Home/White Papers/ABA Three-Way Match Handbook
Edition 1, 2026 · 28 pages · CPT 97151 to 97158

The ABA three-way match handbook for multi-payer billing.

Authorization, supervision ratio, and EHR session note brought to one gate before submission. Eight CPT codes covered. Twenty Pre-Flight validator rules. BACB aligned. BHCOE channel-partner reviewed. The handbook the senior partner team hands new clients on day one.

Edition
1 · 2026
Length
28 pages
Audience
ABA practices
CPT range
97151-58
Reviewed
BHCOE
Recovery
$1.4M example

Executive summaryFive things the three-way match fixes.

Most ABA takebacks happen because three sources of truth disagreed and no gate caught the disagreement before submission. The three-way match closes that gap. This handbook is the working reference for a billing supervisor, an RCM director, or a clinical leader who owns the discipline at one site or fifty.

01
Authorization, supervision ratio, and session note land in one gate.
02
Twenty deterministic rules cover the highest-frequency takeback causes.
03
Eight CPT codes from 97151 through 97158 share the same gate.
04
The hold queue absorbs roughly three percent of claims before they ship.
05
Worked example reversed $1.4M of takebacks across 18 months.

ABA billing has three sources of operational truth that almost never live in the same system. The active authorization sits in the payer portal or a copy inside the practice management system. The supervision ratio is computed inside the EHR or pulled from a CSV the clinical director maintains. The session note sits in the EHR with its own timestamp, location, and rendering provider. When the three agree, the claim is clean. When they disagree, the claim either denies on the front end or takes back ninety to one hundred twenty days later, and the economic damage is invisible until the takeback letters arrive.

The three-way match is a deterministic gate that compares the three sources at the moment of submission. It is not a clinical-decision tool. It is a billing-discipline tool. The handbook reads as a working document because it is one. Every page is sourced from the operating cadence ASP-RCM runs with ABA clients today. The reader is the person who carries the operational weight: a billing supervisor who already knows which beneficiary will trigger the next takeback letter, an RCM director comparing month-over-month NCR slippage, a clinical director who keeps the supervision ratio spreadsheet on a second monitor, or the founder who signs the takeback check. The discipline described here works inside CentralReach, Rethink, Therapy Brands, NPAWorks, AccuPoint, or a custom build.

TAKEBACKS REVERSED
$1.4M
42-site engagement, 18 months
AUTH COMPLIANCE
97%
Steady-state post-gate
UNSUBMITTED NOTES
0
After match gate enabled
UNIT LEAKAGE
8-15%
Industry norm without gate
SOURCE 1 / AUTH
Payer portal or PM system
Active unit balance, date range, covered code list, place-of-service.
SOURCE 2 / SUPERVISION
EHR ratio or director CSV
BCBA-over-RBT hours on a rolling 30-day window, payer-specific floor.
SOURCE 3 / NOTE
EHR session record
Date, clock-in, clock-out, location, rendering provider, signature.
"The match gate runs before submission, not after rejection. That is the entire trick."
Senior partner team · ASP-RCM

The numbers behind why this matters are stark. The Behavior Analyst Certification Board now lists roughly 70,000 active BCBAs and over 150,000 active RBTs in 2026, almost double the count five years earlier. Payers responded with tighter authorization controls, narrower place-of-service definitions, and supervision-ratio audits that did not exist in 2019. ASP-RCM clients running the three-way match hold leakage under 2 percent on a steady-state basis. The match runs as a standard control inside our ABA therapy billing services.

70K
Active BCBAs · 2026
150K+
Active RBTs · 2026
<2%
ASP gate leakage

Reference · the eight codesThe ABA CPT family.

All eight CPT codes that the three-way match gates. The handbook breaks each code into its rendering provider, its supervision requirement, and the most common takeback root cause specific to that code. The table below is the at-a-glance reference.

Code
Description
Three-way match watch
Rendered by
97151
Behavior identification assessment
Auth time-banding. Most takebacks are billed time over assessed time. Note must show start and end clock time.
BCBA
97152
Supporting assessment
Supervision link required. Note must name the supervising BCBA. RBT credential active on date of service.
RBT
97153
Adaptive behavior treatment by protocol
Highest takeback exposure. Auth balance, ratio, and time match are the three gates. Most-billed code in the family.
RBT
97154
Group adaptive behavior treatment
Group size limit applies. Note must list all clients in the group. Place-of-service must agree across all claims.
RBT
97155
Adaptive behavior protocol modification
Auth code list. Some payers carve 97155 out of the 97153 unit pool. Watch the supervision overlap rule.
BCBA
97156
Family treatment guidance
Family attendance required. Note must identify the family member attending. Some payers cap monthly units.
BCBA
97157
Multiple-family group treatment guidance
Group size minimum applies. Note must show two or more families. Time match is the highest-frequency takeback.
BCBA
97158
Group adaptive behavior protocol modification
Auth code list. Some payers do not cover. Place-of-service and group size are the standing gates.
BCBA

Each code in the family carries its own match rule, and the gate enforces them as separate predicates rather than a single combined check. 97153 is billed in 15-minute units, so a 2-hour session ships as 8 units and the auth balance has to subtract 8, not 1. 97155 is the subtle one: most commercial plans allow same-day billing of 97155 alongside 97153, but several state Medicaid programs and Tricare regional contractors disallow the same clock-minute being billed under both codes by the same patient.

Payer supervision-ratio floor and unit caps

Payer Supervision floor 97153 cap / week Reauth cadence
BCBS (state plans)10%25 to 40h6 months
UnitedHealthcare / Optum10%30 to 40hQuarterly UR
Aetna10 to 15%30 to 40h6 months
Tricare10%VariableQuarterly
Florida Medicaid (SMMC)5%Up to 40h6 months
Massachusetts Medicaid10%30h (EPSDT)6 months
California (DDS contracts)5 to 10%Per contractPer IPP
Texas MedicaidMonthly contactNo fixed cap6 months

Payer-specific modifier discipline

HO
BCBA-rendered service
MA Medicaid, CT Medicaid
U1-U7
Credential level
IN Medicaid, TX Medicaid
95
Telehealth
Tricare, most commercial
HM / HN
Paraprofessional / RBT
Select state Medicaid

Per-code top failure mode

97153 · highest takeback exposure
Unit math drift. 2-hour session = 8 units of 15 minutes. Off-by-one auth balance check ships claims that take back at audit.
97155 · concurrent-billing trap
Same clock-minute billed alongside 97153 fails on TX Medicaid, FL Medicaid, several Tricare regions. Carve-out must be documented.
97154 · group size ceiling
8 clients per group max for most payers. Note must list every client ID. POS must agree across all claims in the group.
97158 · BCBA supervision documented
4 clients per group max. Supervising BCBA documented for every minute. Some payers do not cover at all.

Concurrent-billing edge cases are where most senior coordinators have learned the hard way. A BCBA who runs a 30-minute 97155 protocol modification inside an RBT-delivered 97153 session needs the EHR to record both clinicians, both start times, both end times, and the overlap window. Without that record, the gate cannot tell whether the BCBA billed 30 minutes of independent work or 30 minutes of supervision-during-treatment, and the payer audit treats the silence as the latter. The supervising BCBA must be documented for every minute of 97158 group treatment, and the group size minimum of two families on 97157 has to be evidenced in the attendance section of the note, not inferred from the billing template.

Per-payer authorization ceilings drive the upstream reauth cadence. Commercial BCBS plans typically authorize 25 to 40 hours per week of 97153 with a 6-month renewal cycle. UnitedHealthcare and Optum issue 30 to 40 hour authorizations with a quarterly utilization review checkpoint, which means the practice files an updated treatment plan, a current 97151 reassessment, and demonstrates measurable progress against the original treatment goals before the quarterly date. Florida Medicaid under SMMC authorizes up to 40 hours per week with EPSDT carve-outs available for medical necessity. Texas Medicaid takes a different approach, with no formal weekly ceiling but a strict requirement that 97155 protocol modification activity occur at least monthly and be documented in the active treatment plan. The gate reads the payer rule and applies the corresponding ceiling, then routes any encounter that would exceed the cap into the hold queue for clinical review before the claim ships.

The fix · the gateOne gate. Three sources. Pre-submit.

Before a claim leaves the billing system, the three sources are compared. Authorization balance, supervision ratio policy, and EHR session note for that date, time, location, and rendering provider. If any disagree, the claim holds for resolution. If all agree, it ships.

AUTHORIZATION Active unit balance Date range valid SUPERVISION RBT hours BCBA ratio policy SESSION NOTE Time, location, provider Three-way Match SHIP IF AGREE
SHIPS CLEAN
96%
First-pass through the gate, faster than legacy pipeline.
HELD AND RESOLVED
3%
Would have denied or taken back. Resolved inside the hold window.
BLOCKED / ESCALATED
<1%
Routed to clinical review before any submission.

Reference · 20 Pre-Flight rulesThe deterministic validator library.

Twenty rules grouped into four categories. The auth rules check the authorization. The supervision rules check the ratio. The note rules check the session note. The provider rules check the credentialing data. Each rule has a deterministic answer at submission time.

01
Auth active on DOS
Authorization date range covers the date of service.
Auth
02
Auth balance not depleted
Remaining auth units cover the billed units.
Auth
03
CPT code on auth code list
The billed CPT is on the authorization's covered code list.
Auth
04
Auth reauth trigger flagged
If under 20 percent of units remain, flag for reauth.
Auth
05
Auth POS matches billed POS
Place-of-service on auth matches place-of-service on claim.
Auth
06
Supervision ratio above payer floor
BCBA hours over RBT hours meets payer-specific minimum.
Sup
07
Supervising BCBA assigned to RBT
RBT has a current supervising-BCBA assignment in Credential OS.
Sup
08
Supervision note attached
A supervision note exists in the billing period for this RBT.
Sup
09
Supervision ratio rolling-week check
Last seven days of supervision still meets the threshold.
Sup
10
Group-treatment supervision check
For 97154 and 97158, supervision is required by the payer.
Sup
11
Session note exists
A closed note exists in the EHR for the DOS.
Note
12
Note start and end time match billed time
Clock-in and clock-out times agree with billed minutes.
Note
13
Note location matches claim POS
The location on the note matches place-of-service on the claim.
Note
14
Note rendering provider matches claim
Provider on the note is the rendering provider on the claim.
Note
15
Note signed and closed by clinical lock
Note status is closed and signed prior to submission.
Note
16
Group-treatment client list complete
For group codes, all client IDs in the group are listed.
Note
17
Rendering BACB credential active on DOS
BACB credential lookup returns active for the DOS.
Prov
18
Supervising BCBA credential active on DOS
Supervising BCBA's BACB lookup returns active for the DOS.
Prov
19
State licensure active on DOS
State licensure file shows active status for DOS.
Prov
20
Payer roster shows active enrollment
Payer enrollment is active for this rendering provider.
Prov

What each rule cluster actually does

RULES 1-5 / AUTHORIZATION
Date, balance, code list, POS, reauth trigger.
  • Single-day gap on either end holds the claim.
  • Balance subtracts in real time as units post through the day.
  • Code-on-auth checks against the explicit code list, not a category.
  • 20%-remaining trigger gives clinical lead time to refile.
RULES 6-10 / SUPERVISION
Ratio, assignment, note, rolling-week, group.
  • Ratio compares BCBA-over-RBT on rolling 30 days vs payer floor.
  • Supervisor assignment comes from Credential OS credential file.
  • A 97155 note must exist in the billing period for the RBT.
  • 7-day check is the early-warning version of the 30-day check.
RULES 11-16 / SESSION NOTE
Exists, time-match, POS, provider, signed, group list.
  • Time-match is the highest-frequency takeback driver in the audit pool.
  • POS rule catches the in-clinic-but-billed-as-home default error.
  • Provider rule catches BCBA cover-for-RBT mid-session mistakes.
  • Draft notes never ship under this gate.
RULES 17-20 / CREDENTIAL
BACB, supervisor BACB, state license, payer roster.
  • Monthly cross-reference vs BACB Registry. 30-day pre-expiry alert.
  • Lapsed supervisor cert invalidates RBT billable activity.
  • State licensure matters in MA, AZ, VA, KY, NC, OK, TN, and growing.
  • Payer-roster check catches Optum and Aetna recert gaps.
PASS
All 20 rules clean
Claim ships to clearinghouse.
WARN
Reauth trigger fired
Ship now, refile in 14 days.
BLOCK
Hold queue
Resolve before submission.

The reauth trigger at 20 percent remaining is the operational kicker. It gives the clinical team enough lead time to file the reassessment and treatment plan before the auth runs out, which avoids the gap days where treatment continues but no auth covers it. A 97155 note in the billing period covering the RBT is the artifact most payers ask for in a post-pay audit. The auth balance subtracts in real time, which means an authorization with 80 remaining units at 9:00am can drop to 0 by 4:00pm after a full day of treatment posts, and the gate has to evaluate the current balance at the moment each claim is staged for submission rather than against the balance recorded at the start of the day.

The time-match check on Rule 12 catches the highest-frequency takeback driver in the audit pool. A note that shows clock-in 9:02am and clock-out 11:00am cannot bill 8 units of 97153 because the session is 1 hour 58 minutes, not the clean 2 hours. After the round-down rule that most payers apply, that note bills 7 units, and the gate refuses to ship the 8th unit even if the billing template defaulted to 8. The state-licensure check on Rule 19 matters in Massachusetts, Arizona, Virginia, Kentucky, North Carolina, Oklahoma, Tennessee, and a growing list of states that require independent ABA practitioner licensure on top of the BACB credential. Each state has its own renewal cycle, and the gate carries a state-specific lookup so that a lapsed Massachusetts license on a Massachusetts beneficiary holds the claim without affecting the rest of the roster.

Anonymized worked example

42-site ABA chain. $1.4M reversed.

  • Pre-gate baseline. Denial rate on 97153 sat at 14.7 percent. Monthly takebacks averaged $78K. Cash days outstanding 52.
  • Activation in 90 days. Gate enabled site by site. Five senior coordinators trained. Parallel run kept billing safe during cutover.
  • Steady-state by month 10. Denial rate held at 3.9 percent. Takebacks ran zero. Cash days outstanding 28. NCR first-pass 98 percent.
  • 18-month cumulative reversal. Recovered takebacks totaled $1.4M. Zero auth-expired session claims billed for twelve months running.
18-MO TAKEBACK $ M 0 M 18 $78K/mo $0/mo
ASP-RCM · senior partner team 97153 takeback $ trend · 18 months

Engagement profile

States
4
AZ, NV, NM, TX
Monthly gross
$3.6M
Mixed payer roster
Beneficiaries
720
Active in treatment
Sites
42
Centers in four states

Pre-gate CARC 197 root cause breakdown

Root cause % of CARC 197 Gate rule that caught it
Auth expired on DOS41%Rule 01
Units depleted28%Rule 02
CPT not on auth code list19%Rule 03
Place-of-service mismatch12%Rule 05

$1.4M recovery composition

PREVENTED DENIALS
$580K
Shipped clean inside the hold window.
PREVENTED TAKEBACKS
$440K
Would have hit at 90-120 day post-pay audit.
RECOVERED AUTH UNITS
$380K
Flagged for reauth before expiry. Would have been write-off.

90-day activation timeline

DAYS 1-14 · DATA PULLS
Credential OS stand-up. Rule configuration per payer.
17 of 84 BCBAs had lapsed BACB lookups. 23 of 312 RBTs missing supervisor assignments. 9 calendar days to clean.
DAYS 15-45 · PARALLEL RUN
Both pipelines live. Gate holds reviewed but not enforced.
Parallel run caught $186K of would-be denials in the first 30 days. Built internal credibility with the billing team.
DAYS 46-90 · SITE CUTOVER
Two sites per week. Hold queue training.
By day 90, all 42 sites running the gate at submission. Senior coordinators owning the daily hold queue review.

Dashboard viewWhat the billing lead actually sees.

A live view of every active authorization across all sites with the supervision ratio and the session note feed joined in. Green is healthy. Amber is the reauth trigger window. Red is the close window. Coordinators work the amber and red queues every morning.

Active auths · multi-site · all states refreshed 14s ago
Beneficiary A · PhoenixRBT: M. Chen · BCBA: T. Park
97153
62%
Beneficiary B · TucsonRBT: J. Smith · BCBA: T. Park
97153
48%
Beneficiary C · MesaRBT: A. Davis · BCBA: K. Liu
97153
84%
Beneficiary D · MesaRBT: A. Davis · BCBA: K. Liu
97155
79%
Beneficiary E · TempeRBT: R. Patel · BCBA: K. Liu
97153
35%
Beneficiary F · PhoenixRBT: M. Chen · BCBA: T. Park
97153
97%
Beneficiary G · PhoenixRBT: S. Garcia · BCBA: T. Park
97153
88%
Beneficiary H · TucsonRBT: J. Smith · BCBA: T. Park
97155
42%
+842 more across 42 sites · 4 red · 27 amber
Engagement ScorecardQuarterly partner report · anonymized
WORKED EXAMPLE

KPI movement before vs current.

Denial rate · 97153
14.7%
3.9%
Auth-expired takebacks
$78K/mo
$0/mo
Supervision ratio compliance
73%
98%
NCR first-pass
86%
98%
Cash days outstanding
52d
28d
Time-on-claim audit recovery
11%
0.4%
Q4 · 2026 ASP-RCM Senior Partner

The first month was the change. Once the three-way gate caught two takebacks we would have shipped, the team understood it. By month four, no one wanted to bill without the gate running.

CFO · 42-site ABA chain · anonymized

Implementation checklistStand up the gate in 90 days.

The eight steps below are the sequence ASP-RCM runs with every new ABA client. The first six are the bulk of the work. The last two lock in the discipline.

01
Pull 90 days of denial data and the takeback log.
CARC and RARC codes. Map root cause by category.
02
Map authorization to billing.
Reconcile auth balance and code-list against the prior 90 days.
03
Pull the supervision ratio report by RBT.
Identify the periods where the ratio drifted below the floor.
04
Stand up the credential file in Credential OS.
Every BCBA and RBT with active BACB lookup and licensure dates.
05
Configure the 20 Pre-Flight rules per payer.
Payer-specific thresholds applied. Test with parallel run.
06
Enable the gate site by site.
Two sites per week. Senior coordinators trained on the hold queue.
07
Stand up the hold queue ritual.
Daily morning review. Resolution targets by category.
08
Run the quarterly partner scorecard.
KPI movement vs baseline. Recovered dollars tracked.

Three pitfalls every implementation surfaces

PITFALL 01
Credential file is the bottleneck.
Most rosters carry expired certifications, missing supervisor assignments, and stale licensure dates. The 14-day Credential OS window is allocated for a reason.
PITFALL 02
Supervision baseline disappoints.
Prior spreadsheets tracked monthly aggregates, not rolling 30-day windows by RBT. The gap surfaces immediately. Use it as a target, not a blame artifact.
PITFALL 03
Hold queue ritual drifts.
Highest leverage and most likely to fade after the consultant leaves. Named owner, SLA per category, weekly senior-partner review with the CFO.

Hold-queue SLA by category

Hold category Resolution SLA First owner
Auth holdSame dayCoordinator
Note hold24 hoursCoordinator
Supervision hold48 hoursBilling supervisor
Credential hold5 business daysRCM director
"The discipline is what makes the gate sustainable. The technology is the easy part."
Senior partner ritual · ASP-RCM

Escalation ladder

TIER 1
Coordinator
Owns daily morning queue, routes within SLA.
TIER 2
Billing supervisor
Hold past SLA. Calls clinical to resolve.
TIER 3
RCM director
Systemic pattern. Engages payer or credential team.
TIER 4
Senior partner
Weekly review with client CFO. Strategic decisions.

Quarterly partner scorecards close the loop. Each quarter the senior partner team produces a movement report against baseline that the client CFO reads in fifteen minutes and challenges in detail in another fifteen. Denial rate movement on 97153, takeback recovery in dollars, supervision ratio compliance by RBT, NCR first-pass on the top three payers, and recovered authorization units that would have written off. Pattern-level findings flow back into the rule library so that a payer policy shift caught at one client tightens the gate for every other client running the same payer.

GlossaryThe vocabulary of ABA billing.

BACB
Behavior Analyst Certification Board. The credentialing body for BCBAs and RBTs.
BCBA
Board Certified Behavior Analyst. The supervising clinician role in ABA.
RBT
Registered Behavior Technician. The rendering provider for most direct treatment.
BHCOE
Behavioral Health Center of Excellence. Accreditation body for ABA practices.
Auth
Authorization. The payer-issued approval that covers a date range and unit count.
Takeback
Post-pay reversal where the payer claws back funds for a previously paid claim.

About the authorsWho wrote this paper.

Aparna Suresh
Senior partner · BACB co-author · ASP-RCM
Co-author of the BACB Essential First Step. Built the ABA RCM practice that the handbook is sourced from. Founded ASP-RCM in 2019.
ASP-RCM ABA team
Clinical · Billing · Credential OS build
The senior partner team behind the three-way match service inside Credential OS, the 20 Pre-Flight rule library, and the worked examples that anchor this paper.

Common questionsFrequently asked: three-way match.

What is the three-way match?
A pre-submission gate that confirms three sources agree before an ABA claim ships: the active authorization on file, the supervision ratio policy required by the payer, and the EHR session note for that date, time, location, and rendering provider. If any disagree, the claim is held. If all three agree, it ships.
Which CPT codes does the handbook cover?
All eight ABA codes from 97151 through 97158. 97151 assessment, 97152 supporting assessment, 97153 adaptive behavior treatment by protocol, 97154 group adaptive behavior treatment, 97155 adaptive behavior protocol modification, 97156 family adaptive behavior treatment guidance, 97157 multiple-family group treatment guidance, and 97158 group adaptive behavior protocol modification.
What are the 20 Pre-Flight validator rules?
A library of payer-agnostic and payer-specific rules grouped into four categories: authorization rules (active dates, unit balance, code-on-auth), supervision rules (ratio threshold, supervising BCBA assignment, supervision note attached), session-note rules (timestamp matches billed time, location matches, rendering provider matches), and provider rules (BACB credential active, RBT supervision link valid).
How does this connect to Credential OS?
Credential OS carries the BCBA, BCaBA, and RBT certification status, the BACB credential lookup, and supervising-BCBA assignment per RBT. The three-way match pulls those facts as inputs at the moment of submission. Without a real platform behind the credential data, the validator rules collapse into stale spreadsheets.
What does BHCOE alignment mean here?
The handbook is reviewed against the BHCOE Clinical and Operational Standards for ABA. ASP-RCM is the only RCM vendor with a BHCOE channel partnership. The validator rules are tuned to BHCOE expectations on auth, supervision, and session documentation.
Does the gate slow down submission?
Net no. The hold queue absorbs roughly 3 percent of claims that would have shipped and been denied or taken back. Those claims get resolved inside the gate window and shipped clean. The remaining 96 percent of claims ship faster because the gate runs in milliseconds inside the EHR-to-clearinghouse path.
What is the worked example?
An anonymized 42-site ABA chain across four states. Pre-gate denial rate 14.7 percent on 97153. Pre-gate takebacks ran $78K per month. Post-gate denial rate 3.9 percent. Zero auth-expired session claims billed for twelve months running. Cumulative recovery $1.4M across 18 months.
Does this work for a single-site practice?
Yes. The three-way match logic is identical at any scale. Single-site practices, multi-state chains, and IDDs all run the same gate. The economics scale with volume. The discipline is the same.

Want this handbook applied to your data?

Send 90 days of denial data, your authorization log, your supervision ratio report by RBT, and your provider roster. Inside 30 days, a written audit, recoverable revenue in dollars, and a 90-day fix plan. Yours to keep.