CMS Published Its First ABA Toolkit. Here's What It Means for BCBAs.

In August 2026 the Centers for Medicare & Medicaid Services published the State Medicaid & Children’s Health Insurance Program Applied Behavior Analysis Toolkit. It is the first document of its kind: a federal, book-length treatment of how states should cover, pay for, authorize and audit ABA. The cover carries a month rather than a day, so we date it to August 2026 as printed.

It is not a regulation, and CMS says so twice. It is also not a clinical guideline — the toolkit states it “does not include or represent clinical recommendations and should not be interpreted as establishing a standard of care or directing clinical judgment.” What it is, is a signal of what CMS expects the fifty state agencies to start looking at. Those agencies write the rules BCBAs actually work under, which is why this matters more than its non-binding status suggests.

We read it. Here is what is in it, and what changes for practitioners.

The number that explains the document

Medicaid and CHIP spending on ABA went from about $1.94 billion in 2021 to $10.1 billion in 2025 — a 421 percent increase in four years. Over the same period, the number of beneficiaries with an autism diagnosis receiving any Medicaid or CHIP service rose 67 percent, from 1.15 million to 1.92 million.

Spending grew roughly six times faster than the diagnosed population. That gap is the reason this toolkit exists, and nearly every recommendation in it follows from that one ratio.

Two related figures sit alongside it. CMS reports that in 2025, $1.47 billion — 14.5 percent of all Medicaid and CHIP ABA spending — was paid for ABA delivered to treat conditions other than autism, ADHD among them. And it tallies federal and state audits in Colorado, Indiana, Wisconsin, Maine, Massachusetts, Nebraska and Nevada that together identified at least $198.4 million in improper Medicaid payments, with Colorado alone accounting for $77.8 million in a February 2026 HHS Office of Inspector General report.

CMS names what the audits found: “incomplete documentation, insufficient support for determining the medical necessity of treatment, and limited oversight of high-intensity service patterns.”

What actually changes for a BCBA

Nothing, immediately. Nothing in this document binds a practitioner. But it tells you what your state agency is about to be asked about, and five things in it are worth reading closely.

The 5 percent supervision figure is being reframed. The toolkit is careful in a way that practitioners should notice: the BACB requirement that an RBT receive supervision equal to 5 percent of monthly service hours is described as “specific to the RBT’s service-delivery hours, not the BCBA’s hours, and represents a minimum credentialing requirement rather than a recommended supervision level for all cases.” CMS then cites clinical practice guidance recommending 10 to 20 percent — one to two hours of supervision for every ten hours of direct treatment, or one to two hours a week where direct treatment is under ten hours. If your organization treats 5 percent as the target rather than the floor, this is the paragraph that will be quoted at it.

Billable and non-billable supervision are being separated explicitly. The toolkit tabulates direct supervision activities against indirect ones, and states that whether an activity is billable “should be determined by referring to a specific state’s Medicaid ABA provider manual.” It quotes practice guidance that BCBAs “may spend 25-30 percent of their time performing indirect supervision activities (which may or may not be billable) and non-billable administrative, professional, or organizational activities.” That is a quarter to a third of a caseload’s clinical labor, formally acknowledged in a federal document as often unpaid.

High-hour prescribing is now a named risk. CMS writes that stakeholders raised “recurring concerns that high service hours may be prescribed as a standard approach rather than being tied to outcomes, instead of reserving more intensive ABA for situations in which higher service intensity is clearly justified and documented based on the child’s individual clinical needs.” The document pairs this with an observation about age: utilization is high among children aged 6 to 11, while the evidence CMS cites is strongest for children under 6. Expect authorization scrutiny to concentrate exactly there — older children on high weekly hours.

Telehealth boundaries are drawn. Most states permit ABA by telehealth, but the toolkit sets expectations: BCBA assessments “often must occur in person unless otherwise authorized,” ongoing supervision and caregiver training are generally allowed but “should not be completely rendered using telehealth,” and telehealth “should generally not be used as the primary modality for assessments for ASD diagnosis.”

Documentation is where enforcement will land. Chapter 7 runs through prepayment claim edits, electronic visit verification, prepayment medical review, post-payment audit design and sampling. None of it is new machinery. All of it is being pointed at ABA.

On ownership, CMS reports and declines to conclude

The toolkit devotes a section to corporate structure, and its restraint is notable. It cites published research finding 574 private-equity-acquired autism service delivery sites between 2015 and 2024, spanning 42 states, with the largest concentrations in California (97 sites), Texas (81), Colorado (38), and Illinois and Florida (36 each). It cites a separate analysis counting 12 leading private-equity-owned chains employing at least 30,000 workers across 1,300 locations.

It then reports, as a fact about the field rather than a finding of its own, that “there are concerns among the ABA provider and caregiver communities that the growing prevalence of private equity firms acquiring ABA organizations could result in the prioritization of profit over the quality of individual care.”

And it stops there: “CMS has not taken a formal position on corporate ownership of ABA providers to date; however, regardless of ownership structure, ABA needs to be provided based on an ITP-driven individualized treatment model and not a one-size-fits-all model designed for revenue maximization.”

That last clause is the operative sentence, and it is ownership-neutral by construction. It applies to a private-equity-backed chain and a founder-owned two-clinic practice identically.

The rate table, checked against ours

Chapter 4 includes a table of the lowest and highest state fee-for-service rates for three ABA codes, sourced from the Council of Autism Service Providers’ 50-state comparison and verified by CMS against paid claims. We maintain our own reimbursement dataset built independently from the states’ own fee schedules, so we compared them.

Code	CMS: lowest	Ours	CMS: highest	Ours
97151 assessment	$18.79 Washington	$18.79 ✓	$112.65 New Mexico	$112.65 ✓
97152 supporting assessment	$9.90 West Virginia	$9.90 ✓	$41.74 Mississippi	$41.74 ✓
97153 treatment by protocol	$10.39 North Dakota	$10.81	$22.63 Alaska	$31.95

Four of six match to the cent, which is a useful check on both datasets. The two that differ are both cases where the state has since repriced. North Dakota’s $10.39 is its 2024 figure — the state moved to $10.60 in 2025 and $10.81 on 1 July 2026. Alaska’s current schedule, effective 1 July 2026, prints $31.95.

This is not a criticism of the toolkit. A federal document assembled over months will lag schedules that change every July, and CMS labels the table as 2025 rates. It is a reason to read any rate table, ours included, with its effective date attached — which is why every figure on this site carries one.

What to do with this

If you run a practice, three things are worth doing in the next quarter. Read your own state’s provider manual against the supervision section, because the billable-versus-indirect distinction is decided there and nowhere else. Look at your authorization patterns for children over six on high weekly hours, since that is the intersection the toolkit points at twice. And check that your documentation would survive the post-payment sampling methodology described in Chapter 7, because $198.4 million in identified improper payments is the number that gets a state agency’s attention.

If you are a BCBA rather than an owner, the supervision-percentage reframing is the part to know. A document your state agency will be reading now says in plain terms that 5 percent is a credentialing floor and 10 to 20 percent is the clinical recommendation.

And if you are a parent: the toolkit does not restrict anything. EPSDT still entitles children under 21 to medically necessary services. CMS explicitly “does not endorse or require any particular treatment modality, including ABA” — a sentence that cuts both ways, and one worth knowing exists.

The full document runs to 173 pages, including a state self-assessment checklist in Appendix A and per-state reported rates in Appendix E. It is free to download.