Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Short Answer: PsychPlus Bought a Stack, Not a Patient Panel
PsychPlus did not buy a patient panel when it acquired Koa Health on June 23, 2026. It bought an owned technology platform, and mid-market psychiatry buyers should now treat tech-stack ownership, cross-border data governance, and payer viability of digital therapeutics as first-tier diligence workstreams, not footnotes.
The Houston-based psychiatry group announced the deal in an EIN press release on June 23, 2026. Most trade coverage led with the digital therapeutics angle and the cross-Atlantic story. Tidy headline. The actual story is the Galaxy stack.
Chris Larson at Behavioral Health Business reported that the addition of a digital therapeutic and patient-facing app bolsters PsychPlus’s homegrown tech stack, which it calls Galaxy, and that PsychPlus already owns its EHR, scheduling, documentation and billing systems. That is a meaningfully different transaction than the psychiatry roll-ups that closed in 2022 and 2023, where buyers were stacking NPIs and locations and running everything on a licensed copy of someone else’s EHR.
Koa also brings a validated clinical evidence base. The deal announcement states Koa’s digital products were developed in collaboration with researchers from Harvard Medical School, University of Oxford, and Massachusetts General Hospital, and are backed by 23 peer-reviewed clinical studies and 56 patents. Together the combined company now supports more than 6 million patients globally.
For the mid-market psychiatry operators and PE sponsors calling us weekly, this is the signal worth watching. Buyers just watched the competitive bar move. If your nearest competitor owns its scheduling logic, its documentation templates, and its outcomes data pipeline, an off-the-shelf Athena or Kipu deployment is no longer a neutral choice at exit.
Cross-Border Data Flows and the HIPAA / 42 CFR Part 2 Problem
Here is where buy-side diligence gets uncomfortable. Koa Health was built in the UK under UK GDPR and the Data Protection Act 2018. PsychPlus operates in Texas, Florida, Georgia, and other US jurisdictions where HIPAA and, for any SUD-adjacent psychiatric care, 42 CFR Part 2 govern data handling. Those frameworks do not auto-translate.
The Part 2 rules got materially tougher in the last 24 months. The American Psychiatric Association confirms that a final rule revising 42 CFR Part 2 was released by SAMHSA, went into effect on April 16, 2024, and enforcement for the updated Part 2 rules started on February 16, 2026. HHS’s Office for Civil Rights announced its Civil Enforcement Program for Part 2 records on February 13, 2026, and confirmed it would accept complaints alleging Part 2 violations and breach notifications starting February 16, 2026.
HHS’s own press release is explicit about the teeth. OCR Director Paula M. Stannard stated that “OCR is uniquely positioned to enforce patient rights and the regulated community’s obligations” given its history administering HIPAA privacy and breach enforcement.
Translation for buyers: if a target’s platform ever touched SUD-adjacent PHI without consent architecture that meets Part 2’s specific content requirements, that exposure now carries the same civil money penalty structure as a HIPAA violation. Thomson Reuters’ summary of the August 2024 HHS inflation adjustment confirms Tier 1 HIPAA penalties run from $141 to $71,162 per violation, with Tier 4 willful-neglect penalties reaching $2,134,831 per violation and a matching calendar-year cap.
The diligence questions that actually matter are not on the standard QofE checklist. Where does the data physically sit today? Who has admin access from which country? Does the BAA structure hold up under an OCR investigation? Has the platform ever processed a record subject to Part 2 consent rules, and if so, could the consent architecture even capture the required Part 2 statement and scope-of-consent language?
Buyers in Tennessee and Pennsylvania have discovered post-close that a newly acquired digital tool was sending PHI through a sub-processor in a jurisdiction nobody had mapped. Remediation on one of those ran north of $400,000 and took eleven months. If you are on the sell-side and your platform was built outside the US, get ahead of this. Buyer’s counsel will find it.
Payer Viability of Digital Therapeutics in a US Psychiatry Book
The second diligence trap is reimbursement. Digital therapeutics have a US reimbursement story that is, charitably, still developing.
CMS’s own fee schedule summary confirms the 2025 Medicare Physician Fee Schedule introduced three new HCPCS codes (G0552, G0553, and G0554) for approved digital mental health treatment devices provided incident to professional behavioral health services used with ongoing behavioral health treatment under a plan of care. That was the door opening. Read the fine print.
Nixon Law Group’s analysis of the final rule confirms that G0553 has an estimated reimbursement rate of $20.06 for the first 20 minutes of treatment management, G0554 pays roughly $19.73 for each additional 20 minutes, and G0552 was assigned contractor pricing rather than a national rate. Nixon also documents CMS’s requirement that devices “must be cleared under section 510(k) of the FD&C Act or granted De Novo authorization by FDA and in each case must be classified under 21 CFR 882.5801 for mental or behavioral health treatment.” That is a narrow gate.
Most commercial payers have not moved in lockstep with CMS, and prior authorization friction on digital tools is real. When PsychPlus folds Koa’s digital tools into its psychiatry workflows, the relevant question for a similarly situated operator is not whether the technology is clinically interesting. It is whether the in-network commercial payers and Medicaid MCOs in your operating states will actually pay for the encounters those tools generate. Digital health reimbursement in Florida and Texas Medicaid looks very different than in Massachusetts or Washington.
A pro forma that assumes uniform digital therapeutic reimbursement across a multi-state psychiatry footprint is a pro forma I would not sign off on. Underwrite as if a payer SIU letter is coming, because federal enforcers are watching the same signals. DOJ announced on June 30, 2025 that its 2025 National Health Care Fraud Takedown resulted in criminal charges against 324 defendants for their alleged participation in schemes involving over $14.6 billion in intended loss, and separately noted that 49 defendants were charged in connection with the submission of over $1.17 billion in allegedly fraudulent claims to Medicare resulting from telemedicine and genetic testing fraud schemes. Aggressive digital therapeutic and telehealth billing is exactly the pattern that triggers a payer special investigations unit review.
Integration Risk: Two Tech Stacks, One Operating Company
The third issue quietly kills synergy numbers. PsychPlus had a tech stack before the deal. Koa had a tech stack. Now there is one company and two stacks, and someone has to decide what survives.
The synergy slide in the LOI rarely survives contact with engineering reality. The scheduling system the acquirer uses is wired into the credentialing database, which is wired into the payer enrollment files, which is wired into the clinical documentation. Pulling any one piece out to swap in the acquired company’s tool means re-validating every downstream workflow. For a psychiatry group with even 40 prescribers across multiple states, that is a six to nine month project minimum, and it happens while clinicians are still seeing patients and revenue cycle still has to close the month.
Part 2’s new mechanics make the integration lift heavier, not lighter. HHS confirms that the final rule allows a single consent for all future uses and disclosures for treatment, payment, and health care operations, and permits HIPAA covered entities and business associates that receive records under that consent to redisclose the records in accordance with the HIPAA regulations. That sounds like a simplification. In practice, appending disclosure information to each electronic Part 2 disclosure and rebuilding consent capture across two platforms is real engineering work.
Operators who do this well budget for a dedicated integration lead reporting to the COO, a frozen feature roadmap on both platforms for at least two quarters post-close, and an explicit clinical leadership sign-off on any documentation template change. The ones who do it poorly assume the engineering teams will figure it out, then watch clinician productivity drop 15 to 20 percent for a year while everyone fights the new tool.
What This Means for Buy-Side and Sell-Side Readiness
The PsychPlus and Koa deal is a marker. Mid-market psychiatry roll-ups now compete on owned technology, and that changes what buyers must diligence and what sellers must prepare.
If you are on the buy-side, expand the diligence scope:
- Add a tech and data governance workstream alongside the financial, clinical, and regulatory streams.
- Map the data residency and sub-processor chain end to end.
- Pressure-test the BAA structure against an OCR investigation, not just an audit checklist.
- Get a real opinion on 42 CFR Part 2 applicability if any part of the target’s book touches SUD care. OCR began accepting Part 2 complaints on February 16, 2026.
- Model payer reimbursement state by state, not in aggregate. Digital mental health treatment coverage in Florida and Texas Medicaid does not mirror Massachusetts.
- Budget integration cost honestly.
If you are on the sell-side and you built proprietary technology, document it the way a buyer’s diligence team will want to see it:
- Data flow diagrams.
- Sub-processor lists.
- BAA inventories.
- Reimbursement evidence by payer.
- Engineering team retention plans.
Sellers who do this work will see their multiples reflect it. Sellers who do not will watch a strategic premium evaporate during confirmatory diligence, the same way I watched operators lose nearly $6 million of headline value last year because the tech disclosures came late and incomplete.
Leah Kendall and I are having exactly this conversation with sponsors and operators calling into AHS from Texas, Florida, Georgia, Tennessee, and Pennsylvania right now. If you are underwriting or preparing a psychiatry or behavioral health platform where owned technology is part of the story, this is the year to get the data governance and reimbursement diligence right before the LOI lands.
Frequently asked questions
What does the PsychPlus acquisition of Koa Health actually change for behavioral health M&A diligence?
It reframes the target. Behavioral Health Business reported that PsychPlus already owns its EHR, scheduling, documentation, and billing systems under its Galaxy platform, and the Koa deal added a digital therapeutic and patient-facing app to that owned stack. Buyers evaluating similar mid-market psychiatry targets in Texas, Florida, Georgia, Tennessee, and Pennsylvania should now treat proprietary technology, engineering team retention, and data governance as first-tier diligence workstreams alongside financial and clinical review, not add-ons.
Why does buying a UK-built digital mental health platform create HIPAA and 42 CFR Part 2 risk?
UK GDPR and the US frameworks do not auto-translate. Once a UK-built platform processes US patient data, HIPAA applies, and any SUD-adjacent psychiatric care can pull the platform into 42 CFR Part 2. HHS’s 2024 final rule aligned Part 2 penalties with HIPAA and applied HIPAA breach notification to Part 2 records, and OCR began accepting Part 2 complaints and breach notifications on February 16, 2026. Under HHS’s August 2024 inflation adjustment, HIPAA per-violation penalties currently run from $141 to $71,162 in Tier 1 and reach $2,134,831 at Tier 4.
Can psychiatry practices actually get paid for digital therapeutics in 2026?
Medicare pays a narrow slice. The 2025 Medicare Physician Fee Schedule introduced HCPCS G0552, G0553, and G0554 for digital mental health treatment devices used incident to behavioral health services under a plan of care. Per Nixon Law Group, G0553 pays an estimated $20.06 for the first 20 minutes of monthly treatment management, G0554 pays roughly $19.73 per additional 20 minutes, and G0552 is contractor-priced by the local MAC. Devices must be FDA-cleared or De Novo authorized and classified under 21 CFR 882.5801. Commercial payer and Medicaid MCO coverage remains uneven state by state.
How aggressive is federal enforcement on telehealth and digital billing right now?
Very. DOJ’s 2025 National Health Care Fraud Takedown, announced June 30, 2025, resulted in criminal charges against 324 defendants for schemes involving over $14.6 billion in intended loss, with 49 of those defendants tied to telemedicine and genetic testing schemes involving over $1.17 billion in allegedly fraudulent Medicare claims. Any buyer underwriting a psychiatry platform with heavy digital or telehealth billing volume should assume a payer SIU letter is a realistic scenario and stress-test accordingly.
References
- Behavioral Health Business: PsychPlus Acquires Koa Health (Chris Larson, June 25, 2026)
- PsychPlus Announces the Acquisition of Koa Health (press release, June 23, 2026)
- HHS OCR: Civil Enforcement Program for Confidentiality of SUD Patient Records (February 13, 2026)
- American Psychiatric Association: 42 CFR Part 2 Final Rule summary
- HHS Fact Sheet: 42 CFR Part 2 Final Rule
- Thomson Reuters: HHS Civil Monetary Penalties for HIPAA, effective August 8, 2024
- CMS: Medicare Physician Fee Schedule Final Rule Summary CY 2025
- Nixon Law Group: New Reimbursement Opportunities for Digital Mental Health Treatment in 2025 CMS Final Rule
- DOJ: 2025 National Health Care Fraud Takedown (June 30, 2025)