Compliance Checklist

Maryland ABA Compliance: The 75/25 Supervision Rule

A practical guide to Maryland's COMAR 10.09.36.08 requirement: audit methodology, documentation standards, economic impact, and the compliance infrastructure providers need to survive MCO scrutiny.

18 min read

Overview

What the 75/25 Rule Actually Requires

Maryland's 75/25 supervision rule (COMAR 10.09.36.08), enforced through MCO audits beginning January 2024, requires BCBAs to deliver at least 25% of clinical supervision via in-person observation for all Medicaid-funded ABA cases. More stringent than both the BACB's 5% fieldwork standard and neighboring states' telehealth-flexible models, the requirement affects 285 enrolled providers serving 8,400 children across Maryland's $312 million annual Medicaid ABA spend.

The burden falls hardest on hybrid supervision models relying on remote BCBAs, who must now coordinate monthly in-person touchpoints across distributed caseloads under documentation standards built to withstand intensified MCO audit scrutiny.

The Enforcement Stakes

The lead behavioral health MCO, covering 62% of Medicaid lives across 4 of 9 MCOs, now conducts systematic supervision audits with average clawbacks of $47,000 per non-compliant provider. Initial audit failure rates sit at 31%, driven primarily by inadequate session note documentation, missing modality distinctions, and gaps in monthly compliance cadence.

The path forward requires building compliance infrastructure proactively, not reactively. Providers need supervision scheduling, documentation protocols, and waiver strategies that anticipate MCO audit methodology while sustaining clinical efficiency at Maryland Medicaid's $68.40/hour rate for CPT 97153.

Key Metrics

Maryland ABA at a Glance

Key Metrics at a Glance

8,400

Maryland Medicaid ABA beneficiaries (CMS-416 2024)

$312M

Annual Medicaid ABA spend (FY2024)

285

Enrolled ABA provider organizations

892

Licensed BCBAs in Maryland (BACB Registry Q1 2026)

25%

Required in-person supervision (vs. 5% BACB minimum)

$68.40

Medicaid reimbursement rate for CPT 97153/hour

Regulatory Framework

Maryland's 75/25 Rule: Statutory Basis and Enforcement Evolution

Maryland's supervision requirement originates from COMAR 10.09.36.08, initially adopted in January 2020 as part of the state's comprehensive ABA coverage regulations under the Maryland Medical Assistance Program. The regulation mandates that 'a supervising practitioner shall provide a minimum of 25% of supervision through direct, in-person observation of the behavior technician implementing the treatment plan.' This exceeds both the BACB's Ethics Code requirement (5% direct observation) and the supervision standards in adjacent jurisdictions: Virginia (10%), Pennsylvania (no specified minimum), and Delaware (following BACB standards).

01
Initial Implementation (Jan 2020 - Dec 2022)

Educational warnings only. Fewer than 5% of providers were audited. The focus was on awareness and education rather than enforcement.

02
Transition Period (Jan 2023 - Jun 2025)

Corrective action plans issued. Audit frequency increased to 15% of providers annually. Providers given opportunity to remediate without financial penalty.

03
Active Enforcement (Jul 2025 - Present)

Full clawbacks and terminations. Audit frequency now 40% of providers annually. The shift coincided with Maryland's transition to a centralized behavioral health MCO platform covering 4 of 9 MCOs.

Why Active Enforcement Changed Everything

The standardized audit protocols deployed across multiple states brought industrial-scale compliance review to a market previously characterized by MCO-specific, relationship-based oversight. What worked informally before 2025 is no longer sufficient.

Section 01

Operational Interpretation Challenges

The regulation's seemingly straightforward 25% requirement masks significant operational complexity. Key interpretation issues that drive audit failures include how the 25% threshold is calculated and applied across cases.

Ambiguous Interpretations

The regulation does not specify whether the 25% applies to: total supervision hours per case per month, total supervision hours per RBT per month, aggregate supervision across the provider organization, or rolling averages versus monthly snapshots.

MCO's Strict Interpretation

The lead MCO's audit methodology applies the strictest interpretation: 25% of supervision hours for each unique beneficiary must occur in-person within each calendar month, with no averaging across months or cases.

For providers utilizing hybrid models with remote BCBAs supplementing local staff, the regulation creates scheduling bottlenecks. A remote BCBA supervising 12 cases must coordinate at least 3 in-person supervision sessions monthly (assuming 1 hour supervision per case), requiring either concentrated travel windows or handoffs to local BCBAs solely for compliance purposes.

Documentation Standards

Acceptable evidence of in-person supervision requires: timestamped session notes indicating physical presence, distinct documentation from remote supervision sessions, parent/caregiver attestation of BCBA presence (best practice), and GPS-enabled timeclock entries (increasingly required by MCOs).

Section 02

MCO Audit Methodology: What to Expect

Based on provider reports from 47 completed audits (July 2025 - March 2026), the MCO review process follows a predictable pattern that providers can prepare for in advance.

T-30
Audit Notice

Case selection of 10-20 files. No failure triggers at this stage. Providers receive advance notice of the audit scope.

T-14
Documentation Request

6-month lookback period. Failure trigger: missing monthly records. All supervision logs and session notes for the lookback period must be produced.

T+0
Initial Review

Review of supervision logs and session notes. Failure trigger: less than 25% documented as in-person. Modality distinctions are the primary focus.

T+14
Provider Response

Remediation evidence submitted. Failure trigger: inconsistent attestations. Providers can submit additional evidence but retroactive fixes are difficult to substantiate.

T+30
Final Determination

Clawback calculation issued. Failure trigger: pattern of non-compliance. Repeat failures can trigger extended lookback periods of up to 24 months.

Critical Audit Vulnerabilities by Failure Rate

43%

Session Note Insufficiency: notes stating 'supervision provided' without specifying in-person vs. remote

31%

Monthly Gap Patterns: consistent in-person supervision that misses isolated months

18%

RBT-BCBA Mismatch: in-person supervision by non-assigned BCBAs not properly documented

8%

Calculation Disputes: provider math versus auditor interpretation

Section 03

Economic Impact Analysis

The 75/25 rule imposes quantifiable operational burdens that directly impact provider economics. For a typical 8-BCBA practice, annual compliance costs total $171,264 before considering audit risk exposure.

Annual Compliance Cost per BCBA

$8,736

Additional travel time (3 hrs/week x 48 weeks x $60.67/hr)

$5,568

Documentation overhead (2 hrs/week x 48 weeks x $58/hr)

$4,320

Scheduling inefficiency (10% capacity reduction x $86,400 annual)

$2,784

Audit preparation (48 hrs/year x $58/hr)

$21,408

Total compliance burden (24.8% of median BCBA compensation)

2,503 hrs

Additional billable hours required annually per 8-BCBA practice to offset compliance overhead at $68.40/hr (97153)

Audit risk exposure compounds these direct costs. Based on reported clawback amounts from 31 providers who failed initial audits: 35% received clawbacks of $10,000-$25,000 (average $18,200); 42% received $25,001-$50,000 (average $37,400); 19% received $50,001-$100,000 (average $71,300); and 4% received over $100,000 (average $147,000, negotiated settlement).

Clawback Calculation Scope

The clawback calculation typically encompasses: all supervision hours billed (97155) for non-compliant months, a portion of treatment hours (97153) deemed inadequately supervised, and interest and penalties at 1.5% monthly after 60 days.

Section 04

Competitive Market Dynamics

The 75/25 rule creates asymmetric competitive advantages based on operating model. Understanding which business types benefit and which face existential pressure is critical for strategic planning.

Winners Under the 75/25 Rule

Traditional brick-and-mortar centers: already conducting in-person supervision as standard practice. High-Medicaid-concentration providers: forced compliance yields operational discipline. Maryland-native organizations: local BCBA workforce reduces travel burden.

Organizations at Risk

Multi-state operators: remote supervision models broken by Maryland requirements. Private equity roll-ups: centralized clinical teams cannot achieve compliance at scale. Rural providers: geographic dispersion makes 25% in-person economically unviable.

Market Exits Since Enforcement

Market exits since enforcement began include approximately 3 multi-state operators and 7 rural providers, representing approximately 4% of licensed capacity. Local providers should prepare for consolidation opportunities.

Section 05

Regulatory & Policy Context

Maryland's 75/25 rule exists in tension with federal telehealth flexibilities expanded during COVID-19 and extended through December 2024 via the Consolidated Appropriations Act. While CMS guidance permits states to define medical necessity and supervision standards for Medicaid-covered services, the federal push toward telehealth parity creates potential challenge vectors including EPSDT mandate arguments, ADA implications for rural beneficiaries, and interstate commerce challenges by multi-state operators.

MD
Maryland: 25% monthly, Active Clawbacks

Case-by-case waiver provisions with less than 15% approval rate. The strictest enforcer in the Mid-Atlantic region.

VA
Virginia: 10% monthly, Educational Enforcement

Automatic waivers for rural counties. More flexible approach has attracted families from Maryland border counties.

NJ
New Jersey: 20% bi-weekly, Grace Periods

Liberal waiver provisions with over 60% approval rate. Enforcement uses grace periods rather than immediate clawbacks.

PA
Pennsylvania/Delaware: BACB Standards (5%)

No specified minimum beyond BACB standards. Minimal enforcement activity. Significant competitive advantage for providers operating in these states.

Legislative Outlook

House Bill 429 (2025 session), which would have reduced the in-person requirement to 10% and expanded waiver eligibility, died in committee in March 2025. The Maryland Association for Behavior Analysis (MDABA) continues lobbying for quarterly averaging, automatic waivers for cases more than 30 miles from a BCBA, and group supervision counting toward the in-person requirement.

Strategic Recommendations

Building Compliance Infrastructure: A Three-Phase Approach

Providers must architect systematic compliance processes that anticipate audit scrutiny. The following three-phase approach moves from immediate scheduling fixes through documentation protocols to full audit readiness.

01
Phase 1: Scheduling Architecture (Immediate)

Deploy scheduling software with supervision modality tracking (CentralReach, Rethink). Establish a 'First Friday' protocol: all in-person supervision for the month scheduled in the first 14 days. Create BCBA coverage maps ensuring every case has designated primary and backup in-person supervisors. Implement 'supervision surge weeks' where remote BCBAs concentrate travel.

02
Phase 2: Documentation Protocols (30 Days)

Standardize session note templates with mandatory modality fields. Require photo documentation of in-person sessions (with appropriate consent). Deploy GPS-enabled timeclock systems (ClockShark, TSheets) with geofencing. Institute monthly reconciliation reports comparing scheduled versus actual in-person percentage.

03
Phase 3: Audit Readiness (60 Days)

Conduct monthly mock audits using the MCO audit methodology. Maintain 12-month rolling supervision logs with modality breakdowns. Create audit response templates with pre-populated attestation forms. Establish legal counsel relationship specializing in Medicaid audit defense.

Hybrid Models

Compliant Hybrid Supervision Model Design

For organizations utilizing remote BCBAs, designing compliant hybrid models requires careful orchestration. Three viable models have emerged from provider experience since active enforcement began.

A
Regional Circuit Model

Remote BCBAs assigned geographic clusters. Monthly 2-3 day in-person circuits covering all cases. Local RBT leads facilitate observation sessions. Cost: $2,400/month travel stipend per remote BCBA.

B
Local Partnership Model

Contract with local BCBAs solely for in-person supervision. Remote BCBA maintains clinical oversight. Shared documentation in unified EHR. Cost: $45-60/hour for contract BCBA time.

C
Concentrated Service Model

Limit remote BCBA cases to single geographic zones. Relocate remote BCBAs quarterly for intensive supervision periods. Higher travel costs offset by reduced complexity. Cost: $4,000/quarter relocation expenses.

Target Operational Mix for Compliance Efficiency

30-35%

In-person supervision target (buffer above 25% minimum)

8-10 cases

Per BCBA (enables monthly in-person circuit)

less than 40%

Remote BCBA percentage (maintains local presence)

4-6 hrs

Monthly supervision per case (allows 1.5 hr in-person)

Key Risk Factors

Emerging Risks to Monitor

Beyond the immediate compliance requirements, four structural risks have the potential to significantly compound the burden on Maryland ABA providers over the next 24 months.

01
Retroactive Audit Expansion

The lead MCO may extend lookback periods beyond 6 months to 24 months for providers with initial failures, potentially triggering clawbacks exceeding $200,000 for mid-size providers. Mitigation requires maintaining 24-month documentation reserves and considering audit insurance products.

02
BCBA Workforce Constraints

Maryland's 892 licensed BCBAs cannot physically provide 25% in-person supervision for all 8,400 beneficiaries if caseloads exceed 12-15, creating systemic capacity constraints that may force waitlists or service denials. Providers should model maximum sustainable capacity assuming full compliance.

03
Commercial Payer Adoption

While currently limited to Medicaid, commercial payers may adopt similar supervision requirements to align with state standards, extending compliance burden to the 65% of ABA services delivered under commercial coverage. Providers should implement universal compliance protocols now.

04
Technology Dependence

GPS-enabled documentation systems required for audit defense create vulnerability to technical failures, data breaches, and privacy challenges. Maintain redundant paper documentation for critical supervision sessions and ensure HIPAA-compliant BAAs with all technology vendors.

Conclusion

The Path Forward

Maryland's 75/25 supervision rule represents the leading edge of state-level efforts to ensure ABA quality through prescriptive operational requirements rather than outcome metrics. The sustainable path forward requires providers to embed compliance infrastructure into core operations rather than treating it as an administrative overlay, while actively engaging in advocacy for evidence-based regulatory refinement.

The Bottom Line

Success in this environment belongs to operators who view the 25% threshold as a minimum floor for quality rather than a maximum ceiling for compliance. Providers who build systematic infrastructure now will be positioned to absorb future regulatory changes from a position of strength.