Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The short answer: probably not, and the enforcement data proves it
Most behavioral health treatment center operators are not ready for the current enforcement environment, and the numbers coming out of Washington in the last twelve months prove it. If your compliance program was built for 2019, you are behind what DOJ, CMS, HHS-OIG, SAMHSA, and your state licensing authority are doing right now.
On June 23, 2026, the Department of Justice announced its 2026 National Health Care Fraud Takedown. DOJ charged 455 defendants, including 90 doctors and other licensed medical professionals, in schemes involving over $6.5 billion in false claims, with cases in 56 federal districts and 50 state Medicaid Fraud Control Units participating. Behavioral Health Business reported that 39 of those cases were behavioral health, addiction treatment, and autism therapy providers, accounting for at least $208.4 million in suspected fraudulent payments, with SUD providers making up roughly 68.5% of that total, or $142,891,408.
One case inside the 2026 action should stop every treatment center operator cold. Prosecutors allege Jimmy Muyumbu of Motherland Counseling in Arizona submitted nearly $45 million in fraudulent claims to Arizona’s Medicaid program (AHCCCS) and was paid $36.7 million. Whole networks of addiction clinics. One state. That is not a trend line to note in your next board meeting. It is the operating environment.
CMS Administrator Dr. Mehmet Oz put it plainly the day of the announcement: “CMS is done playing catch-up.”
What actually changed: data-driven enforcement, aligned Part 2 rules, and a new accreditation bar
Three specific shifts define this environment. Operators need to know each one by name.
1) DOJ is running claims data through analytics before a target knows they are one. The Health Care Fraud Unit built a Data Fusion Center that combines analysts from DOJ’s Criminal Division, HHS-OIG, and the FBI. In the first prosecution arising from the Fusion Center, the Financial Intelligence Review Team detected an alleged $67 million scheme to bill Illinois Medicaid for behavioral health services never provided, with the defendant submitting claims for more than 500 hours of counseling and therapy per day, far exceeding the company’s provider capacity. The investigation opened within days of the financial intelligence review, and the defendant was arrested less than seven months later while allegedly attempting to leave the country. CMS separately suspended 1,079 providers and revoked billing privileges for 1,403 providers, while HHS-OIG initiated actions to restore over $10 billion of flagged and suspended payments back to the Medicare Trust Fund.
2) 42 CFR Part 2 now looks and feels like HIPAA. HHS Office for Civil Rights and SAMHSA published the Final Rule in 2024. Beginning February 16, 2026, entities and persons subject to Part 2 must comply with all applicable requirements, and the penalties for noncompliance align with the penalties available under HIPAA. Civil penalties now range from $141 to $2.1 million per violation, adjusted annually for inflation, plus criminal fines and possible imprisonment for the most serious violations. OCR investigations may be resolved through resolution agreements, monetary settlements, corrective action plans, or civil money penalties. Patients can now file complaints directly with the Secretary of HHS.
3) CARF raised the clinical documentation bar. Standard 2.A.12, newly introduced in CARF’s 2025 Behavioral Health Standards Manual, requires organizations to develop a clear, written procedure for implementing Measurement-Informed Care. If your clinical leadership cannot produce outcome data on PHQ-9, GAD-7, or DAST-10 at defined intervals, your next survey window will not go the way you want.
The findings surveyors keep writing, and why they keep writing them
In Florida, treatment center owners answer to two masters. The Florida Department of Children and Families licenses substance use disorder providers under Chapter 397, Florida Statutes and Chapter 65D-30, Florida Administrative Code, while the Agency for Health Care Administration licenses mental health facilities. That split trips up new operators constantly. A founder buys a building in Broward County, opens a PHP (an outpatient level of care, ASAM Level 2.5), and discovers three weeks before opening that the correct license, the required policies, and the surveyor’s checklist are not what the pro forma assumed.
The finding patterns repeat across states:
- Terminated employees still active in the EMR days after separation.
- Medication reconciliation gaps between admission and the first physician contact.
- EOC tour deficiencies: blocked egress, expired fire drills, unlocked med rooms.
- Consent forms that do not carry the updated Part 2 disclosure language.
- Utilization management notes that do not match the ASAM level of care being billed.
The CARF Measurement-Informed Care requirement is now a top finding driver. A missing written MIC procedure is the most commonly cited deficiency in 2025 and 2026 CARF behavioral health surveys. Drift is what a mock survey is designed to catch before a real surveyor does.
The operator-side playbook: what payer readiness actually looks like now
A treatment center CEO in the Southeast called me last month after a payer SIU audit clawback wiped out a quarter of collections on one contract. The clinical work was defensible. The documentation trail was not. Operators lose money in that gap, and they can fix it before a payer or a state surveyor forces the issue.
Here is what a defensible operational backbone looks like heading into the back half of 2026:
- Chart audits done by humans, not just software. AI misses things. It hallucinates. It skips obvious errors. Use it as a first pass, not as the compliance program.
- A single-owner map of licensure, accreditation, payer contracts, credentialing, HIPAA, and Part 2. When four vendors each own a piece, deadlines slip and findings pile up. One accountable operational leader. One calendar. One risk register.
- Real-time EMR access controls tied to HR termination workflows. If a terminated staff member can still log in the next business day, you have a HIPAA and Part 2 problem the moment a surveyor asks.
- ASAM Criteria 4th Edition alignment across clinical, UM, and billing. Level-of-care documentation and the claim submitted must reconcile. If they do not, the SIU audit will find it.
- A running mock survey cadence, not a pre-survey scramble. Quarterly EOC tours. Quarterly chart audit samples. Annual policy refresh.
Operators who treat accreditation as an operating discipline get through survey windows without drama. Compliance programs that rely on responding to external inquiries are insufficient; internal billing audits need to be capable of identifying the same outliers the government is seeing. Payer SIUs use much of the same data logic.
What this means for founders, PE-backed buyers, and CEOs preparing for exit
For a private equity buyer running diligence on a behavioral health platform right now, the compliance file is not a checkbox. It is the deal. Buyers price reps and warranties around False Claims Act exposure, Part 2 breach history, and open licensure findings into purchase agreements. A single unresolved state finding at a satellite location can delay a close by 60 to 90 days. Multi-site operators with fragmented policies across states get discounted harder than they used to.
For founders scaling from one site to three or five in Florida or Tennessee, the pattern is the same. Payer readiness, licensure, and accreditation do not run in sequence. They run in parallel from the day the founder signs the lease. Feasibility studies and pro formas that ignore the true cost of a compliance program understate operating expense and overstate margin.
For CEOs preparing for exit in the next 18 to 36 months, start now. The buyer will look at your last two survey cycles, your SIU audit history, your Part 2 compliance evidence, and your UM documentation. Fix it before diligence, not during. Deal flow in the behavioral health sector was up 17% year over year in 2025, marking the industry’s second consecutive year of gains since 2023. Buyers have options and they will use them.
The regulators are moving faster. The auditors have better tools. The buyers know it. Operators who treat their compliance program as an operating discipline, not a documentation exercise, keep their licenses, keep their contracts, and keep their exit multiples.
Frequently asked questions
What is the biggest regulatory risk facing behavioral health treatment centers in 2026?
Data-driven federal enforcement paired with the newly enforceable 42 CFR Part 2 civil penalty regime. DOJ’s 2026 National Health Care Fraud Takedown charged 455 defendants tied to more than $6.5 billion in alleged fraud, with 39 behavioral health, addiction treatment, and autism therapy cases accounting for at least $208.4 million per Behavioral Health Business. Compliance with the updated Part 2 rule was due February 16, 2026, exposing operators to civil monetary penalties ranging from $141 to approximately $2.1 million per violation per year, breach notification obligations, and direct patient complaints to HHS.
When did the updated 42 CFR Part 2 rule become enforceable, and what changed?
Per HHS, beginning February 16, 2026, entities subject to the regulation must comply with all applicable requirements, and civil penalties now align with HIPAA. Key changes include a single patient consent for future treatment, payment, and health care operations disclosures; application of the HIPAA Breach Notification Rule to Part 2 records; and a new patient right to file complaints with the Secretary of HHS. OCR announced its civil enforcement program on February 13, 2026 and began accepting complaints and breach notifications on February 16, 2026.
What is CARF Standard 2.A.12 and why does it matter for accreditation readiness?
Standard 2.A.12 was introduced in CARF’s 2025 Behavioral Health Standards Manual and requires accredited organizations to develop a clear, written procedure for implementing Measurement-Informed Care. Programs must identify validated tools (commonly PHQ-9, GAD-7, and DAST-10), collect outcome data at defined intervals, and use that data clinically to adjust treatment. A missing written MIC procedure is now among the most commonly cited deficiencies in 2025 and 2026 CARF behavioral health surveys.
How should PE-backed buyers approach compliance diligence on a behavioral health platform right now?
Treat compliance as a value driver, not a checkbox. Review the last two accreditation survey cycles across every site, all state licensure findings and corrective actions, SIU audit and payer clawback history, Part 2 breach and complaint records, and ASAM Criteria 4th Edition level-of-care documentation against billing. Given the DOJ Data Fusion Center opened its first case around an alleged $67 million Illinois Medicaid behavioral health scheme where the defendant allegedly billed more than 500 hours of counseling per day, historical claims data patterns are now a diligence item, not just a compliance one.
References
- U.S. Department of Justice, National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection with Over $6.5 Billion in Alleged Fraud (June 23, 2026)
- Behavioral Health Business, Behavioral Health Billing Fraud, Kickbacks Totalled $208M in Massive DOJ Fraud Bust (June 24, 2026)
- HHS Office for Civil Rights, Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records (February 13, 2026)
- Woods Rogers, Compliance Deadline Approaches for 42 CFR Part 2 Amendments: Enhanced Penalties and Enforcement Process
- Arnold & Porter, DOJ Announces Record-Breaking 2026 Health Care Fraud Takedown
- Fierce Healthcare, DOJ announces $6.5B healthcare fraud takedown with record Medicaid enforcement
- Greenspace Health, New Standards for CARF Accreditation: The Impact of Measurement-Based Care
- Behavioral Health Business, SUD Falls Short While Mental Health, IDD Led Behavioral Health M&A in 2025 (April 14, 2026)
- Eye on Enforcement, DOJ Announces Record Number of Defendants Charged in 2026 National Health Care Fraud Takedown