. Colorado's state solution, for example, offers a mobile application, a toll-free telephone number, and a provider web portal.

Geofencing — flagging clock-ins that occur outside an expected radius of the service address — is an agency-side quality control, not a federal requirement. Colorado states that EVV does not restrict services to pre-determined locations; the location stamp is evidence of where care happened, not a fence around where it may happen.

Manual entry is the audit surface. Every EVV program has an exception workflow for missed punches and dead phone batteries, and every exception is visible to regulators. In Colorado, records created or changed through the portal are "notated as manual entry or edit and will be subject to Department audit," and modified records count against a provider's unmodified-EVV compliance metrics. In Texas, visit maintenance must be completed within 95 calendar days of the date of service, each correction requires the most appropriate reason code plus any required free text, and corrections after the window require an approved Visit Maintenance Unlock Request. The operational target is a high rate of clean, unmodified electronic captures, with manual entry reserved for genuine exceptions.

Penalties and claim edits: hard vs. soft

States enforce EVV on providers through claim edits. A soft edit lets the claim pay while flagging the missing or mismatched EVV record — an informational warning phase. A hard edit denies the claim outright when no matching EVV visit record exists.

The typical pattern is soft first, hard later. Colorado monitored compliance from August 3, 2020 through January 31, 2022, surfacing missing EVV on the remittance advice, then activated the denial edit on February 1, 2022. Texas ran an HHCS practice period from October 1 through December 31, 2023, during which claims without a matching visit would not deny, before claims matching took effect. Ohio rolled out denial edits in seven phases from March 1, 2025 to March 1, 2026, stating plainly that "claims that do not match will be denied."

Denial at submission is not the end of the exposure. Post-payment audits can treat unverified visits as overpayments subject to recoupment, and the OIG's active ABA audit series shows federal reviewers are already examining whether Medicaid ABA payments complied with federal and state requirements.

How to prepare even without a current ABA mandate

If your state has not extended EVV to ABA, the cheapest time to become compliant is before the mandate exists. Five moves cover most of the distance:

• Watch your state's EVV service code list and operational memos — extensions arrive as list updates, not legislation, and Colorado's took effect with roughly 18 months between mandate and hard denials.
• Capture all six Cures Act data points today, including GPS-stamped time in and time out, so a future mandate becomes a data-transmission task rather than a new clinical workflow.
• Keep the schedule, the session documentation, and the claim aligned; EVV claims matching is a three-way comparison, and mismatched times or places are what edits catch.
• Track your manual-entry rate as an internal KPI, since states audit modified records first and treat unmodified electronic capture as the compliance baseline.
• Confirm your practice management platform can export visit records in aggregator-compatible formats (open-model states) or coexist with a state-mandated system (closed-model states).

Frequently asked questions