top of page
Search

Why Small ABA Practices Struggle With Compliance

Writer: Courtney Padelsky, MS, BCaBA
Courtney Padelsky, MS, BCaBA
Oct 26
15 min read

Disclaimer:

This article is educational in nature and reflects general guidance based on published regulations, federal audit reports, and government guidance. It is not legal, employment, clinical, or billing advice, and it does not create a consultant-client relationship. Compliance requirements vary by state, payer, licensing body, service setting, and organizational structure. Please consult qualified counsel and your own regulators and funders before making policy, employment, or billing decisions.

Small ABA practices rarely lack good intentions about compliance. What they more often lack is a person whose job it is, time protected to do it, and a routine for checking their own work before someone else does.


Picture a twelve-table neighborhood restaurant. The owner is also the head chef. She orders the produce, trains the line cooks, covers the dinner rush when someone calls out, and runs payroll on Sunday nights after close. The food is excellent, and the regulars bring their parents.


The walk-in cooler is supposed to have its temperature logged twice a day. The log was filled in faithfully for the first four months after opening. The last entry is from March.


The health inspector arrives on a Thursday. She does not taste the risotto.


That is roughly where compliance sits in many small ABA practices. The clinical work may be genuinely good. The evidence that services were delivered, documented, billed, and protected the way the rules require comes from a separate set of systems, and in a small practice those systems often have no clear owner.


Good care and documented care are produced by different systems.

Eye-level view of a clinician reviewing notes inside a parked car
Compliance often happens between visits, which makes protected time and clear systems essential.

Small Does Not Mean Off the Radar

Over the past two years, the HHS Office of Inspector General (OIG) has released a series of audits examining state Medicaid payments for ABA. Indiana came first in 2024, with at least $56 million in improper fee-for-service payments for 2019 and 2020. Wisconsin followed in 2025 at $18.5 million. Maine’s report, released in January 2026, found at least $45.6 million in improper payments for rehabilitative and community support services that include ABA. Colorado’s report, issued in February 2026, found at least $77.8 million. We looked at the Colorado audit more closely in Preparing for a Medicaid Audit Without Panic.


In Indiana, Wisconsin, and Colorado, OIG reported the same result: every one of the 100 sampled enrollee-months included at least one claim line that was improper or potentially improper.


These were audits of state Medicaid programs, not of individual providers, and the dollar figures are estimates projected from samples. They are still worth reading closely. A statewide sample does not sort claims by the size of the organization that submitted them, so a claim from a practice with nine employees sits in the same pool as a claim from a practice with nine hundred.


The recommendations are where the reports become practical. In Colorado, OIG recommended that the state give ABA providers additional guidance on:

  • documentation, including the services needed to support CPT code 97155,

  • signature requirements,

  • what session notes must contain,

  • what the state considers billable ABA time,

  • and on credentialing requirements.

OIG also recommended periodic statewide post-payment reviews that include medical records. Colorado’s Medicaid agency has told reporters that it has already begun auditing providers after payment and reviewing claims before payment.


For small practices, the practical takeaway is that more people are likely to be reading their records, and reading them more closely.


Compliance is Rarely a Billable Role

In most small ABA practices, revenue comes from billable clinical hours, and every role is measured, formally or informally, against that fact. RBTs, BCaBAs, and BCBAs generate revenue. Intake and scheduling keep the hours filled. HR and compliance work, done well, generate no claims at all.


That makes them easy to defer. When budgets are tight, the role that does not bill is often the last one created and the first one absorbed into someone else’s job. Clinical work has a client waiting. Payroll has a date. Authorizations expire. Compliance work has no natural deadline until an auditor, a payer, or a breach supplies one. In our experience, HR and operational compliance tend to stay on the back burner until a problem forces them forward:

  • a records request,

  • a payer audit,

  • a breach,

  • a wage claim,

  • or a termination that did not go the way anyone expected.


Two assumptions usually fill the gap. The first is that the owner can handle it personally. Many owners are highly capable clinicians, and some have strong business instincts, but compliance is its own discipline, and it competes for the same hours as clinical oversight, payer calls, and payroll. The second is that the office administrator can absorb it. Office administrators are frequently the people holding small practices together, and many are excellent at the work they were hired to do. Scheduling, phones, intake paperwork, and supply orders are different work from interpreting a state Medicaid manual, reviewing worker classification, or completing a HIPAA risk analysis. Assigning that responsibility without training, authority, or protected time tends to move the risk to a new desk while leaving it unmanaged.


OIG’s own guidance acknowledges the resource problem. Its General Compliance Program Guidance, published in November 2023, includes a section on adapting compliance programs for small entities. A practice that cannot support a compliance officer can designate a compliance contact instead and can draw on policy and procedure templates from consultants or professional organizations. The guidance does not lower the expectation, though. Small entities may use less formal processes, but they are still expected to have an effective program.


That is a reasonable standard. It also assumes that someone has the time to meet it.


Compliance work has no natural deadline until someone outside the practice supplies one.

The Rules Come From Many Directions

A small ABA practice billing Medicaid and commercial insurance can easily answer to all of the following at once:

  • the HIPAA Privacy, Security, and Breach Notification Rules;

  • a state Medicaid provider manual and, in many states, waiver requirements;

  • the terms of each payer contract;

  • BACB certification requirements and the Ethics Code for its certificants;

  • state behavior analyst licensure where it exists;

  • facility or agency licensing where it applies;

  • and federal and state employment law for every person on the payroll or under contract.


Each of these has its own vocabulary, its own update cycle, and its own expectations for documentation. They overlap in places and quietly conflict in others. A large provider can assign them to different specialists. A small one tends to assign them to whoever opened the email.


Practices usually know the rules that affect them most often, typically payer authorization rules, very well. They tend to be less certain about the rules that rarely come up, until several of them come up at once.


People Compliance is Compliance Too

When small practices think about compliance, they usually think about billing and HIPAA. Employment law tends to get less attention, even though it touches every person the organization brings on.


Classification is a common starting point for trouble. Small practices often use a mix of W-2 employees, 1099 contractors, and owner-operators, sometimes within the same clinical role, and the reasoning behind each arrangement is not always documented or consistent. As we discussed in Contractor vs. Employee in ABA and Behavioral Health Services: What Agencies Get Wrong, shared systems such as an EHR or billing platform do not determine employment status. Clinical and operational control does.


The rest of the employment lifecycle carries its own risk. Onboarding that skips required forms or never documents credential verification. Job descriptions that no longer match the job. Performance concerns that are discussed in passing but never written down, so the record does not support the decision when a termination finally happens. Terminations handled under pressure, without a consistent process for final pay, system access, and client transition. None of these is unusual, and each one is easier to prevent than to defend.


The Gap Between Policy and Evidence

Ask a small practice for its compliance manual and there is a good chance one exists. It was often purchased or adapted in the first year, when a credentialing packet or an accreditation application required it.


Then ask for evidence that it is being followed: the last quarterly chart audit the manual promises, the training sign-offs for staff hired since spring, the date of the most recent HIPAA security risk analysis.


That second request is where small practices tend to struggle, and HIPAA shows why it matters. The HHS Office for Civil Rights (OCR) has been running a Risk Analysis Initiative, an enforcement effort focused on organizations that cannot show an accurate and thorough assessment of the risks to the electronic health information they hold. Enforcement actions under the initiative reached fourteen by mid-2026, and they have not been limited to large systems. One involved a single-location imaging provider and a $5,000 penalty, and OCR used the announcement to state directly that small providers must also conduct accurate and thorough risk analyses.


A risk analysis is easy to complete once, file, and set aside. The practice’s risk picture changes when it switches EHRs, allows staff to text from personal phones, or adds a scheduling app. A three-year-old analysis may describe a practice that no longer exists.


That gap can matter in a review. A written policy that is not followed may show that the organization knew the standard and did not meet it.


Home- and Community-Based Services Need Adapted Systems

Many compliance templates assume a traditional office or clinic. Staff arrive at one location, records stay in the building, a supervisor is down the hall, and the workday starts and ends in the same place. A large share of ABA does not work that way.


Home- and community-based services move the work into family homes, schools, parks, grocery stores, and cars. Hybrid practices do both, with some staff in a clinic and others in the field, sometimes within the same week. Each setting raises questions that an office-based policy manual was never written to answer.

  • How is protected health information handled on a phone or tablet that travels between homes?

  • When and where are session notes completed, and what happens when the signal drops?

  • How does an RBT report an incident when no supervisor is on site?

  • How is drive time between client homes tracked and paid? Under federal wage and hour rules, travel from one work site to another during the workday is generally counted as hours worked, and state rules may add requirements.

  • How does supervision happen when the supervisee is rarely in the same building as the supervisor?


This is where many small practices find that general HR and compliance resources fall short. Traditional HR and compliance professionals often come from office, hospital, or corporate environments, and their experience may not include adapting regulations to services delivered in someone’s living room. The rules still apply. Applying them well in home-, community-based, and hybrid settings usually requires policies, procedures, and protocols written for how the work actually happens.


We touched on related home- and community-based considerations in Adult ABA Exists. So Why Is It So Hard to Access? and in last month’s article, Assent in ABA: Why Believing In It Isn’t Enough.


Policies written for an office rarely fit services delivered in a family’s kitchen.

Wide-angle view of a quiet home entryway with a clinician bag and closed notebook
Field-based services need practical policies that fit homes, schools, and community settings.

The Expensive Mistakes are Usually Ordinary

Compliance failures in ABA are often imagined as fraud. Many of them look more like paperwork.


In Maine, the most common reason for improper payments was a comprehensive assessment that was missing or lacked a required staff or parent signature. In Colorado, the areas OIG flagged for clearer guidance were documentation supporting a specific CPT code, signatures, session note content, billable time, and credentialing.


Consider how each of those can happen in a small practice. The note template was built three years ago and never included a field for the protocol modification that supports a 97155 claim. A parent signs the assessment at the kitchen table, the scan never makes it into the record, and nobody notices because nobody checks. A BCBA’s credential lapses for eleven days because the only person tracking expiration dates was on leave. An RBT counts part of the drive between home sessions as session time because nobody defined billable time for that payer in writing.


None of those requires bad intent. Each one reflects the absence of a second set of eyes, which is one of the most common features of compliance in a small practice.


Growth Outruns Infrastructure

Many of the practices we work with did not struggle with compliance at eight employees. The founder knew every client, read every note, and reviewed every claim. The system was the founder’s memory, and at that size, memory was often enough.


Somewhere between fifteen and forty staff, that approach usually stops working, and it tends to stop quietly. A second and third BCBA arrive with their own documentation habits. A billing company comes on board. The practice opens a second location, or begins offering in-home services in a new county. Each change adds volume and variation to a process that was never written down because it never needed to be. We wrote about this pattern from the hiring side in Hiring Won’t Fix Your Chaos – It Will Multiply It.


Software developers call the result technical debt: shortcuts that were reasonable at the time and that accrue interest later. Compliance accumulates the same kind of debt, and the interest tends to come due at an inconvenient moment, often during a records request with a short deadline.


The Clock Starts When a Problem is Found

One reason small practices delay internal auditing is a fear that sounds reasonable: if we look, we might find something.


That is possible. Federal law generally requires providers to report and return an identified Medicare or Medicaid overpayment within 60 days. A CMS rule that took effect January 1, 2025, revised when an overpayment is considered identified and allows the 60-day period to be suspended for up to 180 days while a provider conducts a timely, good-faith investigation into whether related overpayments exist. Failing to return an overpayment on time can create exposure under the False Claims Act.


The revised standard ties identification to knowledge as the False Claims Act defines it, which includes deliberate ignorance and reckless disregard. In practical terms, choosing not to look may offer less protection than many owners assume. It also gives up the main advantage of finding errors internally: the opportunity to correct the process, correct the claims, and document both.


How these obligations apply to a particular state Medicaid program or commercial payer varies. This is a conversation to have with qualified counsel before it becomes urgent.


What Right-Sized Compliance Looks Like

OIG’s framework has seven elements:

  1. written policies and procedures;

  2. compliance leadership and oversight;

  3. training and education;

  4. effective lines of communication, including a way to raise concerns;

  5. consequences and incentives;

  6. risk assessment, auditing, and monitoring;

  7. and responding to detected offenses with corrective action.

A large health system builds a department around each one. A small ABA practice can meet their intent with far less, as long as each one actually happens.


For a practice of ten to forty people, that often means one named person who owns compliance and has protected time on the calendar to do it. It means policies short enough that staff have actually read them and specific enough to describe what the practice really does, including in homes and the community. It means training at hire and annually, with sign-offs someone can produce on request, and a way for an RBT to raise a concern without routing it through the person they are concerned about. It means a recurring review of a small sample of notes and claims against payer requirements, a credential tracker that does not depend on one person’s memory, documented classification decisions for everyone on the team, and a written plan for what happens when a review finds something.


That last piece matters more than it may appear. Practices that decided in advance how they would handle an error tend to handle it calmly. Practices that did not tend to handle it slowly, and slow is usually the more expensive version.


Readers of Preparing for a Medicaid Audit Without Panic will recognize the shape of this. The Four Pillars of People, Processes, Documentation, and Continuous Improvement describe the same system from the audit side.


Right-sized compliance is small enough to sustain and specific enough to show.

What Compliance is Not

Compliance is not a binder. A manual on a shelf documents an intention.


It is not the billing company’s responsibility alone. A billing vendor submits claims based on what clinicians documented, and responsibility for whether those claims were supportable generally remains with the provider whose name is on them. A billing services agreement is worth reading with that in mind.


It is not a one-time project. A practice can complete a compliance overhaul in a quarter and drift most of the way back within a year if nobody owns the calendar.


It is not a task that can be added to an office administrator’s duties without training, authority, and time.


It is not fear. A program built on fear tends to produce defensive documentation, copy-forward notes, and staff who stop asking questions. The goal is a practice that can show its work.


An Important Caution

The OIG figures deserve careful handling before anyone repeats them. These audits examined state Medicaid programs, sampled a limited number of enrollee-months, and projected dollar estimates from those samples. Potentially improper is a different category from improper, and states have pushed back on some findings; Colorado disagreed with one of OIG’s five recommendations and partially agreed with another. A finding that every sampled month contained at least one problematic claim line is a signal about documentation and oversight systems across a program. It does not show that most providers in those states did anything intentionally wrong.


Compliance requirements also vary considerably by state, payer, service setting, and organizational structure. What applies to a clinic-based practice in Colorado may not apply to a home-based provider in Texas or a hybrid practice in Wyoming. This article is best read as a map of common gaps. Advice specific to the organization should come before any change in policy.


Where to Start

  1. Name one person who owns compliance, in writing, and put recurring time for it on their calendar. If that person is the owner, the time still needs to be blocked.


  2. Find the date of the most recent HIPAA security risk analysis. If it cannot be found, or it predates the current EHR, start there.


  3. Pull ten session notes from last month and read them against the largest payer’s documentation requirements rather than against the practice’s own template. Write down what is missing.


  4. List every person on the team with their classification (W-2, 1099, or owner-operator) and confirm the reasoning is documented.


  5. Build a credential tracker with expiration dates for every clinician, and set reminders sixty days out.


  6. If services are delivered in homes or the community, read the policy manual from the perspective of an RBT in a family’s kitchen, and note every place it assumes an office.


  7. Read the billing services agreement and find the sentence that says who is responsible for claim accuracy.


  8. Decide what will happen when an error is found: who is told, how scope is determined, and how the error is corrected and documented.


  9. Put a twelve-month calendar of reviews somewhere the whole leadership team can see it.


The Bottom Line

Small ABA practices struggle with compliance for reasons that have little to do with how much their owners care. They carry much of the same regulatory load as larger organizations with a fraction of the staff. The work does not bill, so it is easy to defer. Services delivered in homes and communities need systems that general templates were not written for. And growth changes the practice faster than its systems change.


The fix is usually smaller than owners fear: a named owner, protected time, policies that describe how the work is actually done, and a routine for checking that work on a schedule.


Good care earns a family’s trust. Evidence of good care keeps the doors open to serve them.


Want the Small Practice Compliance Snapshot?

We built a one-page self-assessment that walks a small practice through seven areas where compliance gaps tend to form: ownership and oversight, policies, people and employment, clinical documentation and billing, privacy and security, home- and community-based services, and finding and fixing problems. It takes about fifteen minutes and is designed to show where to look first.


Interested in a free copy? Email cpadelsky@prismadimensionsgroup.com with “Compliance Snapshot” in the subject line and we’ll send it to you within two business days.

How Prisma Dimensions Group Can Help

Prisma Dimensions Group provides fractional compliance, HR, and operations leadership to behavioral health and human services organizations, including practices that deliver services in homes, schools, and the community, and hybrid practices that operate in both clinic and community settings.


On the people side, we support labor and employment compliance across the full employment lifecycle: classification of W-2 employees, 1099 contractors, and owner-operators; onboarding; performance management and documentation; and terminations.


On the clinical side, we provide compliance consultation on session note templates and clinical documentation, billing and claims audits, client intake and referral processes, supervision systems, and payer contracting and credentialing.


If your practice has outgrown its compliance systems, or never quite had them, we would be glad to talk.


References

Comments

  • LinkedIn
  • Facebook
  • Instagram

© 2025 by PRISMA DIMENSIONS GROUP, LLC

bottom of page