Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
Building Scalable Regulatory Infrastructure
Multi-site behavioral health operators stay compliant when their leaders run compliance as one centralized operating system, not a stack of site-level binders. That means one policy library, one credentialing source of truth, one incident reporting workflow, and a fractional or full-time compliance officer who actually owns the risk register across every location.
The stakes are not theoretical. On January 15, 2025, DOJ announced that False Claims Act settlements and judgments exceeded $2.9 billion in fiscal year 2024, with approximately $1.7 billion of which involved the health care industry. Whistleblowers filed 979 qui tam lawsuits in FY 2024, the highest number in a single year; qui tam cases comprised over 83% ($2.4 billion) of recoveries, and the government paid over $400 million to whistleblowers tied to those recoveries. Behavioral health sits inside that number. Of the 979 qui tam suits filed in FY 2024, 370 alleged fraud in the health care industry.
The cases my team at Atlantic Health Strategies works follow a familiar pattern: a Florida operator opens a second site in Tennessee, the EMR templates drift, supervision logs go missing at one location, and twelve months later the SIU audit lands. Operating outpatient mental health clinics, addiction treatment programs, and integrated networks across state lines pulls operators into an environment where state licensing boards, the HHS Office of Inspector General, the DEA, SAMHSA, and commercial payer SIUs all want different documentation.
Reactive compliance loses to that environment. Every time.
The Regulatory Complexity of Multi-Site Behavioral Health Systems
Every facility sits inside its own state licensing framework, with its own supervision rules, staffing ratios, and program definitions. Then federal authority layers on top. The OIG’s General Compliance Program Guidance provides summaries of the primary federal fraud and abuse laws (including the Anti-Kickback Statute, Physician Self-Referral Law (the “Stark Law”), False Claims Act, Civil Monetary Penalty Authorities, Exclusion Authorities) and the HIPAA Privacy and Security Rules. Add CMS billing requirements, OSHA workplace rules, and 42 CFR Part 2 confidentiality for SUD records.
Once an operator moves from one site to four, the cracks my team sees during mock surveys are almost always the same:
- Documentation templates that diverge by clinic director preference
- Billing and coding protocols that vary between the Florida and Tennessee sites
- Credentialing files missing the supervision logs the state surveyor asks for first
- Policy versions nobody at the satellite site has actually read
- Incident reports that never make it past the local clinical director
These gaps grow because operators grew compliance organically rather than designing it for multi-site governance. At AHS we replace that with one policy framework, one reporting structure, and one set of audit cadences across the network, while leaving room for state-specific variation where licensure demands it.
Fractional Compliance Leadership for Behavioral Health Organizations
For most operators with two to eight sites, a fractional Chief Compliance Officer is the right answer before a full FTE makes financial sense. The OIG anticipates this. OIG recommends that small entities lacking the financial or administrative ability to support a compliance officer on either a full-time or part-time basis consider appointing one individual as the entity’s compliance contact and have that person be responsible for ensuring all compliance activities are completed. A fractional engagement at AHS typically covers enterprise risk assessments, policy maintenance, documentation and billing audits, compliance committee reporting, exclusion screening, and ongoing staff education. Behavioral-health-specific ICPGs have not landed yet, so the GCPG is your operating rubric.
Board-level oversight belongs inside the program. The new guidance also includes recommendations to conduct annual internal risk assessments, to consider quality of care as a component of the compliance program, and to emphasize the importance of a board’s and executive leadership’s oversight of compliance.
One piece that matters for behavioral health specifically: the OIG flagged private investment by name. OIG specifically calls out the growing presence of private equity and other forms of private investment in health care and recommends that such investors scrutinize their operations and oversight to ensure compliance with fraud and abuse laws and the delivery of high-quality care for patients. If you are a PE-backed platform stitching together SUD and mental health assets across three states, the regulator is reading your cap table.
Designing Scalable Compliance Programs: The Seven Elements
The framework AHS builds around is the OIG’s General Compliance Program Guidance (GCPG), published November 6, 2023. The OIG released it as the first significant update in 15 years. Treat it as voluntary in name and mandatory in practice. Prosecutors and surveyors use it as their rubric.
The seven elements anchor any scalable program: written policies and a code of conduct, designated compliance leadership, training and education, effective lines of communication, enforcement through well-publicized disciplinary standards, auditing and monitoring, and structured response and corrective action. OIG sticks with the seven elements of compliance identified in the U.S. Sentencing Guidelines as the framework for its compliance program recommendations.
What changed in 2023 (and what AHS actually operationalizes for clients) is that quality of care now sits inside the compliance program rather than next to it. OIG highlights that quality of care considerations should be included in a compliance program to mitigate patient harm and False Claims Act liability. For a PHP (ASAM Level 2.5, an outpatient level of care) or IOP operator, that means your utilization management documentation, your ASAM Criteria (4th Edition) level-of-care decisions, and your discharge planning are all compliance artifacts, not just clinical ones.
Workforce Credentialing, HIPAA Exposure, and Behavioral Health Enforcement
Workforce drift is where most multi-site programs fail their first real audit. Licensure renewals slip. Continuing education hours go untracked. Supervision logs at the Georgia site look nothing like the ones at the Arizona site. When a state surveyor asks for proof at 9:14 a.m. On a Tuesday, you have until lunch to produce it.
HIPAA and Part 2 sit next to credentialing on the risk register. The dollar exposure has teeth. On December 3, 2024, OCR announced a $1.19 million civil monetary penalty against Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions Institute in Florida, concerning HIPAA Security Rule violations, following receipt of a breach report that a former contractor for the company had impermissibly accessed their electronic record system. OCR’s investigation began after it received a breach notification in which the company reported that its electronic medical record systems were accessed without authorization by a former contractor on three occasions; the former contractor accessed the ePHI of approximately 34,310 individuals. OCR Director Melanie Fontes Rainer put it plainly: “Current and former workforce can present threats to health care privacy and security”.
Behavioral-health-specific enforcement reinforces the point. On December 10, 2025, U.S. Attorney David Metcalf announced that Recovery Centers of America agreed to pay $1,000,000 to resolve allegations that it failed to comply with provisions of the Controlled Substances Act designed to prevent the diversion of controlled substances, and an additional $1,000,000 to resolve allegations that it violated the False Claims Act by billing the government for drug and alcohol treatment services that it failed to adequately provide. The CSA allegations arose from audits and investigations the DEA conducted at RCA facilities in Pennsylvania and Maryland between 2019 and 2024, and the settlement provides for the whistleblower, a former Outcomes Supervisor at RCA’s corporate headquarters in King of Prussia, Pa., to receive a $230,000 share of the settlement amount.
AHS integrates licensure tracking, training completion, exclusion screening, incident reporting, and Part 2 / HIPAA documentation inside one operational backbone. Your clinical team runs the care. The compliance program runs underneath it. When the surveyor knocks at the Georgia site, or the SIU letter lands in your Florida office, the answer should already be in the system.
Frequently asked questions
What does an effective compliance program look like for a multi-site behavioral health organization?
It follows the OIG’s seven elements from the November 6, 2023 General Compliance Program Guidance: written policies and a code of conduct, designated compliance leadership, training, lines of communication, enforcement standards, auditing and monitoring, and structured response and corrective action. The 2023 update added annual internal risk assessments, board-level oversight, and quality of care as a compliance domain. For multi-site operators, that translates into one centralized policy library, one credentialing system, exclusion screening against OIG and state Medicaid lists, and a fractional or full-time compliance officer who owns risk across every location.
How large is HIPAA penalty exposure for a behavioral health provider?
OCR can impose civil monetary penalties per violation with tiered annual caps based on culpability. Recent enforcement makes the exposure concrete: on December 3, 2024, OCR imposed a $1.19 million civil monetary penalty on Gulf Coast Pain Consultants in Florida for HIPAA Security Rule failures, including failure to terminate a former contractor’s ePHI access, which affected approximately 34,310 individuals. OCR Director Melanie Fontes Rainer stated that current and former workforce can present threats to health care privacy and security.
Why does the OIG specifically mention private equity in its 2023 compliance guidance?
The 2023 GCPG calls out the growing presence of private equity and other private investment in healthcare and tells those investors to scrutinize their operations and oversight for compliance with fraud and abuse laws and the delivery of high-quality care. For PE-backed behavioral health platforms operating across multiple states, that means heightened federal scrutiny of ownership incentives, growth assumptions, and clinical decision-making at the portfolio level, including how DOJ evaluates management fees, referral arrangements, and utilization patterns during a False Claims Act investigation.
What behavioral-health-specific False Claims Act enforcement should operators watch?
On December 10, 2025, the U.S. Attorney’s Office for the Eastern District of Pennsylvania announced that Recovery Centers of America agreed to pay $2 million ($1 million under the Controlled Substances Act and $1 million under the False Claims Act) tied to DEA audits at RCA facilities in Pennsylvania and Maryland between 2019 and 2024 and to billing the government for drug and alcohol treatment services it failed to adequately provide. A former Outcomes Supervisor at RCA’s corporate headquarters in King of Prussia, Pa., received a $230,000 share of the settlement as the qui tam whistleblower.
References
- HHS OIG, General Compliance Program Guidance (November 6, 2023)
- U.S. Department of Justice, False Claims Act Settlements and Judgments Exceed $2.9B in Fiscal Year 2024 (Jan. 15, 2025)
- HHS Office for Civil Rights, Gulf Coast Pain Consultants Notice of Final Determination
- U.S. Attorney’s Office, Eastern District of Pennsylvania, Recovery Centers of America Agrees to Pay $2 Million (Dec. 10, 2025)
- HHS OIG Enforcement, Recovery Centers of America Settlement