CMS EPSDT Guide Undercuts ABA Hour Caps and Plateau Denials

First Children’s-Benefit Rewrite Since 2014

WASHINGTON – CMS has updated the rules for pediatric Medicaid ABA authorization for the first time in 12 years. The new guidelines mention the same hourly maximums that Indiana used earlier this year.

On May 13, the agency released an updated EPSDT: A Guide for States. This manual covers Early and Periodic Screening, Diagnostic, and Treatment, which is the Medicaid benefit that gives children under 21 access to any medically necessary service under Section 1905(a) of the Social Security Act.

CMS says this update is about bringing past guidance together, not making new policy. The document itself says it “compiles into a single document various EPSDT policy guidance that CMS has issued over the years.” Georgetown University’s Center for Children and Families also noted in a June 10 analysis that it does not create new policy. Instead, it combines 12 years’ worth of letters, bulletins, and toolkits into a single reference. This is part of a larger EPSDT effort, influenced by the Bipartisan Safer Communities Act of 2022, a letter from a state health official in September 2024, and a behavioral health toolkit from February 2026.

The guide does not mention ABA by name. Its only autism-specific reference is in the resource list: the July 7, 2014 CMCS bulletin on Medicaid coverage for children with autism. However, the rules it brings together medical necessity, prior authorization, and managed care obligations are the same ones used for every ABA authorization for a child on Medicaid.

Hard Limits, Soft Limits, and Hour Caps

The section most often quoted is in the medical-necessity chapter. The guide states, “Flat, fixed, hard, or arbitrary limits (e.g., budget or monetary caps, standard deviations from the norm, or hourly maximums) are not consistent with the EPSDT requirements and therefore may not be applied to the coverage of Section 1905(a) services for EPSDT-eligible children.”

Soft limits are allowed, but hard limits are not. The guide says a state can set thresholds for how much care is used, but “additional services beyond these limits must be provided if determined to be medically necessary to correct or ameliorate the individual child’s condition.” For example, a state can limit physical therapy visits for adults, but for children, any limit must allow for individual review. Any rules a state sets for medical necessity “may not contradict or be more restrictive than the federal statutory EPSDT requirement.”

Prior authorization survives too, with conditions. States “need to ensure that their utilization control/prior authorization systems are programmed to apply the EPSDT requirements,” and no screening service may require prior authorization at all. Cost cannot decide the question on its own: a state “may not deny medically necessary treatment to a child based on cost alone.” However, it may consider the relative cost-effectiveness of alternatives.

Maintenance, Plateaus, and Software

The guide is clear about children who stop making measurable progress. Services that “ameliorate” a condition must be covered, and those that “maintain or support health problems rather than cure or improve them” can also count as ameliorative. It adds that children with disabilities “may benefit from services that can prevent conditions from worsening, reduce pain, and avert the development of more costly illnesses and conditions.” The guide ends by saying EPSDT requires coverage “not only of medically necessary treatment to correct or ameliorate identified conditions, but also of preventive and maintenance services.”

Anne Dwyer, an associate research professor at Georgetown’s Center for Children and Families, wrote that the language “directly undercuts the so-called ‘plateau’ rationale that some payers have used to terminate ongoing therapy or treatment once a child stops showing measurable progress.” Her summary: “If the treatment keeps a child from regressing, it is covered.”

The guide also addresses the use of software in utilization review. It says, “If the state or its contractors rely on software to streamline coverage decisions, the state should ensure that any software used in this process is consistent with EPSDT requirements.” Just before this, it requires that the state or its managed care plan “must apply the ‘correct or ameliorate’ standard and take into account the child’s long-term needs.” Dwyer sees this as a safeguard as more algorithmic review tools are used in utilization management.

For managed care plans that provide most children’s Medicaid coverage, the guide sets a clear minimum: a plan “may not use a definition of medically necessary services for children that is more restrictive than the state’s definition, which in turn cannot be more restrictive than the federal ‘correct or ameliorate’ standard.” Giving responsibility to a plan does not change this. The guide says, “[S]tates retain ultimate responsibility for ensuring that all EPSDT-eligible children in the state have access to the full EPSDT scope of coverage and services.”

Where the Guide Meets Indiana

No state is testing the new rules as much as Indiana. Bulletin BT202627, which took effect on April 1, 2026, made ABA only available as an EPSDT service, ended coverage at age 21 with a transition period through September 30, 2026, set a 4,000-hour lifetime cap for comprehensive ABA, limited targeted ABA to 15 hours per week, and reduced maximum rates for nongroup services by 6 percent. The rate for CPT 97153, the technician-delivered ABA code, dropped from $17.06 to $16.04 per 15-minute unit. An earlier summary from Indiana’s Family and Social Services Administration set weekly limits of 30 to 38 hours based on diagnosis, or higher if a provider prescribes more, with CMS approval pending.

The bulletin includes the federal safeguard in its own language. If a child needs more than 4,000 hours of comprehensive ABA and it “is found to be medically necessary, as determined through subsequent review … it will be covered under EPSDT.” This means the lifetime cap can be waived if an individual review finds that more hours are needed, just as the new federal guide requires.

Virginia has taken a quieter approach: no new cap, but more paperwork. Changes from the Department of Medical Assistance Services, effective October 15, 2025, unbundled requests under CPT 97155 (the protocol-modification code), required authorization for each unit, and added new rules for scheduling requests above 20 hours per week, according to the Virginia Association for Behavior Analysis. Pressure on states is not receding: federal Medicaid cuts under H.R. 1 are straining state budgets, Georgetown CCF noted.

“EPSDT requirements are obligations, not aspirations … they apply regardless of the delivery system a state chooses or the fiscal pressure it faces.” – Anne Dwyer, Associate Research Professor, Georgetown University Center for Children and Families (2026)

The federal protection described in the guide has a limit: EPSDT ends at age 21. The updated document does not affect Indiana’s decision to stop paying for ABA for adults after September 30, 2026.

For providers and families, the main change is that they now have a single federal document from May 2026 to cite in denial appeals, managed-care contract disputes, and comments on proposed state rules, instead of having to reference many different letters and bulletins. Indiana’s next rate cut, 4 percent across all ABA codes, takes effect on April 1, 2027.

AT A GLANCE

SOURCES & REFERENCES