CMS Issues Toolkit on Applied Behavior Analysis: What States and Providers Should Consider

The Centers for Medicare & Medicaid Services (CMS) on August 4, 2026, issued the Applied Behavior Analysis Toolkit, a 174-page guidance document for state Medicaid and Children's Health Insurance Program (CHIP) agencies. The guidance marks the Trump Administration's latest effort to combat fraud in federal healthcare programs and curb Medicaid spending growth.

The guidance also comes amid a backdrop of high-profile federal oversight and enforcement activities, including task forces launched by the Trump Administration and investigative efforts led by congressional committees that have touched a variety of healthcare services and providers within Medicaid programs, such as Applied Behavior Analysis (ABA), hospice care and long-term care in Minnesota, California, New York and other states.

ABA Toolkit

CMS cites the rapid growth in ABA utilization and spending relative to the number of children receiving services as the primary reason for heightened oversight, noting that the number of children diagnosed with autism spectrum disorder (ASD) receiving ABA services grew 189 percent over four years, whereas spending grew 421 percent during the same period. The toolkit does not endorse a particular treatment modality or approach to ABA for beneficiaries diagnosed with ASD.

Instead, the toolkit describes possible approaches for designing Medicaid benefits, policy and coverage, as well as measures to stem waste, fraud and abuse, such as updating provider enrollment and credentialing requirements or utilization management to identify improper billing. In addition, the toolkit identifies documentation flags that may indicate improper billing, including but not limited to overlapping treatment, excessive service hours, reevaluations that do not reflect progress, and lack of engagement by a parent or caregiver. These indicators mirror findings from U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) investigations into ABA services that identified questionable billing patterns.

Although the toolkit does not create binding requirements for state Medicaid and CHIP programs, it signals that CMS may take additional enforcement and oversight measures in the months and years ahead centered around the practices outlined in the toolkit. States will likely use the toolkit to revise ABA coverage policies, provider enrollment and credentialing requirements, and Medicaid payment rates.

Federal Efforts Related to Waste, Fraud and Abuse

CMS has significantly heightened its enforcement posture, shifting from its long-standing practice of disallowing federal matching funds after states identify Medicaid fraud post-payment. The agency is now utilizing a combination of targeted enforcement measures and sweeping pauses on the distribution of federal funding. CMS deferred $1 billion in payments to Minnesota and California after identifying "high-risk" Medicaid claims on July 21, 2026.

Though states have the opportunity to respond to CMS' actions by providing additional documentation to substantiate the veracity of medical claims in question, CMS is also using alternative tools to identify and address potential fraud, including urging states to revalidate Medicaid providers and requesting information about their plans to address fraudulent activity. The HHS OIG recently announced it review states' Medicaid Fraud Control Units (MFCUs) prior to the next annual recertification, with one state subsequently receiving notice that additional federal funding for its MFCU had been denied. CMS is also using other regulatory tools at its disposal to promote program integrity across its programs such as requests for information to inform future activity.

Congressional oversight activity also indicates that states will face additional scrutiny from lawmakers as members of the U.S. Congress develop potential legislative measures to address fraud and reinforce the Trump Administration's efforts. The U.S. House of Representatives Committee on Energy and Commerce and Committee on Education and the Workforce have pursued investigations into fraudulent activity, respectively seeking information from states and individuals regarding guardrails in place to monitor for, identify and remedy fraud within Medicaid programs, including ABA services. The committees have jurisdiction over Medicare, Medicaid and employer-sponsored insurance, giving them substantial authority to obtain information on these areas and others through requests or subpoenas.

With Congress largely focused on the upcoming November 3, 2026, midterm elections, and a limited number of legislative days before then, waste, fraud and abuse in Medicaid and other federal healthcare programs will likely continue to drive HHS initiatives as agency leaders advance the Trump Administration's policy priorities.

Activity at the State Level

States are actively pursuing legislation and regulations to overhaul coverage and payment for Medicaid services, either in response to CMS enforcement and compliance actions or as they reassess their financial solvency in response to Medicaid reimbursement changes passed as part of the One Big Beautiful Bill Act (H.R. 1). For example, in 2026, a number of states – including Georgia, Indiana, Michigan, Nebraska, New York, North Carolina and Vermont – modified their rate structures and reimbursement models. New York Medicaid also instituted a six-month moratorium for new ABA enrollments and changes of ownership. Finally, earlier this summer, Illinois updated its ABA licensure laws to require ABA practices be owned by licensed providers and established penalties for non-licensee control over such practices, effective in January 2027.

Expect state Medicaid and commercial payers to be actively involved in scrutinizing practice ownership structures. Holland & Knight has advised several clients in restructuring their organizations based on these laws and anticipates other states may consider imposing similar requirements in the coming years.

Moving Forward

Although the toolkit does not establish a new framework or impose new federal requirements for ABA services, it clearly signals CMS' oversight priorities. In the short term, state agencies and legislatures will likely consider additional program integrity requirements to monitor for and identify potential improper billing practices. States may also consider new requirements for structuring organizations and imposing penalties for corporate control. Providers should prepare for increased scrutiny, including new documentation requirements, pre-payment audits and additional administrative burdens.

For any questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.