Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Short Answer: PsychPlus Bought a Stack, Not a Patient Panel
PsychPlus did not buy a patient panel when it acquired Koa Health on June 23, 2026. Faisal Tai and his team bought an owned technology platform, and mid-market psychiatry buyers should now treat tech-stack ownership, cross-border data governance, and payer viability of digital therapeutics as first-tier diligence workstreams, not footnotes.
Most trade coverage led with the digital therapeutics angle and the cross-Atlantic story. Tidy headline. The actual story is the Galaxy stack. Chris Larson at Behavioral Health Business reported that the addition of a digital therapeutic and patient-facing app bolsters PsychPlus’s homegrown tech stack, which it calls Galaxy, and that PsychPlus already owns its EHR, scheduling, documentation and billing systems. That is a meaningfully different transaction than the psychiatry roll-ups that closed in 2022 and 2023, where buyers were stacking NPIs and locations and running everything on a licensed copy of someone else’s EHR.
Koa also brings a validated clinical evidence base. The deal announcement states that Koa’s digital products were developed in collaboration with researchers from Harvard Medical School, University of Oxford, and Massachusetts General Hospital, and are backed by 23 peer-reviewed clinical studies and 56 patents. Together the combined company now supports more than 6 million patients globally. Koa itself had raised roughly €44.1 million (about $50.2 million) since its founding in 2016, so PsychPlus inherited real capital investment on the platform side, not a napkin-stage app.
For the mid-market psychiatry operators and PE sponsors calling us weekly, this is the signal worth watching. Buyers just watched the competitive bar move. If your nearest competitor owns its scheduling logic, its documentation templates, and its outcomes data pipeline, an off-the-shelf Athena or Kipu deployment is no longer a neutral choice at exit.
Cross-Border Data Flows and the HIPAA / 42 CFR Part 2 Problem
Here is where buy-side diligence gets uncomfortable. Koa Health was built in the UK under UK GDPR and the Data Protection Act 2018. PsychPlus operates in Texas, Florida, Georgia, and other US jurisdictions where HIPAA and, for any SUD-adjacent psychiatric care, 42 CFR Part 2 govern data handling. Those frameworks do not auto-translate.
The Part 2 rules got materially tougher in the last 24 months. HHS confirms that beginning February 16, 2026, entities and persons subject to the regulation protecting the confidentiality of SUD patient records must comply with all applicable requirements, and OCR announced its Civil Enforcement Program on February 13, 2026 and began accepting complaints and breach notifications on February 16. OCR Director Paula M. Stannard did not soften the language. She stated that “OCR is uniquely positioned to enforce patient rights and the regulated community’s obligations” given its history administering HIPAA privacy and breach enforcement.
Translation for buyers: if a target’s platform ever touched SUD-adjacent PHI without consent architecture that meets Part 2’s specific content requirements, that exposure now carries the same civil money penalty structure as a HIPAA violation. Per the HIPAA Journal, the penalties for noncompliance align with HIPAA, and OCR can pursue resolution agreements, monetary settlements, corrective action, or civil money penalties.
The diligence questions that actually matter are not on the standard QofE checklist:
- Where does the data physically sit today?
- Who has admin access from which country?
- Does the BAA structure hold up under an OCR investigation?
- Has the platform ever processed a record subject to Part 2 consent rules, and if so, could the consent architecture even capture the required Part 2 statement and scope-of-consent language?
Operators in Tennessee and Pennsylvania have discovered post-close that a newly acquired digital tool was sending PHI through a sub-processor in a jurisdiction nobody had mapped. Remediation on one of those ran north of $400,000 and took eleven months. If you are on the sell-side and your platform was built outside the US, get ahead of this. Buyer’s counsel will find it.
Payer Viability of Digital Therapeutics in a US Psychiatry Book
The second diligence trap is reimbursement. Digital therapeutics have a US reimbursement story that is, charitably, still developing. CMS’s own fee schedule summary confirms that the 2025 Medicare Physician Fee Schedule introduced 3 new HCPCS codes (G0552, G0553, and G0554) for approved digital mental health treatment devices provided incident to professional behavioral health services used with ongoing behavioral health treatment under a plan of care. That was the door opening.
Read the fine print. Nixon Law Group’s analysis of the final rule confirms that G0553 has an estimated reimbursement rate of $20.06 for the first 20 minutes of treatment management, G0554 has an estimated reimbursement rate of $19.73 for each additional 20 minutes, and G0552 was assigned contractor pricing rather than a national rate. Nixon also documents CMS’s requirement that devices “must be cleared under section 510(k) of the FD&C Act or granted De Novo authorization by FDA and in each case must be classified under 21 CFR 882.5801 for mental or behavioral health treatment”. That is a narrow gate. Most commercial payers have not moved in lockstep with CMS, and prior authorization friction on digital tools is real.
When PsychPlus folds Koa’s digital tools into its psychiatry workflows, the relevant question for a similarly situated operator is not whether the technology is clinically interesting. It is whether the in-network commercial payers and Medicaid MCOs in your operating states will actually pay for the encounters those tools generate. Digital health reimbursement in Florida and Texas Medicaid looks very different than in Massachusetts or Washington. A pro forma that assumes uniform digital therapeutic reimbursement across a multi-state psychiatry footprint is a pro forma I would not sign off on.
Underwrite as if a payer SIU letter is coming, because federal enforcers are watching the same signals. DOJ announced on June 30, 2025 that its 2025 National Health Care Fraud Takedown resulted in criminal charges against 324 defendants for their alleged participation in schemes involving over $14.6 billion in intended loss, and Epstein Becker Green noted that this more than doubled the prior record of $6 billion set in 2020. Aggressive digital therapeutic and telehealth billing is exactly the pattern that triggers a payer special investigations unit review.
Integration Risk: Two Tech Stacks, One Operating Company
The third issue quietly kills synergy numbers. PsychPlus had a tech stack before the deal. Koa had a tech stack. Now there is one company and two stacks, and someone has to decide what survives.
HIStalk Practice confirmed that PsychPlus will integrate Koa’s app with its homegrown EHR and practice management systems. That is a sentence in a news brief. It is a nine-figure engineering commitment in practice.
The synergy slide in the LOI rarely survives contact with engineering reality. The scheduling system the acquirer uses is wired into the credentialing database, which is wired into the payer enrollment files, which is wired into the clinical documentation. Pulling any one piece out to swap in the acquired company’s tool means re-validating every downstream workflow. For a psychiatry group with even 40 prescribers across multiple states, that is a six to nine month project minimum, and it happens while clinicians are still seeing patients and revenue cycle still has to close the month.
Part 2’s new mechanics make the integration lift heavier, not lighter. Quarles notes that under the updated regulations, the HIPAA enforcement framework now applies to Part 2 violations, including financial penalties for noncompliance, criminal fines, and possible imprisonment. That sounds like a simplification. In practice, appending disclosure information to each electronic Part 2 disclosure and rebuilding consent capture across two platforms is real engineering work.
Operators who do this well budget for a dedicated integration lead reporting to the COO, a frozen feature roadmap on both platforms for at least two quarters post-close, and an explicit clinical leadership sign-off on any documentation template change. The ones who do it poorly assume the engineering teams will figure it out, then watch clinician productivity drop 15 to 20 percent for a year while everyone fights the new tool.
What This Means for Buy-Side and Sell-Side Readiness
The PsychPlus and Koa deal is a marker. Mid-market psychiatry roll-ups now compete on owned technology, and that changes what buyers must diligence and what sellers must prepare.
If you are on the buy-side, expand the diligence scope:
- Add a tech and data governance workstream alongside the financial, clinical, and regulatory streams.
- Map the data residency and sub-processor chain end to end.
- Pressure-test the BAA structure against an OCR investigation, not just an audit checklist.
- Get a real opinion on 42 CFR Part 2 applicability if any part of the target’s book touches SUD care. HHS confirms that beginning on February 16, 2026, OCR began accepting Part 2 complaints and breach notifications.
- Model payer reimbursement state by state, not in aggregate. Digital mental health treatment coverage in Florida and Texas Medicaid does not mirror Massachusetts.
- Budget integration cost honestly.
If you are on the sell-side and you built proprietary technology, document it the way a buyer’s diligence team will want to see it:
- Data flow diagrams.
- Sub-processor lists.
- BAA inventories.
- Reimbursement evidence by payer.
- Engineering team retention plans.
Sellers who do this work will see their multiples reflect it. Sellers who do not will watch a strategic premium evaporate during confirmatory diligence, the same way I watched operators lose nearly $6 million of headline value last year because the tech disclosures came late and incomplete.
Leah Kendall and I are having exactly this conversation with sponsors and operators calling into AHS from Texas, Florida, Georgia, Tennessee, and Pennsylvania right now. If you are underwriting or preparing a psychiatry or behavioral health platform where owned technology is part of the story, this is the year to get the data governance and reimbursement diligence right before the LOI lands.
Frequently asked questions
What does the PsychPlus acquisition of Koa Health actually change for behavioral health M&A diligence?
It reframes the target. Behavioral Health Business reported that PsychPlus already owns its EHR, scheduling, documentation, and billing systems under its Galaxy platform, and the Koa deal added a digital therapeutic and patient-facing app to that owned stack. Buyers evaluating similar mid-market psychiatry targets in Texas, Florida, Georgia, Tennessee, and Pennsylvania should now treat proprietary technology, engineering team retention, and data governance as first-tier diligence workstreams alongside financial and clinical review.
Why does buying a UK-built digital mental health platform create HIPAA and 42 CFR Part 2 risk?
UK GDPR and the US frameworks do not auto-translate. Once a UK-built platform processes US patient data, HIPAA applies, and any SUD-adjacent psychiatric care can pull the platform into 42 CFR Part 2. HHS confirms that beginning February 16, 2026, entities subject to Part 2 must comply with all applicable requirements, and OCR began accepting Part 2 complaints and breach notifications on that same date. Penalties align with HIPAA and can include civil money penalties, corrective action plans, and resolution agreements.
Can psychiatry practices actually get paid for digital therapeutics in 2026?
Medicare pays a narrow slice. The 2025 Medicare Physician Fee Schedule introduced HCPCS codes G0552, G0553, and G0554 for approved digital mental health treatment devices, with G0553 reimbursed at roughly $20.06 for the first 20 minutes and G0554 at roughly $19.73 for each additional 20 minutes, per Nixon Law Group. G0552 uses contractor pricing set by regional MACs. Commercial payer adoption is uneven, and CMS requires devices to be FDA 510(k) cleared or De Novo authorized and classified under 21 CFR 882.5801. Underwriters should model reimbursement state by state.
Why should behavioral health operators care about the 2025 DOJ Health Care Fraud Takedown when they are not doing anything fraudulent?
The Takedown resets the enforcement environment. DOJ charged 324 defendants in schemes involving over $14.6 billion in intended loss, more than doubling the 2020 record of $6 billion. Telemedicine and digital-billing patterns were specifically flagged. Payer SIUs mirror federal enforcement patterns, which means aggressive digital therapeutic and telehealth billing is now a signal that draws payer audits even when the underlying claims are legitimate. Documentation discipline matters more than it did 18 months ago.
References
- Behavioral Health Business. PsychPlus Acquires Koa Health (Chris Larson, June 25, 2026)
- PsychPlus Announces the Acquisition of Koa Health (June 23, 2026 press release)
- HHS OCR. Civil Enforcement Program for Confidentiality of SUD Patient Records (Feb. 13, 2026)
- HIPAA Journal. February 16, 2026 Compliance Deadline for Part 2 Final Rule
- Quarles. 42 CFR Part 2 Compliance Deadline and HHS Enforcement
- CMS. Medicare Physician Fee Schedule Final Rule Summary CY 2025 (PDF)
- Nixon Law Group. New Reimbursement Opportunities for Digital Mental Health Treatment in 2025
- DOJ. 2025 National Health Care Fraud Takedown (June 30, 2025)
- Epstein Becker Green. Analysis of the 2025 DOJ Health Care Fraud Takedown
- HIStalk Practice. News 6/29/26 (PsychPlus / Koa integration note)