ABA Compliance: What To Do When You Don't Know Where to Start

At some point, many ABA leaders realize compliance can't live in the back of their mind anymore.

Maybe the organization is growing.

Maybe Medicaid is now part of the payer mix.

Maybe a payer requested records.

Maybe you realized your QA efforts were starting to veer toward something different.

Maybe someone asked, "Do we have a compliance plan?" and the answer was, "What do you mean? What's a compliance plan?"

Or maybe nothing specific happened at all. You just have the uncomfortable sense that there are probably gaps somewhere, and you're not sure where to look first.

All of these are really common scenarios that we see every day. In all of them, something causes a nervousness that there's something you should be doing, but you aren't sure what and don't know how to find out.

ABA organizations are often built by clinicians, owners, and operators who are very good at solving the problems directly in front of them. Staffing. Turnover. Treatment decisions. Authorizations. Billing. Parent communication. Schedule changes. Documentation. Cancellations. Wash, rinse, repeat.

Meanwhile, new requirements keep popping up.

Another payer expectation.

Another training requirement.

Another documentation standard.

Another authorization requirement.

Another form.

Another credentialing rule.

Another audit concern.

None of them seem particularly large by themselves, but they add up.

Until one day you realize you're not just running an ABA organization, you're running a healthcare organization.

You go from, "We need to make sure we are delivering excellent ABA services" to, "We need to do something about compliance."

And then immediately after that:

"I have no idea where to start."

Where should you start with ABA compliance?

Start with a compliance risk assessment, not a policy manual or a note audit. A risk assessment shows you where your organization is most exposed right now, so you can build a compliance plan that addresses your highest risks first instead of whatever feels most urgent. In compliance, sequence matters. Assess first, then plan, then build.

That order mirrors how you already work clinically. You would never start treatment before assessing the client, setting goals, and writing a plan. Compliance works the same way.

Why Compliance Feels So Hard to Start

The first problem is that "compliance" sounds like one thing. It sounds like a state you can achieve. "We are compliant."

But it's not one thing. It's a practice and a process that must respond to all the context and contingencies in play.

In ABA, compliance may touch:

• clinical documentation
• billing practices
• payer requirements
• staff qualifications
• licensing
• supervision
• HIPAA
• incident reporting
• internal auditing
• corrective action
• training
• policies and procedures

The list goes on and on.

So when someone says, "We need to work on compliance," the next question is usually:

"Okay. Which part?"

That's where many organizations get stuck.

They start with whatever feels most urgent or whatever seems to have the most concrete requirements. A policy manual. A note audit. HIPAA training. A compliance officer job description. A payer handbook. A folder called "Compliance" that everyone hopes will eventually become a system.

All of those things may be useful.

But they are not automatically the right starting point, and starting with what feels most urgent can turn into a random game of whack-a-mole.

Why "Feels Urgent" Is Not Always the Starting Point

It helps to start with what the function of compliance is.

The purpose of compliance is to help organizations prevent problems where they can, detect problems when they occur, and respond appropriately when something goes wrong. Those three functions come straight from the HHS Office of Inspector General's guidance on effective compliance programs, and they hold whether you run a five-person startup or a 200-person group.

In compliance, we often talk about those potential problems as risks.

Risk isn't a mysterious compliance concept. It's simply a way of describing where problems are most likely to occur and how significant the consequences would be if they did.

Often, ABA leaders approach compliance like a to-do list:

"Just tell me what I have to do and I'll do it."

This makes sense, but you can see it can't answer all of the important questions:

What problems can happen here?

If something happens, how big of a problem will it actually be?

And what can I do to manage it?

Compliance is actually much closer to clinical decision-making than you might think. You're constantly evaluating the context you're operating in, what's going right, what could go wrong, what is going wrong, and whether your current systems can respond appropriately.

The reality is, the problems facing a five-person startup are different from the problems facing a 200-person organization billing Medicaid across multiple locations.

The risks are different.

Which means the priorities are different.

Which means the compliance activities should be different.

An effective compliance program requires shifting from asking only,

"What are we required to do?"

to asking

"Where are we most exposed to risk right now?"

The Problem With Starting Randomly

When compliance work starts randomly, organizations can spend a lot of time building things that do not address their highest risks.

For example, an organization might spend weeks revising a policy manual while their session notes do not support medical necessity or meet payer requirements. If that gap sounds familiar, it's the exact problem we unpack in Your Note Describes the Session. Does It Defend the Bill?.

Another organization might train staff on documentation while no one is reviewing whether billing matches what was actually documented.

Another might assign someone as the compliance officer without giving that person authority, protected time, or a clear reporting pathway. What that role actually needs to succeed is its own question, one we cover in Positioning Compliance Officers for Success in ABA Organizations.

The issue is not effort.

The issue is sequence. Much like clinical work, where you start has a major effect on where you end up.

Compliance work is much easier to manage and much more effective when you know what needs attention first and start there.

So Where Do I Start? A Risk Assessment

Once again, our clinical practices give us a meaningful structure for compliance. Just as in clinical work, knowing where to start requires assessing where you are right now and knowing where you're headed. You would never just start providing treatment. You would assess your client, identify goals, and develop a plan for reaching those goals.

A compliance risk assessment tells you where you are and helps answer the question:

"Where do we need to go, and where should we start?"

It is not the same as a session note audit, although documentation may be part of it.

It is not the same as a policy review, although policies may be reviewed.

It is not the same as buying a compliance manual, although policies and procedures may eventually need to be built.

A risk assessment looks across the organization to identify where compliance risk is most likely to occur and where the current systems may not be strong enough to prevent it, detect it, or respond to it. That includes knowing which activities actually deserve your monitoring attention, a question we dig into in How to Know What to Audit.

In ABA, that may include questions like:

• Are session notes supporting the services billed?
• Are provider qualifications and supervision requirements being monitored?
• Are billing practices aligned with payer rules and authorization terms?
• Are you recruiting staff and clients in compliant ways?
• Are compliance concerns documented and escalated appropriately?
• Are policies actually implemented, or do they only exist on paper?
• Is someone reviewing the work of billers, supervisors, and documentation reviewers?
• Does leadership have visibility into compliance trends?
• Are corrective actions tracked to completion?

The goal is not to find every possible flaw.

The goal is to create visibility and a roadmap. A clear picture of where you are and where you need to get to.

Once you assess, creating a plan to get from where you are to where you need to be becomes much more manageable. A good risk assessment should result in a compliance plan.

The Goal Is Not Perfection

A good compliance program does not mean nothing ever goes wrong. Remember, there's no such thing as reaching a state of compliance.

That's not how healthcare works.

And it is definitely not how ABA works.

Payers and regulators do not expect perfection. But they do expect organizations to take compliance seriously.

They expect systems.

They expect clear plans.

They expect oversight.

They expect documentation.

They expect follow-through.

When something goes wrong, the question is not only:

"What happened?"

It is also:

"Could the organization have known?"

And:

"What did the organization do once they found out?"

Signs You May Need a Risk Assessment and a Compliance Plan

A risk assessment may be a good next step if you are thinking things like:

"We know we need to deal with compliance, but we don't know what that should look like."

"We have policies, but I'm not sure they match what we actually do."

"We review notes, but I'm not sure we're auditing the right things."

"We have grown quickly and our systems haven't caught up."

"We take Medicaid and I'm not sure whether our compliance infrastructure is enough."

"We keep finding issues after the fact."

"We have a compliance person, but the role isn't clearly defined."

"We want to be proactive, but we don't know what to prioritize."

If any of those sound familiar, the problem may not be that you are behind.

The problem may be that you need a clearer map.

A Practical Way to Think About Starting

If you are trying to strengthen compliance, resist the urge to start with the biggest binder.

Start with the biggest risks.

For many ABA organizations, that means looking first at:

1. Session notes. Do your notes support the service billed?
2. Billing alignment. Does the claim match the authorization, provider, code, time, and documentation?
3. Supervision and qualifications. Are staff qualified, supervised, and monitored according to payer and regulatory expectations?
4. Reporting and escalation. Do staff have a way to raise concerns, and does the organization track what happens next? (If you don't have that pathway yet, here's why every ABA agency needs one.)
5. Oversight. Does leadership actively evaluate whether the system is working?

Then make a plan to address them. You do not have to fix everything at once.

But you do need to know where you are and where you're headed.

Frequently Asked Questions

Where should an ABA organization start with compliance?
Start with a compliance risk assessment. It shows you where your organization is most exposed before you spend time building policies, running audits, or writing job descriptions. A risk assessment gives you the information you need to sequence the work, so you address your highest risks first instead of whatever feels most urgent.

What is a compliance risk assessment in ABA?
A compliance risk assessment looks across your whole organization to find where compliance problems are most likely to happen and where your current systems may not be strong enough to prevent, detect, or respond to them. It's broader than a session note audit or a policy review, though it may include both. The result is a clear picture of your risks and a roadmap for what to fix first.

Is a risk assessment the same as a session note audit?
No. A session note audit looks closely at documentation. A risk assessment looks across the entire organization, including documentation, billing, supervision, reporting, and oversight, to find where you are most exposed. Documentation may be one part of a risk assessment, but it isn't the whole thing.

Do we need a compliance plan if we're a small ABA agency?
Yes. The risks facing a five-person startup differ from those facing a 200-person group billing Medicaid across states, but every organization carries risk. Payers and regulators don't expect perfection. They expect you to take compliance seriously, with systems, plans, oversight, and follow-through. A small agency's plan can be lean, but it should still exist.

What do payers and regulators actually expect from a compliance program?
Not perfection. They expect systems, clear plans, oversight, documentation, and follow-through. When something goes wrong, they ask whether the organization could have known, and what it did once it found out. A functioning compliance program answers both questions well.

Final Takeaway

If compliance feels overwhelming, that doesn't mean you are doing something wrong.

It may mean you are trying to build the solution before you have assessed the problem and made a solid plan.

ABA leaders are used to assessment-first thinking in clinical work. Compliance is not so different.

Assess where you are.

Identify where you're going.

Make a plan for getting there.

That is the purpose of a risk assessment and compliance plan. It gives you a clearer picture of your current compliance infrastructure, identifies priority areas, and helps turn "I don't know what I don't know" into a practical action plan.

If your organization is growing, billing Medicaid, preparing for audits, or simply realizing that informal systems are no longer enough, a risk assessment can help you decide what needs attention first.

Want to see what that looks like for your agency? Learn about our Personalized Compliance Risk Assessment and Roadmap. We'll help you find your highest risks and leave you with a clear, prioritized plan.