Federal auditors checked four states for autism therapy billing. In all four, nearly every claim they sampled had something wrong. The national data shows the same pattern in every state they have not checked yet.

Medicaid spending on applied behavior analysis (ABA), the primary funded treatment for autistic children, grew from $448 million to$2.03 billion nationally between 2019 and 2023, a 4.5-fold increase in four years. This paper uses a February 2026 HHS release of national Medicaid claims data, filtered to ABA billing codes, to build that figure independently of any single state’s reporting.

Four states have so far been audited by the HHS Office of Inspector General under an active review of state ABA programs: Indiana, Wisconsin, Maine, and Colorado. Each audit found that nearly every enrollee-month sampled contained at least one improperly or potentially improperly documented payment, totaling roughly $198 million in confirmed improper payments and approximately$400 million more flagged as potentially improper across the four states combined. Indiana alone accounts for $133 million in combined improper and potentially improper questioned costs. Three more states are under review and have not yet been named publicly.

This paper adds three findings the state audits did not, and could not, produce on their own, because they each examined one state at a time.

First, the growth is national, not a handful of outlier states. The audited states’ spending curves (Indiana up 1,363 percent since 2017, Colorado up 283 percent since 2019) are not aberrations. The national total grew 4.5 times over the same general period.

Second, a single billing code dominates the program everywhere, every year. Indiana’s own working group found that code 97153, individually administered therapy delivered by the least-credentialed staff tier, accounted for over 80 percent of that state’s ABA spending. National data shows the same code held between 72 and 77 percent of all ABA spending in every year from 2019 through 2023. This is not an Indiana problem. It is how the benefit is billed everywhere, and it has not changed as the program grew sixfold.

Third, the growth came from new billing entities entering the market, not from existing providers expanding at a faster rate, and market concentration did not meaningfully increase. The number of billing providers grew roughly sixfold over the same period, while the share of spending held by the largest providers stayed within a narrow band throughout. This complicates a simple story of a small number of firms consolidating the market. It does not rule out that some of the growth is duplicative or that the least credentialed billing code drove the expansion. What the aggregate data does not show is the more common assumption: a story of large operators scaling up.

What this paper does not do is verify that any specific claim in the national data was fraudulent, medically unnecessary, or improperly billed. That is the sampling-audit work OIG performs one state at a time, and this paper’s data cannot substitute for it. What it does is show that the pattern OIG found in four states, when it looked, is present everywhere, before anyone looks.

The paper closes by placing this spending against a comparison that has no equivalent public reporting: what happens to funding, and to the person, once that same child ages into an adult system that was never built with anything like this level of documentation or growth.

The billing pattern behind the audits

What OIG has found, state by state

HHS OIG announced a seven-state review of Medicaid ABA programs in January 2022. Four reports have been released as of this writing. All four examined fee-for-service claims only; none examined managed care claims, a scope limitation addressed below.

All four refund figures above are confirmed directly against each state’s OIG report.

Maine’s audit is not an ABA-specific audit. Its subject is Rehabilitative and Community Support services, a broader MaineCare category that includes ABA and other autism treatments delivered in home, school, and community settings, billed primarily under HCPCS code H2021 rather than the 97151-97158 code family used elsewhere in this paper. It is included here because OIG groups it with the ABA audit series and because the same documentation failures were found, but its dollar figures are not directly comparable to the ABA-specific figures for the other three states.

Across the four audits, OIG’s consistent finding was a documentation failure at the level of nearly every sampled enrollee-month: missing or insufficient records to support billed services, not a finding that the underlying service did not occur or was clinically unnecessary. Wisconsin had conducted no statewide postpayment review of its ABA program since it began in 2016.

Three states remain under review. OIG does not name a state publicly until its report is released, so which three are next is not public information as of this draft.

The spending trajectories that triggered the audits, and a scope distinction specific to Indiana

Each audited state’s own spending growth was part of what drew OIG’s attention.

• Indiana: fee-for-service ABA payments, the figure OIG’s own audit covers, grew from approximately $14.4 million in 2017 to$210.7 million by 2023, an increase of roughly 1,363 percent, confirmed directly in the OIG report’s own footnotes. Total Medicaid ABA spending, fee-for-service and managed care combined, grew from $21 million in 2016 to$611 million in 2023, reported by the Wall Street Journal as the fastest growth rate of any state ABA program in the country. CPT code 97153 accounted for 86 percent of the ABA payments covered by OIG’s audit period specifically, consistent with the Indiana ABA Working Group’s separate finding that the code held over 80 percent of spending in every year from 2019 to 2024.
• Colorado: fee-for-service ABA payments, per OIG’s own report, grew from $60.1 million in 2019 to$163.5 million in 2023, with a further figure of $230.3 million reported for 2024. Colorado’s own report describes this later figure as a continuation of the same fee-for-service series, not a broader total, and its background section states that pediatric behavioral therapies, including ABA, are primarily administered through the fee-for-service delivery system in Colorado.
• Wisconsin: fee-for-service ABA payments, per OIG’s own report, grew from $39.9 million in 2018 to$53.7 million in 2022, with a further figure of $82.3 million reported for 2023. As with Colorado, Wisconsin’s own report describes this as a continuation of the fee-for-service series, and its background section states that behavioral treatment benefits, including ABA, are administered through fee-for-service.
• Maine: RCS payments grew from $52.2 million in 2019 to$80.6 million in 2023 per OIG’s own report; a separately reported figure of $103.8 million by 2024 was not independently verified against the source report for this paper.

Indiana is the exception among these states, not the pattern. Only Indiana’s audited program is described elsewhere as running substantially through managed care, and only Indiana’s own OIG report acknowledges a parallel managed care channel outside the audit’s scope. Colorado’s and Wisconsin’s own reports describe ABA in those states as fee-for-service-administered, which argues against extending Indiana’s FFS-versus-total gap to them. Because this paper’s national HHS-based figures include managed care claims, the most defensible comparison is between this paper’s national totals and Indiana’s total figure specifically, not a claimed pattern across all three states.

Indiana’s audit found a managed care channel outside its own scope

Every completed OIG audit in this series examined fee-for-service claims exclusively. In Indiana specifically, OIG’s own report notes that managed care organizations, not the State agency, reviewed managed care ABA claims, and that at least one MCO told the State agency that ABA claims are difficult to review given documentation issues, the same category of problem the audit found on the fee-for-service side. Indiana’s own audit therefore acknowledges a parallel channel of ABA spending, reviewed separately by MCOs rather than by OIG or the state’s own postpayment process, where the same kind of documentation problem may exist unverified. Colorado and Wisconsin’s own reports do not describe an equivalent unaudited channel; both describe ABA in their states as primarily delivered through fee-for-service, which is the channel each audit actually covered.

One case from Indiana’s own audit makes the pediatric-to-adult boundary concrete rather than abstract. The audit documents a 19-year-old still receiving ABA under the state’s former under-21 coverage cutoff. Indiana’s 2026 reform now cuts ABA off entirely at 21, shifting adults to a separate, more restrictive waiver-based system. The billing code, the audit, and the spending trend all stop at the same age this paper’s second half is about.

Data

This analysis uses the Medicaid Provider Spending by HCPCS Code file, published by HHS on opendata.hhs.gov in February 2026. The file is built from T-MSIS, the same underlying system that feeds OIG’s state audits, and reports total paid amount, total claim lines, and total unique patients for every combination of billing provider, servicing provider, HCPCS code, and month, covering January 2018 through December 2024, and including fee-for-service, managed care, and CHIP claims.

The file was filtered to the ABA-specific billing code families: CPT codes 97151 through 97158, the codes in current use since January 1, 2019, and their Category III predecessors, codes 0359T through 0374T, which were used through 2018 before being replaced. Using only the current codes would understate 2018 spending to near zero and produce a false jump at the 2019 boundary; both code sets are included here so the pre- and post-2019 figures are comparable.

Known limitations

November and December 2024 are excluded. Per publicly reported analysis of this same HHS release, state-level reporting for those two months is visibly incomplete, with national spending across all Medicaid services dropping sharply in a pattern consistent with delayed state submission rather than an actual spending decline. This paper excludes 2024 entirely and reports 2018 through 2023.

Implausible individual rows were excluded. A small number of rows in the raw file contained payment values in the billions or trillions of dollars for a single provider, code, and month. Rows above $5 million for a single combination were excluded as data errors rather than real spending, consistent with data quality concerns already raised publicly about this release.

State cannot be seen directly. This paper’s data cannot see beneficiary state or region; state would have to be inferred from a billing provider’s registered address, which is unreliable for multi-state organizations and centralized billing structures common in ABA. For that reason, this analysis is presented at the national level only, not by state.

National ABA spending, 2018 to 2023

National spending on these codes grew 4.5 times between 2019 and 2023. Because this figure includes managed care claims, the most defensible state-level comparison available is Indiana’s total ABA spending of $611 million in 2023 (fee-for-service and managed care combined), since Indiana is the one audited state where a managed care channel outside the audited scope is independently documented, both by outside reporting and by OIG's own report. Set against that total, Indiana's growth remains steeper than the national rate, but the gap between them is smaller than a comparison to the$210.7 million fee-for-service figure alone would suggest. Colorado and Wisconsin, whose own reports describe their ABA programs as fee-for-service-administered, are not treated as comparable on this specific dimension.

A single billing code has dominated spending every year

Code 97153 covers adaptive behavior treatment by protocol, administered individually, typically delivered by registered behavior technicians, the least credentialed tier of ABA staff, under the supervision of a board-certified analyst who does not need to be present for the session. Indiana’s ABA Working Group found this same code accounted for over 80 percent of that state’s spending from 2019 through 2024.

The national figure is somewhat lower than Indiana’s, but the pattern is the same, and it has held within a seven-point range for five consecutive years while total spending grew 4.5-fold. This is the structure of the benefit, nationally, sustained through a period of rapid expansion rather than a temporary distortion from the program’s early years settling out.

The growth came from new entrants, and concentration did not meaningfully rise

The number of distinct billing providers submitting ABA claims grew from 322 in 2018 to 1,933 in 2023, roughly sixfold.

Despite the sixfold growth in the number of billing entities, the share of national spending held by the largest 1 percent and 10 percent of providers stayed within a narrow band across all six years. A market being consolidated by a small number of expanding operators would show that share rising over time. It did not. The more consistent read is that the program grew primarily through new billing entities entering at a similar scale to existing ones, not through a small number of incumbents scaling disproportionately.

This finding cuts against a simple private-equity-rollup narrative, though it does not rule one out; a rollup strategy built on acquiring many small, separately billing entities rather than consolidating billing under fewer NPIs would look identical in this data. What can be said is that spend concentration itself did not increase.

A secondary finding: median monthly caseload per billing provider stayed close to 18 to 20 patients across the entire period, while payment per patient per month rose from roughly $3,134 in 2018 to$4,220 in 2023, an increase of about 35 percent. Median caseload per provider held flat while payment per patient rose, so the growth shows up as billing intensity per patient rather than a larger caseload per provider.

A note on the underlying data’s reliability

This paper’s own extraction encountered the same data quality concerns raised in early public analysis of this HHS release, most notably rows with payment values orders of magnitude too large to be real, which were excluded as described above. The scale of that exclusion, and the broader caveats already published about this release (uneven managed care capture across states, incomplete recent months, and suppression of low-volume combinations) mean the figures above should be read as a reasonably reliable national trend, not as an audited or reconciled total. They are, however, independently constructed from CMS’s own source system, not drawn from a press release characterizing it.

What happens on the other side of the same system

Everything above describes a system under increasing scrutiny: four state audits, a seven-state federal review, spending growth precise enough to chart month by month, and a billing pattern consistent enough to compare across states and years. Whatever else is true of ABA, it is visible. It is measured, argued over, and now audited.

No equivalent visibility exists for the same population once they age out of pediatric services.

The clearest federal measurement of autism, the CDC’s ADDM Network, surveys children at age 8 and has no adult counterpart. CMS does track an adult Autism Spectrum Disorder indicator inside its Chronic Conditions Data Warehouse, and its own Office of Minority Health published a single snapshot from it in 2018, showing 0.3 percent of all Medicare fee-for-service beneficiaries and 1.6 percent of those under 65 with an ASD claim, with a twelvefold difference in prevalence between dual Medicaid/Medicare beneficiaries (2.5 percent) and Medicare-only beneficiaries (0.2 percent). That figure has not been updated in the public domain since. The public-facing tool built on the same underlying system, the Mapping Medicare Disparities Tool, does not carry Autism Spectrum Disorder as a selectable condition at all. Reproducing or updating the 2018 number requires a formal CMS research data request, a fee, and a wait measured in weeks to months, a process built for an academic study, not for public accountability.

The population this can see is itself narrow. Medicare and Medicaid eligibility runs through disability status or income. An autistic adult who is employed and insured through an employer does not appear in this data at all. The one federal research effort built specifically to study autism across adulthood, Drexel University’s National Autism Indicators Report series, states its own limitation directly: its own words describe adulthood as the life stage least understood in autism research, policy, and practice, and its own adult-focused work is explicit that its subject is adults with more severe support needs who depend on public services. Even the most dedicated research program addressing this population cannot see an employed, privately insured, later-diagnosed adult. A 2025 analysis of a commercial insurer’s own claims, covering 2.39 million members, found autism diagnosed in just 0.1 percent of insured adults against 1.1 percent of insured children in the same population, a number that exists only because a private payer chose to publish it, not because any public system tracks it.

Two smaller instances of the same effect, found in the course of this research, are worth stating plainly because they show the coarsening is a choice, not a limitation of the underlying data. CMS’s own interactive Medicare disparities atlas presents chronic condition prevalence at state and county level for eighteen conditions, but excludes Autism Spectrum Disorder from its public county map because more than a third of counties fall below its cell-size threshold, a data-collected-not-published decision. California’s Department of Rehabilitation reports vocational rehabilitation consumers by disability type and county using a nine-category taxonomy that does not include autism as a value, despite the fact that the federal RSA-911 form the state reports from records autism as a distinct, separately codeable cause of impairment. The identifier exists in the record California is required to submit. It does not appear in the table California chooses to publish.

Put next to the rest of this paper, the asymmetry is not that no one is paying attention to autism. Billions of dollars and a seven-state federal audit say otherwise. The asymmetry is that all of that attention, spending, and oversight infrastructure stops functioning the moment the person it was built around turns into an adult.

What this does and does not support

Supported.

• A national estimate of Medicaid ABA spending by year, 2018 through 2023, independently constructed from CMS’s own claims-level source data.
• A national measurement of billing concentration by procedure code, showing code 97153’s dominant and stable share of spending across five years.
• A national measurement of provider count growth and market concentration, showing that the number of billing entities grew roughly sixfold while concentration of spending among the largest providers did not meaningfully rise.

Not supported.

• Any claim that a specific claim, provider, or state engaged in fraud. The four completed OIG audits found documentation deficiencies, meaning records insufficient to verify billed services, not confirmed fraud, and explicitly did not assess whether any child clinically needed the service billed. This paper’s data is claims volume and cannot make that distinction at all.
• Any claim about clinical outcomes, whether ABA as delivered helps or harms the children receiving it. This paper takes no position on that question and the data cannot speak to it.
• A state-by-state breakdown. Billing provider address is an unreliable proxy for beneficiary state given multi-state organizations and centralized billing, so this analysis is presented at the national level only.
• A fully reconciled or audited total. This analysis excluded implausible individual payment values and the incomplete final two months of 2024, following the same data quality concerns already raised publicly about this HHS release, but a rough exclusion rule is not equivalent to an audit.
• Any general-population estimate of adult autism prevalence. No dataset used in this paper, or located in the course of researching it, supports one. The adult figures above describe narrow, program-eligible populations only, a limitation stated in the source data itself.

Why the pattern looks the way it does

Three structural features of the ABA billing model plausibly explain the patterns above, without requiring an assumption of widespread fraud.

Supervision requirements create an economic floor under code 97153. Adaptive behavior treatment by protocol is designed to be delivered by a registered behavior technician, the lowest-cost, least-credentialed staff tier, under a board-certified behavior analyst’s supervision rather than presence. That structure is what makes ABA deliverable at any real scale: BCBAs are comparatively scarce and expensive, and a service model built entirely around their direct time would not scale to the caseloads described above. A stable 72 to 77 percent share for the RBT-delivered code is close to what that staffing economics would predict on its own, independent of any billing behavior.

Low barriers to entry as a billing provider, combined with high demand, explain rapid entrant growth better than rising concentration would. New billing entities entered at a pace that outstripped incumbent growth, not a small number of firms consolidating share. That is consistent with a market where opening a new ABA practice or franchise location is comparatively easy relative to opening, for example, a hospital-based service line, and where documented, growing state Medicaid waitlists for autism services (a pattern this paper did not independently verify but which is widely reported alongside the audits above) create sustained demand for new entrants regardless of whether existing providers are expanding.

Documentation requirements appear not to have scaled with the program. Wisconsin’s own audit noted it had performed no statewide postpayment review since the program began in 2016, a five-year gap during which its spending more than doubled. If oversight capacity is fixed or grows slowly while claims volume grows exponentially, the audit-detectable error rate found once review finally occurs, which was measured near universal across sampled enrollee-months in all four states, is a predictable consequence of that mismatch rather than evidence that the underlying billing behavior changed for the worse over time.

None of these explanations excuses inadequate documentation where OIG found it. They are offered because a structural explanation is falsifiable and improvable in a way that an unstated assumption of fraud is not, and because the aggregate data in this paper is consistent with all three without requiring the more dramatic reading.

What is missing, stated concretely

The federal government can currently produce a monthly, national, code-level accounting of what it spends on ABA, publish it, and audit it state by state when the numbers warrant a closer look. It cannot currently produce an equivalent accounting of what happens to the same children once they become adults, because the data infrastructure to do so was never built, and where a piece of it exists, as with CMS’s restricted Chronic Conditions Data Warehouse, it is not accessible without a research process closed to the public.

Two concrete steps would close a meaningful part of that gap without requiring new legislation or new data collection.

First, CMS could add Autism Spectrum Disorder to the public Mapping Medicare Disparities Tool, the same tool that already exposes some thirty other chronic conditions from the identical underlying claims system. The data already exists inside CCW; the barrier is a publication decision, not a collection gap.

Second, states reporting RSA-911 vocational rehabilitation data, which already records autism as a distinct, federally mandated cause-of-impairment code, could publish that field at the same granularity they already publish disability category and county, rather than collapsing autism into a broader cognitive or developmental impairment bucket at the point of release. California’s own data shows this collapse happening today, on a field the state is otherwise fully capable of reporting, since it is required to submit that same field to RSA-911 already.

Neither step requires funding a new adult surveillance system from nothing. Both require an agency deciding to publish a number it already has.

A third, narrower step sits inside the audit series already underway: extending the same sampling methodology OIG has applied to Indiana’s fee-for-service claims to the managed care claims that Indiana’s own audit report describes as reviewed separately by managed care organizations, with at least one organization flagging the same documentation difficulty found on the fee-for-service side. The audit infrastructure and methodology already exist. They have not yet been pointed at that channel, in Indiana or, where a similar managed care channel exists, in any other state.

Reproduction

Data, code, and retrieval log:

zatara-research-data/05-one-code-every-year

Data: Medicaid Provider Spending by HCPCS Code, U.S. Department of Health and Human Services, retrieved July 29, 2026. Filtered to CPT codes 97151-97158 and predecessor codes 0359T-0374T, 2018 through 2023. Code and data snapshots: zatara-research-data/05-one-code-every-year.

@techreport{zatara2026paper5,
  title       = {National concentration in Medicaid applied behavior analysis billing, 2018 to 2023},
  author      = {Zatara, David},
  year        = {2026},
  institution = {Independent Researcher},
  type        = {Working Paper},
  number      = {5}
}