New York's ABA Audit Protocol Reaches Back to 2021. It Starts With the Referral.

New York's Office of the Medicaid Inspector General posted its ABA audit protocol on June 29, 2026. It covers service dates from August 1, 2021 through June 25, 2026, nearly five years. OMIG's 2026 work plan says it “anticipates beginning audits in late 2026.” The protocol tells you what will be checked. It doesn't tell you when you'll be picked.

We covered New York's supervision rule on September 8, and the protocol's supervision criteria restate those requirements: five percent of hours a month, two face-to-face contacts, and no more than six supervisees at once. What's new is everything around it.

The turn: the referral decides whether the claims exist

Three of the 18 criteria turn on documents that sit outside the session note, and each one disallows the claim.

• A referral must exist. From a New York-licensed physician, psychologist, psychiatric NP, pediatric NP or physician assistant. “If no referral is found covering the services, the claim will be disallowed.”
• It must be sufficient. Insufficient referrals include ones “written more than two years prior” or missing the patient's age, the ASD or Rett diagnosis, the date of initial diagnosis, a severity level (if written by an ASD-diagnosing provider), a statement that the patient needs ABA, or “the DSM-5 Diagnostic Checklist for ASD diagnoses.”
• The referrer must hear back. The LBA “must provide a report at least annually to the referring practitioner.” No status report covering the services, no claim. The cited rule, 8 NYCRR 29.20(b), applies to services from June 30, 2023.

A referral with one gap doesn't cost one claim. It touches every claim it's supposed to cover.

The rest of the list

• Treatment plans developed by an LBA and updated every six months or after a significant change.
• Non-reimbursable: services in a school setting, a CBAA billing Medicaid directly, family or group guidance not authorized in the treatment plan, and group sessions over 8 individuals.
• More units billed than documented: the difference is disallowed.
• Rendering provider on the claim conflicting with the record, referrers not enrolled in Medicaid, excluded individuals, other insurance not billed first.
• Claims billed to Medicaid for managed care enrollees instead of to the plan.

The limits

The protocol is guidance, not rulemaking, and OMIG says it can still enforce requirements the protocol leaves out. “Late 2026” is a forecast, not a date. The protocol's older references are to the fee-for-service ABA manual, and it doesn't say how managed care encounters will be treated.

What you must know or do

• Pull the referral behind every active client and test it against the eight insufficiency items. Start with the two-year age and the DSM-5 Diagnostic Checklist, the two most likely to be missing.
• For each referral, find a status report sent to the referrer in every year since June 30, 2023. If one's missing, the claims in that year are the exposure.
• Line up treatment plan dates for each client. Any gap longer than six months marks the claims at risk.
• Search claims for a school place of service and for a CBAA as billing provider. Both are listed as non-reimbursable outright.