CMS's EPSDT Guide Rules Out Hourly Maximums and SD-Based Limits for Under-21s

CMS's revised EPSDT coverage guide for states, dated May 2026, says on page 20: “Flat, fixed, hard, or arbitrary limits (e.g., budget or monetary caps, standard deviations from the norm, or hourly maximums) are not consistent with the EPSDT requirements and therefore may not be applied” to Section 1905(a) services for EPSDT-eligible children. The June 2014 edition named only limits “based on a monetary cap or budgetary constraints.” Standard deviations, hourly maximums and the word “arbitrary” are new.

That's live in Virginia right now. DMAS's draft Mental Health Services Manual, Appendix D, says ABA services “may not exceed 20 hours per week, except as authorized under EPSDT review.” Public comment closes at 11:59 p.m. on October 21, with a planned effective date of October 22.

The turn: soft limits are allowed, so the fight is over the exception

The guide doesn't ban limits. A state “may adopt a definition of medical necessity that places ‘soft’ limits on services, pending an individualized determination,” but “additional services beyond these limits must be provided if determined to be medically necessary.” Most of the 2026 hour limits we've covered are built that way on paper: Virginia's 20 hours with EPSDT review, Nebraska's 20 hours with a prior-auth exception, and Georgia's enhanced review above 30. What the guide gives you is the test for whether the exception is real: an individualized decision for that child, or a formality.

What else the guide says

• Medical necessity for an under-21 “must be made on a case-by-case basis, taking into account the child's particular needs,” under the “correct or ameliorate” standard and including the child's long-term needs. That binds “the state―or the MCP as contracted by the state.”
• On software: “If the state or its contractors rely on software to streamline coverage decisions, the state should ensure that any software used in this process is consistent with EPSDT requirements.”
• Prior authorization “must be conducted on a case-by-case basis” and “may not delay delivery of needed treatment services.”
• A state “may not deny medically necessary treatment to a child based on cost alone,” though it may choose an equally effective, cheaper alternative.

The limits

The guide doesn't name ABA. It lists CMS's July 7, 2014 bulletin on Medicaid coverage of services to children with autism among its resources. It's guidance, not a new regulation. It reaches Medicaid only, so Aetna's commercial guide, which sets hours by standard deviations, isn't covered by it. And “should ensure” on software is softer language than “may not” on limits.

What you must know or do

• Virginia owners: if you comment by October 21, quote page 20 and ask DMAS to state in Appendix D what standard its EPSDT review applies to requests above 20 hours, and that MCOs must apply the same one.
• BCBAs writing Medicaid appeals for under-21s: when a denial or partial approval cites an hour ceiling, a standard-deviation band or a typical range, quote page 20 and ask the plan to produce the individualized necessity decision for that child.
• Billing leads: sort the last six months of Medicaid authorizations for under-21s by hours requested against hours approved. Approvals that land exactly on a 20- or 30-hour line are the ones to look at first.
• Owners: on your next Medicaid denial, ask the plan whether software or an automated tool was used to reach it. The guide makes the state answerable for whether that tool follows EPSDT.