What EPSDT Is — and Why It Matters More Than Any State Mandate

WASHINGTON, D.C. — The Early and Periodic Screening, Diagnostic, and Treatment benefit was written into federal law in 1967 as part of the Social Security Act. Its premise was straightforward and sweeping: every child under 21 enrolled in Medicaid is entitled to comprehensive preventive healthcare services, and every condition identified through screening must be treated with whatever medically necessary services are required to correct or ameliorate it. The language is not advisory. It is mandatory. States that participate in Medicaid — which is every state — must provide EPSDT as a condition of receiving federal funds.

For nearly five decades, the mandate existed without specific reference to autism or ABA therapy. States interpreted it narrowly, covering well-child visits and basic screenings but declining to extend it to intensive behavioral treatments. Families whose children were diagnosed with autism and whose physicians prescribed ABA therapy were routinely told that Medicaid did not cover it — a statement that was legally incorrect but operationally accurate, because no federal agency was enforcing the obligation.

That changed on July 7, 2014, when the Centers for Medicare and Medicaid Services issued Informational Bulletin CIB-07-07-14. The bulletin did not create a new obligation. It clarified an existing one: states were required, under EPSDT, to cover medically necessary autism services — including ABA — for all Medicaid-eligible children under 21. The bulletin outlined coverage categories, discussed the relationship between EPSDT and state waiver programs, and explained that services must be covered even if the state had not included them in its adult Medicaid plan. A September 2014 FAQ reinforced the message.

California moved first, implementing coverage within months. Most states took years. Texas became the 50th state to cover ABA through Medicaid in 2022. By then, ABA had become Medicaid’s fastest-growing line item. Total Medicaid spending on ABA procedure codes reached $14.49 billion in 2024, a 279 percent increase from 2018. The mandate had worked. The question was whether states would keep honoring it.

What the Law Actually Requires

The EPSDT mandate, codified in Sections 1902(a)(43), 1905(a)(4)(B), and 1905(r) of the Social Security Act, imposes three distinct obligations on state Medicaid programs.

Screening: States must provide periodic health screenings, including developmental and behavioral health assessments, on a schedule that meets reasonable standards of medical practice. This includes autism screenings — a requirement that, if properly enforced, would identify children far earlier than the current average diagnostic age of approximately four years.

Diagnosis: When a screening identifies a condition, the state must arrange for diagnostic services to confirm and characterize it. For autism, this means access to qualified diagnostic professionals — a resource that remains in critically short supply in most states, contributing to the 12-to-24-month wait times that persist nationally.

Treatment: Once a diagnosis is confirmed, the state must cover all medically necessary services to correct or ameliorate the condition. This is the provision that makes EPSDT the most powerful protection in autism law. The treatment obligation is not limited to services listed in the state’s Medicaid plan. If a service is available anywhere under federal Medicaid law and is medically necessary for the child, the state must provide it. Hard caps on the number of visits or hours per year are not permitted under EPSDT. Prior authorization is allowed, but only if it does not function as a de facto denial of medically necessary care.

“States must provide coverage for an array of medically necessary mental health and SUD services along the care continuum — including in children’s own homes, schools and communities — in order to meet their EPSDT obligation.” — CMS, September 2024 EPSDT Guidance

The September 2024 guidance — the most comprehensive CMS had issued in a decade, required by Section 11004 of the Bipartisan Safer Communities Act — reinforced these requirements and added detail on behavioral health coverage, workforce expansion, care coordination, and the obligation of managed care organizations to comply. The 57-page document made explicit what the 2014 bulletin had implied: states are ultimately accountable for EPSDT compliance, regardless of whether they deliver Medicaid through managed care.

How States Are Violating the Mandate

Despite the clarity of the law and the specificity of CMS guidance, EPSDT violations in the context of ABA therapy have become systematic across multiple states. The violations fall into several categories, each of which functionally limits children’s access to medically necessary care while maintaining nominal compliance with the statutory text.

Rate Cuts That Force Provider Exits. When a state or its managed care organizations cut reimbursement rates below the cost of service delivery, providers cannot sustain operations and either exit the market or reduce capacity. The result is the same as a coverage denial: the child has a legal right to services that no provider in their geography can afford to deliver. Nebraska’s 48 percent rate cut for direct therapy services in August 2025 — from approximately $144 per hour to $74.80 — is the most dramatic recent example. Arizona’s Mercy Care imposed a combined 40 percent reduction over three months in 2025, then terminated contracts with the two largest ABA providers when they attempted to negotiate, leaving approximately 1,000 families without covered providers.

Hard Hour Caps Disguised as Utilization Management. EPSDT explicitly prohibits hard caps on medically necessary services. Yet multiple states have proposed or implemented caps on ABA hours. New York’s pending SB S5107 would impose a 680-hour annual cap on ABA services. Indiana is developing tiered hour limits based on severity level. These caps, if implemented, would directly contravene the EPSDT requirement that treatment be provided based on individual medical necessity, not categorical limits.

Prior Authorization as a Barrier. While prior authorization is permitted under EPSDT, it must function as a clinical review process, not a denial mechanism. In Colorado, the state’s move to require prior authorization for ABA services — combined with reimbursement reductions — prompted a lawsuit in October 2025 by 11 providers and eight families alleging that the requirements were singling out ABA for restrictions not applied to comparable medical services, violating both EPSDT and the Mental Health Parity and Addiction Equity Act.

Network Adequacy Failures. When managed care organizations terminate contracts with major providers without ensuring that adequate alternatives exist, children with EPSDT rights are left without access to covered services. The Arizona litigation — Centria’s December 2025 lawsuit against Mercy Care and AHCCCS, and the February 2026 class action on behalf of 11 families — centers on this exact theory: that MCOs cannot use for-any-reason termination clauses to eliminate major providers without triggering federal network adequacy requirements that protect children’s access to medically necessary care.

Failure to Screen. The least visible violation may be the most consequential. EPSDT requires periodic developmental screening. The American Academy of Pediatrics recommends autism-specific screening at 18 and 24 months. Yet screening rates remain far below universal, particularly in communities with the highest Medicaid enrollment. Children who are never screened are never diagnosed, and children who are never diagnosed never trigger the treatment obligation. The failure to screen is a failure at the front door of the mandate.

The Enforcement Gap: A Law Without a Cop

The fundamental weakness of the EPSDT mandate is enforcement. CMS has the authority to withhold federal matching funds from states that fail to comply, but it has rarely exercised that authority in the ABA context. The agency’s enforcement posture has historically been guidance-heavy and action-light: informational bulletins, FAQs, strategy documents, and technical assistance, but almost no formal enforcement actions against states that impose restrictions inconsistent with EPSDT requirements.

The Bipartisan Safer Communities Act of 2022 attempted to address this gap. Section 11004 required the HHS Secretary to review state EPSDT implementation, identify compliance concerns, provide technical assistance, and issue updated guidance every five years. It also directed the Government Accountability Office to study state oversight of managed care organizations’ EPSDT compliance and report to Congress by June 2025. The GAO study was intended to produce the first systematic assessment of whether MCOs — which now administer the majority of children’s Medicaid nationwide — are actually honoring the EPSDT obligation.

The September 2024 CMS guidance was the most concrete product of this mandate. But guidance is not enforcement. When Nebraska cut ABA rates by 48 percent, CMS issued no public response. When Arizona’s MCOs terminated contracts with the state’s largest providers, CMS did not intervene. The pattern is consistent: the federal agency that wrote the mandate has not demonstrated a willingness to enforce it against states that are actively undermining it.

“Unfortunately, enforcement and oversight of state Medicaid programs following the EPSDT mandate are limited, and patients and/or providers must litigate denials at the Fair Hearing level.” — American Speech-Language-Hearing Association

In June 2025, the Supreme Court’s decision in Medina v. Planned Parenthood South Atlantic further narrowed the enforcement landscape. The 6-3 ruling held that Medicaid beneficiaries do not have a private right of action under 42 U.S.C. § 1983 to enforce the Medicaid Act’s any-qualified-provider provision. While the decision addressed a specific statutory section and not EPSDT directly, its reasoning — that federal spending statutes do not presumptively create individually enforceable rights — cast a shadow over the broader question of whether families can sue states for EPSDT violations. Courts have historically recognized EPSDT as creating enforceable rights, but the Medina framework makes future challenges more legally precarious.

The practical result is that families must rely on litigation to enforce a right that the federal government will not enforce administratively. EPSDT lawsuits have produced significant wins — permanent injunctions in Florida and California, preliminary injunctions in Ohio and North Carolina — but litigation is slow, expensive, and available only to families with access to legal representation. The child whose ABA hours were cut last month cannot wait for a court order that may take years.

The Federal Budget Threat: EPSDT Under Fiscal Pressure

The EPSDT mandate’s future is further complicated by the broader Medicaid fiscal environment. The One Big Beautiful Bill Act, signed by President Trump in 2025, includes more than $900 billion in federal Medicaid spending reductions over the next decade. While the law does not specifically target EPSDT, the overall fiscal pressure on state Medicaid programs will inevitably force states to find savings wherever they can. ABA therapy — one of the fastest-growing Medicaid line items, with documented fraud concerns and utilization patterns that have attracted federal audit scrutiny in at least seven states — is an obvious target.

The HHS Office of Inspector General announced in 2022 that it would review Medicaid ABA payments in seven states. The first audit, of Indiana, found at least $56 million in improper payments. Wisconsin followed with $18.5 million. Colorado’s audit, released in March 2026, found $77.8 million in improper payments and demanded $42.6 million in federal refunds. The pattern gives states a politically defensible basis for rate cuts and prior authorization requirements: we are not cutting children’s services, we are addressing documented fraud and billing abuse.

The distinction matters for EPSDT compliance. Targeting fraud is legitimate. Cutting rates below the cost of care delivery is not, because the effect is to make medically necessary services functionally unavailable. The question courts and regulators must address is where the line falls — and whether states that cite fraud as a justification for rate cuts are actually targeting fraud or using it as cover for budget reduction.

What Families Need to Know

For families navigating the current environment, EPSDT remains the strongest legal protection available. Despite the enforcement gap, the mandate establishes clear rights that can be asserted in administrative proceedings and in court.

Your child is entitled to medically necessary ABA therapy under EPSDT if they are under 21 and enrolled in Medicaid. The state cannot impose hard caps on hours or visits that override a physician’s determination of medical necessity. Prior authorization is permitted but cannot function as a blanket barrier to access. If services are denied, reduced, or terminated, you have the right to a Medicaid fair hearing — and you can request that services continue during the appeal under what is known as “aid pending.”

If your state’s rate cuts have caused your ABA provider to exit the market or reduce capacity, the legal theory being tested in Arizona and other states — that network adequacy failures violate EPSDT — may provide a basis for legal action. The National Health Law Program, Autism Speaks, and the Council of Autism Service Providers all maintain resources for families facing EPSDT violations.

The mandate exists. It is real. It is enforceable. The problem is not the law. The problem is that the people responsible for enforcing it — at the federal and state level — have, in too many cases, chosen not to.

AT A GLANCE

EPSDT Enacted: 1967 (Social Security Act); applies to all Medicaid-eligible children under 21
Key CMS Bulletins: July 7, 2014 (CIB-07-07-14, autism/ABA coverage); September 24, 2014 (FAQ); September 2024 (57-page comprehensive guidance per BSCA §11004)
Statutory Authority: Social Security Act §§1902(a)(43), 1905(a)(4)(B), 1905(r)
Core Requirements: Periodic screening (including developmental/behavioral); diagnostic services for identified conditions; all medically necessary treatment to correct or ameliorate conditions
ABA Coverage: All 50 states cover ABA under Medicaid (Texas, last state, 2022); EPSDT requires coverage when medically necessary regardless of state plan
National ABA Spend: $14.49 billion total Medicaid ABA (2024); 279% growth from 2018 (Trilliant Health)
Prohibited Under EPSDT: Hard caps on visits/hours; categorical denials of medically necessary services; prior authorization that functions as de facto denial
Permitted Under EPSDT: Prior authorization (if clinically based); individualized medical necessity determinations; utilization review
BSCA Section 11004: Required CMS to review state EPSDT implementation, identify compliance gaps, issue guidance every 5 years; GAO study on MCO compliance due June 2025
Medina v. PPSA (2025): Supreme Court (6-3) held Medicaid beneficiaries cannot enforce provider-choice provision under §1983; broader implications for private EPSDT enforcement uncertain
Active EPSDT-Related ABA Litigation: Arizona (Centria v. Mercy Care, Dec. 2025; class action, Feb. 2026); North Carolina (21 families v. DHHS, Oct. 2025); Colorado (11 providers + 8 families v. state, Oct. 2025)
HHS OIG Audits: 7-state review announced 2022; Indiana ($56M improper), Wisconsin ($18.5M), Colorado ($77.8M, Mar. 2026); Maine and others pending
State Rate Cuts: Nebraska: 48% (Aug. 2025); Arizona: ~40% combined (July–Sept. 2025); North Carolina: 10% (Oct. 2025, enjoined); Colorado: proposed reductions + prior auth
Proposed Hour Caps: New York SB S5107 (680 hrs/yr); Indiana (tiered caps under development)
Federal Budget Threat: One Big Beautiful Bill Act: $900B+ Medicaid cuts over 10 years; ABA identified as high-growth target
Enforcement Gap: CMS has rarely withheld federal funds for EPSDT non-compliance in ABA context; families must litigate to enforce rights
Key Advocacy Orgs: National Health Law Program; Autism Speaks; Council of Autism Service Providers (CASP); state-level provider coalitions
Family Rights: Medicaid fair hearing for any denial, reduction, or termination; aid pending (continued services during appeal); no hard caps on medically necessary services

SOURCES & REFERENCES

Federal Law: Social Security Act §§1902(a)(43), 1905(a)(4)(B), 1905(r)
CMS Guidance: CIB-07-07-14 (July 2014); SHO #24-005 (September 2024)
Legislation: Bipartisan Safer Communities Act (P.L. 117-159), Section 11004; One Big Beautiful Bill Act (2025)
Data Source: Trilliant Health, December 2025 (Medicaid/commercial ABA claims)
Federal Audits: HHS OIG: Indiana (Dec. 2024), Wisconsin (July 2025), Colorado (Mar. 2026)
Supreme Court: Medina v. Planned Parenthood South Atlantic, No. 23-1275, 606 U.S. ___ (June 2025)
Key Resources: healthlaw.org (National Health Law Program EPSDT case docket); medicaid.gov/autism-services; autismspeaks.org/medicaid-epsdt
Published: BreakingNewsABA.com — March 2026