Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The short answer: no, and February 16, 2026 proved it
Most behavioral health treatment centers were not ready for what hit in 2026, and the federal numbers say so more plainly than any consultant pitch. HHS set the compliance date for the revised 42 CFR Part 2 rule at February 16, 2026, and OCR announced on February 13, 2026 that it would begin accepting Part 2 complaints and breach-notification allegations three days later. Regulators moved from guidance to enforcement inside a single week.
The dollar signal from Main Justice arrived at the same moment. On January 16, 2026, DOJ reported that False Claims Act settlements and judgments exceeded $6.8 billion in fiscal year 2025, with more than $5.7 billion tied to healthcare. That is the highest single-year FCA total in the statute’s history. Whistleblowers filed a record 1,297 qui tam suits and DOJ opened 401 new investigations.
Then came the June 30, 2025 National Health Care Fraud Takedown: 324 defendants across 50 federal districts, over $14.6 billion in intended loss, $245 million in seized assets. Behavioral health operators were in that mix. If you run a treatment center in Florida, Arizona, Virginia, Texas, or Pennsylvania and you have not rebuilt your compliance program for this environment, your board should already be asking why.
What actually changed: Part 2, parity, and enforcement posture
Three things shifted at once, and operators who read them as separate stories will keep missing the pattern.
First, Part 2. HHS finalized the rule to implement section 3221 of the CARES Act and align Part 2 with the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules. A single patient consent can now cover future uses for treatment, payment, and healthcare operations, HIPAA-style breach notification applies to Part 2 records, and patients can file complaints directly with the HHS Secretary. The teeth are in the enforcement framework: under the 2024 amendments, HIPAA penalties now apply to Part 2 violations, including civil penalties ranging from $141 to $2.1 million per violation (adjusted annually), criminal fines, and possible imprisonment. If your consent forms, Notice of Privacy Practices, and breach response playbook still read like 2023, your team is already behind.
Second, parity. The 2024 MHPAEA final rule sits under an enforcement pause. On May 15, 2025, the Departments of Labor, HHS, and Treasury announced they will not enforce the 2024 Final Rule based on a failure to comply that occurs prior to a final decision in the ERISA Industry Committee litigation, plus an additional 18 months. But the 2013 rule and the underlying statute (including the CAA 2021 comparative analysis requirement) remain in effect, and several states have codified 2024-rule requirements. Payer SIUs continue to audit nonquantitative treatment limitations regardless of the federal pause.
Third, the enforcement posture. DOJ, HHS-OIG, FBI, and CMS stood up a Health Care Fraud Data Fusion Center that, per DOJ, uses cloud computing, artificial intelligence, and other agency resources to identify emerging schemes. Deputy Attorney General Todd Blanche framed the message directly in DOJ’s FY2025 announcement: the False Claims Act “remains one of the government’s most powerful weapons against fraud.” Data-driven audits are the baseline. CMS itself reports it prevented over $4 billion in improper payments and suspended or revoked billing privileges for 205 providers in the months before the takedown.
Where operators get caught: six pressure points
Last quarter I sat through a state licensing inspection where the surveyor asked how quickly a terminated employee’s EMR access was disabled. That is the level of surveyor focus operators should expect now. Six pressure points recur across the mock survey and EOC tour work my team runs:
- ASAM Criteria 4th Edition alignment. Payers and state licensing bodies are updating level-of-care determinations. If your clinical documentation still uses 3rd-edition language, your utilization management and payer readiness are exposed.
- 42 CFR Part 2 operational compliance. Revise consent forms, update the Patient Notice, retrain workforce on redisclosure, and rebuild the breach response plan against the HIPAA Breach Notification Rule.
- Medical necessity documentation. Acadia Healthcare agreed to pay $16,663,918 to the United States to resolve False Claims Act allegations of billing for medically unnecessary inpatient behavioral health services, plus $3.18 million to Florida, Georgia, Michigan, and Nevada. DOJ alleged Acadia admitted patients who did not qualify for inpatient care and failed to discharge them when they no longer needed it. Medical necessity is the recurring theme in behavioral health FCA settlements.
- Managed care contracting and payer audits. SIU audit letters are being triggered by billing outlier data, not just complaints. Match every payer contract’s medical necessity language against your utilization management output.
- Kickback exposure. Marketing arrangements, referral relationships, and gift-card incentives are all being scrutinized under the Anti-Kickback Statute and state analogs.
- Cybersecurity as an FCA theory. DOJ recovered more than $52 million across nine civil cyber-fraud settlements in FY2025, including an $11.2 million settlement against a health benefits administrator for allegedly falsely certifying compliance with cybersecurity requirements. If you attest to safeguards your IT team cannot demonstrate, that is a False Claims problem.
The Medicaid squeeze and what it means for your pro forma
Reimbursement pressure is not abstract. H.R. 1, the “One Big Beautiful Bill Act” signed July 4, 2025, made major reductions in federal health spending. KFF summarized the direction: CBO stated the law will reduce federal spending on health care by over $1 trillion and lead to a 10 million increase in the country’s uninsured population. Medicaid is the single largest payer of behavioral health services in the United States, so those cuts are a direct hit to census assumptions in every behavioral health pro forma written in the last three years.
The pressure is uneven. States that expanded Medicaid, and grant-dependent programs in states like Ohio, Pennsylvania, and Georgia, will feel it first. Rural operators feel it harder still: the Center for American Progress reports that the average operating margin for rural hospitals was 3.1 percent in 2023, with 44 percent of rural hospitals operating with negative margins. Founders and PE-backed buyers should be recalibrating growth assumptions, revisiting timely filing performance, and pressure-testing utilization management workflows before the next quarterly board meeting, not after.
Model the KFF direction against your Medicaid payer mix, then rerun your days cash on hand under three census scenarios. If the answer is uncomfortable, that is the point.
What readiness looks like between now and Q1 2026
Readiness is a schedule, not a mood. Here is the sequence my team runs for operators heading into 2026:
- Mock survey against ASAM Criteria 4th Edition and current state licensure standards. Document every finding, assign an owner, close within a defined survey window.
- 42 CFR Part 2 gap assessment. Consent forms, Notice of Privacy Practices, breach notification playbook, workforce retraining, business associate agreements. HHS released model NPPs on the eve of the compliance date, which most operators have not yet customized to their entity and state law.
- Payer readiness review. Pull the last 12 months of denials, timely filing performance, and utilization management turnaround. Match against each contract’s medical necessity language.
- SIU audit dry run. Pull 30 charts, human-audit them, and see what a payer would see.
- Accreditation readiness. Whether you are pursuing Joint Commission or CARF, EOC tour findings and clinical leadership documentation should be current, not reconstructed the week before survey.
- Cybersecurity attestation review. Confirm what you are attesting to in payer contracts and federal grant applications actually matches the controls your IT team can produce.
Operators who treat this as a checklist will fail the checklist. Operators who treat their licensing, accreditation, compliance, IT, HR, and finance functions as one integrated program will still be operating in 2027.
Frequently asked questions
What is the 42 CFR Part 2 compliance deadline for behavioral health treatment centers?
The compliance date is February 16, 2026. HHS published the final rule on February 8, 2024; it took effect April 16, 2024, and OCR now enforces Part 2 under the HIPAA Enforcement Rule framework. OCR announced on February 13, 2026 that it would begin accepting Part 2 complaints and breach-notification allegations three days later. Under the 2024 amendments, HIPAA penalties apply to Part 2 violations, ranging from $141 to $2.1 million per violation.
How aggressive is federal enforcement against behavioral health providers right now?
Historically high. DOJ reported over $6.8 billion in False Claims Act settlements and judgments in FY2025, with more than $5.7 billion tied to healthcare, the highest annual total in FCA history. The June 30, 2025 National Health Care Fraud Takedown charged 324 defendants across 50 federal districts with over $14.6 billion in intended loss and seized $245 million in assets. DOJ opened 401 new investigations in FY2025.
Is the 2024 mental health parity final rule still in effect?
The new provisions of the 2024 MHPAEA final rule are on an enforcement pause. On May 15, 2025, DOL, HHS, and Treasury announced they will not enforce the 2024 Final Rule for noncompliance occurring prior to a final decision in the ERISA Industry Committee litigation, plus 18 months. However, the 2013 MHPAEA final rule and the underlying statute (including CAA 2021 amendments requiring written NQTL comparative analyses) remain fully in effect. Several states have adopted 2024-rule requirements into state statute, and payer SIU audits of NQTLs continue.
What Medicaid policy changes should behavioral health operators model into their pro forma?
H.R. 1, the One Big Beautiful Bill Act signed July 4, 2025, cuts federal Medicaid spending substantially over 10 years. KFF summarizes CBO’s projections at over $1 trillion in reduced federal health spending and a 10 million increase in the uninsured population. Because Medicaid is the largest payer of behavioral health services in the United States, operators should stress-test census assumptions, days cash on hand, and payer mix scenarios, particularly in states heavily reliant on Medicaid expansion populations.
References
- HHS OCR. Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or “Part 2”
- HHS OCR. Fact Sheet: 42 CFR Part 2 Final Rule
- DOJ. False Claims Act Settlements and Judgments Exceed $6.8B in FY2025
- DOJ. 2025 National Health Care Fraud Takedown
- DOJ. Acadia Healthcare $19.85M FCA Settlement
- DOL/HHS/Treasury. Statement Regarding Enforcement of the 2024 MHPAEA Final Rule
- KFF. Health Provisions in the 2025 Federal Budget Reconciliation Law (OBBBA)
- Woods Rogers. 42 CFR Part 2 Enhanced Penalties and Enforcement