Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Direct Answer: Run the EMR Migration as an Operational Deployment, Not an IT Project
Behavioral health operators should run an EMR migration as an operational deployment with a Situation Room command structure, not a software swap. The reason is concrete: 42 CFR Part 2 records, ASAM Criteria 4th Edition documentation, and payer audit trails all sit inside the chart being moved, and OCR now enforces Part 2 with the same tools it uses for HIPAA. On February 13, 2026, HHS announced a civil enforcement program for the confidentiality of SUD patient records, and beginning February 16, 2026, entities and persons subject to the regulation protecting the confidentiality of SUD patient records must comply with all applicable requirements.
Atlantic Health Strategies has run migrations across Kipu, Ritten, CareLogic, BestNotes, AdvancedMD, Sunwave, and Lightning Step. Thousands of active charts. None of those were software replacements. Our teams ran them as coordinated operational campaigns with a named clinical lead, a billing lead, a compliance lead, and a single accountable owner sitting inside the operator’s executive team. That structure is the point.
Why PE Consolidation Forces an EMR Decision: The Math
PE buyers do not acquire behavioral health platforms to leave the tech stack alone. Researchers at Oregon Health & Science University, the University of Pennsylvania, and Yale, publishing in JAMA Psychiatry in May 2024, found 642 mental health clinics and 1,152 clinics treating substance use disorders that had undergone private equity acquisition over that period, as of last year, constituting 6.2% of all mental health facilities and 7.1% of addiction treatment facilities nationwide. In Colorado, Texas and North Carolina, the proportion of private equity-owned practices accounted for roughly a quarter of all facilities providing mental health treatment.
OHSU’s Dr. Jane Zhu, the study’s lead author, put it plainly: “At this point, there is no stone left unturned by private equity investors”.
The deal volume backs this up. Healthcare Brew, citing the Private Equity Stakeholder Project, reported 44 behavioral health-specific deals in 2023, with ARC Health, a behavioral health company backed by Thurston Group and Five Points Capital, making nine acquisitions in 2023 and accounting for 20% of all behavioral health deals that year. Fortune Business Insights projects that the US behavioral health market size will grow from $83+ billion in 2023 to $115+ billion by 2030.
Boards inside PE-backed platforms expect standardized documentation and billing platforms inside the first year post-close. When CEOs of acquired groups call AHS, the question is rarely “should we consolidate the EMR?” It is “how do we consolidate without taking the census down for a quarter?”
The Situation Room Model: How AHS Runs the Migration
We borrowed the term Situation Room because the operating posture is the same. A small group of decision-makers. Real-time data on the table. A clear command structure. A stopwatch.
Here is how our team structures a migration for a multi-site operator running detox, residential, and outpatient programming under the ASAM Criteria, 4th Edition:
- Pre-migration assessment. Chart inventory, document-type mapping, payer enrollment audit, and a Part 2 status review for every program touching SUD records.
- Command structure. One executive sponsor on the operator side. One AHS migration lead. Named clinical, billing, and compliance leads with decision rights.
- Chart integrity validation. Every chart hash-checked pre and post. ASAM-aligned documentation templates configured before go-live, not after.
- Revenue cycle continuity. Timely filing windows protected. 837/835 flows tested in parallel for at least one full billing cycle before cutover.
- Staff training by role. Clinicians, admissions, utilization management, and billing get role-specific workflows, not generic vendor demos.
- Post-launch monitoring. A 60-day watch on documentation completion rates, AR aging, and denial codes against the pre-migration baseline.
This is not exotic. It is the minimum. Most operators do not have the internal bandwidth to run it while also admitting patients and closing month-end.
The Part 2 Problem Nobody Wants to Talk About
This is the section operators ignore until OCR asks for records. In August 2025, HHS Secretary Robert F. Kennedy Jr. Delegated the authority for enforcing compliance with the Part 2 regulations to OCR, the same agency that enforces HIPAA. Then the teeth came out. As of February 16, 2026, OCR began accepting (i) complaints alleging violations of the regulation that protects the confidentiality of SUD patient records, and (ii) notifications of breaches of SUD patient records.
Paula M. Stannard, Director of the HHS Office for Civil Rights, framed the shift this way: “OCR is uniquely positioned to enforce patient rights and the regulated community’s obligations given our extensive experience administering compliance and enforcement programs for health information privacy, security, and breach notification under HIPAA”.
As one healthcare law firm summarized it, Part 2 confidentiality is no longer “compliance-by-policy” and is now a HIPAA-style civil enforcement regime with OCR’s familiar tools, including investigations, corrective action commitments, resolution agreements, monetary settlements, and civil money penalties.
The penalties align with HIPAA’s tiered structure. Under the January 28, 2026 inflation adjustment, HHS inflation adjustments apply to penalties assessed on or after January 28, 2026, for violations occurring on or after November 2, 2015, calculated by multiplying the previous penalties by 1.02598. The minimum penalty for each violation of a particular HIPAA requirement or prohibition increased to $145 (up from $141), and the calendar-year penalty cap increased to $2,190,294 (up from $2,134,831) for all violations of an identical HIPAA provision. Tier 4, willful neglect not corrected, carries a minimum fine of $73,011 per violation, up to $2,190,294, with an annual penalty cap of $2,190,294. Criminal penalties are also possible.
What does this have to do with an EMR migration? Everything. If your team moves SUD records out of CareLogic into Kipu, or from BestNotes into Sunwave, every consent form, disclosure log, and breach notification trail must survive the cutover intact. A botched migration that exposes SUD records is now both a HIPAA event and a Part 2 event, with OCR on both sides of the desk. Operators in Tennessee, Utah, Florida, Arizona, Colorado, Texas, and North Carolina, the states where AHS sees the most concentrated behavioral health M&A activity, should treat February 16, 2026 as the hard floor under any EMR transition plan.
Vendor Selection and the CEO's Real Job
Picking the EMR is the loudest decision and usually the wrong place to start. CEOs should first set the documentation standard the platform has to support: ASAM Criteria, 4th Edition for SUD; payer-specific medical necessity criteria for commercial and Medicaid; state licensure documentation requirements (which differ materially between Florida AHCA, Texas HHSC, and Colorado BHA); and Joint Commission or CARF standards depending on accreditation strategy.
Once the operator sets the documentation standard, the vendor question gets simpler. Some platforms were built for outpatient therapy practices and bolt awkwardly onto residential and residential withdrawal management (ASAM Level 3.7 in the 4th Edition). Others were built around SUD residential and withdrawal management and require workarounds for high-volume outpatient mental health. Note that PHP (ASAM Level 2.5) is an outpatient level of care, not residential. Vendors that blur that distinction in configuration will create billing and licensure exposure downstream.
CEOs of PE-backed platforms in Colorado, Texas, and North Carolina, the states where the JAMA Psychiatry data shows PE-owned practices accounted for roughly a quarter of all facilities providing mental health treatment, are increasingly running formal vendor evaluations with their MSO partner before issuing a single MSA. Boards expect standardized reporting across the portfolio within months of close. CEOs who walk into that board conversation without a documented EMR consolidation plan lose credibility fast. The ones who walk in with a Situation Room framework, a named operational partner, a chart migration timeline, and a Part 2 compliance plan keep the conversation about growth instead of risk.
Frequently asked questions
How long should an EMR migration take for a multi-site behavioral health operator?
For a portfolio of 3 to 6 sites spanning detox, residential, PHP (ASAM Level 2.5, an outpatient level of care), and IOP, AHS typically plans a 90-to-150-day migration with a full parallel billing cycle before cutover. Anything shorter usually skips chart integrity validation and Part 2 consent reconciliation, which is where OCR enforcement risk lives now that the 42 CFR Part 2 compliance date of February 16, 2026 has passed and OCR is actively accepting complaints and breach notifications.
What is the biggest financial risk in a poorly run behavioral health EMR migration?
Revenue cycle collapse. If timely filing windows are missed during cutover, denials spike and AR aging blows out within 30 days. Operators should budget for at least one full billing cycle of parallel 837/835 testing and a 60-day post-launch denial review against pre-migration baselines. On the compliance side, Part 2 violations are now punishable under the HIPAA enforcement framework. Under the January 28, 2026 inflation adjustment, civil monetary penalties start at $145 per violation for Tier 1 and reach a Tier 4 per-violation maximum and annual cap of $2,190,294 for willful neglect not corrected.
Does AHS provide EMR migration services in California or New York?
No. Atlantic Health Strategies does not operate in or license facilities in California or New York. Our active multi-site EMR migration work is concentrated in states with heavy behavioral health M&A activity, including Colorado, Texas, North Carolina, Florida, Tennessee, Utah, and Arizona. The JAMA Psychiatry data from OHSU, Penn, and Yale identifies Colorado, Texas, and North Carolina as core private-equity concentration zones, where PE-owned practices reach roughly a quarter of mental health facilities. That is where portfolio-level EMR consolidation demand is highest.
Who actually enforces 42 CFR Part 2 during an EMR transition?
In August 2025, HHS delegated administration and enforcement of 42 CFR Part 2 to the HHS Office for Civil Rights (OCR), the same agency that enforces HIPAA. On February 13, 2026, HHS announced a civil enforcement program, and effective February 16, 2026, OCR began accepting complaints alleging Part 2 violations and notifications of breaches of SUD patient records. A breach of SUD records during an EMR migration is now subject to the HIPAA Breach Notification Rule and civil money penalties under the HIPAA enforcement framework, with a Tier 4 per-violation maximum and identical-provision annual cap of $2,190,294.
References
- HHS Press Release: Office for Civil Rights Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records (Feb. 13, 2026)
- Federal Register: HHS Annual Civil Monetary Penalties Inflation Adjustment (Jan. 28, 2026)
- Zhu JM, et al. Geographic Penetration of Private Equity Ownership in Outpatient and Residential Behavioral Health. JAMA Psychiatry (May 2024)
- OHSU News: Study finds private equity expanding to mental health facilities (May 1, 2024)
- Healthcare Brew: Private equity is flying to behavioral health (June 18, 2024)
- Private Equity Stakeholder Project: Private Equity in U.S. Healthcare. Trends in 2023 Deal Activity
- HIPAA Journal: February 16, 2026 Compliance Deadline for Part 2 Final Rule
- Health Law Attorney Blog: OCR Launches Civil Enforcement for 42 CFR Part 2 (Feb. 18, 2026)