Working Paper No. 05

National concentration in Medicaid applied behavior analysis billing, 2018 to 2023

Medicaid ABA spending grew from $448 million to $2.03 billion nationally between 2019 and 2023, a 4.5-fold increase. One billing code held 72 to 77 percent of that spending every year. The growth came from new entrants, not consolidation.

1. The billing pattern behind the audits

HHS OIG announced a seven-state review of Medicaid ABA programs in January 2022. Four reports have been released as of this writing, all examining fee-for-service claims only.

Maine's audit covers Rehabilitative and Community Support services, a broader category billed under H2021, not the 97151-97158 code family used elsewhere in this paper. Its figures are not directly comparable to the other three states.

Across the four audits, OIG's consistent finding was a documentation failure at the level of nearly every sampled enrollee-month: missing or insufficient records to support billed services, not a finding that the underlying service did not occur or was clinically unnecessary. Wisconsin had conducted no statewide postpayment review of its ABA program since it began in 2016. Three more states remain under review and have not been named publicly.

A scope distinction specific to Indiana

Indiana's fee-for-service ABA payments, the figure OIG's audit covers, grew from about $14.4 million in 2017 to $210.7 million by 2023. Total Medicaid ABA spending in Indiana, fee-for-service and managed care combined, grew from $21 million in 2016 to $611 million in 2023, reported by the Wall Street Journal as the fastest growth rate of any state ABA program in the country.

Indiana is the exception among audited states, not the pattern. Colorado's and Wisconsin's own reports describe ABA in those states as fee-for-service-administered, with no separate managed care channel, which argues against extending Indiana's FFS-versus-total gap to them. Because this paper's national figures include managed care claims, the most defensible state-level comparison is between the national total and Indiana's total figure specifically, not a claimed pattern across all three states.

Indiana's own OIG report notes that managed care organizations, not the State agency, reviewed managed care ABA claims, and that at least one MCO described those claims as difficult to review given documentation issues, the same category of problem found on the audited fee-for-service side. One case from the audit makes this concrete: a 19-year-old still receiving ABA under Indiana's former under-21 coverage cutoff. Indiana's 2026 reform now cuts ABA off entirely at 21, shifting adults to a separate, more restrictive waiver-based system. The billing code, the audit, and the spending trend all stop at the same age this paper's second half is about.

2. National ABA spending, 2018 to 2023

This analysis uses the Medicaid Provider Spending by HCPCS Code file, published by HHS on opendata.hhs.gov in February 2026, built from T-MSIS, the same system that feeds OIG's state audits. The file was filtered to CPT codes 97151 through 97158 and their Category III predecessors, 0359T through 0374T, used through 2018 before being replaced, so pre- and post-2019 figures are comparable.

Because this national figure includes managed care claims, the most defensible state-level comparison available is Indiana's total ABA spending of $611 million in 2023, since Indiana is the one audited state where a managed care channel outside the audited scope is independently documented. Set against that total, Indiana's growth remains steeper than the national rate, but the gap is smaller than a comparison to the $210.7 million fee-for-service figure alone would suggest.

Known limitations

State-level reporting for November and December 2024 is visibly incomplete, per publicly reported analysis of this release, so this paper excludes 2024 entirely. A small number of rows contained implausible payment values in the billions or trillions for a single provider-code-month; rows above $5 million for a single combination were excluded as data errors. This paper's data cannot see beneficiary state directly, so all findings are presented at the national level only.

3. A single billing code has dominated spending every year

Code 97153 covers adaptive behavior treatment by protocol, administered individually, typically delivered by registered behavior technicians, the least credentialed tier of ABA staff, under the supervision of a board-certified analyst who does not need to be present for the session.

4. The growth came from new entrants, and concentration did not meaningfully rise

The number of distinct billing providers submitting ABA claims grew from 322 in 2018 to 1,933 in 2023, roughly sixfold.

A market being consolidated by a small number of expanding operators would show the top-provider share rising over time. It did not. The more consistent read is that the program grew primarily through new billing entities entering at a similar scale to existing ones. This finding cuts against a simple private-equity-rollup narrative, though it does not rule one out: a rollup strategy built on acquiring many small, separately billing entities rather than consolidating billing under fewer NPIs would look identical in this data.

Median caseload per provider held flat while payment per patient rose about 35 percent, so the growth shows up as billing intensity per patient rather than a larger caseload per provider.

5. What happens on the other side of the same system

Everything above describes a system under increasing scrutiny: four state audits, a seven-state federal review, spending growth precise enough to chart month by month. Whatever else is true of ABA, it is visible. No equivalent visibility exists for the same population once they age out of pediatric services.

The CDC's ADDM Network surveys autism at age 8 and has no adult counterpart. CMS's own Office of Minority Health published a single snapshot from its Chronic Conditions Data Warehouse in 2018: 0.3% of all Medicare fee-for-service beneficiaries and 1.6% of those under 65 had an ASD claim, with a twelvefold difference between dual Medicaid/Medicare beneficiaries (2.5%) and Medicare-only beneficiaries (0.2%). That figure has not been updated in the public domain since. The Mapping Medicare Disparities Tool, built on the same underlying system, does not carry Autism Spectrum Disorder as a selectable condition at all.

Two smaller instances of the same effect show the coarsening is a choice, not a limitation of the underlying data. CMS's own interactive Medicare disparities atlas presents eighteen chronic conditions at state and county level but excludes ASD from its public county map because more than a third of counties fall below its cell-size threshold. California's Department of Rehabilitation reports vocational rehabilitation consumers using a nine-category taxonomy that omits autism, despite the federal RSA-911 form the state reports from recording autism as a distinct, separately codeable cause of impairment. The identifier exists in the record California is required to submit. It does not appear in the table California chooses to publish.

The asymmetry is not that no one is paying attention to autism. Billions of dollars and a seven-state federal audit say otherwise. The asymmetry is that all of that attention, spending, and oversight infrastructure stops functioning the moment the person it was built around turns into an adult.

6. What this does and does not support

7. Why the pattern looks the way it does

Supervision requirements create an economic floor under code 97153. The code is designed to be delivered by the lowest-cost staff tier under supervision rather than presence. BCBAs are scarce and expensive; a model built entirely around their direct time would not scale to the caseloads described above. A stable 72-77% share is close to what staffing economics alone would predict.

Low barriers to entry, combined with high demand, explain entrant growth better than rising concentration would. Opening a new ABA practice is comparatively easy relative to a hospital-based service line, and widely reported Medicaid waitlists for autism services create sustained demand for new entrants regardless of whether existing providers are expanding.

Documentation requirements appear not to have scaled with the program. Wisconsin performed no statewide postpayment review since 2016, a five-year gap during which spending more than doubled. A near-universal audit-detectable error rate once review finally occurs is a predictable consequence of that mismatch, not necessarily evidence that billing behavior worsened over time.

None of these explanations excuses inadequate documentation where OIG found it. They are offered because a structural explanation is falsifiable and improvable in a way an unstated assumption of fraud is not.

8. What is missing, stated concretely

The federal government can produce a monthly, national, code-level accounting of ABA spending and audit it state by state. It cannot produce an equivalent accounting of what happens once the same children become adults, because the infrastructure was never built, and where a piece of it exists, it is not accessible without a research process closed to the public.

Two concrete steps would close part of that gap without new legislation. First, CMS could add Autism Spectrum Disorder to the public Mapping Medicare Disparities Tool, which already exposes some thirty other conditions from the identical claims system. Second, states reporting RSA-911 data, which already records autism as a distinct federally mandated code, could publish that field at the same granularity they already publish disability category and county.

Neither step requires funding a new adult surveillance system from nothing. Both require an agency deciding to publish a number it already has.

A third, narrower step sits inside the audit series already underway: extending the same sampling methodology OIG applied to Indiana's fee-for-service claims to the managed care claims Indiana's own report describes as reviewed separately, with at least one organization flagging the same documentation difficulty. The audit infrastructure already exists. It has not yet been pointed at that channel.

9. Reproduction

Data source, extraction code, and the row-exclusion rules described above:

zatara-research-data/05-one-code-every-year

Cite this paper: