Behavioral Health Regulatory Compliance
Substance use disorder treatment, mental health clinics, and residential behavioral health facilities.
2,731
Total Enforcement Actions
2,232
Actions This Year
—
Total Penalties Tracked
2,731
Critical / High Severity
Regulatory Overview
Substance use disorder (SUD) and mental health providers face a dual compliance burden: HIPAA applies to all PHI, but 42 CFR Part 2 imposes even stricter confidentiality protections specifically on SUD records. DEA registration is required for any provider dispensing or prescribing controlled substances. SAMHSA oversees block grant compliance for states, with program integrity reaching down to individual certified providers.
Primary Enforcement Focus
42 CFR Part 2 violations, DEA diversion investigations, and Medicaid/Medicare billing fraud are the primary enforcement drivers. State behavioral health licensing boards pursue professional discipline independently.
Common Violation Patterns
42 CFR Part 2 Unauthorized Disclosure
Sharing SUD records with courts, employers, or other providers without proper consent — a violation distinct from HIPAA.
DEA Controlled Substance Diversion
Methadone, buprenorphine, and amphetamine diversion at OTPs and outpatient clinics. High-priority DEA investigation focus.
Medicaid Billing Fraud
Billing for group therapy as individual sessions, billing for no-show clients, and upcoding service intensity.
Unlicensed Practice
Counselors operating without required CADC/LCSW credentials, or facilities operating without state behavioral health license.
Enforcement Actions — Behavioral Health
Violations Signal Board
Latest Behavioral Health NewsAll
Merakey Buys I Am Boundless, Annual Revenue to Top $1B
Merakey has acquired the Ohio-based nonprofit I Am Boundless. Combined, the nonprofits anticipate generating up to $1 billion in revenue. Merakey is one of the largest providers of behavioral health and intellectual and developmental disability care with locations in 12 states. I Am Boundless will continue to operate under its established name and retain its […] The post Merakey Buys I Am Boundless, Annual Revenue to Top $1B appeared first on Behavioral Health Business.
PsychPlus Acquires Koa Health
Houston, Texas-based psychiatry practice PsychPlus has acquired Koa Health, a London-based digital therapeutic and B2B-focused digital mental health company. The terms of the deal were not disclosed. The addition of a digital therapeutic and patient-facing app bolsters PsychPlus’s homegrown tech stack, which it calls Galaxy. It also has its own electronic health record, scheduling, documentation […] The post PsychPlus Acquires Koa Health appeared first on Behavioral Health Business.
A New Federal Interpretation Challenges the ‘Gold Standard’ of SMI Care
This is an exclusive BHB+ article. Community-based care has long been the gold standard for treating patients with serious mental illness and other disabilities. In the 21st century, we’ve seen the rise of Certified Community Behavioral Health Clinics (CCBHCs), designated facilities that bring mental health and substance use disorder treatment directly to those who need […] The post A New Federal Interpretation Challenges the ‘Gold Standard’ of SMI Care appeared first on Behavioral Health Business.
Behavioral Health Billing Fraud, Kickbacks Totalled $208M in Massive DOJ Fraud Bust
In its largest Medicaid fraud investigation ever, the U.S. Department of Justice just filed charges against 455 defendants, 39 of which are cases related to behavioral health, addiction treatment and autism therapy providers. In total, these 39 cases account for at least $208.4 million in suspected fraudulent payments. Nine of these cases do not specify […] The post Behavioral Health Billing Fraud, Kickbacks Totalled $208M in Massive DOJ Fraud Bust appeared first on Behavioral Health Business.
Adult-Focused Services Are ‘The Greatest Need’ Autism Therapy Providers Could Address
This is an exclusive BHB+ story As the autism therapy industry faces increased pressure from all sides, some industry insiders say the next major evolution of the industry must be an expansion into adult-oriented services. Few among the fast-growing number of providers that specialize in autism therapy also have adult services. A handful of industry […] The post Adult-Focused Services Are ‘The Greatest Need’ Autism Therapy Providers Could Address appeared first on Behavioral Health Business.
Key Regulations
42 CFR Part 2 — SUD Confidentiality
Prohibits disclosure of SUD patient records without written consent in most circumstances. Stricter than HIPAA — separate consent required.
HIPAA 45 CFR Parts 160 & 164
Applies to all protected health information. Works alongside (not instead of) 42 CFR Part 2 for SUD records.
21 CFR Part 1301 — DEA Registration
All practitioners dispensing or prescribing Schedule II–V substances must hold valid DEA registration and maintain required records.
SAMHSA Block Grant Requirements
States receiving MHBG and SABG funding must meet set-aside and reporting requirements; program integrity flows to certified providers.
False Claims Act (31 USC 3729)
Federal tool used to pursue Medicaid/Medicare billing fraud in behavioral health — including upcoding, unbundling, and services not rendered.