State Medicaid ABA Policy Changes, 2025-2026: What Changed and What You Now Have to Track

The twelve states at a glance

Every row below comes from the state's own bulletin, provider manual, administrative rule, or session law, and that document is named in the state's section further down. Where a widely repeated figure could not be traced to a state document, it is left out rather than approximated — several omissions in this guide are deliberate, and the last section explains how to check your own state directly.

This table covers the twelve states with an adopted change. Three more we checked and found unchanged are covered further down. It is not a national survey, and a state's absence means only that it is not covered here, never that nothing changed there.

Why so many states changed the ABA benefit at once

The common upstream cause is an audit series. The HHS Office of Inspector General maintains an active work-plan item covering multi-state reviews of Medicaid payments for applied behavior analysis, and individual state audits under it have been published on a rolling basis: Indiana (report A-09-22-02002, December 2024, at least $56 million in improper payments), Wisconsin (A-06-23-01002, July 2025, at least $18.5 million), Maine (announced January 22, 2026, at least $45.6 million), and Colorado (A-09-24-02004, February 2026, at least $77.8 million). Those four are the federal reviews, but they are not the whole picture. State-level oversight bodies have run their own: the Massachusetts Office of the Inspector General reported on MassHealth's ABA program in March 2024, the Nebraska Auditor of Public Accounts issued an ABA attestation report in September 2025, and Nevada's Legislative Counsel Bureau audited autism treatment services back in January 2021. CMS counts the whole set at a minimum of $198.4 million in improper Medicaid payments across seven jurisdictions.

The Colorado report is the most consequential published so far. Its title states the finding plainly: "Colorado Made at Least $77.8 Million in Improper Fee-for-Service Medicaid Payments for Applied Behavior Analysis Provided to Children." Of 100 sampled enrollee-months, OIG determined that every one contained services that were improper or potentially improper. Ninety-three failed on documentation, 18 involved providers without appropriate credentials, and 7 lacked a diagnosis or referral supporting medical necessity. In the potentially-improper category, 96 involved services that were not fully described in the record, 88 involved potentially unallowable activities, 76 involved potential non-therapy time, and 67 involved potential group activities billed individually. OIG estimated $77.8 million in improper payments ($42.6 million federal share) and $207.4 million in potentially improper payments ($112.5 million federal share). The report also notes the growth that drew the attention: Colorado fee-for-service ABA spending rose from $60.1 million in 2019 to $163.5 million in 2023.

Four audits in the series remain in progress and their target states have not been disclosed. That matters for planning: the pattern so far has been an OIG report followed by a state policy rewrite, and at least four more states are somewhere in that pipeline. Colorado's own July 2026 bulletin cites "recent oversight findings" as a reason for its new ordering-provider requirement, making the causal chain explicit.

On August 4, 2026 the pattern acquired a federal capstone. CMS published a 173-page document titled "State Medicaid & Children's Health Insurance Program Applied Behavior Analysis Toolkit," written to help state Medicaid and CHIP agencies design ABA coverage, payment, utilization management, provider qualifications, and program integrity. Its framing number is the one to know: using its own T-MSIS claims data, CMS reports that Medicaid and CHIP payments for ABA rose from roughly $1.94 billion in 2021 to $10.1 billion in 2025 — an increase of 421 percent — while the number of children with an autism diagnosis who actually received ABA rose 189 percent. Both figures are CMS's own and it prints them in the same sentence; together they mean spending per child receiving ABA grew roughly 80 percent over four years. Be careful with the other growth number in the toolkit: the 67 percent rise from 1.15 million to 1.92 million counts beneficiaries with an autism diagnosis receiving any Medicaid or CHIP service at all, most of whom never received ABA. Setting 421 against 67 produces the widely repeated claim that spending outpaced the population six-to-one; against the population that actually received the service, the real ratio is closer to two-to-one.

Announcing it, CMS was explicit about what the toolkit is not: it does not establish new federal requirements, reduce EPSDT obligations, endorse any single treatment approach to ABA, or direct states to limit access to medically necessary care. It is guidance, and every state decides on its own whether to act on it. But it closes with a set of state checklists — literal question lists on clinical standards, coverage, payment, provider qualifications, utilization management, and program integrity — and those checklists are the closest thing available to a preview of what state Medicaid agencies will be asking providers over the next two years. The twelve states in this guide moved before the toolkit existed. The states that have not moved yet now have a federally drafted starting point.

Indiana: a lifetime hour allocation, EPSDT-only coverage, and a new modifier scheme

Indiana Health Coverage Programs bulletin BT202627, published February 26, 2026 and effective April 1, 2026, is the most operationally disruptive change in this group because it touches modifiers, authorization content, supervision, telehealth eligibility, member eligibility, and rates in a single document.

The headline is a lifetime allocation. The bulletin states that eligible individuals may receive up to 4,000 hours (16,000 units) of comprehensive ABA therapy services over their lifetimes based on medical necessity, with up to 15 hours of medically necessary targeted ABA therapy services weekly following the utilization of those 4,000 hours. Comprehensive treatment is defined as 16 hours or more per week. Modifier UA identifies services counting toward the allocation and must appear on both the prior authorization request and the claim; 97155 and 97156 are excluded from the count and must not carry modifier UA on either. The changes do not apply to ABA services provided by a school corporation.

The word worth holding onto is allocation rather than cap, and the distinction is not cosmetic. The bulletin provides that if further comprehensive ABA therapy is found to be medically necessary, as determined through subsequent review by FSSA, the member's managed care entity, or a delegated entity of FSSA, it will be covered under EPSDT. Because Indiana now delivers the benefit exclusively through EPSDT, and EPSDT obliges states to cover medically necessary treatment for members under 21, the 4,000 hours work as the point where the burden of justification shifts rather than as a door that closes. An agency that reads the number as a hard stop will step children down, or discharge them, when it did not have to.

Indiana provides a portal view of units consumed — a Limit Details panel shown during eligibility verification — but the bulletin cautions that the figure is subject to claim billing and processing lags and should be used as an adjunctive tool only. In practice that means the state's own counter trails reality, so an agency that relies on it alone can schedule past the allocation and discover the overage only after the claims deny.

Coverage also narrowed. ABA is now delivered exclusively through Early and Periodic Screening, Diagnostic and Treatment (EPSDT) services. Members aged 21 and older retained coverage through September 30, 2026, and are excluded for dates of service on or after October 1, 2026.

Rates dropped and will drop again. The bulletin applies a 6 percent maximum fee-rate reduction to all non-group ABA therapy services effective April 1, 2026, followed by a further 4 percent reduction on April 1, 2027 that applies to all codes, group included. As an illustration, 97153 rendered by a registered behavior technician moved from $17.06 to $16.04 per unit, and is scheduled to reach $15.39 in 2027.

Three other changes affect daily operations. Supervision is quantified: the bulletin requires a minimum of one hour of supervision by a BCBA or other IHCP-approved qualifying supervising clinician for every eight hours of technician-delivered ABA therapy. Caregiver participation is required in all ABA therapy prior authorization requests, allowing up to 18 hours over a standard six-month authorization period. And modifier 95 — the telehealth indicator — is no longer permitted on 97151, 97152, 97153, 97154, or 0373T. One change loosens rather than tightens: 97153 is no longer restricted to registered behavior technicians and may now be rendered by BCaBAs, BCBAs, BCBA-Ds, and HSPPs.

Indiana then went further than any other state in this guide, and the second move is about who is allowed to be in the market at all. Bulletin BT202692, published June 4, 2026, records that CMS approved a moratorium on ABA provider enrollment: the effective date is June 6, 2026, the initial period is six months, and the bulletin states that the IHCP may continue to extend it in six-month increments. It covers brand-new ABA group enrollments and changes of ownership for existing ABA therapy agencies; it does not apply to rendering-provider enrollment requests for individuals providing ABA therapy. An agency planning to open an Indiana location, and any owner planning to sell one, is blocked for a period the state can renew indefinitely.

One detail in the moratorium is worth checking against whatever summary you were given, because the correction is easy to miss. The earlier bulletin announcing the request, BT202667 of May 7, 2026, carries an update stating that the moratorium will apply to applications received prior to June 6, 2026. Coverage of the moratorium has reported the opposite — that applications submitted before the effective date would be processed under the old rules. Anyone with an application already in flight should read that erratum rather than the summary.

The door is not sealed. BT202692 states that the IHCP will consider limited exceptions to the moratorium to ensure sufficient member access to ABA therapy services in areas in need, that a provider agency seeking one must already be accredited per the requirements described in BT202646, and that requests are submitted by emailing OMPPProviderRelations@fssa.in.gov. That sequence matters for anyone planning around it: accreditation is a precondition of asking, not something to arrange after an exception is granted, so an unaccredited agency hoping to enter an underserved county has to start with ACQ, not with the email.

Running alongside it is an accreditation requirement with two dates and a hard consequence. Bulletin BT202646, published March 26, 2026, requires all currently enrolled ABA group providers to submit documentation demonstrating that the agency has initiated the accreditation process by August 1, 2026, and states that failure to provide documentation will result in the enrollment being deactivated. Documentation goes to INXIXabaenrollments@gainwelltechnologies.com, or an already-accredited provider may upload the certificate through the IHCP Provider Healthcare Portal as a provider maintenance update. Full accreditation, actively maintained, is required by October 1, 2027, through one of two recognized bodies: the Autism Commission on Quality (ACQ) or the Behavioral Health Center of Excellence (BHCOE).

The two bodies are not equivalent, and the asterisk in the bulletin is where that shows. Its footnote reads that any previous accreditation issued from BHCOE will be accepted until an agency's reaccreditation with ACQ. So BHCOE accreditation already in hand carries an agency forward, but the renewal is expected to land at ACQ — which means a provider whose BHCOE cycle expires before October 2027 should be planning an ACQ application rather than a BHCOE renewal. Read together with the moratorium, Indiana is simultaneously closing the door to new entrants and raising the bar for the incumbents already inside.

North Carolina: the rules are statute, and out-of-state analysts can no longer enroll

North Carolina is the only state in this group whose changes were written by the legislature rather than the Medicaid agency. House Bill 696, ratified on April 28, 2026 and signed by the governor two days later as Session Law 2026-1, contains a section titled "Medicaid Coverage for ABA Therapy" that directs the Division of Health Benefits to amend clinical coverage policy 8F — research-based behavioral health treatment, or RB-BHT — and to seek approval from the Centers for Medicare & Medicaid Services if that is necessary. The bulletins agencies have been reading are the implementation of that statute, not its origin. This matters practically: a policy bulletin can be revised by the agency that issued it, and a statute cannot.

North Carolina Medicaid published an updated reminder on August 5, 2026 covering requirements for RB-BHT service delivery under clinical coverage policy 8F, effective August 1, 2026. It replaces in full the July 21, 2026 bulletin on the same subject, and it applies to NC Medicaid Direct and NC Medicaid Managed Care alike.

The provision with the widest reach is not in the bulletins at all. Section 3C.18(c) of the session law amends the state's provider-eligibility statute to read that Board Certified Behavior Analysts and Qualified Autism Services Practitioner Supervisors "shall not be permitted to enroll in the North Carolina Medicaid program as out-of-state providers." It took effect when the bill became law on April 30, 2026 and applies to every enrollment application submitted on or after that date. A multi-state agency that planned to serve North Carolina children with analysts enrolled elsewhere, or a telehealth-first provider supervising into the state from out of state, has to place a North Carolina-enrolled analyst behind that work instead.

Paraprofessionals must hold either the Registered Behavior Technician certification from the Behavior Analyst Certification Board or the Applied Behavior Analysis Technician certification from the Qualified Applied Behavior Analysis Credentialing Board for their services to be reimbursed. The grace period is dated rather than open-ended: for paraprofessionals already on staff without a qualifying certification, the 120 days start on August 1, 2026, which places the deadline at the end of November 2026. New hires get 120 days from their date of hire — or, under the statute, from the date the employing provider first enrolled as a Medicaid RB-BHT provider, whichever is later. A newly enrolling agency therefore does not inherit a clock that has already been running against its staff. In the other direction, the statute exempts paraprofessionals, including both Registered Behavior Technicians and non-registered technicians, from Medicaid credentialing requirements — certification is the gate, enrollment is not.

The clause that changes scheduling immediately is the one attached to that grace period. Any paraprofessional without a qualifying certification requires direct oversight by a Licensed Qualified Autism Service Provider any time they are providing a service, until they are fully certified. This is not a supervision percentage measured after the fact — it is a condition on every individual session that staff member works, for as long as the certification is outstanding.

Telehealth was removed for paraprofessional RB-BHT services, specifically CPT codes 97152 through 97154. For supervision, telehealth may be used up to a maximum of 50 percent of total 97155 billing per beneficiary per 180-calendar-day period.

Authorization duration changed as well: treatment plans involving more than 16 hours of services per week must be reauthorized every three months, and all RB-BHT services count toward that 16-hour threshold. Existing authorizations are left alone — the bulletin states that providers need take no action on them and that nothing will be done to reduce their duration, with the new rule enforced at reauthorization.

The same 16-hour threshold carries a second, separate obligation in the statute, and agencies reading only the bulletin will miss it. Any individualized service plan involving more than 16 hours of services per week must be approved by the prepaid health plan or by the Department, and the statute says those plans "shall be updated and reapproved monthly." That is a different cadence from the three-month reauthorization cycle and a different object — the plan rather than the authorization. Agencies with high-intensity clients should confirm with their PHP how the two are being operationalized rather than assuming the longer interval governs both.

Two staffing requirements sit next to each other and are easy to conflate. The first is a floor with no trigger: at least 10 percent of all RB-BHT services provided by a paraprofessional must involve observation and direction of that paraprofessional by an LQASP. The second is a band, and the statute is more specific than the bulletin summaries suggest. Once a beneficiary has received more than 200 hours of RB-BHT services from a provider's paraprofessionals within a six-month period, that provider's LQASP-delivered services to that beneficiary must be at least 10 percent but no more than 20 percent of the hours its paraprofessionals delivered to the same beneficiary. Exceeding 20 percent may still be reimbursed with documented medical necessity. The statute defines the arithmetic explicitly: the numerator is LQASP hours billed for that beneficiary in the six-month period, the denominator is paraprofessional hours billed for that same beneficiary. Compliance documentation goes to the Division of Health Benefits every six months.

Note what the denominator is not. It is not the agency's caseload, not the technician's hours, and not a calendar-year figure — it is one beneficiary's hours from one provider over a rolling six months, and the ceiling means a well-intentioned agency can fail by supervising too much as easily as too little.

The 50-percent telehealth ceiling deserves attention because of its shape. It is not a per-session rule or a monthly rule — it is a ratio measured per beneficiary across a rolling 180-day window. An agency cannot know whether it is compliant without continuously computing telehealth 97155 units as a share of all 97155 units for each client over the trailing six months. The 200-hour trigger has the same problem in another dimension: it depends on a running total per beneficiary across six months, so the obligation switches on partway through a period rather than at its boundary.

What makes those ratios worth engineering for rather than estimating is the enforcement schedule attached to them. The statute authorizes the Division of Health Benefits to adopt rules recouping payment for all relevant noncompliant services on a first or second occurrence of noncompliance, and — on a third occurrence of noncompliance the statute describes as material and systematic — to suspend the provider's eligibility to bill Medicaid for a minimum of one year and a maximum of two. For most ABA agencies a one-year Medicaid billing suspension is not a penalty, it is closure. A supervision ratio that is reconstructed from a spreadsheet at audit time is being defended after the fact against a rule whose third strike ends the business.

The statute does leave room for relief. The Division may develop exceptions to the telehealth restrictions and the in-person assessment requirement based on documented medical necessity or access-to-care needs, explicitly including poor provider availability in rural and underserved areas. Those exceptions have to be adopted into coverage policy through the state's normal notice process, with a report to the legislative health and Medicaid oversight committees — so they will be public and dated when they arrive, and worth watching if geography is the constraint on your caseload.

New York: a five-percent supervision floor with face-to-face contact

The New York State Department of Health published "Applied Behavior Analysis Service Updates for Supervision of Unlicensed Individuals and Technicians" in the August 2025 Medicaid Update (Volume 41, Number 8), effective October 1, 2025.

Licensed behavior analysts must supervise unlicensed individuals and technicians for a minimum of five percent of the hours the unlicensed individual or technician spends providing behavior analysis services each calendar month. That supervision must include at least two face-to-face, real-time contacts per month; the guidance is explicit that telephone, email, and text do not satisfy the requirement, and that the LBA must observe the technician delivering services during at least one of the contacts. The requirement applies to Medicaid Managed Care as well as fee-for-service.

The update also narrows what counts as billable protocol modification: 97155 is billable when the LBA joins the session to direct implementation of a new or modified protocol, not for supervision generally. Supervision documentation should be recorded in the patient file, with record retention of six years, or until the patient turns 22, whichever is longer, and ten years for Medicaid Managed Care.

New York also cut the direct-service rate. 97153 was set at $16.85 per unit effective October 1, 2025, and $14.45 per unit effective April 1, 2026 — a reduction of roughly 14 percent within six months.

Colorado: ordering-provider NPI on every claim, plus active recoupment

Colorado's Department of Health Care Policy and Financing published provider bulletin B2600539 in June 2026. Health First Colorado implemented Ordering, Prescribing and Referring (OPR) system requirements for services under the Pediatric Behavioral Therapies benefit effective July 1, 2026. The ordering practitioner's NPI must be included in the ordering/referring provider field on claims for services that require an order, and that practitioner must be fully and actively enrolled as either an OPR or a rendering provider prior to claim submission. That second wording is worth reading carefully before anyone files new paperwork: a practitioner already enrolled as a rendering provider satisfies the requirement, so a separate OPR enrollment is needed only for practitioners who order but never render. The bulletin states that claims submitted without a valid ordering provider NPI may be denied. It cites the federal OPR regulations at 42 CFR 455.410 and 455.440, and "recent oversight findings" as the reason.

The same bulletin describes recoupment already underway on assessment billing, and the rule it restates is one an agency can get wrong in either direction. 97151 is a flat-rate code limited to one unit per 365 days. Providers may also bill two units of 97151 with modifier TJ, on a different date of service, only once per 365 days, to signify recurring assessments within the prior authorization renewal process. Two units, not a second one — an agency that reads TJ as adding a single unit will under-bill its own reauthorization assessment every year. The bulletin states that claims have been identified where more than one unit of 97151 without modifier TJ was billed and paid in error; impacted claims will be reprocessed, any overpayment resulting from billing more than one unit will be recouped, and recoupment happens through standard adjustment and recovery processes rather than a separate notice.

One piece of good news in the same document: the Pediatric Behavioral Therapies benefit is exempt from the 2.0 percent across-the-board provider rate reduction enacted in HB 26-1410, effective July 1, 2026.

Colorado also legislated. House Bill 26-1425, titled "Applied Behavior Analysis Services," was signed on June 2, 2026 with an effective date of August 12, 2026. It creates a Colorado Behavior Analyst Licensing Board and moves behavior analysts from an unregulated occupation to a licensed one — but the practitioner licensure requirement does not arrive until July 1, 2028, so no individual analyst has anything to file today.

The nearer deadline in that act is a facility one, and it is narrower than most summaries of the bill suggest. The act amends the definition of "day treatment facility," and the entities newly captured by that amended definition must apply for licensure by August 1, 2026 and be licensed by August 1, 2027. That licensing sits with the Colorado Department of Human Services rather than with the regulator that licenses individuals or with the Medicaid agency. It is not a requirement on every ABA agency in the state, and the first question for a Colorado provider is whether the amended definition reaches its service model at all.

The honest status as of August 2026 is that implementation has not started. The state's regulator has published a Behavior Analyst page noting that the licensing board is created in 2026, but all five board seats are listed as vacant and no rules, applications, or fee schedules have been published. Facility standards were likewise not available. Colorado is a state to watch on a calendar rather than to act on today — except for the OPR claim requirement above, which is already live.

Virginia: delegation authority, location justification, and assessment currency

The Virginia Department of Medical Assistance Services maintains an "Applied Behavior Analysis (ABA) Policy and Regulatory Clarifications" bulletin, last updated December 16, 2025. It is a clarification document rather than a new benefit design, but several clarifications have direct billing consequences and it carries an explicit warning about retraction of Medicaid payments.

Clinic or center-based ABA is not covered without a documented justification for that location in the individual service plan. The justification has to be in the ISP and authorized by the service authorization contractors — Acentra Health for fee-for-service and the Cardinal Care managed care organizations — and the bulletin frames the test as medical necessity for that specific setting, not provider convenience. Note the threshold that sits beside it and is easy to misread: the extra documentation is triggered by what is requested, not by what is delivered. Citing Appendix D, page 28 of the Mental Health Services Manual, the bulletin requires that for all authorization requests exceeding 20 hours (80 units) or more per week, providers submit the schedule of activities used to structure the time; a general schedule of clinic-based activities is not sufficient.

Delegation authority is limited, and the limit is narrower than the phrase suggests. Only licensed behavior analysts, licensed assistant behavior analysts, and licensed clinical psychologists have authority to delegate ABA to non-licensed staff. Licensed clinical social workers and licensed professional counselors do not — but the bulletin is explicit that they may still provide ABA directly, or supervise services provided by LMHP residents and supervisees, if they have appropriate training in ABA. What they cannot do is oversee non-licensed staff delivering ABA under their supervision. An agency that reads the rule as "LCSWs and LPCs cannot do ABA" will stop billing work that is payable; the restriction is on the supervision line, not on the clinician.

Assessment rules tightened in the same document. The initial assessment must be completed by the LBA, LABA or LMHP acting within scope of practice, and it must be conducted in person with the youth and the youth's family and caregivers — the family's presence is part of the requirement, not an optional addition. It must include a functional assessment using validated tools. Assessments must be reviewed and updated at least annually, and the bulletin states that services will not be reimbursed if the assessment is incomplete, outdated, or missing. Where services are delivered in a clinic, office or center-based setting, caregiver involvement requirements apply on top: direct family involvement in the treatment program is required at a minimum of weekly and must be documented in the ISP, and family training under 97156 and 97157 is required. That weekly cadence is scoped to those settings — it is not a blanket rule for home-based care.

Telemedicine carries its own ISP content requirement that is easy to miss because it lives in a separate section. Authorization requests for ABA delivered through telemedicine require detailed documentation and justification, providers must document that the youth and their parent or caregiver have the skills to participate meaningfully and safely, and if any services are delivered that way the ISP must contain at least three things: a schedule stating when or under which conditions services will be provided through telemedicine and when they are scheduled in person; clinical evidence that the amount, duration and scope of telemedicine use is a clinically appropriate modality for that individual; and evidence of how the provider will meet the treatment needs documented in the ISP through an in-person modality when needed. This is a plan-writing obligation rather than a claim field, which is precisely why it tends to be discovered during a retrospective review.

A companion bulletin dated August 13, 2025 and signed by DMAS Director Cheryl J. Roberts changed what an authorization request must contain: effective for dates of service October 15, 2025 and later, providers are required to submit service authorizations that include the units requested for each ABA CPT code used for treatment. This applies to both fee-for-service and Cardinal Care Managed Care.

Nebraska: a rate reset, then a place-of-service ban

Nebraska moved twice. Provider bulletin 25-14, dated July 1, 2025 and effective August 1, 2025, updated ABA reimbursement rates: 97151 at $38.16, 97152 at $25.88, 97153 at $18.70, and 97154 at $7.49. The bulletin cites the federal access and payment regulation at 42 CFR 447.200 and a regional market study as the basis.

The second move matters more operationally. Provider bulletin 26-06, dated June 1, 2026, changes coverage requirements for dates of service on and after July 1, 2026, and states plainly that ABA services delivered in a school are the school's responsibility under Nebraska Administrative Code Title 471, Chapter 25 and the Medicaid State Plan: independent providers may not bill Medicaid directly for services provided at a school.

That is a place-of-service rule, and place-of-service rules are unusually easy to violate by accident. A technician who follows a child into a school day, a session that moves from the clinic to a school campus mid-authorization, a location field that defaults to the client's home record — each produces a claim that looks ordinary and is not payable. Agencies operating in Nebraska need the service location recorded at the moment of service rather than inferred afterward from the client's file.

The same bulletin opens a narrower door: individuals receiving waiver services from the Division of Developmental Disabilities may receive ABA assessments under 97151 and 97152 regardless of age, and for waiver recipients only, that assessment may be recommended and used for non-ABA purposes, provided it still meets every other assessment requirement.

Nebraska also replaced its ABA service definition effective the same day, and that replacement carries the state's second structural change. The definition states that direct ABA service hours provided to the individual may not exceed 6 hours in a single day or a total of 20 hours per week, and that additional daily or weekly treatment hours may be requested in certain clinical circumstances, for which clinical justification must be submitted for prior authorization and be approved. Two ceilings, not one, and the daily limit is the one likely to be breached by accident: a caseload can sit comfortably under 20 hours a week while a single make-up day pushes past 6.

Note the shape of that rule against Indiana's. Indiana's 4,000 hours are an allocation with EPSDT behind them; Nebraska's 6 and 20 are limits with a prior-authorization exception in front of them. In Nebraska the extra hours have to be requested and approved before they are delivered, which makes the schedule, not the claim, the place where the rule is either met or broken.

Florida: two named instruments, and their scoring report inside every authorization packet

Florida is frequently described as having an ABA rule change pending. It does not. Rule 59G-4.125, Behavior Analysis Services, was amended and has been in effect since February 10, 2025; the rule's own history line reads "New 2-19-17, Amended 10-29-17, 10-9-23, 2-10-25," and the rulemaking record shows the amendment noticed in December 2024 and closed. The amended rule incorporates by reference a document titled Florida Medicaid Behavior Analysis Services Coverage Policy. An agency waiting for Florida to finish rulemaking is waiting for something that finished eighteen months ago.

The coverage policy sets a weekly ceiling: Florida Medicaid covers up to 40 hours per week of behavior analysis intervention services as indicated in the recipient's prior-authorized behavior plan.

The most operationally disruptive requirement is the assessment one, and it is unusually specific about which instruments. The initial assessment must include the administration, scoring, and reporting of two core standardized behavior instruments: the Vineland-3 Comprehensive Parent Interview Form for all recipients, plus the Maladaptive Behavior Domain for recipients ages 3 and older; and the Behavior Assessment System for Children, Third Edition, Parenting Relationship Questionnaire — the BASC-3 PRQ — for all recipients ages 2 through 18. The policy then states that the complete scoring report, including outcome measure scores, must be submitted with service prior authorization requests. Most states require an assessment; Florida names the instruments and requires the scored output to travel with the authorization request.

Two clocks then run at different speeds, and confusing them is how a Florida authorization fails. A reassessment and updated behavior plan to renew prior authorization for continued services must be completed at least every six months. The core instruments must be included with reassessments every 12 months. So the plan is on a six-month cycle and the instruments are on a twelve-month cycle, which means every other reassessment carries an additional, time-consuming deliverable that the one before it did not. Authorization itself runs through a quality improvement organization: providers must obtain authorization from the QIO prior to initiating behavior analysis services and at least every 180 days thereafter.

Several smaller rules carry direct billing consequences. Maximum group size is six participants. The Lead Analyst may provide up to two hours per week of training to parents or guardians via telemedicine, billed with 97156 and the GT modifier. Travel time is on the non-covered list. Providers must only claim reimbursement for services performed for 8 minutes or more when determining the number of billable 15-minute units. And supervision is billable but never twice: the supervisor may be reimbursed for observing a supervisee implementing the behavior plan, and the supervisee will not be reimbursed when the supervisor is reimbursed for the same time period — a rule the fee schedule enforces through modifier XP, which marks the supervisee's concurrent time as non-reimbursable while the supervisor bills 97155 or 97155 HN.

Florida's fee schedule also carries a full group-size modifier scheme and per-assessment unit ceilings. The table below reproduces its structure; deliberately absent are the dollar amounts, which should be read off the current fee schedule directly rather than from any summary, including this one.

Texas: an eight-hour day counted across four codes, and telehealth down to one

Texas made one change that removed paperwork and several that constrain delivery, and the removal is narrower than it is usually reported. A TMHP notice dated February 14, 2025 provided that, for dates of service on or after April 1, 2025, the prescribing provider signature would no longer be needed on the completed Comprehensive Care Program prior authorization request form when requesting the 90-day treatment extension, while the initial treatment plan must still be signed and dated by a prescribing provider for the full 180 days. That change is final and now sits in the Texas Medicaid Provider Procedures Manual, Children's Services Handbook, January 2026 edition, at section 2.3.11.4.

The trap is one subsection later. Section 2.3.11.6, the 180-day recertification, still requires a completed prior authorization request form signed and dated by a prescribing provider within 60 calendar days prior. The signature came off one of the two renewal paths, not both — so an agency that adopted "Texas no longer needs the prescriber signature" as a general rule will submit an unsigned recertification and have it fail.

The constraint with the widest daily reach is a cross-code ceiling: direct treatment for the child or youth is limited to a total of 8 hours per day, inclusive of procedure codes 97153, 97154, 97155, and 97158. That total spans direct one-on-one service, group service, protocol modification, and group protocol modification together. No single staff member's schedule shows it — a technician's six hours plus an analyst's two and a half in the same day breaches a limit that neither person can see from their own calendar. It is a per-child daily sum across four codes and everyone who touched that child, and it has to be visible while the day is still being scheduled.

Telehealth in Texas is narrower than in any other state in this guide. Behavior analysis evaluation and treatment services may only be delivered via telehealth using synchronous audiovisual technology, and the manual's telehealth table lists exactly one entry: procedure code 97151 with modifier 95. It then states plainly that LaBAs and RBTs may not deliver any service remotely, and that use of telehealth in one-on-one direct service delivery with the child or youth by a behavior technician or LaBA is prohibited. In practice, remote delivery in Texas Medicaid means the evaluation, performed by the licensed behavior analyst.

Three other rules shape the claim. Providers append HO for a licensed behavior analyst, HN for a licensed assistant behavior analyst, HM for a behavior technician, and 95 for telehealth. Procedure code 97151 is authorized for up to 24 units — six hours — HO only, for the initial evaluation and again for each subsequent re-evaluation, with re-evaluation by the LBA once every 180 days, and it must be used within 30 calendar days of the first date of service for that code. And two categories of time are simply not payable: Texas Medicaid will not reimburse multiple ABA providers during one session when more than one is present, which it calls concurrent billing — excluded except when the family and the child are receiving separate services and the child is not present in the family session — and separate reimbursement for treatment planning, note documentation, report writing, or updating charts and data sheets is prohibited other than what is allowable under 97151.

One gap is worth naming rather than filling. Texas adjusted ABA rates effective September 1, 2025, and the rate document exists, but the state's rate-analysis site refuses automated retrieval and the per-code figures in circulation come from vendor summaries rather than from the state. This guide does not publish them. A Texas provider should read the current fee schedule from the HHSC rate tables directly.

California: a second way in, and a roster you have to be able to produce

California did not cut rates or cap hours. It changed who can deliver the benefit and how an agency proves its own staff were qualified, and the second one is the sharper edge.

The structural change came on July 1, 2025, when the Department of Health Care Services began offering a pathway for individuals with fee-for-service Medi-Cal to access Behavioral Health Treatment directly from DHCS through an enrolled Medi-Cal fee-for-service BHT provider — a change the Department of Developmental Services describes, in directive G-2025-Behavioral Health-001, as primarily intended to address the needs of individuals who require BHT services but do not meet regional center eligibility criteria. The Medi-Cal manual states the consequence for members: they have a choice to receive BHT services either through their local Regional Centers or directly through enrolled fee-for-service providers who bill DHCS. For agencies, a second enrollment route now exists alongside the Regional Center vendorization most California providers grew up with.

The requirement most likely to surprise a California agency is in the provider manual's Behavioral Health Treatment section, updated November 2025. Enrolled Qualified Autism Service providers and community-based organizations do not need to report QAS Providers, QAS Professionals, or QAS Paraprofessionals in Medi-Cal's online enrollment portal, in fee-for-service or managed care. Instead, they must maintain an active, current list of all QAS Providers, QAS Professionals, and QAS Paraprofessionals, and make that information available to DHCS upon request and in the event of a state or federal audit.

Read that twice, because the absence of a registration step is the risk. In a state that registers each clinician, the state's own file is the record of who was qualified and when. California has deliberately not built that file — which means the agency's internal roster is the only evidence, and it is evidence that has to be current on the day it is requested rather than reconstructable afterward. A roster maintained in a spreadsheet that lags hiring, or that shows only today's staff and not who held what credential on a given past date of service, is the exact artifact an auditor will ask for.

The November 2025 manual also added billing and documentation rules for the family-training HCPCS codes. For S5110, home care training for family per 15 minutes, and S5111, the same per session, providers must comply with special billing and documentation requirements, and may not bill both codes on the same date of service for the same member for the same service. Eight documentation elements are enumerated: date and duration, the name and credentials of the person delivering the training, the names and relationships of the family members trained, the clinical goals addressed, the method of instruction, the family's engagement, the link to the treatment plan, and the follow-up plan. On modifiers, codes 97151 through 97158 take U7 and 99, with SA added in the managed care column; H2014 may only be used for individual services, never group; and 97153 and 97154 carry the footnote that the service may be provided by QAS Paraprofessionals.

Authorization runs off a six-month review: the behavioral treatment plan shall be reviewed no less than once every six months by a QAS Provider for continuation of services, authorization is required to continue or modify services following that review, and services provided without authorization shall not be considered for payment except in the case of retroactive Medi-Cal eligibility. The same manual carries a clause worth knowing in the other direction — decreasing the amount and duration of services is prohibited if the BHT services are medically necessary.

One honest gap: most California ABA volume runs through managed care plans, and the manual explicitly defers to an All-Plan Letter for what those plans must do. The Department's own website blocks automated retrieval, so the current managed care All-Plan Letter could not be read for this guide. Nothing here should be taken as describing California managed care requirements; a plan's provider manual and the current All-Plan Letter govern that, and they should be read directly.

South Carolina: a replaced manual, and a telehealth ceiling measured against authorized units

South Carolina replaced its autism services provider manual outright rather than amending it. The live manual carried by the Department of Health and Human Services is dated July 1, 2026, superseding the prior edition, and it changes both assessment and telehealth.

Assessment moved in person. The manual states that the behavior identification assessment cannot be completed via telehealth, and separately that autism spectrum disorder diagnoses conferred by telehealth are not considered valid — a rule about the referral coming in the door, not only about the service going out of it. An agency accepting a telehealth-conferred diagnosis from an outside provider has an authorization problem before it delivers a single hour.

For protocol modification, South Carolina set a ceiling with an unusual denominator: up to 25 percent of the total units approved for 97155 may be rendered via telehealth, only when authorized by the quality improvement organization, and must be billed using the GT modifier. Note that this is a share of approved units, where North Carolina's 50 percent ceiling is a share of billed units per beneficiary across a rolling 180 days. Two states, the same code, the same idea, two different denominators — and the shape of the denominator determines whether an agency can know its compliance in advance or only after the fact. South Carolina's is knowable at authorization; North Carolina's moves with every session booked.

Authorization periods are six months throughout, and the manual is consistent about it: renewals are submitted to the QIO for six-month service renewals, the individualized plan of care covers a six-month time period, and a minimum of six caregiver training sessions is required per six-month service authorization period. The QIO is Acentra Health. A caregiver-training minimum tied to the authorization period is a scheduling obligation, not a documentation one — six sessions cannot be produced in the last week of a period that has already ended.

One negative finding is worth stating explicitly, because it has circulated as fact. Summaries of this manual have reported that South Carolina now determines medical necessity using InterQual criteria. The string does not appear anywhere in the manual's fifty-nine pages. It may be true of the QIO's internal process and simply not stated in the provider manual, but it is not a manual requirement, and an agency should not build a medical-necessity narrative around a criteria set the governing document never names. The manual's own fee schedule is a separate document that this guide has not verified.

Georgia: a 30-hour review threshold, and the claim must name the supervisor

Before anything else, check which document you are reading. Georgia's governing policy is Part II, Policies and Procedures for Autism Spectrum Disorder Services, version dated July 1, 2026, published through the GAMMIS provider portal. A copy of the January 1, 2018 edition is still reachable from a state web page and carries an empty revision record, so it looks authoritative and is eight years stale. Everything below is from the July 2026 version, whose revision record dates each change.

The change with the widest reach sets a review threshold rather than a limit. The policy states that treatment services typically range from 10 to 30 hours per week, though the amount may be higher or lower when medically necessary, and that requests exceeding 30 hours per week will undergo an enhanced authorization review. The revision record confirms it as new guidance effective July 1, 2026. That is not a cap, and a Georgia provider should not treat it as one — but it does mean the weekly total on an authorization request now determines which review queue the request lands in, so an intensity decision made clinically has an administrative consequence attached to a specific number.

The second change alters who is named on the claim. The revision record for July 1, 2026 states that the provider listed on the claim must be the one who rendered the service, and the policy then adds the ABA-specific reading of that rule: for RBT or BCaBA rendered services, such as 97153, the supervising BCBA must be identified as the rendering provider on the claim. Agencies that had been submitting the technician as rendering provider have to change the claim, not the clinical practice.

Enrollment is also constrained geographically, and this one is not new — the manual's revision record dates it to October 2024, when section 601.1.2 was revised to "physically reside and practice" as it relates to the location requirements for providers to enroll. As it now reads: to enroll as a Medicaid provider, the practitioner must reside in Georgia or within 50 miles of the Georgia border and must hold an active license issued by the Georgia BCBA Licensure Board. Individual practitioners — physicians, psychologists, BCBA-Ds and BCBAs — must enroll as rendering providers linked to the group or facility through which they deliver services, while BCaBAs and RBTs are not enrolled directly by the Division, because it does not treat them as independent practitioners. It is included here because it is still widely missed, not because it changed in 2026; read alongside North Carolina's out-of-state enrollment ban, it is the second southeastern state closing the door on remote, out-of-state clinical staffing.

Reauthorization content is now prescribed. Prior authorization requests for follow-up services, after the initial treatment authorization, must include a summary of previous goals and progress, the results of a recent behavioral assessment, and individualized goals. Read the recency rule precisely, because it is not measured from the day the packet goes out: the behavioral assessment must have been conducted or dated no more than two months older than the effective date of the requested prior authorization. An assessment that was current when the last authorization was written can therefore be too old to support the next one, and the date it has to clear is the start of the new period. Separately, the revision record shows the prior authorization turnaround time cut from 45 days to 7 days effective April 1, 2026 — a change that helps providers, and one that also compresses the window for assembling those materials.

Georgia's rate structure is worth understanding even without quoting figures. Appendix A of the manual prices 97153 by practitioner level, with distinct rates for physician or BCBA-D, BCBA, BCaBA and RBT, and then again by setting: an in-clinic rate, an out-of-clinic rate, and a telemedicine rate. Georgia pays more for out-of-clinic delivery than in-clinic, and prices telemedicine at the in-clinic level. The revision record shows the rates were increased effective October 8, 2025. Read the current Appendix A for the amounts rather than any summary, including this one; the prior table could not be retrieved to quantify the increase.

One item to watch rather than act on. On April 28, 2026 the Department of Community Health announced a set of proposed fraud, waste and abuse prevention amendments for ABA, including additional prior authorization requirements, determination of RBT oversight ratios based upon claims accuracy, remote supervision of RBTs by a provider located within Georgia or within 50 miles of the border, capacity requirements for agencies of a certain size to serve high-acuity members, an annual report on abandoned care, and increased emphasis on the prohibition of member solicitation. The announcement says full details will be sent to providers as banner messages as final decisions are made. The oversight-ratio and agency-capacity items do not appear in the July 2026 manual text, so they should be treated as proposed. A supervision ratio derived from claims accuracy would be a genuinely novel mechanism and is the one to watch.

Illinois: same rates, a new authorization column, and a wider telehealth line

Illinois is the clearest example in this guide of a change that a rate-focused reader would miss entirely. The Adaptive Behavior Support Services fee schedule was reissued on May 14, 2026, and comparing it line by line against the prior 2022 schedule, every unit price is identical and every daily maximum is unchanged. Nothing about the money moved. Three other things did.

First, a prior authorization column was added that did not exist in the earlier schedule. It marks 97153, 97154, 97155, 97156, 97157, 97158 and 0373T as requiring authorization, and 97151, 97152 and 0362T as requiring it if the request exceeds six hours. An agency reading the schedule for rates would see no change; an agency reading it for fields would see a new gate on nearly every code.

Second, telehealth billing was widened in a way that matters at the claim line. The 2022 schedule instructed providers to use only the GT modifier with place of service 02. The 2026 schedule instructs them to use the GT or 93 modifier with place of service 02 or 10, as applicable. Place of service 10 is the patient's home, so Illinois has drawn a distinction between telehealth delivered to a patient at home and telehealth delivered elsewhere, and the modifier and place-of-service pair now have to match the actual circumstance rather than a default.

Third, who may deliver the service expanded. The higher service level now includes HFS-enrolled ABS Certified Developmental Clinicians — licensed professional counselors, clinical social workers, clinical professional counselors, marriage and family therapists, occupational therapists and speech-language pathologists — and the technician level now includes HFS-enrolled ABS Developmental Technicians, with team services deliverable by one developmental clinician and two technicians. Illinois runs two parallel technician tracks with different supervision lines: registered behavior technicians must receive supervision from a BCBA, while ABS Developmental Technicians must be supervised by an ABS Developmental Clinician and hold the Profectum Registered Developmental Technician credential. Neither line carries a countable ratio or percentage, which makes Illinois unusual among the states here.

One further Illinois item is frequently reported alongside these and is deliberately not stated here: that fee-for-service prior authorization requests moved to a single clinical review portal in 2025. The change may well be real, but the provider notice said to carry it is not retrievable from the state's notice archive, and this guide does not publish a date or a platform name it could not read at the source. An Illinois agency should confirm its current fee-for-service authorization route with HFS directly, and should expect it to differ from the managed care route regardless.

Three states that did not change, verified rather than assumed

Confirming that a rule does not apply is worth as much as discovering one that does, and it is almost never published, because nothing happening does not make a headline. These three were checked against their own governing documents in August 2026.

Arizona has not changed its ABA policy in nearly six years. AHCCCS Medical Policy Manual 320-S, Behavior Analysis Services, carries effective dates of November 1, 2019 and October 1, 2020, and it is the live version rather than an archived one. It contains no hour cap, no age limit, and no supervision ratio; dosage is clinician-set, with services prescribed or recommended in specific dosages, frequency, intensity and duration by a qualified behavioral health professional. The single countable obligation is that treatment plans must result in progress reports at minimum every six months. The Covered Behavioral Health Services Guide, effective October 1, 2025 and updated May 18, 2026, lists 97151 through 97158 and defers entirely to 320-S — and, unlike the section immediately following it, carries no billing-limitations subsection for ABA. This is a verified negative, not an absence of evidence.

Michigan has a significant rewrite drafted and not adopted. MDHHS proposed policy 2613-BCCHPS, with comments due April 23, 2026 and a proposed effective date of June 1, 2026, would remove the requirement that a child receive a physical examination before accessing behavioral health treatment, update diagnostic re-evaluation language, and clarify ABA standards. Every page of the draft is stamped as a proposed policy draft, and no final bulletin adopting it could be located — the July 2026 quarterly manual-update bulletin does not list a behavioral health treatment bulletin among those incorporated. Treat it as proposed. One narrow Michigan change is in effect: bulletin MMP 26-17, issued June 1, 2026 and effective July 1, 2026, allows Medicaid-funded specialty behavioral health services to support children with intellectual or developmental disabilities in a child caring institution that exclusively serves children with I/DD, when authorized by the responsible PIHP or CMHSP. The institution cannot have more than 16 beds as licensed by the state, and the authorization must identify the funding source for the services rendered. The exclusivity condition is the limiting one — it is not a general opening for ABA in residential settings.

New Jersey shows no ABA-specific change. The state's ABA treatment provider enrollment packet is current — its cover letter is dated May 2026 — but the provider-qualification table inside it still carries a September 2021 revision stamp, and the requirements are unchanged: BCBA-D, BCBA, BCaBA, or a behavior technician holding either a bachelor's degree with one year of supervised experience, a high school diploma with three years, or RBT certification, with fingerprint-based criminal background checks required before any employee delivers direct services. The only rate action locatable is a December 30, 2024 notice updating fee-for-service rates across all benefit categories using Medicare's annual update effective January 1, 2025; it does not mention ABA or any of the ABA codes, and it should not be reported as an ABA rate change. New Jersey's ABA fee schedule itself could not be retrieved, and a widely circulated per-unit figure for 97153 traces only to a vendor aggregator — it is not published here for that reason.

What these changes have in common: ten new things to capture

Read individually, each state's bulletin looks like a local compliance chore. Read together, they point in one direction: the states are converting qualitative expectations into quantitative thresholds. A rule you used to satisfy by clinical judgment now has a number attached, and a number has to be measured continuously rather than reconstructed at audit time.

Ten fields appear across these documents that most agencies have never maintained deliberately:

• Cumulative units per member across the client's entire history — Indiana's 4,000-hour lifetime allocation, with 97155 and 97156 excluded from the count. This survives payer changes, staff turnover, and gaps in service, and the state's own portal figure lags claim processing.
• Supervision as a ratio, computed monthly or continuously — Indiana's one hour per eight technician hours, New York's five percent of monthly technician hours plus two face-to-face contacts, North Carolina's 10 percent observation floor plus a 10-to-20 percent band per beneficiary once 200 paraprofessional hours are passed. Three states, three different denominators, and in North Carolina a ceiling as well as a floor.
• Telehealth as a share of a code — North Carolina's 50 percent of 97155 per beneficiary across a rolling 180 days, and South Carolina's 25 percent of the units approved for 97155. One denominator is knowable at authorization and the other moves with every session booked, so the same rule needs two different controls.
• A daily total that spans several codes and several people — Texas caps direct treatment at 8 hours per day across 97153, 97154, 97155 and 97158 combined, and Nebraska at 6 hours per day and 20 per week. No individual staff calendar shows this; it is a per-child sum across everyone who worked with that child that day.
• Group size at the moment of service — Indiana's U4, U6 and U8 modifiers and Florida's UN through US each carry a distinct rate, so the number of children present when the service was delivered is now a billing field, not a note detail.
• A weekly or per-request total that routes the review rather than denying the claim — Georgia sends any request above 30 hours per week into an enhanced authorization review, and Illinois now requires prior authorization on 97151, 97152 and 0362T only when the request exceeds six hours. Neither is a cap and neither refuses anything by itself, but in both states the number written on the request decides how that request gets handled, which makes it a scheduling and authorization figure rather than a clinical one alone.
• Ordering practitioner identity and enrollment status — Colorado's OPR requirement means a claim can be clinically perfect and still deny because the referring practitioner's NPI is missing or that practitioner is not actively enrolled. Georgia pushes the same field in the other direction: for RBT or BCaBA rendered services such as 97153, the supervising BCBA must be identified as the rendering provider on the claim, so the name on the claim and the person in the room are deliberately not the same.
• Where the service physically happened — Nebraska's school-setting exclusion turns place of service into a payability test rather than a descriptive field. A location captured at the moment of service is verifiable; one inherited from the client record is a guess that bills.
• Which credential each person held on each date of service — North Carolina's certification deadline and per-session oversight rule, and California's requirement to produce a current roster of every QAS person on audit. Current staff status is easy; who was qualified on a date eight months ago is the question that actually gets asked.
• Assessment instrument currency, on a clock separate from the plan — Florida requires a reassessment and updated plan every six months but the two named core instruments only every 12, so every other renewal carries a deliverable the previous one did not.

How to check whether your state is next

Industry newsletters are a poor early-warning system for this, and the reason is specific: they frequently report a mechanism accurately while attaching it to the wrong service line. A change that applies to personal care or home health gets summarized as applying to autism services because the same bulletin mentions an autism waiver in another context. The result is a deadline that does not exist for ABA.

The reliable method is short and it is the same in every state. First, find your state Medicaid agency's provider bulletin archive and read the ABA or behavioral health entries for the last 18 months in full — these changes arrive as bulletins, not legislation. Second, open the fee schedule or service code list and search for the actual codes, 97151 through 97158 and 0373T; if the codes are absent, the rule does not apply to you regardless of what the summary said. Third, check the HHS OIG work plan for an audit covering your state, since a published audit has reliably preceded a benefit rewrite. Fourth, if you serve Medicaid Managed Care, read the plan's provider manual separately: New York's supervision requirement explicitly extends to managed care, and a plan can impose contract terms stricter than the state's.

Finally, when a bulletin does land, read it for new fields before reading it for rates. A rate cut is painful but requires no system change. A new modifier, a lifetime counter, a ratio, or a required identifier changes what has to be captured at the point of service — and captured data cannot be created retroactively when the claim denies.