Virginia Medicaid, administered by DMAS, covers ABA for children under 21 through the EPSDT benefit — historically labeled "Behavioral Therapy" and now documented as ABA in the Mental Health Services manual's Appendix D. The structure is one of the more intake-friendly in our directory: assessment codes need no service authorization at all, so with an ASD diagnosis in hand you can book the assessment immediately. The rigor arrives at the treatment authorization, which since October 2025 must itemize units per CPT code. All five Cardinal Care MCOs run on the identical DMAS criteria and standardized forms — their guides below cover the per-plan mechanics.
DMAS requires no service authorization for the assessment codes — 97151, 97152, and 0362T — a fact confirmed both in the Mental Health Services manual's Appendix D and in the fee file's own PA flags. For intake, that means the sequence can be: verify eligibility → book the assessment immediately → build the treatment request from the assessment. One post-pandemic constraint: initial assessments must be conducted in person.[1][4]
All treatment hours require service authorization with a predetermined number of units for each treatment procedure code. Effective for dates of service October 15, 2025 and later, requests — fee-for-service and every Cardinal Care MCO alike — must itemize units per ABA CPT code on the new DMAS standardized preservice form (no more bundling under 97155), so intake and clinical planning need to align on requested intensity code by code. Requests at or above 20 hours/week (80 units) must include an individualized schedule of activities, and continued-stay requests need an updated ISP plus graphical progress data. There is no hard hour cap — EPSDT medical necessity governs. Fee-for-service authorizations still run on Acentra Health's Atrezzo Next Generation (ANG) system, but the access path changed: DMAS added an "FFS Service Authorization" tile inside its Medicaid Enterprise System (MES) provider portal effective April 27, 2026, direct login to Atrezzo continued only through May 31, 2026, and effective June 1, 2026 every provider must reach FFS service authorizations through MES single sign-on and that tile rather than a direct Atrezzo/Kepro login (portal.kepro.com/Login/Login is retired for this purpose). DMAS's bulletin describes the access mechanism for FFS service authorizations generally rather than naming behavioral health/ABA specifically, but the change applies across all FFS service types, ABA included. MCO members continue to follow their plan's own process.[2][1][6]
Effective January 1, 2026, the CMS Interoperability and Prior Authorization Final Rule imposes hard decision deadlines on prior-authorization requests — covering behavioral health/ABA — for DMAS FFS and every Cardinal Care MCO alike: 72 hours for expedited requests, and 7 calendar days for standard requests. The 7-day standard clock can extend to 14 days only if the member or provider requests the extension, or if DMAS/the MCO needs additional evidence and the extension is in the member's interest. Build these deadlines into your follow-up cadence — a standard ABA treatment-authorization request sitting past 7 days with no extension notice is worth escalating rather than assuming it's normal.[7]
Virginia's fee schedule pays by practitioner licensure tier, flagged with modifiers: no modifier = technician, HN = Licensed Assistant Behavior Analyst (LABA), TF = LMHP, HO = Licensed Behavior Analyst (LBA). Per 15-minute unit (effective 12/1/2021 and still current in the July 2026 fee file): 97153 direct treatment pays $15.00 at the technician tier, $23.48 LABA, $39.40 LMHP, and $46.63 LBA; assessment and QHP codes (97151, 97155, 97156) pay $23.48 / $39.40 / $46.63 at the LABA / LMHP / LBA tiers. Who renders the service is therefore a first-order revenue variable in Virginia. One trap when reading the raw fee file: it also carries generic physician-fee rows for 97151 and 97156 at a few dollars per unit — those are the non-ABA schedule lines, not the ABA program rates.[3][18]
Cardinal Care is the unified brand for Virginia Medicaid managed care, and a new single managed-care contract took effect July 1, 2025 — the same date Molina exited Virginia Medicaid (contract terminated 6/30/2025) and Humana Healthy Horizons entered, absorbing Molina's members. The five active MCOs — Aetna Better Health, Anthem HealthKeepers Plus, Humana Healthy Horizons, Sentara Community Plan, and UnitedHealthcare Community Plan — all apply the identical DMAS criteria and standardized ABA forms, so the per-plan differences are operational: portals, fax lines, credentialing paths, and UHC's Optum carve-out. Providers in every MCO network must also keep their DMAS PRSS enrollment current, and only Board of Medicine-licensed LBAs/LABAs can provide ABA within scope.[16][17]
Virginia does not require the RBT credential. Technician-level Medicaid ABA is delivered by unlicensed personnel working under a Licensed Behavior Analyst (LBA) or Licensed Assistant Behavior Analyst (LABA) per the Board of Medicine's supervision rules (18VAC85-150), and there is no state technician registry — DMAS classifies staff simply as licensed or unlicensed. Scope limits still bind: technicians may give input but cannot develop, review, or update the ISP (an LBA/LABA/LMHP task), and cannot render or bill parent/family training. If you staff with RBTs voluntarily, the BACB floor travels with the credential — age 18+, high-school education, the 40-hour training, a competency assessment, a criminal background check plus abuse-registry check within the 180 days before applying, and ongoing supervision of at least 5% of monthly service hours. VirginiaABA's guidance also holds that technicians must be W-2 employees paid for indirect time (supervision, data analysis), not 1099 contractors — association guidance we couldn't trace to a DMAS document, but worth pricing into the staffing model.[4][8][9][10][11][12][13][14][15]
The screening picture is unusual: ABA agencies sit outside DBHDS licensure (the pre-2012 DBHDS outpatient ABA license became unnecessary once the Board of Medicine took over individual licensure), so Virginia's barrier-crime regime — Va. Code § 37.2-416's CCRE/FBI checks and DSS child-abuse-registry searches — does not bind an ABA-only agency; it applies only if you separately hold a DBHDS license for other services. Employee-level checks instead arrive through the BACB (for RBT-certified hires) and through MCO contracts: Anthem HealthKeepers Plus's provider manual (effective 7/1/2026) requires OIG LEIE exclusion screening before hiring or contracting with any individual, periodic re-checks of current employees and contractors, and immediate reporting of any exclusion — the federal rule behind it (42 CFR 1001.1901) bars payment for anything an excluded person furnishes. At the entity level, Medicaid enrollment consent covers criminal background checks, with fingerprinting only if DMAS or CMS designates the provider high categorical risk (42 CFR 455.434); ABA is not on the federal high-risk provider list, but DMAS's risk-category assignment for ABA isn't published — confirm at enrollment. Revalidation runs at least every five years via PRSS.[4][8][9][10][11][12][13][14][15]
Supervisor licensure runs through the Board of Medicine under Va. Code § 54.1-2957.16: LBA requires current BCBA certification, LABA requires current BCaBA plus documented supervision by an LBA. The supervision floors are qualitative, not ratio-based — 18VAC85-150-120 makes the LBA ultimately responsible for care under his supervision, requires a written supervisory agreement with each LABA, and sets formal LABA supervision at no less than one hour at least every four weeks (informal phone/email contact doesn't count), with no numeric supervisor-to-technician ratio or percent-of-hours observation floor in the licensure regulation itself. DMAS, however, sets its own frequency floors in Appendix D, and they bind regardless: the LBA, LABA or LMHP must “observe the youth and supervise services monthly,” with that supervision documented in the record as a review of progress notes and data plus dialogue with supervised staff, and “supervision of unlicensed staff shall occur at least twice a month by the LBA, LABA or Licensed Clinical Psychologist,” evidenced by the licensed supervisor’s contemporaneously dated signature. Treat those two cadences — monthly on the youth, twice monthly on unlicensed staff — as the audit standard. Two billing consequences: supervision without the client present isn't separately billable (technician rates were built to include it), and each LBA must be individually enrolled in MES and credentialed with each Cardinal Care MCO you accept — a per-supervisor, per-plan administrative load. Two items we couldn't verify directly: the current Appendix D's own staffing text (host unreachable at review) and the LBA continuing-education renewal rule (18VAC85-150-100) — confirm both with DMAS provider enrollment and the Board.[4][8][9][10][11][12][13][14][15]
The questions that decide whether a family can start with Virginia Medicaid (DMAS), and what they have to bring. Each maps onto something intake should ask on the first call.
Under 21 — Appendix D's ABA admission criteria state it as the first requirement, and the benefit rides EPSDT, so there is no hard hour cap beneath it.[1]
No recency window on the diagnosis. Appendix D admits on a current primary ICD diagnosis correlating to a DSM diagnosis, or on a provisional psychiatric diagnosis developed by an LMHP where no definitive diagnosis has been made — and DMAS states there is no timeframe for the use of a provisional psychiatric diagnosis, expecting the LBA to follow up with the youth's physician or other LMHPs as more information is gathered. What must stay current is the assessment: it is reviewed and updated at least annually by the LBA, LABA or LMHP, and continued-stay criteria test symptoms within the past 30 days.[1][4]
Two different questions, and Appendix D answers both. The diagnosis: the youth must currently meet criteria for a primary ICD diagnosis that correlates to a DSM diagnosis, or have a provisional psychiatric diagnosis as developed by an LMHP — Appendix D does not restrict the benefit to autism or name a specialty list of diagnosing clinicians. The ABA assessment: it must be completed by an LBA, LABA or LMHP acting within scope (an LMHP-R, LMHP-RP or LMHP-S with completed education and training in ABA may complete it under the supervising LMHP), conducted in person with the youth and the family or caregivers, and an assessment completed by an LABA may be used only for ABA, not as a Comprehensive Needs Assessment for other services.[1][4]
The initial assessment must include a functional assessment using validated tools, completed by the LBA, LABA or LMHP within scope, and documentation must describe any assessment tools used. DMAS publishes no approved list — the QHP may use clinical judgement to choose the best assessments for the youth — so what is audited is that a validated instrument was used and named, not which one.[1][4]
No physician order. DMAS retired the requirement for an order or letter recommending services signed by a physician, nurse practitioner or physician assistant — what replaced it is a notification duty: the QHP must notify the youth's primary care physician that the child is receiving ABA, providers must communicate the results of the assessment and treatment planning to the PCP, and care coordination with the PCP must be documented in the youth's record.[4][1]
Initial assessments must be conducted in person with the youth and the family or caregivers. Beyond that, coverage of services delivered by telemedicine is governed by the Telehealth Services Supplement to the Mental Health Services manual, and the use of telemedicine must be documented in the ISP submitted with both the initial and the continued-stay authorization. Care coordination, data analysis and treatment-plan activities billed under 97151 or 97155 do not have to be provided face to face. MCO-contracted providers must consult their contracted MCO for that plan's telehealth policies.[1][4]
Standard (non-urgent) requests: decided within 7 calendar days of receipt; expedited: within 72 hours — in force since January 1, 2026 for DMAS FFS (Acentra) and every Cardinal Care MCO alike. The standard clock can extend by up to 14 calendar days if the member or provider requests it, or if the extension is justified in the member's interest to obtain more medical evidence; expedited applies when the standard timeframe "could seriously jeopardize the member's life, physical or mental health, or ability to attain, maintain, or regain maximum function." Before the rule the standard limit was 14 days. When to submit: Appendix D says providers "shall submit service authorization requests by the requested start date of services. If submitted after the required time-frame, the begin date of authorization will be based on the date of receipt" — and the DMAS bulletin adds that days/units not submitted timely are denied. Assessment codes need no authorization, so the clock matters for treatment and every continued-stay request.[7][1][19][20]
Medicaid pays last. DMAS: "The provider must bill other insurance as primary," and "The member can keep private health insurance and still be covered by Medicaid. The other insurance plan pays first." For ABA specifically, the Project BRAVO FAQ answers the secondary-claim question directly: "All claims must first be submitted [to] the youth's commercial plan before being submitted to the youth's Medicaid MCO for secondary coverage consideration." The Medicaid claim must still reach DMAS within 12 months of the date of service even while you wait on the primary, and a claim flagged as having other coverage with no TPL payment needs the EOB/denial attached. Appendix D makes payment for every non-assessment ABA service conditional on service authorization ("Services other than assessment (97151, 97152 and 0362T) must be service authorized by the FFS service authorization contractor or MCO") and names no exemption for a secondary claim, so get the Medicaid authorization even when the commercial plan pays first. TRICARE and CHAMPVA both pay ahead of Medicaid: TRICARE rules state "Medicaid is not a double coverage plan. In any double coverage situation involving Medicaid, CHAMPUS is always the primary payer," and CHAMPVA "assumes primary payer status" over Medicaid. Federal law lets a state pay first and chase the third party for claims for preventive pediatric services, "including early and periodic screening, diagnosis and treatment services"; DMAS's mental health billing chapter publishes no such exception for ABA, so bill the commercial plan first.[21][4][1][22][23][24]
Coverage decides whether Virginia Medicaid (DMAS) pays. These decide whether the claim survives: how sessions must be staffed and supervised, what may be billed concurrently, the per-day ceilings, who signs the note, where the service is payable, and whose NPI the claim goes out under.
Three separate floors. The LBA, LABA or LMHP must at a minimum observe the youth and supervise services monthly, with supervision documented as a review of progress notes and data plus dialogue with supervised staff about progress and the effectiveness of the ISP. Supervision of unlicensed staff must occur at least twice a month by the LBA, LABA or Licensed Clinical Psychologist, demonstrated by the contemporaneously dated signature of the licensed supervisor. Clinical supervision is required for services rendered by an LABA, LMHP-R, LMHP-RP or LMHP-S, consistent with the scope of practice set by the applicable Virginia Department of Health Professions board — on the nature of supervision DMAS defers to that board and to the BACB. Supervision time without the individual present is not billable; the technician rates were built to include it.[1][4][9]
Appendix D publishes the combinations that may be billed at the same time: 97152 with 97151 (except 97152 HN together with 97151 HN); 97153 with 97155 (except 97153 HN together with 97155 HN) — DMAS adds that 97155 and 97153 may be billed together for supervision activities when the QHP is directing the technician in delivering treatment and the QHP, technician and youth are all present; 97154 and 97158 at the same time for different youth in the same group, with identical professional-level modifiers; 97153 at the same time for two technicians when the reason is documented in a service-authorized ISP; and services with the youth alongside family or group family training when delivered by different qualified staff. What is barred: an additional technician-level code alongside 97158 or 97154. Separately, ABA may not be authorized concurrently with Intensive In-Home, Mental Health Skill Building, Psychosocial Rehabilitation, Partial Hospitalization or Assertive Community Treatment, though short-term authorization overlaps are allowed during transitions.[1][4]
No per-day unit ceiling. Assessment codes 97151, 97152 and 0362T carry no service authorization and no unit limit, but may only be billed as part of an initial assessment or a full reassessment. Since dates of service 10/15/2025 every treatment code is authorized with its own predetermined number of units rather than bundled under 97155. Requests at or above 20 hours (80 units) a week must include an individualized schedule of activities that distinguishes therapeutic from recreational time — a general schedule of clinic-based activities is not sufficient. Group sizes follow CPT guidelines. In Residential Treatment Services settings, including therapeutic group homes and PRTFs, the payable ABA set narrows to 97151, 97154 (with modifier HN, HO or TF only), 97155, 97156 and 97157.[1][2]
Documentation must carry the initial assessment completed by the LBA, LABA or LMHP including the assessment instruments used, dates of service and face-to-face contacts, staff and participant names, and staff credentials and signatures. Treatment progress must be documented through daily data collection plus a weekly summary note, with graphical analysis of goals and objectives for those dates of service. Supervision is demonstrated by the contemporaneously dated signature of the licensed supervisor. The ISP must be reviewed at least every 30 calendar days — a progress note satisfies the review if it documents the discussion, any alterations, and the individual's response; the individual's signature is not required, and the 30-day review is held for audit rather than submitted.[1][4]
ABA may be provided in home or community settings where the targeted behaviors are likely to occur, and in clinic settings — the setting must be justified in the ISP. School is the constrained one: ABA may only be provided in the school setting when the purpose is observation and collaboration by the QHP related to behavior and skill acquisition, not direct therapy, and only when authorized by the school, the parent and the provider and included in the ISP. Technician-level codes may not be billed for school observation and collaboration, and DMAS interprets school as any education setting, private or public; additional school ABA may be available under school health services through the local education agency. Services rendered primarily by a relative or guardian who is legally responsible for the youth's care are not covered.[1][4]
ABA providers must be enrolled with DMAS under the ABA provider types (PCT 156 or 456 with PS 903; PCT 020 or 023; PCT 256 with PS 104), licensed by the applicable Virginia Department of Health Professions board, and credentialed with the youth's Medicaid MCO for managed-care members. Every CPT code is billed with the staff modifier that identifies the professional providing the service: HN for an LABA, HO for an LBA, TF for an LMHP. QHP-level codes must be provided by an LBA or LMHP, with an LABA able to act as a QHP as determined by the supervising LBA under 18VAC85-150-120, and LMHP-Rs, LMHP-RPs and LMHP-Ss with completed ABA education and training able to provide them under the supervising LMHP. Technician-level codes may be delivered by an LMHP-R/RP/S under supervision, an LABA under an LBA, personnel supervised by an LBA or LABA under 18VAC85-150-10 et seq., personnel supervised by a Licensed Clinical Psychologist under § 54.1-3614, or by an LBA or LMHP acting as the technician — LBAs may bill technician-level codes with the appropriate modifier. Unlicensed personnel include but are not limited to RBTs; Virginia does not require the RBT credential.[1][9]
Yes — for members under 21 with autism, under the EPSDT benefit, with no hard hour cap. Assessment codes need no service authorization; all treatment hours are authorized with units itemized per CPT code.
No — 97151, 97152, and 0362T require no service authorization under DMAS rules (confirmed in the manual and the fee file's PA flags). Treatment codes do.
Licensure-tiered rates per 15-minute unit: 97153 pays $15.00 (technician), $23.48 (LABA), $39.40 (LMHP), or $46.63 (LBA); assessment and QHP codes pay the LABA/LMHP/LBA tiers. Modifiers HN/TF/HO flag the tier.
Aetna Better Health, Anthem HealthKeepers Plus, Humana Healthy Horizons (which replaced Molina on July 1, 2025), Sentara Community Plan, and UnitedHealthcare Community Plan — all on identical DMAS criteria and forms.
As of June 1, 2026, through DMAS's Medicaid Enterprise System (MES) provider portal single sign-on and its "FFS Service Authorization" tile — direct login to Acentra's Atrezzo portal (portal.kepro.com) was retired for this purpose after May 31, 2026. MCO members still submit through their own plan's portal.
Under the CMS Interoperability and Prior Authorization Final Rule (effective 1/1/2026), DMAS FFS and every Cardinal Care MCO must decide expedited requests within 72 hours and standard requests within 7 calendar days — extendable to 14 days only if the member/provider requests it, or DMAS/the MCO needs more evidence in the member's interest.
Payer policies change frequently and vary by plan, state, and funding type. This guide was compiled from the sources above and last reviewed September 2026; it is general information, not billing, legal, or clinical advice. Always verify current requirements against the payer's live policy and a benefits check for the specific member.
Carelu collects all of this automatically.
Every ID, document, and detail this payer requires — gathered conversationally the moment a family reaches out, with insurance verified before your team touches the file.
Get a Demo