How long does Medicaid have to decide a prior authorization request for ABA?

Under 42 CFR 440.230(e), for requests on or after January 1, 2026, a standard decision must be made no later than 7 calendar days after receipt, extendable by up to 14 additional calendar days. An expedited decision must be made no later than 72 hours. In fee-for-service, CMS's toolkit states there is no extension available on the expedited timeframe.

How do I keep ABA hours running while I appeal a reduction?

In Medicaid managed care, 42 CFR 438.420 requires the enrollee to request continuation of benefits on or before the later of 10 calendar days after the plan sends the adverse benefit determination notice, or the intended effective date of the action. In fee-for-service, 42 CFR 431.230 requires the agency not to terminate or reduce services pending the hearing decision if the beneficiary requests a hearing before the date of action. Advance notice is generally at least 10 days under 42 CFR 431.211.

Can a payer deny ABA just because the requested hours exceed its threshold?

Not for a child under 21 without an individualized review. CMS's ABA toolkit states that utilization review relying solely on singular factors such as diagnosis codes, age, or preset hourly thresholds risks conflicting with EPSDT, and that prior authorization must be conducted on a case-by-case basis and must not delay the delivery of needed treatment services.

Who defines medical necessity for ABA?

States do. CMS's toolkit states that federal statute does not define medical necessity, that states define the specific criteria used in ABA reviews, and that CMS does not review or approve states' medical necessity criteria. Under 42 CFR 438.210(a)(5)(i), a managed care contract's definition may be no more restrictive than the one used in the state Medicaid program.

ABA Prior Authorization and Denials: What Payers Ask For

Federal decision deadlines, the documentation payers actually review, and the appeal path — including the 10-day window that keeps your child's hours running while the appeal is decided.

If your child’s ABA hours are being cut, the most valuable thing to know is not the appeal deadline. It is the continuation-of-benefits deadline, which is much shorter. In Medicaid managed care, 42 CFR 438.420 requires the enrollee to file for continuation of benefits on or before the later of 10 calendar days after the plan sends the notice of adverse benefit determination, or the intended effective date of the action. You have 60 calendar days to file the appeal itself. You have roughly 10 to keep the hours running while it is decided.

This guide covers what prior authorization asks for, the federal clocks, and the appeal path.

What prior authorization can and cannot do

CMS’s August 2026 Medicaid and CHIP ABA toolkit describes prior authorization as “the primary utilization management mechanism used by states and managed care plans to evaluate whether ABA meets established medical necessity criteria before services are delivered.”

The legal frame for children is EPSDT. The toolkit states that “while state plan services available to adults may include limits on the amount, duration, and scope of services that can never be exceeded (i.e., a ‘hard limit’), states are not permitted to apply these kinds of limits to any service covered under EPSDT. States are permitted to use utilization controls, such as prior authorization and medical necessity reviews, to safeguard against unnecessary use of care and services in a manner that is consistent with the EPSDT requirements.”

The distinction that follows is the one to memorize. A weekly hour cap that can be exceeded with prior authorization and a medical necessity review is a soft limit and is permitted. A cap that can never be exceeded is a hard limit and is not.

Two more constraints:

Case by case. The toolkit states that “under CMS’s interpretation of section 1905(r)(5), prior authorization must be conducted on a case-by-case basis, evaluating each child’s needs individually, and it must not delay the delivery of needed treatment services.”
Thresholds alone are not a reason. “Utilization review that is not individualized and relies solely on singular factors such as diagnosis codes, age, or preset hourly thresholds, risks conflicting with EPSDT.”

Screening is separate. Under 42 CFR 441.59(a), and as the toolkit puts it, “states may not impose prior authorization requirements for EPSDT screening services.”

Federal decision timelines

42 CFR 440.230(e) sets the fee-for-service clocks, effective for requests on or after January 1, 2026. 42 CFR 438.210(d) sets the managed care equivalents for rating periods beginning on or after January 1, 2026.

Stage	Standard	Expedited	Citation
Prior authorization decision and notice, fee-for-service	7 calendar days after receipt; state may extend up to 14 calendar days if it determines more provider information is needed	72 hours; CMS’s toolkit states no extensions are available in FFS	42 CFR 440.230(e)(1)(i)
Prior authorization decision and notice, managed care	Within state-established timeframes not exceeding 7 calendar days; extension up to 14 calendar days under limited rules	72 hours, with limited extension up to 14 calendar days	42 CFR 438.210(d)(1)
Filing a plan appeal	60 calendar days from the date on the adverse benefit determination notice	Same	42 CFR 438.402(c)
Continuation of benefits during a plan appeal	Request on or before the later of 10 calendar days after the notice is sent, or the intended effective date	Same	42 CFR 438.420
Plan appeal resolution	No longer than 30 calendar days from receipt of the appeal; extendable up to 14 calendar days	No longer than 72 hours after receipt	42 CFR 438.408
Requesting a state fair hearing after a plan appeal	State must allow no less than 90 and no more than 120 calendar days from the notice of resolution	Same	42 CFR 438.408(f)
Requesting a state fair hearing, fee-for-service	Reasonable time not to exceed 90 days from the date the notice of action is mailed	Same	42 CFR 431.221(d)
Final administrative action on a fair hearing	Ordinarily within 90 days	3 working days for MCO, PIHP or PAHP service denials meeting expedited criteria	42 CFR 431.244(f)
Advance notice before a termination or reduction	At least 10 days before the date of action	5 days where probable fraud	42 CFR 431.211, 431.213

Note the asymmetry. The payer gets 7 days to decide and 30 days to resolve an appeal. You get 10 calendar days to protect the hours in the meantime.

What payers actually ask for

The CMS toolkit lists what documentation should let a payer determine “whether the requested ABA is medically necessary, individualized, clinically appropriate, and supported by the child’s functional needs and treatment goals.” It names evidence of functional impairment, a diagnostic evaluation or other clinical assessment supporting the need for ABA, and the individualized treatment plan.

The toolkit’s list of what a reviewer should consider is effectively a checklist for the packet:

The diagnostic evaluation documents functional impairments in communication, behavior and social skills, and was completed by a provider qualified to administer and interpret the assessment tools.
Any ASD diagnosis is based on DSM-5-TR criteria and made by a qualified provider acting within their scope of practice.
ABA is clinically appropriate for the identified needs and the proposed treatment plan is consistent with generally accepted standards of care.
The requested services are “tied to the functional needs of the individual rather than the diagnosis alone.”
The plan “identifies the proposed level, intensity, duration, and setting of services and includes baseline assessments and individualized, measurable goals based on identified functional deficits.”

The toolkit also states that “EPSDT does not require a specific diagnosis for coverage of services,” while noting elsewhere that best practice is to initiate comprehensive ABA only after a qualified, independent clinician has confirmed an ASD diagnosis.

Higher-intensity requests get a different packet

The toolkit tells states to require more when “requested hours approach or exceed the amount of time a child would reasonably be available for treatment during a typical week.” Specifically, states “should expect clinical documentation to clearly explain why the requested level of service is needed, how the hours will be used, how treatment will fit into the child’s daily life, and how the plan supports the child’s functioning across natural settings.”

Virginia is the concrete version. Its December 16, 2025 ABA policy and regulatory clarifications bulletin requires, “for all requests exceeding 20 hours (80 units) or more per week, the schedule of activities used to structure the service sessions” and a description of “how the activity will facilitate the implementation of the ABA treatment.” It states that “Schedules must be individualized. A general schedule of clinic-based activities is not sufficient,” and that time spent in sessions “conducted for family support, education, recreational or custodial purposes” is not covered.

Concurrent and reauthorization review

Approval is not the end. The toolkit describes concurrent review as monitoring during the authorization period — ongoing medical necessity, clinical progress data, “consistency between the amount of service delivered and the hours authorized,” and whether to continue, modify, reduce or end services. Reauthorization is a separate decision point at the end of the period.

Georgia’s requirements are the toolkit’s worked example: updated behavioral assessment results “dated no more than two months before the prior authorization effective date,” progress summaries, updated plans of care, updated data aligned with the most recent behavior assessment and collected during the previous authorization period, and a service schedule. The toolkit stresses “objective data rather than narrative alone.”

It also warns providers, indirectly, what draws scrutiny: states should “flag static, unchanged plans across multiple authorization periods as potential signals of custodial or non-therapeutic use.”

Retrospective review comes after payment. The toolkit reports that federal and state audits of ASD-related services in Colorado, Indiana, Wisconsin, Maine, Massachusetts, Nebraska and Nevada “have reported at least $198.4 million in improper Medicaid payments,” with recurring findings of “incomplete documentation, insufficient support for determining the medical necessity of treatment, and limited oversight of high-intensity service patterns.”

The appeal path

Managed care. File a plan appeal within 60 calendar days of the notice (42 CFR 438.402). File for continuation of benefits within the 10-day window (438.420). Request expedited review where “taking the time for a standard resolution could seriously jeopardize the enrollee’s life, physical or mental health, or ability to attain, maintain, or regain maximum function” (438.410). If the plan upholds the denial, request a state fair hearing within the window the state sets, which must be at least 90 and no more than 120 calendar days from the notice of resolution.

Fee-for-service. Request a fair hearing within the state’s window, which cannot exceed 90 days from the date the notice of action was mailed (42 CFR 431.221(d)). Under 42 CFR 431.230, if the beneficiary requests a hearing before the date of action following proper notice, the agency may not terminate or reduce services until a decision is rendered.

EPSDT arguments that carry weight

For a child under 21, four documented positions are worth stating explicitly in the appeal:

A hard limit is not permissible. SHO 24-005 states “states are not permitted to apply these kinds of limits to any service covered under EPSDT.”
Maintenance counts. SHO 24-005: “a service need not cure a condition in order to be covered under EPSDT as a medically necessary service. Services that maintain or improve a child’s current health condition are also covered.”
Threshold-only denials are vulnerable. The toolkit’s statement that review relying solely on diagnosis codes, age or preset hourly thresholds “risks conflicting with EPSDT.”
A managed care plan cannot be stricter than the state. 42 CFR 438.210(a)(5)(i) requires each state-MCP contract to specify what constitutes medically necessary services “in a manner that is no more restrictive than that used in the state Medicaid program, including quantitative and non-quantitative treatment limits.”

One caution. The toolkit states plainly that “Federal statute does not define medical necessity; states define the specific medical necessity criteria and documentation standards used in utilization reviews of ABA requests. CMS does not review or approve states’ medical necessity criteria.” The federal rules govern timing, notice, appeal rights and the outer limits on state discretion. The substantive standard your request is measured against is your state’s.