Mastering Prior Authorizations: A Blueprint for ABA Practice Efficiency

Mastering ABA prior authorizations means running them as a routine built on five habits. Verify benefits before the assessment, request each authorization by CPT code and units, and document medical necessity with measurable data. Then track units as sessions are delivered, and start reauthorization well before the end date. The routine protects continuity of care and cash flow.

Why are prior authorizations harder for ABA?

Prior authorizations are harder for ABA because the services are intensive, ongoing and billed in 15-minute units across several codes. CMS's State Medicaid and CHIP ABA Toolkit lists the features of an effective ABA prior authorization process. Those include standardized assessment tools, service-hour thresholds that trigger review, and time-limited authorizations with required reassessment. One client can need an assessment authorization, a treatment authorization and several reauthorizations over the course of care.

Higher-intensity requests draw closer review. The toolkit says documentation should explain why the requested hours are needed and how treatment fits the child's daily life. Virginia, for example, requires detailed justification for requests above 20 hours per week.

The administrative load is well documented across health care. In the AMA's most recent prior authorization physician survey, 95 percent of physicians reported that prior authorization delays care. Physicians and their staff reported spending 13 hours a week on prior authorizations. More than 1 in 4 physicians (26 percent) said the process had led to a serious adverse event for a patient. The survey covers physicians, not ABA providers, but the paperwork is the same kind of work.

Federal parity law also shapes how plans use prior authorization. CMS explains that under mental health parity rules, treatment limits on mental health benefits cannot be more restrictive than those on medical and surgical benefits. CMS names prior authorization as one example of a nonquantitative treatment limit. The law does not require a plan to cover mental health benefits, but it applies when a plan offers them.

What should an ABA authorization request include?

An ABA authorization request should show that the services are medically necessary, individualized and tied to the child's functional needs. The CMS toolkit lists what reviewers should consider:

• A diagnostic evaluation that documents functional impairments in communication, behavior and social skills.
• An individualized treatment plan that states the level, intensity, duration and setting of services.
• Baseline assessments and measurable goals based on the identified deficits.
• Requested services tied to functional needs rather than to the diagnosis alone.
• Treatment plan and supervision documentation, plus an explanation of how the requested hours will be used.

Use the standardized assessments each payer accepts, such as the VB-MAPP, ABLLS-R or Vineland, and justify the requested level of care clearly. At reauthorization, graphed session data showing progress is often what reviewers look for. Thorough, consistent session notes are your strongest defense against denials and the base of any appeal.

Request each code the payer authorizes, not just a total of hours. The AMA's behavioral health coding resource groups 97151 and 97152 as assessment codes and 97153 through 97158 as treatment codes. Some payers authorize the assessment separately, so the first request may cover the assessment codes alone. Before services begin, verify the client's benefits and confirm which codes, units and dates the authorization must cover.

How long does a payer have to decide?

The decision deadline depends on the plan, but federal rules now set outer limits for many public plans. Under CMS's Interoperability and Prior Authorization Final Rule, impacted payers must send decisions within 72 hours for expedited requests. Standard requests must be decided within seven calendar days. The timeframes took effect January 1, 2026, for Medicare Advantage, Medicaid and CHIP fee-for-service programs, and Medicaid and CHIP managed care.

The same rule requires those payers to give a specific reason when they deny a prior authorization, starting in 2026. Qualified health plan issuers on the federal exchanges are excluded from the decision timeframes. The CMS toolkit adds that Medicaid managed care plans can extend a decision by up to 14 calendar days in limited cases. For other plans, check the provider manual and contract for each payer's turnaround time.

How do you track authorized units without surprises?

Track authorized units by CPT code, session by session, and compare them with the schedule. A practice that checks balances only at month end can learn about an exhausted authorization from a denial instead.

Concurrent review uses the same numbers. The CMS toolkit says reviews during an authorization compare attendance and units of service with what was authorized. A large gap in either direction is worth explaining before the payer asks. Underused units can leave clients short of the recommended intensity, and overused units produce sessions no one can bill.

Each code draws down on its own, so 97153 hours can look healthy while 97155 units run low. Our post on authorization tracking and supervision across ABA service types covers how to keep each code and each supervisor aligned.

When should reauthorization start?

Reauthorization should start early enough to gather new assessment results and progress data before the payer's submission window closes. The CMS toolkit describes reauthorization as a separate decision near the end of an authorization period. Reviewers look for updated assessment scores, progress graphs, goal mastery and attendance data. Georgia, for example, requires behavioral assessment results dated no more than two months before the new authorization's effective date.

Build the timeline backward from the end date. Schedule the reassessment first, then the treatment plan update, then the packet review by the supervising BCBA. Leave room for the payer's decision time on top of that. A reauthorization started a few days before the end date leaves no margin for a request for more information.

What should you do when a request is denied?

Start with the payer's stated reason, and match your response to it. Some denials come down to missing documentation, which a complete resubmission can fix. Others need an appeal or a peer-to-peer review, where the supervising BCBA discusses the clinical rationale with the payer's reviewer. Learn each payer's appeal levels and deadlines. Keep a standard packet ready: behaviors of concern, functional limitations, assessment scores and graphed progress.

Authorization problems can also surface later, on the claim. They arrive as X12 reason codes such as 197 (authorization absent) or 198 (authorization exceeded). Our guide to ABA denial management shows how to read those codes and fix the cause.

How Lumenality keeps authorizations visible

Lumenality is an ABA-only EHR that keeps authorizations in the same client record as scheduling, session notes and billing. Much of what an authorization request or appeal needs is already in one place:

• Authorization setup. The authorization plan builder records what each payer approved, mapped to CPT codes.
• Drawdown per session. Units draw down by CPT code as sessions are documented, with a warning at 80 percent of units used.
• Expiry flags. Authorizations about to expire are flagged before the dates lapse, so the team can assemble a reauthorization packet in time.
• Eligibility first. Real-time eligibility checks (270/271) run through the built-in Stedi clearinghouse before a client is seen.
• Evidence on hand. FBAs, BIPs, treatment plans with measurable goals, graphed session data and progress reports live in the same record.
• Claims that match. The session note becomes the claim line, so the authorization on the claim is the one the session drew from.

Each practice runs on its own single-tenant deployment with its own database and encryption keys, under a signed BAA. An audit trail records who opened each record. If you'd like to see authorization tracking with your payers, we'd be glad to show you a demo.

*This article was created with AI assistance and reviewed by the Lumenality team.*