by James C. Sherlock

Last week, I conducted a short field survey in Virginia Beach of four businesses registered with the federal government to bill Medicaid as providers of Applied Behavior Analysis (ABA) (i.e., autism) services.  

Each is headquartered in Lakewood, NJ.  

Lakewood is, of course, the location of the Medical Facilities of America DBA LifeWorks Rehab, Virginia’s infamous and largest nursing home chain. So, I looked there for ABA chains with Virginia locations and visited four located in Virginia Beach.

Many ABA chains offer physical centers. The largest are owned by private equity.  

Not these. These four offices are virtual.

There was nobody from those Lakewood companies at either of the two addresses where the four companies listed their Virginia Beach offices.  

The four have similar characteristics:

• There are no “centers.” One of the Virginia Beach locations is a mail drop. The other three are at a single location, serving as clients of an international company that advertises “compliance” services.  
• There is no Virginia Beach phone number.
• The phone numbers they provided in the NPI registration are answering services.  
• There is no company representation at the local addresses.  
• Most are not registered with the Virginia State Corporation Commission.
• Websites are where they do business. Again, no phone numbers are listed. They have automated chat systems.

There are perhaps hundreds of similarly situated ABA service providers statewide.

What could go wrong?

NPI

For one, while some such virtual providers may be legitimate, finding clients and using local professionals as contract workers in homes and schools, the federal National Provider Identification (NPI) system provides an easily accessible platform for fraud.  

For another, the federal registration forms do not ask the right questions. For the questions that are asked, there is no follow-up to prevent fraudulent registrations.  

The NPI numbers are not even automatically voided when the locations change ownership. I have found four generations of ownership of the same nursing home at the same address, with each still listed as active on NPI.  

The NPI system is, in short, a mess.

So there is no need to ask whether registration addresses are currently validated by CMS or whether they use AI crawlers in NPI to sort the wheat from the chaff.

Virginia has a lot of the chaff.

Fraud in the Medicaid autism “racket”

America is an incredibly generous nation.  

There is literally unlimited federal money available to fund Medicaid. In Federal Fiscal Year (FY) 2024, federal Medicaid spending reached approximately $618 billion, accounting for roughly 9.1% of all federal government outlays. Total spending, including the state shares, approached a trillion dollars.

So, as with Willie Sutton and banks, much of it is stolen through fraud.  

The Medicaid program most penetrated by fraud (think of the competition for that award) is the one that, under the Social Security Act, requires payment for Applied Behavior Analysis. The feds know it.  

The federal Medicaid and Medicare fraud enforcement arm, the Office of the HHS Inspector General’s badge-carrying investigators, is going state by state to examine ABA billing records. They may not be looking for fraud in all the right places.  

They could start at HHS headquarters with the NPI program.

The results of the state-by-state effort so far are characterized in the titles of two Wall Street Journal articles:

• The editorial, The Medicaid Autism Racket, March 8, 2026
• The Boom in Autism Therapy is Medicaid’s Largest Jackpot by Christopher Weaver, Tom McGinty, and Anna Wilde Mathews, followed on March 10.

Little subtelty there. You owe it to yourselves to read them. They offer breathtaking examples of fraud.  

Minnesota is a case study.

According to a federal complaint, 27-year-old Abdinajib Hassan Yussuf set up a fly-by-night autism center claiming to provide one-on-one therapy for autistic children. He allegedly worked with medical professionals to have children diagnosed with autism and paid kickbacks to parents to enroll them in his center.

He also employed teenage relatives with no formal education or training and raked in more than $6 million in Medicaid money, some of which he wired to Kenya.

And not just in Minnesota.  

One provider billed Medicaid for five hours of therapy at a recreational center with a water slide. Another billed Medicaid for 200 hours of therapy in a month for a single child, though it could substantiate only 49 hours of services. The state paid for all 200 hours. Audited providers were paid as much as $15,470 a month per child.

Indiana was the worst.

When Meghann Mitchell first launched her autism-therapy business in 2019, she took aim at an unlikely source of profit: Indiana’s taxpayer-funded Medicaid program, the public insurance system for the poor.

The bet paid off. In 2023, the state paid Mitchell’s company, Piece by Piece Autism Centers, $29 million to provide therapy to just 84 patients—about $340,000 a child—according to a Wall Street Journal analysis of Medicaid billing records.

That amount surpassed what Indiana Medicaid typically spends in a year treating a newly diagnosed lung-cancer patient or covering a year of nursing-home care.

Colorado’s Medicaid agency was head-scratchingly incompetent.

An IG audit released last week (March) estimated that 99% of Colorado’s Medicaid payments in 2022 and 2023 for autism treatment were improper or likely improper, totalling $285.2 million.

Nearly all providers failed to submit the required documentation for at least some claims, and a quarter billed the state for treatment provided by staff without appropriate credentials. Many autism centers billed Medicaid at more than $50 an hour for autism “treatment” when children were playing games, napping or eating. Many provided little more than glorified day care.

Not sure where Virginia is on the federal schedule of state reviews.

ABA Therapy Mandates

Medically necessary ABA therapy for Medicaid-enrolled children under 21 is provided in every state through the Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) benefit mandated by the Social Security Act.

There are federal processes for qualifying both recipients and providers of Medicaid participation. State Medicaid offices have their own registration processes and run automated checks before paying bills. But the federal government readily acknowledges that the combined validation architecture does not work. At all.

My little survey in Virginia Beach may indicate that Virginia Medicaid, and indeed all state Medicaid agencies, have an even bigger problem than the OIG knows.  

Private insurers are also at risk.  

The Virginia Bureau of Insurance requires most state-regulated health insurance plans to cover medically necessary ABA therapy for autism without age limits, though plans commonly cap ABA-specific benefits at $35,000 annually. There is no sign that the private insurers are sorting out the problems any better than the government. It would be good to know if they are. They could help DMAS.

Tailored searches for ABA provider chains

I was successful with a tailored search of the NPI (National Provider Identifier) portal. The search taxonomy is Behavior Analyst, along with the city and state. The search returns both companies and individual practitioners.  

Over 500 ABA companies headquartered in the Lakewood area met the search criteria. Though listed individually, many of those identifiably operate as multi-state chains. Their individual entities set up to operate in Virginia are also identifiable.  

Those that operate like this require virtually no capital investment. There is no there, there.

So, they can be wherever they say they are. Everyone who thinks such things are unique to Lakewood, raise your right hand.

Recommendations

The federal government. (I have already made these recommendations directly to CMS).

The Centers for Medicare & Medicaid Services absolutely must clean up NPI, and not just for ABA services providers, but for all registrations:

• Change the application. Ask about chain affiliation.  
• The application already forbids a business from using a post office box as an address. Some do it anyway and get away with it. That is easy to find in the current files. I see them all the time.  
• Major companies offer services that they advertise as accommodating the federal requirement by working around it. But then, unwittingly, so do local businesses like the pack-and-ship company in Virginia Beach that was a mail drop for one of the Lakewood businesses. Ban those practices as well.  
• Then follow up on the addresses provided. That can be accomplished by AI.
• Use AI crawlers on NPI data to identify likely fraud suspects operating as chains but not identifying as chains.
• Purge the legacy NPI numbers.

If the bad guys don’t have an NPI number, they cannot even approach the states to register to deliver Medicaid services.

Virginia Department of Medical Assistance Services

• Require SCC registration data from ABA providers.
• Require every ABA provider to register with the name and address of the local business manager and the name, qualifications, and address of the local clinical supervisor.

General Assembly

• Ban Virginia office services companies doing business in Virginia from hosting out-of-state ABA companies.
• Ban businesses operating mail drops from providing services to out-of-state ABA companies.
• Ban out-of-state ABA chains from operating virtual offices in Virginia.

Smart people in government will fix my recommendations and offer others. Hopefully soon.