Minnesota’s EIDBI Fraud Scandal Triggers Federal Compliance Threat

What the Federal Register Notice Says

MINNEAPOLIS — the criminal cases against the EIDBI fraud operators in Minnesota are well documented. Asha Farhan Hassan, whose Minneapolis therapy company billed $14 million in fraudulent EIDBI claims over five years, pleaded guilty in December 2025. Abdinajib Hassan Yussuf, whose St. Cloud autism center allegedly recruited unqualified teenage relatives as behavior technicians, paid cash kickbacks to parents, and stole $6 million, was charged the same week. Federal investigators say these are not isolated actors but part of a fraud web that has drawn at least a dozen participants in the earlier Feeding Our Future child nutrition scandal into autism program billing.

What is less well understood is the parallel federal action targeting not a provider or a network but the state government itself.

On January 6, 2026, CMS Administrator Mehmet Oz sent a letter directly to Governor Tim Walz notifying him that Minnesota’s Medicaid program was operating in substantial noncompliance with federal requirements, and that the agency intended to withhold $515,154,947.56 in federal Medicaid matching funds per quarter until the state fixed it. That figure represents the federal share of one quarter’s expenditures on the 14 high-risk Medicaid services the state had already identified as fraud-prone, a group that explicitly includes EIDBI services for autism. At $515 million per quarter, the potential withholding totals more than $2 billion per year.

The notice was published in the Federal Register on January 14, 2026 (91 FR 1539, document 2026-00512), formally opening an administrative hearing process under Section 1904 of the Social Security Act. The legal basis for the noncompliance finding was Section 1902(a)(64) of the Act, which requires every state Medicaid program to maintain effective mechanisms to receive reports of fraud, waste, and abuse and to compile and analyze related data.

CMS has found that Minnesota’s policies, practices, and oversight mechanisms violate section 1902(a)(64) of the Act, which requires states to ensure their state plans provide mechanisms to receive reports of alleged FWA and to compile and analyze related data. — 91 FR 1539, January 14, 2026

In plain terms, CMS’s finding is not that fraud happened in Minnesota. It is that Minnesota failed to build and operate the system-level infrastructure that should have caught fraud early, reported it to law enforcement, and limited its spread. That distinction matters for every ABA operator in every state: the federal government is no longer confining its accountability framework to individual providers.

The EIDBI Connection: From Provider Fraud to State-Level Failure

EIDBI, Minnesota’s Early Intensive Developmental and Behavioral Intervention program, delivers ABA and related services to children under 21 with autism spectrum disorder diagnoses. It requires a comprehensive multidisciplinary evaluation and an individual treatment plan before services begin. Between 2018 and 2025, all autism providers in Minnesota’s Medicaid system billed a combined $1.6 billion in EIDBI and related claims across DHS programs, according to state records. The state had 84 open fraud cases against autism providers as of December 2025 and had completed on-site visits to 342 providers.

The prosecutions tell a consistent story. Hassan’s Smart Therapy LLC submitted fraudulent EIDBI claims without delivering services, sent hundreds of thousands of dollars abroad, and used proceeds to purchase real estate in Kenya. Yussuf’s Star Autism Center recruited children from the Somali community, at times helping those without autism diagnoses qualify for services, paid parents cash kickbacks, and hired unqualified “behavioral technicians” who were, according to prosecutors, often 18- or 19-year-old relatives with no formal education beyond high school and no training or certifications in autism treatment. Both operations overlapped with participants in the Feeding Our Future food program fraud, which federal prosecutors in 2022 called the largest pandemic relief fraud scheme in U.S. history.

The investigation’s scale: Acting U.S. Attorney Joseph Thompson told reporters in December 2025 that fraud may have siphoned at least half of the $18 billion spent in Minnesota’s 14 high-risk Medicaid programs since 2018. He described what he saw as “industrial-scale fraud” and emphasized that these schemes put services at risk for people who actually need them. As of December 2025, 82 of the 92 people indicted in connected Minnesota fraud cases were Somali American. FBI Director Kash Patel said the bureau believes this is “just the tip of a very large iceberg.”

The CMS notice letter addressed the structural conditions that allowed the fraud to reach this scale. CMS noted that Minnesota had “historically had significant deficiencies in proactively identifying suspected Medicaid FWA, primarily through limitations in data analytics and monitoring.” It pointed to a 2019 CMS audit of the state’s Personal Care Services program, the state’s own legislative auditor’s 2021 report on the same program, and a 2017 HHS OIG report on failures in the state’s nonemergency medical transportation program as evidence that these deficiencies had been documented for years without adequate correction. The pattern, in CMS’s framing, was not a sudden lapse but a long-running institutional failure.

Section 1902(a)(64): The Statute Minnesota Violated

Section 1902(a)(64) of the Social Security Act is not an obscure provision. It is one of the conditions every state must satisfy as part of its Medicaid State Plan. The statute requires states to ensure their plans include a mechanism to receive reports from beneficiaries and others and compile data concerning alleged instances of waste, fraud, and abuse relating to the operation of the Medicaid program.

The federal regulations that implement the statute, at 42 CFR Part 455, Subpart A, go further. They require states to implement methods for identifying, investigating, and referring suspected Medicaid fraud. These methods must include a pathway to receive complaints from any source and methods for identifying questionable practices. The data and complaints must feed into preliminary and full investigations and, where appropriate, referrals to law enforcement.

CMS’s onsite visit in December 2025, which the notice letter describes, revealed the gap between what the statute requires and what Minnesota had in place. The letter states that CMS “met onsite with state agency staff and law enforcement to see firsthand the historical deficiencies in the state’s ability to proactively identify potential Medicaid FWA.” What the agency saw formed the basis of the noncompliance finding.

What the state said in response: Minnesota’s Department of Human Services disputed the characterization of its oversight as inadequate, pointing to 1.5 years of anti-fraud work it said the federal government chose to ignore. The state’s own fact-check page noted that by the time of CMS’s January letter, DHS had already terminated the Housing Stabilization Services program, paused payments to the 14 high-risk services, announced a moratorium on new provider enrollment, and was preparing to conduct on-site revalidation visits to 5,800 Medicaid providers using approximately 200 state workers seconded from other agencies. The state submitted its first CAP on December 31, 2025. CMS rejected it and told the state to submit a revised version by January 30.

The 14 high-risk services identified by Minnesota and cited in the CMS notice: EIDBI (autism), Integrated Community Supports, Nonemergency Medical Transportation, Peer Recovery Services, Adult Rehabilitative Mental Health Services, Adult Day Services, Personal Care Assistance, Recuperative Care, Individualized Home Supports, Adult Companion Services, Night Supervision, Assertive Community Treatment, Intensive Residential Treatment Services, and Housing Stabilization Services. Combined federal and state spending: $3.75 billion.

Section 1904 and Why This Enforcement Action Is Different

CMS has two primary mechanisms for holding states financially accountable for Medicaid failures. Understanding the distinction between them matters for assessing what the Minnesota action means.

Disallowances under Section 1903 are retrospective and transaction-specific. They allow CMS to deny or recoup federal matching funds for particular expenditures that did not meet federal requirements. Disallowances are the tool CMS uses when an audit finds, for example, that a state paid for services without adequate documentation.

The compliance process under Section 1904 is different in kind. It is prospective and systemic. When CMS finds that a state is failing to substantially comply with federal requirements in the administration of its state plan, it can withhold a portion of all future federal matching funds until the state demonstrates compliance. The state is entitled to notice and an opportunity for an administrative hearing before withholding begins, but the withholding can commence after the hearing, and CMS can continue to hold funds while a state appeals to federal court.

Section 1904 should be treated not as a rarely invoked procedural backstop but as a core enforcement tool to compel state compliance and recover federal funds when systemic failures persist. — Paragon Health Institute, February 17, 2026

The Paragon Health Institute, which has published detailed analysis of the Minnesota action, notes that CMS has “multiple, distinct enforcement tools that serve different but complementary purposes” and that effective enforcement requires using them in combination: withholding forces future compliance, disallowances address past expenditures, and recoveries ensure states do not retain improperly obtained federal funds. The coordinated use of all three is what changes state incentives, the institute argues, because it makes fraud financially costly rather than fiscally rewarding.

The scale of the proposed withholding drew significant attention. The Georgetown University Center for Children and Families noted that prior withholdings under the compliance process, on the rare occasions they were used, were typically between one and ten percent of the federal share for specific services. The Minnesota proposed withholding represented nearly 20 percent of the federal share of the state’s entire Medicaid spending on an annual basis. Georgetown described calling this a rarely-invoked procedural backstop as an understatement.

Minnesota requested an administrative hearing on January 9, 2026 through the State Office of Administrative Hearings process, which under federal regulations stopped the immediate commencement of withholding. The hearing itself had not been scheduled as of late March 2026, when CMS approved the state’s revised CAP and asked that the hearing be stayed pending full implementation. The compliance action technically remains open until the state completes all CAP commitments, the latest of which carry deadlines through March 31, 2027.

The Corrective Action Plan and What CMS Rejected

Minnesota submitted its first corrective action plan on December 31, 2025, meeting the CMS deadline. CMS rejected it on January 6 in the same letter that announced the noncompliance finding, describing the submission as “a document labeled as a CAP” rather than a compliant plan. The letter’s specific criticisms are detailed in the Federal Register notice and illuminate what CMS considers minimum acceptable program integrity infrastructure.

The deficiencies CMS identified in the first CAP: it relied heavily on temporary or future-contingent measures, lacked enforceable timelines and performance metrics, acknowledged current noncompliance with key federal requirements, and provided limited assurance of accountability for past misconduct. On the financial recovery side, the plan did not commit to specific enforcement actions, recovery targets, referral thresholds, or timelines for resolving identified overpayments or fraud.

CMS also raised a specific concern that reflects the international dimension of the fraud schemes: given that some funds appeared to have been transferred outside the United States by individuals with ties outside the country, the agency said the CAP should have addressed how the state would understand the ownership and corporate structure of providers and how it would ensure no Medicaid funds were reaching criminal international entities. The plan did not address this.

The revised CAP: Minnesota submitted a 20-page revised plan on January 30, 2026, containing 17 program elements and 35 specific implementation dates. Among the key commitments: on-site revalidation visits to 5,800 Medicaid providers by summer 2026, data analytics and prepayment review enhancements, prior authorization program reform, expanded managed care oversight, and provider training requirements. CMS approved the revised plan on March 19-20, 2026. Its approval letter asked that the state’s pending administrative hearing be stayed “pending complete implementation of the approved CAP, as successful completion would moot the appeal.” The state had met all February and March implementation milestones at the time of approval.

A parallel enforcement action added financial pressure. On February 25, 2026, Vice President J.D. Vance and CMS Administrator Oz jointly announced a deferral of $259.5 million in federal matching funds for Minnesota’s fourth-quarter fiscal year 2025 expenditures, a separate action from the prospective withholding. Minnesota filed suit in federal court on March 2 to block the deferral. On April 6, 2026, a federal district court denied the state’s request for a preliminary injunction, leaving CMS free to continue the deferral while the underlying case proceeds.

The National Picture: ABA Audits Across States

The Minnesota action did not occur in isolation. HHS OIG has released findings from a multi-state audit series specifically targeting Medicaid ABA payments for children with autism. Indiana, one of the earliest states to mandate insurance coverage of ABA, saw its Medicaid spending on ABA rise from $21 million in 2017 to $611 million in 2023, a 30-fold increase. An HHS OIG audit found at least $56 million in improper fee-for-service Medicaid payments for ABA in Indiana over the audit period, with 95 of 100 sampled enrollee months failing to meet documentation requirements and 98 lacking required session notes. An audit of Wisconsin found at least $18.5 million in improper ABA FFS payments.

HHS OIG has identified five additional state ABA audits as forthcoming. The audit series is specifically limited to fee-for-service claims and does not examine managed care claims, which Paragon Health Institute has described as a significant oversight gap given that most Medicaid ABA is delivered through managed care arrangements in most states. CMS’s January letter to Minnesota explicitly called out managed care oversight as one of the deficiencies the state needed to address in its revised CAP.

CMS’s reach beyond Minnesota: Georgetown’s Center for Children and Families reported in April 2026 that CMS had sent letters to at least four other states, including California, Florida, Maine, and New York, requesting detailed information about each state Medicaid program’s anti-fraud policies and procedures. Whether those letters are a precursor to compliance actions under the same Section 1904 framework used against Minnesota is not yet clear. But the pattern suggests that the federal oversight posture toward state Medicaid programs has shifted from guidance to scrutiny in ways that are likely to affect ABA operators in multiple states.

The Paragon Institute notes that the structural vulnerabilities driving ABA fraud, which it identifies as open-ended federal funding, limited real-time verification of service delivery, fragmented oversight between states and federal government, and inadequate managed care claims scrutiny, exist in every state Medicaid program, not only Minnesota. The Indiana and Wisconsin audit findings appear to confirm that documentation failures are common across ABA programs, not unique to jurisdictions with organized fraud schemes.

What ABA Operators Need to Understand

The Minnesota compliance action, the HHS OIG audit series, and the CMS letters to other states together represent a shift in federal Medicaid oversight that has direct operational implications for ABA providers.

Documentation requirements are now an enforcement priority: The HHS OIG audits in Indiana and Wisconsin found that the most common failure mode was not outright fraud but inadequate documentation: missing session notes, unauthorized service authorizations, and payment records that could not be verified against delivered services. In Indiana, 95 of 100 sampled enrollee months failed to meet documentation requirements. These findings are what triggers audit findings, disallowances, and, at scale, state-level compliance actions. ABA operators whose documentation practices are not systematically maintained face exposure regardless of whether any intentional fraud is occurring.

State licensing frameworks for EIDBI are accelerating: Minnesota passed legislation in 2025 requiring EIDBI providers to obtain provisional licenses, with applications due by May 31, 2026, and comprehensive licensing standards to be proposed to the legislature by January 1, 2027. This represents an attempt to create state-level barriers to the fraudulent provider enrollment that the federal government found to be a core failure in the state’s oversight system. More broadly, the pressure on state agencies to demonstrate adequate fraud controls will likely accelerate BCBA and EIDBI licensing requirements in states where those frameworks do not yet exist or are incomplete. Several of the failures documented in the federal notice, such as unqualified practitioners posing as behavior technicians, are enabled in part by the absence of state-level licensure requirements for the behavior technician role.

The CMS notice’s explicit call-out of managed care oversight gaps is also relevant to ABA operators. Most ABA services are delivered under Medicaid managed care contracts, and most of the audit activity to date has been limited to fee-for-service claims. When CMS and HHS OIG turn their attention to managed care claims, which the federal notice indicates is a priority, the documentation and billing standards for ABA therapy under managed care arrangements will be subject to the same scrutiny that has already produced disallowance findings in fee-for-service markets.

For operators, the direct message is that the enforcement environment is shifting from provider-level prosecution of obvious fraud to systemic audit of documentation and billing practices across all ABA providers in all states. The Minnesota case shows what happens when those systemic failures reach a threshold where they implicate state-level program integrity obligations. The Indiana and Wisconsin audit findings show that documentation failures of sufficient scale can produce disallowance findings even in states with no organized fraud schemes. The five forthcoming state audits suggest the federal government is systematically working through the ABA market.

SOURCES & REFERENCES