Operators tend to picture structural risk as a letter from a licensing board. In practice, that letter rarely comes. What comes instead is a payer that declines to reimburse, an auditor that treats the claims as ineligible from the start, or a buyer whose counsel finds the problem in diligence and reprices the deal. Each of those parties has money at stake and a direct financial incentive to look, which is exactly what a regulator usually lacks. The result is that a structure can sit quietly for years and then fail at the worst possible time, and the failure is rarely proportionate to the original sin.
The exposure at a glance
- The three doors: payer, auditor, buyer
- The payer door: reimbursement can simply stop
- You may not need to have intended anything
- Clean at formation is not a defense
- The auditor door: ineligible claims
- The buyer door: the sale is the audit
- Why the transaction itself surfaces the problem
- The part operators underestimate: the staff
- The same logic applies to HIPAA records
- Why remediation before market is the whole game
- How this connects to the rest of your compliance stack
- Frequently asked questions
- Where professional advice is essential
The three doors: payer, auditor, buyer
A structural defect is a latent condition. It does not announce itself, it does not degrade performance, and for as long as nobody with money at stake examines it, it behaves exactly like a sound structure. That is precisely what makes it dangerous, because it means the defect and the discovery are separated by years, and the discovery is triggered by an event you chose: submitting claims at scale, being selected for audit, or going to market.
The three parties who find it are the three parties whose money depends on the answer. A payer wants to know whether it was ever obligated to pay you. An auditor wants to know whether the claims were eligible when submitted. A buyer wants to know whether it is purchasing a business or a liability. None of them is doing you a favor by looking, and all of them are better resourced and more motivated than the licensing board you were worried about.
The payer door: reimbursement can simply stop
This is the sharpest edge, and the one most operators have never considered. The leading illustration comes from New York, where the courts have held that an insurer may refuse to pay a practice at all when non-licensees actually own or control it, notwithstanding what the corporate filings say (State Farm Mut. Auto. Ins. Co. v. Mallela, 4 N.Y.3d 313 (2005); Andrew Carothers, M.D., P.C. v. Progressive Ins. Co. (N.Y. 2019)).
The facts of the later case are worth sitting with. The practice was, on paper, owned by a single licensed professional. In reality two non-licensees ran it and extracted its profits through grossly inflated equipment and premises leases: over a two-year period they took roughly $12.2 million while the nominal licensed owner received about $133,000. The nominal owner did not hire the staff, did not control the operating account, and had no meaningful role in management. The insurers stopped paying, litigated, and won. The result was the expungement of approximately $20 million in claims.
Read that as an operator rather than a lawyer. This was not a fine calculated as a percentage of something. This was the revenue being treated as though it had never been earned, because the entity that billed for it was not eligible to bill for it (11 NYCRR 65-3.16(a)(12), the ineligibility provision at issue).
A fine is a cost of doing business. Ineligibility is a denial that you were ever in business. Those are not the same category of risk, and only one of them ends a company.
You may not need to have intended anything
The instinct is to assume that this kind of consequence requires fraud, and that an operator who was simply badly advised is therefore safe. The New York Court of Appeals rejected that reading directly. It held that an insurer need not prove common-law fraud or fraudulent intent; a willful and material failure to abide by the licensing and incorporation statutes can be enough to render the provider ineligible for reimbursement. The court was explicit that the phrase fraudulently incorporated, which came from an earlier certified question, was potentially misleading, and that what actually mattered was the operation and control of the entity by unlicensed individuals.
The court did impose a limit worth knowing: insurers were cautioned that they cannot withhold payment over mere technical lapses, such as a missed annual meeting or an unpaid filing fee. The doctrine reaches material failures of ownership and control, not paperwork untidiness. That is a meaningful boundary, and it is also a warning, because the thing it reaches is exactly the thing a friendly-owner structure is built out of.
Clean at formation is not a defense
This is the point that should worry a founder who structured carefully years ago and has not revisited it since. The doctrine as articulated does not test only the moment of incorporation. A practice that was properly formed can still lose eligibility if the licensed owner later yields control to unlicensed parties. Structure is therefore not an event you complete; it is a condition you maintain.
In practice, control drifts quietly and for entirely ordinary reasons. The management company gets better at its job and starts making the hiring calls. The founder-clinician steps back from operations to focus on clinical work. The management fee is renegotiated upward without anyone asking whether it still resembles fair market value. Each step is defensible on its own. The aggregate is a practice that a motivated payer would characterise as controlled by non-licensees.
The auditor door: ineligible claims
The audit theory follows the same logic through a different door. If the billing entity was not eligible to submit the claims, then the claims themselves are the problem, and every one of them is a data point. That is what converts a structural question into a volume question: the exposure scales with how successful you have been, because the number of claims is the multiplier.
This is also why the usual reassurance, that the practice has never had a quality complaint and delivers excellent care, provides no protection. The theory does not depend on the care being poor. It depends on the entity that billed for the care having been the wrong entity.
The buyer door: the sale is the audit
Everything above is why sophisticated buyers treat structure as a gating item rather than a cleanup item. If control facts can render historical reimbursement ineligible, then every dollar of revenue booked through a defective structure is a contingent liability, and diligence is the process of pricing it.
Three mechanics make this worse than operators expect. First, the buyer's counsel is not looking for a reason to be generous; they are looking for the reason the price should be lower. Second, representation and warranty insurance generally excludes known issues, so a problem surfaced in diligence typically cannot be insured around and instead comes out of the purchase price or goes into escrow. Third, liability of this kind can follow the assets or the entity depending on the deal structure, which means the buyer is not merely worried about your past, they are worried about inheriting it.
The outcomes, in descending order of how often operators expect them: a price reduction, a larger escrow or holdback, an indemnity carve-out that survives closing, a restructuring condition precedent that delays the deal by months, or the buyer simply declining to proceed. Founders tend to anticipate the first and are blindsided by the last.
Why the transaction itself surfaces the problem
There is a structural irony here that deserves to be stated plainly: the sale is what triggers the examination. A change of ownership is not a private matter between you and the buyer. Medicaid participation carries obligations to disclose ownership and control interests, including managing employees, and a change of ownership generally requires re-disclosure and payer notification, with commercial contracts commonly requiring consent to assignment (see, e.g., the Medicaid provider disclosure requirements at 42 C.F.R. part 455, subpart B).
So the moment you decide to realise the value of the business, you invite the payer to re-examine who actually controls it. If the disclosed ownership never matched the operating reality, the transaction is the event that puts the two side by side. The structure did not fail because it was audited. It failed because you tried to sell it.
The part operators underestimate: the staff
This is the mechanism that turns an expensive problem into a terminal one, and it is the one founders consistently discount.
A buyer of an ABA practice is not really buying entities, contracts, or even the payer mix. They are buying the continuity of a clinical team, because in ABA the revenue is produced by supervised clinicians and it does not survive their departure. The direct-therapy code that fills most authorized hours is delivered by technicians under the supervision of behavior analysts. Lose the supervising analysts and the billing does not decline gracefully; it stops.
Now consider what remediation actually looks like. Fixing a defective structure can require forming new entities, obtaining new provider identifiers, re-enrolling and re-credentialing with every payer, a process commonly measured in months rather than weeks, and re-papering the employment agreements of every clinician. During that window, cash flow stutters, and the workforce hears the word restructuring at the same time they notice the founder is spending all day with lawyers.
The instruments that a structure might otherwise use to hold the team in place are themselves under pressure. Equity transfer restriction agreements, long the mechanism that made a friendly-owner model enforceable, are exactly what recent legislation has begun to restrict, and non-competition agreements with clinicians below a meaningful ownership threshold are increasingly unenforceable (see, for example, Oregon SB 951 (2025), amending ORS 58.375 and 58.376). In a labor market where credentialed behavior analysts are already scarce, an operator in the middle of a restructuring has few levers and a very short runway.
The fix and the flight arrive together. That is the whole problem. Remediation under a deadline is precisely the condition in which the asset you are trying to preserve decides to leave.
The same logic applies to HIPAA records
Structure is the sharpest version of this pattern, but it is not the only one. HIPAA follows the same shape: an obligation that no one enforces until a party with money at stake asks for the evidence, at which point the absence of evidence is itself the finding.
The security risk analysis is the clearest example. It is both the most commonly cited deficiency in enforcement actions and, not coincidentally, one of the first documents a buyer's counsel requests. Its absence is not read as a gap in a program. It is read as proof that the program was never real, and that inference then colours everything else the seller claims about compliance.
The timing alignment is worth noticing, because it is not an accident. HIPAA requires that required documentation be retained for six years from the date of its creation or the date it was last in effect (45 C.F.R. 164.316(b)(2)(i)). Six years is also, in practice, the lookback a careful buyer applies. The evidence file you would hand an auditor and the evidence file you would hand a buyer are substantially the same file, pointed at a different reader. An operator who has been maintaining it all along walks into diligence with the work already done. An operator who has not spends the diligence window building it, under a deadline, while the buyer watches, which is the worst possible condition under which to construct a compliance record.
One further point, because it cuts against the instinct to paper over the gap quickly: documentation that does not describe what the clinic actually does is worse than no documentation. It converts an evidentiary hole into an admission, because it demonstrates that the organisation knew the requirement and represented compliance it did not have.
Why remediation before market is the whole game
Every dynamic on this page points at the same conclusion. The cost of fixing a structure is roughly fixed. The cost of fixing it under diligence is not, because it is compounded by leverage, urgency, and the visibility of the process to the people whose continued employment is the asset being sold.
Fixing it early is quiet. There is no term sheet, no deadline, no counterparty auditing the process, and no reason for the clinical team to sense anything is happening. Fixing it late is loud, and the noise is the damage.
The practical sequence is unglamorous. Establish what your structure actually is, as opposed to what the formation documents say. Establish whether the state you operate in reaches your profession at all, since many do not. Identify where control has drifted from the licensed owner. Where a management arrangement exists, test the fee against a defensible fair-market-value rationale and test the agreement for the decision rights it hands to non-licensees. Then assemble the evidence file, on the assumption that someone hostile will eventually read it.
How this connects to the rest of your compliance stack
This guide is the argument that makes the other topics matter. Each of them is a place where the exposure described here is either created or closed:
- The entity decision. Whether your state reaches behavior analysis at all is the threshold question, and in most states the answer is that it does not, which is why so much anxiety here is misplaced and so much of the remaining risk is concentrated in the states where it is not. See the entity decision.
- Entity structures. The form you chose, and whether the professional form was required or merely elected, determines whether an ownership rule attaches to you at all. See entity structures and PLLCs.
- Ownership and MSOs. This is where control drifts, where fee-splitting rules bite, and where the management agreement either protects you or convicts you. See ownership, MSOs, and private equity.
- Medicaid and insurance. The payer is the counterparty with the most direct financial interest in your eligibility, and the enrollment file is where your ownership was disclosed. See Medicaid and insurance mandates.
- Facility licensure and HIPAA. The evidence file that satisfies an auditor is the evidence file that satisfies a buyer. See facility licensure and HIPAA.
Frequently asked questions
My state does not regulate ABA ownership at all. Does any of this apply to me?
The cases you cite are New York insurance cases. Why should they concern me?
We were structured correctly when we formed. Are we fine?
Can we just fix it when a buyer raises it?
What does a buyer actually ask for?
Where professional advice is essential, not optional
This is the topic where general information reaches its limit fastest. Whether a doctrine reaches your profession, whether your control facts would be characterised as drift, whether a management fee is defensible, and what a specific buyer will do with what they find are all fact-specific questions that turn on your state, your documents, and your operating reality. Nothing on this page determines any of them. Engage qualified counsel in your state, a credentialing specialist, and a transaction adviser, and do it while you still have the luxury of time.
The general principle worth carrying away is simply this: the parties who enforce structural rules are the parties who pay you and the parties who buy you, both of whom look precisely when you most need them not to. Build the structure you would be comfortable having read by someone whose financial interest is served by finding it defective.
The doctrines described here vary enormously by state and are actively changing, and the cases discussed arose in a specific jurisdiction and a specific insurance context. Nothing on this page is a determination about your practice, a prediction about any transaction, or a substitute for advice from counsel in your state. Verify your structure, your disclosures, and your evidence file with qualified professionals before you restructure, sell, or expand.