“Be audit-ready” has become the most-repeated advice in ABA. It's right, but it's not specific enough. When a payor sends a letter requesting two months of session notes across a dozen learners, what happens next depends on what your system can actually produce. When a state auditor asks for proof that treatment matched the plan, can your platform answer that question, or does someone on your team start reconstructing it from memory?
An audit letter shouldn't trigger an organization-wide archaeological dig. Yet for too many practices, that's exactly what happens.
Federal and state audits of Medicaid-funded ABA services have grown more frequent and more detailed. Across multiple state-level reviews, the Office of Inspector General has identified improper or potentially improper Medicaid claims, including deficiencies in documentation supporting services provided.
What struck me most reading those reports wasn't just the findings themselves. It was how many of the documentation failures could have been prevented long before an auditor ever asked a question.
What auditors are actually finding
The same categories keep showing up regardless of the state.
Notes that don't fully describe the service
A session happened, its note exists, but the documentation doesn't connect the care that was delivered to the treatment plan in enough detail for a reviewer to confirm medical necessity.
Missing or late signatures
Supervisor attestations that were never completed. Treatment plan approvals that didn't get signed before services started. Caregiver signatures that should have been collected and weren't.
Credentialing holes
Services billed for a provider who wasn't enrolled with the payor when the session took place. Sometimes the enrollment lapsed; sometimes it hadn't been completed yet. It gets flagged either way.
No documentation of what was modified in treatment
This is especially important for CPT 97155, the code that covers a BCBA®'s direct treatment with protocol modification. Auditors want to see what changed and why. If this week's note reads the same as last week's, it leaves room for questioning whether protocol modification was actually happening.
No verifiable record of who accessed or edited a patient record
This comes up more in HIPAA reviews and state licensure audits than in payor reviews. But as the compliance surface area grows with remote access, AI-assisted features, and high staff turnover, so does the expectation that a practice can show who saw what and when.
Not every audit finding is a software failure. But when the evidence of work performed is incomplete, scattered across systems, or impossible to retrieve, the technology becomes part of the problem.
What Motivity is doing to help ABA practices protect the care they’re delivering
Many compliance features have been in Motivity for years. Credential tracking, authorization validation, and session note approval workflows aren't new to the platform. Other capabilities have been added more recently, shaped by what our customers, our Scientific Advisory Board, and the broader regulatory environment told us the field needs. This is what those updates have been building toward.
The philosophy is straightforward: audit readiness shouldn't be something you scramble to achieve. It should be something your systems have been quietly building all along.
Pulling notes at scale
An auditor's document request can cover hundreds of session notes across multiple learners, payors, and date ranges. Practices using disconnected systems need to pull them one by one. I've heard from customers who spent days doing nothing but assembling audit packets.
Motivity's bulk note export allows pulling every note matching a set of filters (learner, clinician, program, payor, date range) in one step, so gathering all that documentation takes minutes. Your clinical directors have better things to do than spend three days proving that documentation their team already created actually exists.
Knowing who signed what and when
Supervisor attestations, treatment plan approvals, and session note sign-offs all carry a timestamp in Motivity. If a signature is late or missing, it surfaces in the clinician's or supervisor's workflow before it can become a finding.
Motivity has tracked session note approvals and supervisor sign-offs for years. What's been added is the reporting layer that makes the full signature trail exportable at the scale a payor review demands. When an auditor asks to see who signed what and when for a specific learner, the answer is a full report, not a dig through individual notes.
Proving who accessed what and when
HIPAA reviews and state licensure audits ask a different kind of question than payor audits. They want to know who logged into the system, who viewed a specific learner's records, who edited a note, and when all of it happened.
Motivity's IT and access log reports answer those questions directly. Login activity, record views, and edits are all tied to a user, a record, and a timestamp. For practices managing high staff turnover, multiple locations, and remote access, this is the layer that turns a HIPAA audit from a scramble into a routine pull.
Catching documentation gaps before claims go out
A note that technically exists but doesn't meet a specific payor's documentation standard is a denial waiting to happen. Catching that gap after a claim is rejected, weeks later, means a clinician is trying to remember details from a session they barely recall.
That's not much of a feedback loop. It's asking someone to reconstruct the past after the opportunity to fix it has largely disappeared.
Through Motivity's integration with Brellium, every signed session note is automatically checked against payor-specific documentation requirements. When Brellium identifies a gap, the clinician gets specific, actionable feedback while the session is still fresh. The correction happens inside Motivity's existing approval workflow, without a separate QA pull.
Providers had started pairing the two platforms on their own before the integration existed. One clinical leader put it this way:
“The compliance stack I keep recommending is Motivity + Brellium. Motivity builds the clinical oversight and fidelity record at the point of care, while Brellium identifies potential documentation and compliance gaps.”
Showing that treatment matched the plan
In most practices, answering whether the treatment delivered in session actually corresponded to what the BCBA® prescribed means reconstructing from past notes and graphs.
With Motivity's treatment fidelity features, each session captures the prescribed trial count for every target, the progress toward that count, and whether anything was skipped or partially run.
The clinical value of that data is what came first when designing these features after an NIH-funded study. The fact that it also serves as audit evidence is a byproduct of having built it into the daily workflow rather than bolting it on as a compliance add-on. That's an important distinction. The best compliance infrastructure doesn't ask clinicians to do their jobs twice. It makes the work they're already doing easier to verify.
Stronger clinical language in every note
Audit readiness isn't only about retrieving documentation. It's also about what's actually in the note when the auditor reads it.
A thin session note, or a note that sounds polished but misses clinical detail, can read like they were written to check a box, not to describe what happened with a learner. This puts the medical necessity question back at the table.
And AI has introduced an interesting new problem: it's now remarkably easy to make weak documentation sound impressive. Polished language and clinical substance are not the same thing.
That's why we took our time testing Motivity’s AI Session Note Narrative Generator in real clinical workflows before making them widely available. The feature drafts clinical narratives from actual session data and the clinician's own observations. The language is specific to what happened in that session: which targets were run, what behavior was observed, and what modifications the BCBA® made.
The result for the practices using them has been more consistent documentation across their teams, stronger clinical language in the notes, and fewer rounds of revision before a note is ready to sign. That consistency is significant when an auditor reads ten notes in a row from the same practice and expects each one to hold up on its own.
Why audit evidence should live in the same system
Auditors cross-reference evidence: was the provider credentialed when the session took place? Was the note signed by the supervisor before the claim was submitted? Do the session data support the treatment code billed? Each of those questions draws from a different part of the workflow. When the answers live in separate systems, assembling the response becomes a big project. If they share a single source, it can become as simple as a few clicks.
That doesn't mean enterprise ABA organizations need to force every workflow into one application. It means the evidence needs to be connected, accessible, and verifiable across the systems they choose to use. The last thing an enterprise needs is another collection of data silos, each confidently insisting it contains the truth.
That's been a consistent principle for how we build at Motivity: compliance evidence should be the secondary outcome of doing the clinical and operational work, not a separate effort layered on top.
That's the standard we're building toward. We do updates to Motivity monthly, and every release reflects what the field and our customers tell us matters next.
If you’d like to see what pulling an audit packet actually looks like in Motivity, we’re happy to show you.
