Colorado saw red flags in autism therapy billing and approved higher rates anyway

By Jen Schumann | Rocky Mountain Voice

Federal auditors documented convicted staff working with autistic children. Colorado had no system to catch it.

Every week, parents of autistic children in Colorado dropped their kids off with behavior therapists they trusted. What they didn’t know—what the state never required anyone to verify—was whether those therapists had passed a background check. Many hadn’t. Not because anyone failed a background check. Because Colorado never required one.

HHS Office of Inspector General audit highlights—February 2026. Source: https://oig.hhs.gov/documents/audit/11494/A-09-24-02004-highlights.pdf

The findings from federal auditors came out in February. At least $77.8 million in improper Medicaid payments for autism therapy in 2022 and 2023 were identified. And pointed to an additional $207.4 million in question.

Not a single case in the audit sample was clean.

And buried in the same report was a finding that went largely unnoticed—one that goes beyond the money.

Colorado is fighting the refund. 

The billing explosion nobody stopped

ABA is an intensive, hands-on therapy for autistic children—focused on communication, daily skills and behavior. In Colorado, it has become very expensive, very fast.

Colorado spent $60.1 million on ABA through Medicaid in 2019. Four years later, that number had climbed to $163.5 million—an increase of 172%.

HCPF, the state agency that runs Colorado Medicaid, watched that number climb. So did the Joint Budget Committee, which oversees the state budget and received HCPF’s annual presentations. Neither raised a public alarm.

Then the federal auditors showed up.

The OIG examined 100 sampled enrollee-months across 96 unique children from the 2022 and 2023 billing period. 

Every single one contained at least one improper or potentially improper payment. 

The confirmed improper total came to $77.8 million. The potentially improper total—payments auditors could not fully clear—added another $207.4 million, bringing total exposure to $285.2 million.

The specific violations were systematic, not isolated. 

In 93 cases, session notes didn’t meet documentation requirements. In 18 cases, providers lacked appropriate credentials. In 88 cases, notes described potentially unallowable activities—recreational outings, academic tutoring, daycare—billed as therapeutic ABA. In 67 cases, group sessions were billed as one-on-one individual therapy.

Federal auditors made five recommendations to Colorado in response. The most important one still isn’t settled.

HHS OIG recommendations to Colorado, February 2026. Source: https://oig.hhs.gov/documents/audit/11493/A-09-24-02004.pdf 

Colorado has refused to pay. The state disputes the methodology and the $42.6 million refund demand remains unresolved, with no timeline for when that changes.

What the JBC knew—and what it did anyway

The ABA billing explosion did not happen in secret. It happened in the state budget, in formal presentations to the Joint Budget Committee.

That September, HCPF brought in Medicaid Director Adela Flores-Brennan and Chief Financial Officer Bettina Schneider to brief the JBC.

The slides they brought showed how much had changed. The number of children served had doubled. Spending had quadrupled. The cost per child had jumped 75 percent. And the provider base had exploded.

HCPF presentation to the Joint Budget Committee, September 20, 2023. Source: https://content.leg.colorado.gov/sites/default/files/hcpf-09-20-23.pdf

Vice Chair Shannon Bird was there that day. Now she’s running for Congress in CD8. 

The hearing itself stretched for hours, but this portion alone held the committee’s attention for nearly 90 minutes. A recording shows the committee spent every minute of it on one question: were providers getting paid enough? Nobody asked whether the billing itself was legitimate.

Three months later, in December 2023, JBC staff analyst Eric Kurtz presented the annual budget briefing. 

His recommendation for the JBC: approve an $11.9 million increase in ABA provider rates, bringing them to 100 percent of benchmark. 

The Medicaid Provider Rate Review Advisory Committee—a seven-member body with no ABA billing specialists—had recommended the increase. The JBC approved it.

JBC Staff Budget Briefing, December 11, 2023—R6b Targeted Provider Rates. Source: https://content.leg.colorado.gov/sites/default/files/fy24-25_hcpbrf1sum.pdf

The OIG audit covering 2022 and 2023 was already underway. The JBC gave ABA providers a rate increase while the federal government was finding that 100 percent of sampled billing was improper.

The same month: HCPF fought fraud next door

What makes the ABA oversight failure particularly striking is what HCPF did in the same month for a different Medicaid program showing the same warning signs.

Nine days later, HCPF was back at the legislature—this time on December 20—with an emergency request.

The issue was non-emergency medical transportation, or NEMT. Providers and utilization had spiked, and HCPF was getting reports of fraud.

HCPF had received troubling reports of fraud. In one report cited in its emergency funding request, a provider allegedly bribed Medicaid members at a homeless shelter in Pueblo to enter an overcrowded vehicle and provide their Medicaid identification numbers—then drove them to a methadone clinic in Denver, a route with closer options. 

Some of the alleged bribes, according to HCPF, were paid in the form of drugs.

HCPF’s response to NEMT fraud was immediate and aggressive. 

It requested $1.285 million for statewide provider credentialing, pre- and post-payment claims reviews, and law enforcement coordination. It placed 400 providers on prepayment review. It contracted for post-payment analysis of approximately 25,000 claims from 130 providers.

HCPF emergency funding request for NEMT fraud, December 20, 2023. Source: https://content.leg.colorado.gov/sites/default/files/hcpf1331-12-20-23.pdf 

The warning signs for ABA and NEMT were nearly identical: dramatic provider increases, spending spikes, exploding utilization. 

HCPF responded to NEMT with emergency fraud measures, and the funding to implement them. 

For ABA, it requested a rate increase. A recording of the September 20 committee hearing shows the discussion focused entirely on whether providers were being paid enough—not whether they were billing correctly.

NEMT is now one of three Colorado Medicaid programs flagged in a congressional investigation by the U.S. House Energy and Commerce Committee, which cited a 436 percent spending spike. 

The committee set a March 17 deadline for Colorado’s response. In its letter, the department asked Congress to treat the enclosed materials as confidential and requested notification before any disclosure to third parties.

HCPF response to U.S. House Energy and Commerce Committee, March 17, 2026 | Source: Colorado Department of Health Care Policy and Financing

The safety failure underneath the billing data

While the money is significant, a safety failure buried in the same audit drew far less attention.

In a section titled “Other Matters,” the OIG noted that Colorado does not require ABA facility staff to undergo background checks before working with children. The state confirmed this in its written response to the audit. The OIG flagged it. 

Colorado media outlets noted the absence of a background check requirement. What auditors found when they looked inside the facilities went unreported.

HHS Office of Inspector General audit, February 2026—”Other Matters” section, page 30. Source: https://oig.hhs.gov/documents/audit/11493/A-09-24-02004.pdf 

The OIG audit documented what happened.

At one facility serving an 11-year-old child with autism, federal auditors found three staff members with criminal records: a noncredentialed behavior technician with a weapons-related felony conviction from three months before the audit period; a registered behavior technician convicted of misdemeanor assault and misdemeanor harassment—described as a strike, shove, or kick—with the harassment occurring seven months before; and a second behavior technician with a weapons-related aggravated misdemeanor. 

At a separate facility, also serving an 11-year-old with autism, a behavior technician had two driving-related convictions including driving under the influence—and session notes showed the child was transported in a van with that technician on two dates of service.

None of this was caught by the state. Colorado had no system to catch it. It still doesn’t.

ABA therapists work in intimate settings. They go into family homes. They work one-on-one with nonverbal children—youth who don’t self-advocate easily. The entire therapeutic model depends on trust, proximity and repeated individual contact.

In 18 of the sampled cases, the audit found payments had been made for services delivered by staff without appropriate credentials. Colorado doesn’t require background checks for the behavior technicians doing the hands-on work. It doesn’t require them to be certified. It just pays the bill.

In a written response to RMV, HCPF spokesman Marc Williams acknowledged the problem but directed responsibility toward providers and the absence of federal standards. 

“Some private equity providers and other bad actors have entered the autism care space in a way that exploits its vulnerabilities for profit,” Williams wrote. “They know that CMS requires that children covered by Medicaid be connected to care—a righteous value. But they also know that evidence-based guidelines do not yet exist for this special needs population.” 

Williams said HCPF has been working with CMS to develop tools that would allow Medicaid programs to “stop private equity and other bad actors from bilking taxpayers, employers, and families for financial gain.”

Who was billing—and how much

The OIG audit drew its sample from 47 ABA facilities across Colorado. Their names are not public. The audit does not identify them. The billing amounts per facility are not in the public report.

Where things stand

HCPF filed its March 17 response to Congress, pushing back on how the committee framed the problem while pointing to steps the state says it’s already taking.

The state says it will update billing guidance and add periodic reviews. The refund is another matter. It has not committed to the federal refund demand.

ABA therapy billing has not been the subject of a dedicated state audit. “We have not done an audit that only reviewed the Cover All Coloradans program or Applied Behavior Analysis therapy claims,” the Colorado Office of the State Auditor told RMV.

Lawrence Pacheco, director of the Colorado Attorney General’s Medicaid Fraud Control Unit, responded to RMV but declined to answer specific questions. “The attorney general’s office cannot confirm or otherwise comment on investigations,” Pacheco wrote.

Nobody in Colorado has committed to requiring background checks.

The families who had these services in 2022 and 2023 may never know if the person working with their child was vetted. The state cut the check. It did not ask those questions.

It still isn’t required to.

If your family received ABA therapy services through Colorado Medicaid and you have concerns about provider credentials, background checks, or the quality of care your child received, Rocky Mountain Voice wants to hear from you. Contact us at [email protected].