On this page
- Yes. 432(b), enrolled providers must permit CMS, its contractors, or the state Medicaid agency to conduct unannounced on-site inspections of any and all provider locations.
- 416(f), the state must terminate or deny enrollment if the provider fails to permit access for a site visit, unless it documents that termination is not in the program's best interest.
- ).
Why ABA providers are seeing visits
In October 2026 the Governor's office reported that since January AHCA had conducted more than 400 provider site visits, with particular attention to areas where data and billing patterns showed heightened risk, including Applied Behavior Analysis, durable medical equipment and adult day care. It reported more than 260 providers placed on payment restrictions or suspended, more than 220 terminated for fraud, waste or abuse, and more than 150 referrals to the Attorney General's Office. It also said AHCA had found providers billing excessive hours, including months of consecutive days through weekends and holidays, and in some instances more than 24 hours of services in a single day. The release says AHCA launched a statewide revalidation effort and a provider-screening pilot, and that the efforts target bad actors, not legitimate providers.
What the rules say a site visit is
Federal Medicaid screening rules require state agencies to conduct pre-enrollment and post-enrollment site visits of providers designated as "moderate" or "high" categorical risk. The stated purpose is to verify that the information submitted to the agency is accurate and to determine compliance with federal and state enrollment requirements (42 CFR 455.432(a)). Every enrolled provider must permit CMS, its contractors, or the state agency to conduct unannounced on-site inspections of any and all provider locations (455.432(b)). A state must terminate or deny enrollment if a provider fails to permit access for a site visit, unless it documents in writing that doing so is not in the program's best interest (455.416(f)).
Florida law adds records access. Providers must retain Medicaid-related records for 5 years and make them available during normal business hours; 24-hour notice must be given if patient treatment would be disrupted (section 409.913(9), F.S.). Failing to make records available, or failing to keep records made at the time of service, are grounds for sanctions (409.913(15)(b)–(d)).
Tip. Check the cited source for the current version before you change a billing process.
A preparation checklist built from those rules
Enrollment information matches reality
- The service address on your Medicaid and plan enrollment is where you actually operate, and each location you bill from is enrolled.
- Ownership, managing employees and practitioners on file are current. Federal rules require revalidation at least every 5 years (455.414), and Florida has launched a statewide revalidation effort.
- Each practitioner's credential matches the role billed: Lead Analyst, BCaBA under BCBA supervision, or RBT under BCBA or BCaBA supervision (coverage policy 3.2).
Records you can produce on request
- For each recipient: the original referral, physician's order and CDE (6.2.1, 2.2); the behavior assessment and plan signed by the Lead Analyst and the parent or guardian (6.2.2); the supervision plan naming authorized supervisors; the current authorization.
- Session notes signed and dated by the rendering practitioner with date, time, location, duration, behaviors, targeted skills, response, participants, and the reason if no parent was present (6.2.4).
- Electronic records you can produce in paper format within a reasonable time on AHCA's request (Rule 59G-1.054(3)(b)).
Billing patterns you can explain
- No practitioner billed overlapping times with different clients, and no recipient or practitioner day adds up to impossible hours.
- Weekend and holiday sessions are real, scheduled and documented.
- Concurrent supervision is billed the way your payer requires. In Florida fee-for-service, the supervisee's line uses XP and is not reimbursed.
- No travel time billed, and no services on the same day as excluded overlay or group care services.
During and after the visit
Have one person own the visit, keep a log of what was requested and provided, and hand over copies rather than originals. If records are requested afterward, Florida requires providers to send legible copies at their own expense (59G-1.054(6)(b)). If you receive written findings, respond by the stated deadline, and talk to a health care attorney if sanctions are proposed.
You can run the billing-pattern checks above on your own data every week. A pre-claim check that flags overlaps, impossible days and notes missing required elements means you find the problem before an analyst does.
Watch out. Payer contracts and plan manuals can add requirements beyond the rules summarized here.
FAQ
Can AHCA show up without notice?
Yes. Under 42 CFR 455.432(b), enrolled providers must permit CMS, its contractors, or the state Medicaid agency to conduct unannounced on-site inspections of any and all provider locations.
What happens if a provider refuses a site visit?
Under 42 CFR 455.416(f), the state must terminate or deny enrollment if the provider fails to permit access for a site visit, unless it documents that termination is not in the program's best interest.
How long must Florida ABA providers keep records?
At least five years from the date of service (Rule 59G-1.054(4)(b) and section 409.913(9), F.S.).
How many site visits has AHCA done in 2026?
The Governor's office reported in October 2026 that AHCA had conducted more than 400 provider site visits since January, with particular attention to ABA among other areas.
Clean notes, clean claims, paid claims.
We check every ABA session note before the claim is built, and you keep the PM software you already use.
Related guides
Sources
- Executive Office of the Governor, Results of Florida's Medicaid Integrity Initiative (October 2026)
- 42 CFR Part 455, Subpart E (Provider Screening and Enrollment), eCFR
- Section 409.913, Florida Statutes (Oversight of the integrity of the Medicaid program)
- Rule 59G-1.054, F.A.C., Recordkeeping and Documentation Requirements
- AHCA, Florida Medicaid Behavior Analysis Services Coverage Policy (Dec 2024), incorporated in Rule 59G-4.125, F.A.C.
Last reviewed October 2026. This page summarizes public rules and vendor pages for education; it is not legal or billing advice. Payer contracts and plan manuals can add requirements, so confirm with the payer.