ABA Billing
& Insurance

As an ABA practice owner, your primary focus is on clinical outcomes and the progress of your clients. However, as your practice grows, the administrative burden of Revenue Cycle Management often becomes too heavy to manage in-house.

Outsourcing your billing is a strategic move to reduce claim denials and free up your time for other client-focused priorities. The catch: outsourcing RCM means extending your practice’s circle of trust to a new partner. In an era of increasing data breaches, you aren’t just looking for a billing service; you are looking for a partner or team that cares about securing your data as much as you do. Here’s a guide to the security standards you must demand when outsourcing your ABA billing.

1. The HIPAA Seal of Compliance: More Than Just a Buzzword

Almost every billing company will tell you they are "HIPAA compliant", but how is this being validated?

When you outsource, you should look for a partner that has undergone third-party verification. Check if the vendor has a HIPAA Seal of Compliance; this shows an audited, rigorous security posture, not just standard adherence.

• Why it matters: A breach of PHI can result in devastating fines and, more importantly, a loss of trust from the families you serve. A 3rd party that serves as an approved entity to issue validation ensures the company has the protocols in place to prevent, detect, and respond to threats.

2. The Business Associate Agreement: A HIPAA Necessity

HIPAA compliance is both technical and contractual. Any RCM vendor handling your PHI must sign a BAA. This document is the legal foundation of your partnership, defining exactly how data is handled and who is responsible when things go wrong.

A secure RCM partner should provide a BAA that clearly defines:

• Data Ownership: Ensuring you retain control of your client records.
• Breach Responsibility: Outlining exactly who is liable if an incident occurs.
• Notification Timelines: How quickly they must alert you to a potential issue.
• Liability Allocation: Protecting your practice from financial ruin due to a vendor’s mistake.

3. The Fortress: Secure Hosting and WAF Protection

Where does your data actually live? If a billing service is storing spreadsheets on a local hard drive or using a standard "consumer-grade" cloud service, your practice is at risk.

Secure RCM outsourcing requires a specialized hosting environment. Theralytics partners with AWS, a leader in secure healthcare hosting. This infrastructure includes:

• Web Application Firewall (WAF): This acts as a digital shield, filtering out malicious traffic and preventing hackers from accessing the portal.
• Encryption at Rest and in Transit: Your data should be encrypted while it’s sitting on the server and while it’s being sent to insurance payers.
• Vulnerability Scanning: A secure partner doesn't wait for a hack to happen; they perform regular scans to find and patch "leaks" before they can be exploited.

4. Staff Training & Human Risk: Securing the Weakest Link

Technical shields are only as strong as the people behind them. Most HIPAA breaches occur due to human error: phishing, weak passwords, or improper file sharing. You must ensure your RCM partner treats staff training as a priority, not an afterthought.

Theralytics mitigates human risk through:

• Mandatory HIPAA & Security Training: Our billing team undergoes rigorous, role-specific training to handle PHI safely.
• Background Checks: Every team member is vetted before handling sensitive financial or clinical data.
• Ongoing Compliance Refreshers: Security protocols evolve, and so does our training, ensuring our team is prepared for the latest cyber threats.

5. Access Control: The "Need to Know" Basis

One of the biggest security risks in outsourcing is "over-access." Does your billing team have access to your clinical session notes, behavior plans, or sensitive family history? In a secure environment, they shouldn’t. If they do, ensure the access is for members with specific duties such as sending in treatment plans for reauthorization, verification of benefits, submitting documentation for appeals, and sending copays to clients.

When outsourcing, ensure your Practice Management software allows for Role-Based Access Control.

• The Theralytics Standard: Our platform ensures that billing teams only see the data required to process claims (like CPT codes and demographics) while clinical data remains restricted to the providers.
• Multi-Factor Authentication (MFA): Ensure your partner requires MFA. Even if a biller’s password is compromised, MFA provides a second layer of defense to keep unauthorized users out of your financial records.

6. Incident Response & Breach Notification Readiness

Even the most secure systems must be prepared for an incident. ABA providers should never be left wondering "what happens if?" A professional RCM partner must have a documented Incident Response Plan.

When evaluating a partner, ask:

• How fast will I be notified? HIPAA mandates 60 days, but top-tier partners often notify within 24- 48 hours.
• Who manages the fallout? A secure partner helps manage notifications to payers, the OCR, and clients.

The Theralytics Standard: We maintain a proactive response strategy. If a potential threat is detected, we have clear protocols for containment, eradication, and transparent communication with you.

The incident response is not a last-minute checklist. Our response strategy is built around early detection, clear decision-making, and accountability.

If a potential threat is detected, we follow defined and strict protocols for:

• Rapid triage to determine scope and severity
• Immediate containment to limit exposure
• Eradication of root cause, not just symptoms
• Validation that systems and data are safe before full recovery
• Clear, timely, and transparent communication with you at every stage of the incident response process

7. The Financial Risk of Budget-Friendly Outsourcing

It is tempting to choose the billing service with the lowest percentage rate. However, lower fees may mean the company is cutting corners on IT security, staff training, and compliance audits.

If a budget billing company suffers a data breach, you, as the provider, are often the one held legally and reputationally responsible in the eyes of the law and clients. Investing in a secure RCM partner is an insurance policy for your practice’s reputation.

Questions You Should Ask Before Signing a Billing Agreement:

Before you hand over your practice’s financial keys, ask these three questions:

• Can you provide proof of a third-party HIPAA approval or a Seal of Compliance?
• What specific measures do you use to protect my data from cyber threats?
• How is my data partitioned so that billing staff only see what they need for claims?

Secure Your Practice and Your Revenue

Theralytics was founded by a BCBA who understands that security is a clinical necessity. We offer a seamless, robust solution that combines award-winning software with expert RCM services.

Our commitment to your data is backed by independent verification, including SOC 2 Type II compliance and ONC Health IT certification, ensuring that our technical infrastructure meets the highest federal standards for functionality and confidentiality.

Book a Demo with Theralytics Today to see how we can protect your data while maximizing your reimbursements.

Billing is one of the most important and most misunderstood parts of running an ABA practice. The right billing processes ensure consistent cash flow, payer compliance, and long-term growth. The wrong setup, on the other hand, can lead to delayed payments, mounting denials, and even threaten your practice’s sustainability.

Theralytics Founder and CEO Zo Rana and Director of Revenue Cycle Management Prajod Prakash, who has extensive experience managing billing operations across healthcare specialties, share their expert insights on what makes ABA billing unique, common pitfalls practices face, and how to choose the right billing partner.

What Makes ABA Billing Unique?

According to Prajod Prakash, ABA billing is distinct because it combines behavioral health coding with time-based service structures and payer-specific rules. This creates layers of complexity not typically seen in other medical specialties.

Key elements that make ABA billing unique include:

• Frequent use of time-based CPT and HCPCS codes such as 97151, 97153, 97155, 97156, H0031, H0032, and H2019, all requiring precise session-duration documentation.
• Authorization-driven billing—nearly every ABA service requires prior authorization tied to specific codes, units, and date ranges.
• Highly variable payer guidelines, with differences in rounding, modifiers, supervision rules, and rendering provider requirements across plans.
• Day Club Guidelines, applicable when ABA sessions run one to eight hours with breaks; certain payers require day-club grouping to avoid duplicate denials.
• Clinical overlap, where documentation must align exactly with treatment plans, progress notes, and provider credentials for billing compliance.

Common ABA Billing Mistakes (and How Practices Can Avoid Them)

From Prajod’s experience, the most frequent errors in ABA billing include:

• Incorrect or inconsistent use of CPT codes and modifiers
• Missing or expired authorizations
• Inaccurate rounding of time to billing units
• Misapplication of day club rules
• Incorrect rendering provider setup or credential mismatch
• Documentation that doesn’t support billed codes or units
• Weak denial management workflows
• Failing to follow payer-specific rendering provider requirements

Practices can reduce billing errors and improve claim outcomes by:

• Verifying benefits and authorizations prior to the start of care
• Ensuring accurate and complete client and insurance data
• Aligning billed units with total documented minutes
• Standardizing documentation templates
• Validating modifiers and payer-specific claim format rules
• Keeping payer rendering and day club rules updated
• Promptly resolving rejections and preventing repeat issues
• Tracking denials by category to identify payer patterns

In-House vs. Outsourced Billing: Lessons from the Field

Zo has navigated billing from multiple angles, as a provider doing billing independently, as a leader of an in-house billing team, and as a partner to outsourced billing companies.

He recalls early challenges:

“The biggest surprises I encountered when I first started my own practice were how differently each payer interpreted the same codes… I needed a lot of guidance to understand what was considered billable and how to document session notes for each payer properly.”

He also notes how complex the actual claim-submission process was at first, terms like EDI, ERA, clearinghouse, and CMS-1500 were new and overwhelming.

Outsourcing vs. in-house billing

Zo originally outsourced billing, then brought it in-house, then returned to outsourcing:

“When you outsource, you gain access to an entire team of specialists, whereas an internal billing team might only consist of one or two people.”

As his practice grew, managing billing internally became increasingly difficult. Ultimately: “Going back to outsourcing turned out to be one of the best decisions I could have made… Having a billing partner who understands complex billing scenarios, audits, and multi-state billing is critical.”

What to Look for in a Billing Partner

Zo emphasizes one quality above all:

Timely, effective communication.

“You need a biller who communicates issues clearly and works with you to develop a plan for resolving them… You should always have a clear understanding of what is happening in the background.”

Key qualities Zo recommends:

• Strong communication and transparency
• ABA-specific billing experience
• Compliance readiness (insurance, registrations, payer requirements)
• Regular KPI reporting and visibility into A/R and cash flow

Major red flags:

• Lack of ABA billing experience
• Poor communication or irregular reporting
• No compliance infrastructure
• Inability to provide metrics or performance benchmarks

Key Qualities to Look For

• Strong communication and transparency.
• ABA-specific experience: avoid general medical billers who lack ABA expertise.
• Compliance readiness: ensure the billing company is insured, properly registered, and compliant with payer requirements.
• Transparent reporting: visibility into A/R, aging reports, denial trends, clean claim rates, and performance metrics.

Red Flags to Avoid

• Lack of ABA billing experience.
• Unclear communication or irregular reporting.
• No compliance credentials or insurance.
• Missing metrics or performance guarantees.

How Poor Billing Impacts Client Care

According to Zo, poor billing operations impact far more than revenue:

“Without consistent cash flow, an organization simply cannot sustain the delivery of care.”

He has seen practices shut down due to poor RCM operations, including failures to track A/R, unresolved denials, and missed timely filing limits.

Even when the consequences aren’t catastrophic, limited cash flow prevents investments in staff training, technology, workflows, and clinical quality.

“Poor billing practices don’t just affect finances; they impact every part of an organization, and ultimately, client care.”

Building a Successful ABA Billing Operation

Prajod outlines three foundational components for success: team, process, and tools.

Team Structure

• Billing Specialists / RCM Experts
• Authorization & Verification Team
• QA/Compliance Specialist
• Billing Manager / RCM Lead

Process Flow

Front-end: Eligibility → Authorization → Scheduling
Mid-cycle: Documentation → Coding → Claim QA Review
Back-end: Rejection resolution → Payment posting → Denial tracking → A/R follow-up → Reporting

Tools

• ABA-specific practice management or EHR system
• Automated authorization tracking
• Claim scrubbing
• Rejection and denial reporting tools

Key Billing KPIs Every ABA Practice Should Track

From Prajod’s perspective, the critical KPIs include:

• Clean Claim Rate (CCR): 90%+
• Days in A/R: Under 35 days
• Denial Rate: 7–9% or lower
• Authorization Utilization Rate
• Collection Rate: 95%+
• Average Payment per Unit or Session

These metrics help practices spot payer issues, prevent revenue leakage, and maintain cash-flow stability.

How Technology Streamlines ABA Billing

Technology platforms like Theralytics support billing accuracy and operational efficiency by:

• Automating charge capture directly from session notes
• Tracking authorizations and utilization in real time
• Configuring payer-specific rounding, day club, and rendering rules
• Reducing manual errors with integrated claim scrubbing
• Tracking rejections, denials, and payments electronically
• Offering KPI dashboards to highlight trends early

Integrated systems significantly improve first-pass claim success rates and shorten the revenue cycle, both essential for financial stability.

Conclusion

ABA billing is complex, but it doesn’t have to be overwhelming. By understanding the nuances of ABA billing, avoiding common mistakes, and choosing the right systems and partners, providers can protect revenue, maintain compliance, and stay focused on client care.

Want to see how Theralytics can streamline your ABA billing?
Book a demo to learn how our integrated platform and expert billing team can help your practice simplify billing and strengthen financial performance.

Starting May 5, 2025, California ABA Therapy Providers can enroll in California's Medi-Cal Fee-for-Service (FFS) program through the PAVE system. This new process helps create a smoother experience for both providers and patients. Here’s a simple guide to help you understand the changes.

Why should California ABA Therapy Providers enroll in the Fee-for-Service Medi-Cal Program?

• Your Managed Care Organization (MCO) in California (examples: CalOptima, IEHP, Partnership HealthPlan, etc.) may require you to enroll through PAVE.
• You may want to enroll in the Fee-For-Service Medi-Cal program, even if your MCO does not currently require it.
• Enrolling now ensures you're prepared for any future changes your MCO may implement.

‍

How to Enroll with PAVE

• Enroll through the PAVE portal starting May 5, 2025.
• Organizations must register as a Healthcare Business, not as a Group.
• You’ll need to include:
  
  • First and last names of all providers.
  • National Provider Identifier (NPI).
  • License, certification, or registration numbers for applicable staff.

‍

Attestation & Roster

• Organizations must confirm that all staff, including BCBAs, RBTs, and paraprofessionals:
  
  • Meet the rules in SPA 14-026 and SPA 18-011.
  • Are properly supervised as required by the State Plan.
• BCBAs, RBTs, and paraprofessionals don’t enroll individually but must be listed on their organization’s roster (this process is done manually).
• Each individual must have a Type 1 NPI and be included in the application.

‍

Reporting Changes

• Any updates, like new hires or staff leaving, must be reported through a PAVE Supplemental Application within 35 days.
• Only updates submitted through PAVE will be accepted.

‍

Timeline & Effective Dates

• The sooner you apply, the sooner you can start.
  
  • Applications from May 5 – June 30, 2025: Enrollment starts July 1, 2025.
  • Applications after June 30: Enrollment starts once your application is reviewed and approved.

‍

Administrative Location Requirements

• You must list one physical location for your business.
• This cannot be a P.O. box, home address, or virtual office.
• If you work from multiple locations, you’ll need to submit separate applications.

‍

Managed Care Plan (MCOs) Contracting

• While FFS enrollment is optional, many MCOs (i.e., CalOptima, IEHP, Anthem..etc) may require it to stay in their network.
• MCOs may give you up to 120 days of provisional participation while your enrollment is processed.

‍

Approval and Listing

• Once approved, you’ll receive a PAVE approval letter and be added to the Medi-Cal Open Data Portal.

‍

Key Points to Remember

• BCBAs working for a QAS organization (ABA therapy group) don’t need to enroll individually unless they are billing independently.
• Services are available for all Medi-Cal children under 21 if a doctor or psychologist deems them medically necessary.

‍

Application Process Timeline

• DHCS has 180 days to process your application.
• If corrections are needed, you’ll have 60 days to resubmit, and DHCS will have another 60 days to review.

‍

Credentialing

• Enrolling in PAVE doesn’t replace credentialing with Managed Care Organizations (MCOs). You’ll still need to work directly with MCOss for contracts.

‍

How Theralytics Can Help

Managing Medi-Cal compliance can feel overwhelming, especially for large teams or multi-location practices. Theralytics simplifies the process by helping you organize staff data, track updates, and stay compliant with PAVE’s rules. Whether it’s data migration or meeting the 35-day update deadline, we’ve got you covered.

Theralytics was also built with California-specific needs in mind, including automations for drive time, mileage tracking, and paid 10-minute breaks—designed to handle the complexities of running a business in California.

Let us help you focus on patient care while staying audit-ready. Interested? Contact Theralytics today to get started.

Source: DHCS Stakeholder Hearing Q&A - March 14, 2025)

“I learned the hard way that the topics we barely touched on during our BACB programs—billing codes, proper documentation, A/R management, and insurance policies—were the very things that could make or break my practice” - Zo Rana, Founder and CEO of Theralytics

When the opportunity came to open my own ABA practice, I thought I was ready—I had the clinical vision mapped out, financial numbers crunched, my marketing strategy to grow the business in place, and a clear goal of success for my clients and staff.

But I wasn’t prepared for the hidden battle—the overwhelming administrative burden of compliance requirements, endless paperwork, and constant client scheduling. This overload led to countless headaches like billing errors, claim denials, and additional hours of administrative work. The insurance mandate in my state only added to the chaos, and before I knew it, I was drowning—not in clients, but in paperwork, unpaid claims, and mounting debt.

I learned the hard way that the topics we barely touched on during our BACB programs—billing codes, proper documentation, A/R management, and insurance policies—were the very things that could make or break my practice. I found myself at a crossroads:

1. Keep struggling through endless admin work and financial uncertainty
2. Find a better way to run my practice and reclaim my dream

The fear of audits, denials, and financial instability keeps many practice owners awake at night. I knew there had to be a way to eliminate that stress and protect my business—not just for myself but for every BCBA out there trying to build a practice.

My Vision: A Scalable, Stress-Free Practice

Scaling an ABA practice while maintaining high-quality care is no easy feat. My goal was to create a thriving practice—one that delivered exceptional clinical services while also providing an amazing work environment for my staff.

I didn’t start my business to spend hours on the phone with insurance reps, stuck on hold with instrumental music in the background. I started it to serve clients, grow a team, and make an impact. In order to do that, I needed a system to eliminate the administrative bottlenecks and allow me to focus on what truly mattered—client care, staff development, and practice growth. Once I found and refined that system, I successfully built thriving practices of my own. After building and successfully selling two thriving ABA practices, I’m now dedicated to helping other clinicians navigate and overcome these challenges. Through this journey, I uncovered several hidden challenges that can hold professionals back—and I’m here to help you tackle five of them.

One area that presents a challenge is compliance— and knowing how to identify these issues is key to a practice's success.

5 Hidden Challenges: Compliance Can Make or Break You

Compliance is not just another administrative task—it’s the backbone of a sustainable practice. Yet, I see many new BCBAs underestimate its importance.

1. CPT Codes: Every service you provide must be billed using the correct CPT code. But do you know which codes apply to which services and how to ensure they’re used appropriately? Misuse can lead to claim denials—or worse, compliance violations.
2. Rendering Provider Rules: The rendering provider on your claims matters. But do you know how different payers define the rendering provider and who should be listed? If not, your claims might get rejected before they even get reviewed.
3. Session Documentation: Insurance companies require precise documentation for every billed service. Are your session notes detailed enough to align with your CPT codes? If not, you’re at risk for denials, repayment demands, or worse—failed audits.
4. Rounding Rules & Billing: Small rounding errors can lead to significant financial discrepancies. Are you confident that your billing aligns with payer rounding rules? Even minor miscalculations can result in compliance issues or revenue loss.
5. Audits Can Happen Anytime: No practice is immune from audits. If an insurance company or Medicaid agency requested documentation today, would you be fully prepared? If not, you could be facing clawbacks, fines, or even legal trouble.

If you're feeling buried under billing nightmares, compliance worries, and inefficient systems, you’re not alone. I’ve been there. These challenges inspired me to create Theralytics—a platform built specifically for ABA providers to remove the billing, compliance, and admin headaches that keep them from growing their practices.

Struggling with any of these challenges or want to talk with someone who’s successfully overcome them? Reach out to info@theralytics.net. Learn about FREE consults with me, Zo Rana, former owner of multiple ABA agencies, who can help support your ABA practice.

About Theralytics

Theralytics was established with a clear purpose: to empower ABA providers with a seamless and robust practice management solution. With the expertise of Board Certified Behavior Analysts and healthcare technology specialists, we aimed to bridge the gap between the complexity of managing an ABA practice and the need for simplicity and security.

‍

Zo Rana, M.S., BCBA

Founder and CEO                                                                                                                                                    

Navigating the realm of ABA billing can appear daunting to both newcomers and seasoned professionals alike. Behind the creation of Theralytics, my goal was to simplify and streamline this intricate process. Here, we will delve into pivotal aspects of billing that ABA companies often encounter.

The Importance of Credentialing

Credentialing isn’t a mere checkbox in our professional journey. Imagine a newly certified BCBA eager to provide services but faced with the challenge of an incomplete credentialing process. Some might be tempted to use a credentialed colleague’s details as a shortcut, especially when filling out essential forms like the claim form. A key detail on this form is box 24J, where the individual provider’s National Provider Identifier (NPI) is entered. Filling this incorrectly or using someone else’s NPI not only undermines the integrity of the billing process but also carries significant legal and ethical implications.

Credentialing serves as a testament to a professional’s qualifications, expertise, and readiness to offer services. For agencies and individual practitioners, it’s paramount to implement a robust system that continually monitors and updates credentialing statuses. Beyond just keeping track, it’s vital to ensure we’re always informed and accurate about the NPI we’re placing in box 24J of the claim form. This attention to detail is not merely beneficial—it’s essential. By adopting this proactive stance, risks are mitigated, and every service provided is in full alignment with regulatory standards.

Understanding Rendering Provider Requirements

The intricacies of billing in ABA often hinge on correctly identifying the rendering provider. Medicaid and commercial payers, with their unique requirements, further compound this challenge.

For Medicaid-bound services, the credentialing journey often initiates at the state level. Only after securing state-level credentials can providers advance to individual Managed Care Organizations (MCOs). This sequential approach, while ensuring thorough vetting, necessitates precise adherence to each step. Missteps or oversights can prolong the process, delaying essential services.

Contrastingly, commercial payers present a different challenge—a lack of standardization. Each payer can have distinctive guidelines, making adaptability and constant learning indispensable for BCBAs and ABA agencies.

Billing Ethically is Non-Negotiable

While billing might be seen by some as merely a backend operation, it holds a mirror to our professional ethics and commitment. Ensuring accuracy in billing is paramount.

Resorting to billing under a credentialed provider for services offered by an uncredentialed professional isn’t just unethical—it’s fraught with legal ramifications. For ABA professionals, this highlights the importance of a billing system that’s both transparent and anchored in ethical best practices. Every invoice should accurately represent the services rendered, fostering trust and safeguarding the agency’s reputation.

Single Case Agreements (SCAs) as a Temporary Solution

SCAs, in the context of ABA billing, offer a temporary respite when confronted with immediate credentialing challenges. They are designed to prevent disruptions in client services during unforeseen circumstances.

However, SCAs shouldn’t be mistaken for a long-term solution. They serve as a stopgap, allowing continuity of service while the comprehensive credentialing process progresses in the background.

How to Secure a Single Case Agreement

While SCAs provide a crucial bridge in specific scenarios, obtaining them requires a systematic methodology:

1. Determine the Need: Clearly articulate and document the immediate need for an SCA. Is it due to a sudden departure of a credentialed professional? An unexpected surge in caseload?
2. Reach out to the Payer: Initiate a conversation with the client’s insurance company. Familiarizing oneself with their provider relations department can streamline this interaction.
3. Gather Documentation: Consolidate all pertinent documents. This might range from the client’s current treatment plan to a letter detailing the urgency and potential ramifications if services are halted.
4. Submit the Request: Forward the SCA application as per the insurer’s stipulated procedures.
5. Stay Proactive: Actively track the status of your application. Consistent communication can expedite the process.
6. Review the Agreement: Upon approval, closely examine the SCA’s terms, ensuring compliance during its tenure.
7. Continue with Regular Credentialing: An SCA is a band-aid. Concurrently, ensure the standard credentialing process progresses without delay.

Keeping Up with Changing Payer Guidelines

The fluid landscape of payer guidelines underscores the importance of continuous learning and adaptability. Regular shifts in these guidelines necessitate a proactive stance, rather than a reactive one.

Incorporating dedicated roles or tools like Theralytics can ensure real-time updates, making compliance less cumbersome. By consistently aligning with the most recent payer standards, agencies can avoid pitfalls and ensure smooth service delivery.

Conclusion

Theralytics was conceptualized to address and alleviate challenges inherent to ABA billing. As we venture deeper into this domain, let’s prioritize precision, transparency, and ethics. Our diligence in billing not only impacts our immediate operations but echoes throughout the ABA community and the clients we serve.