In August, CMS released the State Medicaid and CHIP Applied Behavior Analysis Toolkit. It arrived with almost no fanfare, and to be clear, it carries no force of regulation. It may still be the most consequential ABA document of the year.
The reason sits on page six. The toolkit reports that between 2021 and 2025, the number of children with an autism diagnosis receiving ABA through Medicaid grew 189 percent, while spending on their ABA grew 421 percent. Utilization roughly tripled. Spending more than quintupled. When cost outruns the number of children served by that wide a margin, every Medicaid director in the country starts asking the same question, and CMS just handed all of them the treasure map to find the answers.
What the toolkit actually is
CMS is careful to say it does not establish a standard of care, does not direct clinical judgment, and does not endorse ABA or any other modality. What it does is give state Medicaid and CHIP agencies a structured way to tighten how ABA is covered, delivered, paid, and policed. It runs through clinical standards, coverage authorities, payment methodologies, provider qualifications and ownership, utilization management, and fraud, waste, and abuse. Then it closes with something more operational than any chapter: a set of State Checklists. Appendix A is, in effect, a to-do list a state can work straight down.
CMS is also unusually candid about why it wrote the thing. The toolkit points to fraud prosecutions, to kickback and patient-harm cases, and to an ABA market that has consolidated fast. Citing research in Health Affairs and JAMA Pediatrics, it counts 574 private-equity-acquired autism service sites between 2015 and 2024, and twelve leading PE-owned chains employing at least 30,000 workers across roughly 1,300 locations. Its clearest statement of intent is a single sentence: ABA “needs to be provided based on an ITP-driven individualized treatment model and not a one-size-fits-all model designed for revenue maximization.” For a document that spends 170 pages being careful, that line is a thesis.
To its credit, the toolkit does not read as an attack on ABA. It airs the field’s own criticisms, including the limits of an observable-behavior-only lens, the risk of prioritizing compliance over autonomy, and the power imbalance built into intensive models. Then it frames coverage around individualized medical necessity and the EPSDT protections that guarantee children medically necessary care. It represents the field’s critics more honestly than most industry coverage does.
Arizona is already running the playbook
To watch the toolkit move from PDF to policy, look at Arizona. AHCCCS, the state’s Medicaid agency, has a rewrite of its ABA policy, AMPM 320-S, in the pipeline. The draft went out for public comment in April, comments closed June 2, and the agency has signaled a final policy in late summer or early fall. Set the proposed draft beside the toolkit, and the overlap is hard to miss.
The toolkit spends a chapter on provider qualifications and credentialing. Arizona’s draft would require every behavior technician to hold an active RBT certification, with a window to bring current staff into compliance.
The toolkit devotes pages to program integrity, including fingerprint-based background checks for higher-risk providers and prompt ownership disclosure. Arizona’s draft would require fingerprint clearance, criminal background checks, and abuse-registry checks for staff delivering services that are not directly observed.
The toolkit lays out supervision expectations, citing the CASP guideline of one to two hours of supervision for every ten hours of direct treatment and the BACB’s five percent floor for RBTs, with an explicit warning that supervision should not be delivered solely by telehealth. Arizona’s draft pushes required supervision toward the licensed behavior analyst and away from a model where a stretched supervisor covers a wide roster from a distance.
And the toolkit’s longest chapter is utilization management: prior authorization before services, concurrent and reauthorization review, and closer scrutiny of higher-intensity requests. It tells states to flag plans that look custodial rather than therapeutic, and to document when far fewer hours are delivered than were authorized. It also warns states off blunt instruments. Utilization review built on diagnosis codes, age, or a preset hourly cap alone risks colliding with EPSDT, so the toolkit points states toward individualized justification, case by case. Arizona’s draft tracks it closely: prior authorization on a six-month cycle, written justification for requests above 25 hours a week (above 15 for full-time students), and documentation when delivered hours fall well short of what was approved.
None of this is coincidence. Arizona is executing a template, and the fiscal pressure behind it is the same pressure CMS described nationally. Arizona’s own Medicaid ABA spending rose from roughly $260 million to $371 million in a single year, a 43 percent jump, according to KJZZ, and the federal Office of Inspector General is already examining the state’s billing through an audit last fall.
The bill the field has been running up
The models most exposed to the toolkit are the ones built on volume: high authorized hours, thin licensed supervision, remote leverage, and rapid roll-up. Those are the exact levers the toolkit tightens. Raise the credentialing floor, require real supervision, gate the high-hour prescriptions, and track the ownership changes, and the math that made the comprehensive, big-box model attractive stops working.
That is not a judgment on ABA as a therapy. It is a judgment on a way of running it. A provider already delivering individualized, appropriately supervised, medically justified care will feel most of this as paperwork. A provider whose economics depend on forty-hour plans staffed by uncertified technicians under a supervisor three time zones away will feel it as a threat to the business model. The toolkit was written with the second provider in mind, and Arizona’s draft reads the same way.
What ABA operators should do with it
Read the State Checklists as your roadmap for the next two years. If your state has not moved yet, the toolkit is the best available map of what it will ask for, and in what order. Expect the same four levers, in roughly this shape: credentialing, supervision, utilization documentation, and ownership transparency. Get your supervision ratios and your medical-necessity documentation clean before a reviewer asks, because retrospective review and recoupment are in the toolkit too.
And watch what CMS flagged as unfinished. The toolkit names rate methodology, quality measures, value-based models, and facility licensure as areas that still need work. Those are the next chapters. Facility licensure is worth tracking most closely, because it is the lever that reaches past the individual clinician to the clinic itself.
Arizona is not the exception here; it’s the first draft.
Join the discussion ▾