CMS Named ABA a Top Medicaid Fraud Risk and Posted What Every State Paid

A CMS heat map lists CY2025 Medicaid ABA payments, provider counts and medians for every state. CMS says the variation doesn't by itself indicate fraud. Comparing against your own state is the use.

CMS's fraud page now has a “Medicaid High-Risk Services Spotlight” covering “the biggest risks to the Medicaid program.” ABA is listed first, with adult day care and personal care services. It links to a heat map, published in August 2026, giving each state's calendar 2025 Medicaid ABA provider count, total paid, median paid per provider and median paid per beneficiary. The figures come from T-MSIS and cover fee-for-service and managed care, using what plans paid providers.

The turn: it's built for comparison, but not between states

CMS itself warns against the obvious reading: “This geographic variation shown in this map does not, by itself, indicate fraud, waste, abuse, or improper billing.” It also says ABA codes “were identified based upon review of each state's publicly available data” and “how each state defines this service may differ.” Differences between states partly reflect coding. The comparison an analyst can actually make is a provider against its own state's median, and the table now makes that easy for anyone.

The client-state rows

  • California: 23,235 providers, $1.99 billion, median $12,920 per provider, $791 per beneficiary
  • Pennsylvania: 267 providers, $587.5 million, median $956,650 per provider (the highest nationally), $10,952 per beneficiary
  • Virginia: 1,979 providers, $332.2 million, $55,850, $19,313
  • Texas: 1,391 providers, $193.2 million, $51,223, $15,043
  • Tennessee: 1,016 providers, $189.1 million, $139,489, $12,366
  • Missouri: 730 providers, $130.9 million, $81,669, $10,509
  • Oklahoma: 3,117 providers, $115.8 million, $20,114, $24,727
  • Washington: 1,529 providers, $54.3 million, $7,101, $9,871

Nationally, Florida paid the most at about $2.64 billion, with the highest median per beneficiary at $48,296. Idaho paid the least at $363,183, and West Virginia had the lowest per-beneficiary median at $151. By our addition, the 50 states total about $12.04 billion. DC isn't in the table.

The limits

Don't use the Illinois row. It shows 44 providers and $2.28 million, which doesn't square with Illinois's managed care ABA market and looks like a coding gap. Texas's $193.2 million differs from the $153.5 million in HHSC's own utilization report, so scope or period differ. The PDF's internal title is “Draft Fact Sheets,” and CMS may revise it. The figures are medians, and CMS doesn't list the codes it counted per state.

What you must know or do

  • Owners: work out your CY2025 Medicaid paid per client and take the median across your caseload. Put it next to your state's median per beneficiary above.
  • If you're well above it, write down why: authorized hours, age mix, setting, acuity. Have that explanation on file before a plan or auditor asks.
  • Billing leads in Pennsylvania: the per-provider median is high because agencies, not individuals, are enrolled. Compare yourself per beneficiary.