The letter went to every governor and every state Medicaid director on April 23, 2026. The directive itself is short: every state must submit a two-year provider revalidation strategy within thirty days, and must acknowledge receipt within ten business days. The risk categories are not all named publicly, but ABA was called out in CMS's accompanying materials and in Oz's public remarks.

The data behind the directive came from four years of OIG state-by-state ABA audits. Colorado: $77.8 million in improper ABA payments. Indiana: $56.6 million. Maine: $45.6 million. Wisconsin: $18.5 million. None of those refunds have been recovered yet. Combined: over $600 million flagged. CMS is using revalidation as the enforcement lever.

What revalidation actually means at the chain level

Every BCBA, BCaBA, and RBT on your roster will be re-screened. Every NPI will be cross-checked against the National Provider Identifier registry. Every taxonomy code will be validated against the BACB credential database. Every CAQH profile will be audited against state-specific licensure files. The chain that has been sloppy about any of this will lose enrollment status state-by-state as the audits roll out.

The cash-flow impact is the part that lands on the CFO desk. We have seen multi-state chains lose 4 to 7 weeks of billable revenue per BCBA when a single state recertification lapses unnoticed. At a typical 32-hour billable week and a typical Medicaid net rate, that is between $46,000 and $77,000 per BCBA per lapse, with no reasonable way to recover the billable hours later.

The states most exposed

Three categories of states will move fastest. First, the four states already named in OIG audits (CO, IN, ME, WI), where CMS is already in conversation with state Medicaid leadership. Second, states with the highest ABA spend growth curves (NC, AZ, NV, TN, GA), where state legislators are politically motivated to act. Third, states with new MCO contract awards in 2025 or 2026 (GA, KY, LA, MO), where revalidation is operationally bundled with MCO transitions.

If you operate in any of those eleven states, expect revalidation activity in the next 6 to 12 months. If you operate in fewer than three states, your exposure is concentrated. If you operate in more than ten, your exposure is broad but distributed and your reporting infrastructure needs to scale fast.

What this means for your practice

NPI hygiene and taxonomy hygiene are no longer optional. Every BCBA on your roster needs a tracked record of last-revalidation date, next-due date, owner, and state-by-state status. The chain that runs this in a spreadsheet will miss deadlines silently. The chain that runs it in a real dashboard will absorb the regulatory pressure as an operational drill instead of a cash-flow event.

Treat the next 90 days as a discovery sprint and the next 12 months as an execution sprint. Build the dashboard before the audits hit.

✓ This week

Build a single revalidation tracker for every BCBA, every payer, every state. Required fields: date of last revalidation, next due date, owner, state-by-state enrollment status, expiration alerts at 90, 60, and 30 days.

What to watch next

The next 30 days will show which states are organized and which are scrambling. States with mature provider enrollment systems (CA, TX, NY, MA, PA) will publish revalidation calendars quickly. States with lower-volume Medicaid programs (WY, ND, SD, MT) will take longer to operationalize. Either way, expect the first wave of state-specific revalidation notices by mid-summer 2026.

ASP-RCM does this

Credential OS v2.5 was built for the Dr. Oz directive.

Auto-tracks state Medicaid revalidation deadlines across all 50 states and the top 12 commercial payers. Alerts your team 90, 60, and 30 days before each expiration. Single dashboard per BCBA, per chain, per CFO board pack. If we credential your BCBAs, our average new-credential turnaround sits at 22 days against an industry baseline of 102.

Book a 30-minute working call →