Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The short answer: internal QA misses what surveyors and prosecutors find
Behavioral health treatment centers need external audits because internal QA staff cannot see the workflows they wrote, while state surveyors, HHS-OIG auditors, and payer SIU teams are trained to find exactly those blind spots. External reviewers catch the documentation gaps, billing patterns, and Environment of Care issues that quietly compound until they surface as a Requirement for Improvement, a payer takeback, or a subpoena.
The federal enforcement data is not subtle. On June 30, 2025, DOJ announced the results of the 2025 National Health Care Fraud Takedown, which charged 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, across 50 federal districts and 12 State Attorneys General’s Offices in schemes involving over $14.6 billion in intended loss. Behavioral health featured across the docket. Outside analysts noted the figure more than doubled the prior record of $6 billion set in 2020.
Legitimate operators get pulled into the same scrutiny for boring reasons. A coder used the wrong add-on. A therapist copy-forwarded a progress note. A biller kept submitting 99215 when the encounter was a routine check-in.
Attorney General Pamela Bondi framed the enforcement posture bluntly: “This record-setting Health Care Fraud Takedown delivers justice to criminal actors who prey upon our most vulnerable citizens and steal from hardworking American taxpayers.”
A defensible chart, a clean EOC tour, and a payer-ready claim are the output of a compliance program that someone from outside the building checks. Not once a year. On a rhythm.
What surveyors and OIG auditors are actually finding
HHS-OIG audits keep landing on the same category of findings: missing assessments, unsigned notes, treatment plans without required signatures, undocumented provider credentials. Those are not sophisticated fraud schemes. Those are chart-audit findings any competent external reviewer would have caught in a mock survey.
Joint Commission surveys tell the same story in the field. Ligature risks in residential settings, medication reconciliation gaps, incomplete treatment plans, untimely assessments, missing informed consent. Same findings, over and over, across Behavioral Health Care Standards Manual surveys.
The Joint Commission itself confirms that organizations that have already completed their initial survey can be re-surveyed at any time between 18 and 36 months from their initial survey, with the event usually falling within nine months of the three year anniversary. An internal team that treats accreditation as a triennial event is planning around a calendar the surveyors are not using.
An internal QA nurse who audits her own program will not spot what a surveyor spots. Not because she is not sharp. Because she wrote half the workflows.
Billing integrity: the highest-cost failure mode
In August 2025, the U.S. Attorney’s Office for the Northern District of California announced that American Psychiatric Centers, doing business as Comprehensive Psychiatric Services, agreed to pay $2.75 million to resolve allegations that CPS violated the False Claims Act by submitting false claims to government healthcare payors for certain psychotherapy services. The add-on codes at issue were CPT 90833 and 90836, which are add-on codes to be used when psychotherapy services are performed in conjunction with an evaluation and management visit, and which require specific documentation. Seven years of billings. One code family.
In May 2026, North Carolina Attorney General Jeff Jackson announced a $584,143 settlement with Crossroads Treatment Center of Greensboro, P.C., to settle allegations that Crossroads submitted false claims to the Medicaid program. Between 2019 and 2023, Crossroads submitted claims for urinary drug testing to the North Carolina Medicaid program without giving physicians the option to order a lower level of urine drug testing, resulting in more complex testing than was medically necessary.
The pattern was not caught by a whistleblower or a federal auditor. Jackson credited the origin of the case directly: “A managed care organization flagged something that was out of pattern.” Read that sentence twice. A payer’s analytics team caught it before the government did.
An external coding and documentation audit finds these patterns before a whistleblower or an MCO does.
Why "we passed our last survey" is not a compliance program
Founders point to a clean CARF three-year decision and treat it as a shield. It is not. Payer SIU audits, state licensure inspections, and OIG data pulls do not follow the accreditation calendar.
DOJ has collapsed the timeline further. As part of the 2025 Takedown, DOJ described joining forces with data analysts from HHS-OIG, FBI, and other partners to increase efficiency, detection, and rapid prosecution of emerging health care fraud schemes, leveraging cloud computing, artificial intelligence, and other agency resources. CMS in the same announcement reported that it successfully prevented over $4 billion from being paid in response to false and fraudulent claims and suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown. Data does the math before any human auditor walks in.
External audits at Atlantic Health Strategies run on different logic than an internal QA cycle. Our team enters the building as a surveyor would. We pull a stratified sample of charts across ASAM Criteria 4th Edition levels of care. We tour the EOC as if we had never seen it. We test payer readiness against the actual timely filing windows and utilization management rules in the contract. We compare census patterns to billed encounters.
And we tell the CEO what we found, in writing, before someone with subpoena power tells them instead.
What an external audit program actually covers
A serious external audit program for a behavioral health treatment center has five moving parts, and none of them are optional:
- Clinical documentation and chart audit. Human reviewers sampling charts across ASAM Criteria 4th Edition levels of care, testing assessment timeliness, treatment plan signatures, session note quality, discharge planning, and medical necessity.
- Billing and coding audit. CPT and HCPCS validation, add-on code documentation (90833, 90836, 90838), time-based service verification against schedules, and payer-specific rule testing. Drug-testing code selection gets its own pass after the Greensboro Crossroads settlement.
- Mock survey and EOC tour. Ligature risk sweep in residential and withdrawal-management settings, medication storage and reconciliation, emergency preparedness drills, and life-safety inspection currency.
- HIPAA and 42 CFR Part 2 review. Access controls, termination workflows, audit log review, and business associate inventory.
- Payer readiness and UM review. Contract audit against timely filing, prior authorization, and level-of-care criteria; SIU-simulation audit on high-dollar claim families.
Operators in Florida, Texas, North Carolina, and Virginia should pay particular attention. In the 2025 DOJ takedown, 170 defendants were charged with more than $1.84 billion in allegedly false and fraudulent claims to Medicare, Medicaid, and private insurance companies regarding treatments and services that were medically unnecessary, not provided at all, or provided in connection with kickbacks and bribes. State Medicaid Fraud Control Units are staffed, funded, and looking. In North Carolina alone, the Medicaid Investigations Division has recovered more than $1.2 billion in restitution and penalties for the state to date.
If no outside team has ever audited your program on a defined rhythm, you do not have a compliance program. You have a hope.
Frequently asked questions
How often should a behavioral health treatment center undergo an external audit?
At minimum, annually for chart, billing, and Environment of Care. High-acuity or multi-site operators should run quarterly billing audits on high-risk code families (90833, 90836, 90838, drug-testing codes) and a full mock survey 6 to 9 months before any expected Joint Commission or CARF visit. The Joint Commission confirms re-surveys can occur any time between 18 and 36 months from the initial survey, so a rigid three-year internal cadence leaves you exposed.
What is the difference between an internal QA review and an external audit?
Internal QA staff wrote or trained on the workflows they are reviewing, which creates blind spots. An external audit brings surveyor-side and payer-side methodology into the building: stratified chart sampling, tracer methodology on the EOC, and coding review against the actual payer contract. External auditors also test whether written policy matches actual practice, which is where most Joint Commission Requirements for Improvement live.
Which behavioral health billing patterns draw the most federal scrutiny?
Psychotherapy add-on codes 90833 and 90836, tied to the $2.75 million August 2025 DOJ settlement with Comprehensive Psychiatric Services in the Northern District of California; drug-testing code selection, tied to the $584,143 May 2026 Crossroads Greensboro settlement announced by North Carolina Attorney General Jeff Jackson; and billing volumes that outrun documented staff capacity, now flagged by DOJ’s Health Care Fraud Unit Data Analytics Team using cloud computing and AI before human auditors ever walk in.
Can an external audit be discoverable in a False Claims Act case?
Audit findings can become discoverable, which is why the audit should be structured with counsel, remediation should be documented and completed, and the workflow should be governed by attorney-client privilege where appropriate. The greater risk is not having an audit trail at all. A former employee filing a qui tam suit will describe what happened without your version on record.
References
- U.S. Department of Justice: National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud (June 30, 2025)
- HHS Office of Inspector General: 2025 National Health Care Fraud Takedown
- Centers for Medicare & Medicaid Services: 2025 National Health Care Fraud Takedown announcement
- U.S. Attorney’s Office, Northern District of California: American Psychiatric Centers / Comprehensive Psychiatric Services $2.75 million FCA Settlement (August 20, 2025)
- North Carolina Department of Justice: AG Jeff Jackson Secures $584,000 Medicaid Fraud Settlement with Crossroads Treatment Center of Greensboro (May 2026)
- The Joint Commission: Preparing for Your Next Survey for Behavioral Health Care Accreditation
- Epstein Becker Green (Health Law Advisor): analysis of the 2025 National Health Care Fraud Takedown