Maryland ABA Compliance: The 75/25 Supervision Rule
A practical guide to Maryland's COMAR 10.09.36.08 requirement: audit methodology, documentation standards, economic impact, and the compliance infrastructure providers need to survive MCO scrutiny.
18 min read
What the 75/25 Rule Actually Requires
Maryland's 75/25 supervision rule (COMAR 10.09.36.08), enforced through MCO audits beginning January 2024, requires BCBAs to deliver at least 25% of clinical supervision via in-person observation for all Medicaid-funded ABA cases. More stringent than both the BACB's 5% fieldwork standard and neighboring states' telehealth-flexible models, the requirement affects 285 enrolled providers serving 8,400 children across Maryland's $312 million annual Medicaid ABA spend.
The burden falls hardest on hybrid supervision models relying on remote BCBAs, who must now coordinate monthly in-person touchpoints across distributed caseloads under documentation standards built to withstand intensified MCO audit scrutiny.
The lead behavioral health MCO, covering 62% of Medicaid lives across 4 of 9 MCOs, now conducts systematic supervision audits with average clawbacks of $47,000 per non-compliant provider. Initial audit failure rates sit at 31%, driven primarily by inadequate session note documentation, missing modality distinctions, and gaps in monthly compliance cadence.
The path forward requires building compliance infrastructure proactively, not reactively. Providers need supervision scheduling, documentation protocols, and waiver strategies that anticipate MCO audit methodology while sustaining clinical efficiency at Maryland Medicaid's $68.40/hour rate for CPT 97153.
Maryland ABA at a Glance
Key Metrics at a Glance
Maryland Medicaid ABA beneficiaries (CMS-416 2024)
Annual Medicaid ABA spend (FY2024)
Enrolled ABA provider organizations
Licensed BCBAs in Maryland (BACB Registry Q1 2026)
Required in-person supervision (vs. 5% BACB minimum)
Medicaid reimbursement rate for CPT 97153/hour
Maryland's 75/25 Rule: Statutory Basis and Enforcement Evolution
Maryland's supervision requirement originates from COMAR 10.09.36.08, initially adopted in January 2020 as part of the state's comprehensive ABA coverage regulations under the Maryland Medical Assistance Program. The regulation mandates that 'a supervising practitioner shall provide a minimum of 25% of supervision through direct, in-person observation of the behavior technician implementing the treatment plan.' This exceeds both the BACB's Ethics Code requirement (5% direct observation) and the supervision standards in adjacent jurisdictions: Virginia (10%), Pennsylvania (no specified minimum), and Delaware (following BACB standards).
Initial Implementation (Jan 2020 - Dec 2022)
Educational warnings only. Fewer than 5% of providers were audited. The focus was on awareness and education rather than enforcement.
Transition Period (Jan 2023 - Jun 2025)
Corrective action plans issued. Audit frequency increased to 15% of providers annually. Providers given opportunity to remediate without financial penalty.
Active Enforcement (Jul 2025 - Present)
Full clawbacks and terminations. Audit frequency now 40% of providers annually. The shift coincided with Maryland's transition to a centralized behavioral health MCO platform covering 4 of 9 MCOs.
The standardized audit protocols deployed across multiple states brought industrial-scale compliance review to a market previously characterized by MCO-specific, relationship-based oversight. What worked informally before 2025 is no longer sufficient.
Operational Interpretation Challenges
The regulation's seemingly straightforward 25% requirement masks significant operational complexity. Key interpretation issues that drive audit failures include how the 25% threshold is calculated and applied across cases.
The regulation does not specify whether the 25% applies to: total supervision hours per case per month, total supervision hours per RBT per month, aggregate supervision across the provider organization, or rolling averages versus monthly snapshots.
The lead MCO's audit methodology applies the strictest interpretation: 25% of supervision hours for each unique beneficiary must occur in-person within each calendar month, with no averaging across months or cases.
For providers utilizing hybrid models with remote BCBAs supplementing local staff, the regulation creates scheduling bottlenecks. A remote BCBA supervising 12 cases must coordinate at least 3 in-person supervision sessions monthly (assuming 1 hour supervision per case), requiring either concentrated travel windows or handoffs to local BCBAs solely for compliance purposes.
Acceptable evidence of in-person supervision requires: timestamped session notes indicating physical presence, distinct documentation from remote supervision sessions, parent/caregiver attestation of BCBA presence (best practice), and GPS-enabled timeclock entries (increasingly required by MCOs).
MCO Audit Methodology: What to Expect
Based on provider reports from 47 completed audits (July 2025 - March 2026), the MCO review process follows a predictable pattern that providers can prepare for in advance.
Audit Notice
Case selection of 10-20 files. No failure triggers at this stage. Providers receive advance notice of the audit scope.
Documentation Request
6-month lookback period. Failure trigger: missing monthly records. All supervision logs and session notes for the lookback period must be produced.
Initial Review
Review of supervision logs and session notes. Failure trigger: less than 25% documented as in-person. Modality distinctions are the primary focus.
Provider Response
Remediation evidence submitted. Failure trigger: inconsistent attestations. Providers can submit additional evidence but retroactive fixes are difficult to substantiate.
Final Determination
Clawback calculation issued. Failure trigger: pattern of non-compliance. Repeat failures can trigger extended lookback periods of up to 24 months.
Critical Audit Vulnerabilities by Failure Rate
Session Note Insufficiency: notes stating 'supervision provided' without specifying in-person vs. remote
Monthly Gap Patterns: consistent in-person supervision that misses isolated months
RBT-BCBA Mismatch: in-person supervision by non-assigned BCBAs not properly documented
Calculation Disputes: provider math versus auditor interpretation
Economic Impact Analysis
The 75/25 rule imposes quantifiable operational burdens that directly impact provider economics. For a typical 8-BCBA practice, annual compliance costs total $171,264 before considering audit risk exposure.
Annual Compliance Cost per BCBA
Additional travel time (3 hrs/week x 48 weeks x $60.67/hr)
Documentation overhead (2 hrs/week x 48 weeks x $58/hr)
Scheduling inefficiency (10% capacity reduction x $86,400 annual)
Audit preparation (48 hrs/year x $58/hr)
Total compliance burden (24.8% of median BCBA compensation)
Additional billable hours required annually per 8-BCBA practice to offset compliance overhead at $68.40/hr (97153)
Audit risk exposure compounds these direct costs. Based on reported clawback amounts from 31 providers who failed initial audits: 35% received clawbacks of $10,000-$25,000 (average $18,200); 42% received $25,001-$50,000 (average $37,400); 19% received $50,001-$100,000 (average $71,300); and 4% received over $100,000 (average $147,000, negotiated settlement).
The clawback calculation typically encompasses: all supervision hours billed (97155) for non-compliant months, a portion of treatment hours (97153) deemed inadequately supervised, and interest and penalties at 1.5% monthly after 60 days.
Competitive Market Dynamics
The 75/25 rule creates asymmetric competitive advantages based on operating model. Understanding which business types benefit and which face existential pressure is critical for strategic planning.
Traditional brick-and-mortar centers: already conducting in-person supervision as standard practice. High-Medicaid-concentration providers: forced compliance yields operational discipline. Maryland-native organizations: local BCBA workforce reduces travel burden.
Multi-state operators: remote supervision models broken by Maryland requirements. Private equity roll-ups: centralized clinical teams cannot achieve compliance at scale. Rural providers: geographic dispersion makes 25% in-person economically unviable.
Market exits since enforcement began include approximately 3 multi-state operators and 7 rural providers, representing approximately 4% of licensed capacity. Local providers should prepare for consolidation opportunities.
Regulatory & Policy Context
Maryland's 75/25 rule exists in tension with federal telehealth flexibilities expanded during COVID-19 and extended through December 2024 via the Consolidated Appropriations Act. While CMS guidance permits states to define medical necessity and supervision standards for Medicaid-covered services, the federal push toward telehealth parity creates potential challenge vectors including EPSDT mandate arguments, ADA implications for rural beneficiaries, and interstate commerce challenges by multi-state operators.
Maryland: 25% monthly, Active Clawbacks
Case-by-case waiver provisions with less than 15% approval rate. The strictest enforcer in the Mid-Atlantic region.
Virginia: 10% monthly, Educational Enforcement
Automatic waivers for rural counties. More flexible approach has attracted families from Maryland border counties.
New Jersey: 20% bi-weekly, Grace Periods
Liberal waiver provisions with over 60% approval rate. Enforcement uses grace periods rather than immediate clawbacks.
Pennsylvania/Delaware: BACB Standards (5%)
No specified minimum beyond BACB standards. Minimal enforcement activity. Significant competitive advantage for providers operating in these states.
House Bill 429 (2025 session), which would have reduced the in-person requirement to 10% and expanded waiver eligibility, died in committee in March 2025. The Maryland Association for Behavior Analysis (MDABA) continues lobbying for quarterly averaging, automatic waivers for cases more than 30 miles from a BCBA, and group supervision counting toward the in-person requirement.
Building Compliance Infrastructure: A Three-Phase Approach
Providers must architect systematic compliance processes that anticipate audit scrutiny. The following three-phase approach moves from immediate scheduling fixes through documentation protocols to full audit readiness.
Phase 1: Scheduling Architecture (Immediate)
Deploy scheduling software with supervision modality tracking (CentralReach, Rethink). Establish a 'First Friday' protocol: all in-person supervision for the month scheduled in the first 14 days. Create BCBA coverage maps ensuring every case has designated primary and backup in-person supervisors. Implement 'supervision surge weeks' where remote BCBAs concentrate travel.
Phase 2: Documentation Protocols (30 Days)
Standardize session note templates with mandatory modality fields. Require photo documentation of in-person sessions (with appropriate consent). Deploy GPS-enabled timeclock systems (ClockShark, TSheets) with geofencing. Institute monthly reconciliation reports comparing scheduled versus actual in-person percentage.
Phase 3: Audit Readiness (60 Days)
Conduct monthly mock audits using the MCO audit methodology. Maintain 12-month rolling supervision logs with modality breakdowns. Create audit response templates with pre-populated attestation forms. Establish legal counsel relationship specializing in Medicaid audit defense.
Compliant Hybrid Supervision Model Design
For organizations utilizing remote BCBAs, designing compliant hybrid models requires careful orchestration. Three viable models have emerged from provider experience since active enforcement began.
Regional Circuit Model
Remote BCBAs assigned geographic clusters. Monthly 2-3 day in-person circuits covering all cases. Local RBT leads facilitate observation sessions. Cost: $2,400/month travel stipend per remote BCBA.
Local Partnership Model
Contract with local BCBAs solely for in-person supervision. Remote BCBA maintains clinical oversight. Shared documentation in unified EHR. Cost: $45-60/hour for contract BCBA time.
Concentrated Service Model
Limit remote BCBA cases to single geographic zones. Relocate remote BCBAs quarterly for intensive supervision periods. Higher travel costs offset by reduced complexity. Cost: $4,000/quarter relocation expenses.
Target Operational Mix for Compliance Efficiency
In-person supervision target (buffer above 25% minimum)
Per BCBA (enables monthly in-person circuit)
Remote BCBA percentage (maintains local presence)
Monthly supervision per case (allows 1.5 hr in-person)
Emerging Risks to Monitor
Beyond the immediate compliance requirements, four structural risks have the potential to significantly compound the burden on Maryland ABA providers over the next 24 months.
Retroactive Audit Expansion
The lead MCO may extend lookback periods beyond 6 months to 24 months for providers with initial failures, potentially triggering clawbacks exceeding $200,000 for mid-size providers. Mitigation requires maintaining 24-month documentation reserves and considering audit insurance products.
BCBA Workforce Constraints
Maryland's 892 licensed BCBAs cannot physically provide 25% in-person supervision for all 8,400 beneficiaries if caseloads exceed 12-15, creating systemic capacity constraints that may force waitlists or service denials. Providers should model maximum sustainable capacity assuming full compliance.
Commercial Payer Adoption
While currently limited to Medicaid, commercial payers may adopt similar supervision requirements to align with state standards, extending compliance burden to the 65% of ABA services delivered under commercial coverage. Providers should implement universal compliance protocols now.
Technology Dependence
GPS-enabled documentation systems required for audit defense create vulnerability to technical failures, data breaches, and privacy challenges. Maintain redundant paper documentation for critical supervision sessions and ensure HIPAA-compliant BAAs with all technology vendors.
The Path Forward
Maryland's 75/25 supervision rule represents the leading edge of state-level efforts to ensure ABA quality through prescriptive operational requirements rather than outcome metrics. The sustainable path forward requires providers to embed compliance infrastructure into core operations rather than treating it as an administrative overlay, while actively engaging in advocacy for evidence-based regulatory refinement.
Success in this environment belongs to operators who view the 25% threshold as a minimum floor for quality rather than a maximum ceiling for compliance. Providers who build systematic infrastructure now will be positioned to absorb future regulatory changes from a position of strength.
Read more
ABA Industry Report 2026: The State of Revenue Cycle Management
A data-driven guide to the billing and RCM challenges facing ABA practices in 2026 — denial rates, authorization trends, staffing pressures, and what leading clinics are doing differently.
Read the reportState TrackerABA Rate Cuts State Tracker: Where Cuts Are Happening and How Providers Are Responding
Seven states have implemented or proposed ABA rate reductions totaling $486 million in annualized reimbursement. Track where cuts are happening and how providers are responding.
View the tracker