How a Florida Medicaid audit works for an ABA provider

The legal basis

Section 409.913, F.S., requires AHCA to oversee Medicaid providers to keep fraud, abuse and neglect to a minimum, recover overpayments and impose sanctions. The agency conducts reviews, investigations, analyses and audits, and at least 5 percent of all audits are conducted on a random basis (409.913(2)). It monitors patterns of overutilization against state averages and uses provider profiling and billing-pattern analysis to detect abnormal increases. Federal rules separately require screening, site visits for moderate- and high-risk providers, and revalidation (42 CFR Part 455, Subpart E).

In 2026 the scrutiny on ABA is explicit. The Governor's office reported more than 400 site visits since January with attention on ABA, more than 260 providers on payment restrictions or suspended, and billing patterns such as more than 24 hours of services in a single day. AHCA's ABA Task Force is examining service-authorization limits, potential caps on service duration, and provider enrollment and billing standards, with recommendations due December 31, 2026.

How the audit is decided

• Your duty on every claim. The provider must present claims that are true and accurate, for covered, medically necessary services actually furnished, and documented by records made at the time (409.913(7)). Services are treated as excessive or not medically necessary unless the medical basis and the specific need are fully documented.
• Sampling and extrapolation. AHCA must use accepted and valid auditing, accounting, analytical, statistical or peer-review methods, and may use sampling and extension to the population (409.913(20)). A sample's error rate can be projected across all your claims.
• Contemporaneous records only. The audit report is based on information available before it is issued and, for documentation, solely on contemporaneous records. You may not present records to contest an overpayment unless they are contemporaneous and were furnished when requested during the audit (409.913(21)–(22)).
• Time to deliver the services. A sanction can follow if a provider cannot show it had sufficient time, in the case of services, to support its billings (409.913(15)(n)).

What an audit can lead to

• Repayment of overpayments, with 10 percent annual interest from the date of the final determination (409.913(25)(c)).
• Fines of up to $5,000 per violation; each false or erroneous claim leading to an overpayment counts as a separate violation (409.913(16)(c)).
• Prepayment review of claims for up to one year, which can happen without any suspicion of wrongdoing (409.913(3)).
• Withholding of payments on reliable evidence of fraud, willful misrepresentation or abuse (409.913(25)(a)), or after a probable-cause overpayment determination unless you repay or agree a repayment plan within 30 days (409.913(27)).
• Suspension for up to one year, termination for more than one year and up to 20 years, corrective action plans for up to three years, and recovery of investigative costs (409.913(16), (23)).

A self-audit plan

1. Pull a random sample of paid ABA claims from the last 12 months, across practitioners and codes.
2. Match each line to its note. Is there a note for every unit? Does it contain every element in coverage policy 6.2.4? Was it signed within two business days (Rule 59G-1.054)?
3. Recompute the units from documented start and stop times using the 8-minute rule in section 8.2.
4. Check the people. The rendering practitioner's credential matches the code and modifier, supervision follows the supervision plan, and concurrent time is billed the way the payer requires.
5. Check the patterns. No practitioner overlaps, no impossible days, and weekend and holiday sessions documented.
6. Check the file. Referral, order, CDE, signed assessment and plan, current authorization, and progress data with graphs for reauthorization (6.2.1–6.2.3).
7. Fix the process, not just the sample, and keep a written record of what you found and changed.

Because findings rest on contemporaneous records, the cheapest audit defense happens at the moment of documentation. A pre-claim note check moves the self-audit from once a year to every claim.

FAQ

Related guides

Sources

1. Section 409.913, Florida Statutes (Oversight of the integrity of the Medicaid program)
2. 42 CFR Part 455, Subpart E (Provider Screening and Enrollment), eCFR
3. Executive Office of the Governor, Results of Florida's Medicaid Integrity Initiative (October 2026)
4. AHCA, Applied Behavior Analysis Task Force
5. AHCA, Florida Medicaid Behavior Analysis Services Coverage Policy (Dec 2024), incorporated in Rule 59G-4.125, F.A.C.
6. Rule 59G-1.054, F.A.C., Recordkeeping and Documentation Requirements

Last reviewed October 2026. This page summarizes public rules and vendor pages for education; it is not legal or billing advice. Payer contracts and plan manuals can add requirements, so confirm with the payer.