Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
A working definition operators can actually use
Managed services for behavioral health organizations are ongoing, outsourced operational functions, most commonly revenue cycle management (RCM), utilization review (UR), credentialing, compliance monitoring, and HR/payroll, delivered by a third party under a recurring contract. Operators typically engage managed services at three moments: at launch (to avoid standing up a full back office on day one), during rapid multi-site scale (to standardize workflows across sites), and post-acquisition (to stabilize a distressed asset before the buyer’s team is in place).
The category matters because behavioral health does not bill, credential, or get surveyed like a physician practice. Time-based CPT codes, 42 CFR Part 2, ASAM level-of-care documentation, single-state agency licensure, and payer carve-outs all sit on top of standard healthcare operations. A generalist RCM vendor will miss most of it. Behavioral health practices often run denial rates between 10 and 18 percent, well above the under-5-percent target for high performers, largely because of authorization complexity and medical necessity documentation. That gap is the operational thesis behind managed services in this specialty.
According to SAMHSA’s 2022 N-SUMHSS, the survey included 14,854 substance use treatment facilities serving 1,623,647 clients on a single reference date. Most of those facilities are small or mid-sized. Very few can justify a full internal team covering billing, credentialing, UR, compliance, HR, and IT at the level a joint payer audit or a Joint Commission survey demands.
What actually goes into the scope (and what does not)
A defensible managed services scope for a behavioral health operator usually breaks into two buckets, and buyers should insist the contract separates them line by line.
Operational scope. RCM (VOB, authorization, coding, submission, denial work, appeals, patient responsibility), credentialing and re-credentialing across commercial and Medicaid plans, utilization review against ASAM Criteria for level-of-care determinations, HR administration and payroll, and IT/EMR support with 24/7 access controls tied to HIPAA and 42 CFR Part 2.
Strategic scope. Compliance program design and monitoring, mock surveys and EOC tours ahead of Joint Commission or CARF windows, payer strategy and managed care contracting, MHPAEA parity analysis on denial patterns, and preparation for federal enforcement inquiries under HIPAA, 42 CFR Part 2, or the False Claims Act.
The reason to split them: pricing, risk allocation, and regulatory treatment are different. A percentage-of-collections RCM arrangement is common. A percentage-of-revenue compliance arrangement is a red flag under the Anti-Kickback Statute. Operators who blend the two into one flat fee create structural problems the auditor will find later.
- In scope: billing operations, credentialing, UR, HR/payroll, IT support, compliance monitoring, accreditation readiness, licensure filings.
- Usually out of scope: clinical decision-making, medical directorship, DEA-registered prescribing, and anything that crosses into corporate practice of medicine in states that restrict it.
The compliance architecture your MSA has to survive
This is the section most managed services vendors skip in their marketing, and it is where AHS clients spend the most time on document review before signing anything.
A behavioral health managed services agreement has to survive at least six layers of scrutiny. The federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b) and the Stark Law (42 U.S.C. § 1395nn) both look at whether the fee structure is fair market value, commercially reasonable, and not tied to the volume or value of referrals. That is why percentage-based fees on anything other than defined RCM services get flagged. HHS OCR enforces HIPAA. SAMHSA regulates 42 CFR Part 2 for SUD records. The DOL Employee Benefits Security Administration enforces MHPAEA and publishes an annual report to Congress on parity compliance. State single-state agencies (SSAs) hold SUD licensure. The DEA registers MAT and buprenorphine dispensing separately.
The business associate agreement is not a formality. The average cost of a healthcare data breach in 2024 was $9.8 million, according to IBM and the Ponemon Institute, and healthcare has held the top spot for breach cost for 14 consecutive years. If your managed services partner touches an EMR, they need a BAA that specifically references 42 CFR Part 2 qualified service organization language, not a generic HIPAA template pulled off the internet.
As HHS OCR notes in its enforcement summaries, most settlements involve organizations that had policies on paper but no live monitoring. An MSA should require named surveyor-focus items, mock survey cadence, quarterly HIPAA and Part 2 attestations, and a clear finding-response protocol. Vague deliverables produce vague defenses.
When to outsource vs. Insource, by lifecycle stage
The right answer changes with census, site count, and payer mix. A rough operator’s framework:
- Concept and feasibility. Outsource almost everything except the founder’s time. The pro forma cannot support a $180K director of revenue cycle before the first admission. Managed services buys you the back office at a variable cost while you finish the feasibility study and licensure application in states like Florida, Texas, or Montana.
- Launch through first 12 months. Keep RCM, credentialing, and compliance monitoring outsourced. Bring clinical leadership and admissions in-house. This is where a HFMA-aligned days-in-A/R target of 30 to 40 days becomes a real KPI, and where most single-site operators lose money by trying to hire a biller too early.
- Scale (3+ sites). Selectively insource what is now high-volume and standardized. Keep outsourced anything that requires deep specialization: MHPAEA appeals, Joint Commission or CARF prep, SIU audit response, 42 CFR Part 2 breach response.
- Post-acquisition or turnaround. Outsource aggressively for the first 6 to 12 months to stabilize. PE-backed buyers who try to run a distressed SUD asset on the seller’s existing team almost always regret it by month four. The census recovers before the operational backbone does.
- Exit prep. Keep managed services in place through diligence. Clean credentialing files, current accreditation, and defensible compliance monitoring add multiples. Gaps get repriced.
One field observation from a recent Florida engagement: a 40-bed residential operator carrying a 14 percent initial denial rate moved to under 7 percent within two quarters by outsourcing UR and keeping only intake billing in-house. The math on the fee was decided in the first 60 days.
As a managing partner at one national accreditation consultancy has put it, “Healthcare organizations reported the highest data breach costs of any industry for the 14th consecutive year.” Operators who treat managed services as a compliance investment, not a line-item expense, tend to see that reality earlier than operators who do not.
Frequently asked questions
What functions are typically included in a behavioral health managed services agreement?
RCM (VOB, authorization, coding, billing, denial management, appeals), credentialing and re-credentialing, utilization review against ASAM Criteria, compliance monitoring, HR and payroll administration, and IT/EMR support with HIPAA and 42 CFR Part 2 access controls. Strategic add-ons include mock surveys for Joint Commission or CARF, MHPAEA parity analysis, and payer contracting support.
How is managed services different from an MSO (Management Services Organization) structure?
Managed services is a contractual scope. An MSO is a legal entity, usually formed to hold non-clinical assets (billing, IT, HR, real estate) and provide them to a professional entity under a management services agreement. MSOs are commonly used in states with corporate practice of medicine restrictions. Managed services can be delivered without an MSO structure; an MSO always delivers managed services.
When does it make financial sense to outsource RCM versus hiring in-house billers?
Below roughly $8M to $12M in annual net patient revenue, most single-site operators cannot fully load an in-house RCM team (biller, coder, denials specialist, credentialing coordinator, RCM director) at a lower cost per collected dollar than a specialty managed services partner. Above that threshold, hybrid models start to win. The variable is denial rate: operators sitting above the 10 to 18 percent behavioral health average almost always benefit from specialty outsourcing first.
Do managed services arrangements create Stark Law or Anti-Kickback Statute exposure?
They can, if structured carelessly. Percentage-of-revenue fees on services other than defined RCM, fees that vary with referral volume, and undocumented fair market value analyses all draw scrutiny. A defensible MSA uses fixed or per-transaction fees for non-billing scope, documents FMV, and separates operational from strategic deliverables. Independent legal review before signature is not optional.
How do managed services engagements handle 42 CFR Part 2 and HIPAA BAAs?
The managed services partner must sign both a HIPAA business associate agreement and a 42 CFR Part 2 qualified service organization agreement (QSOA). Generic HIPAA templates do not cover Part 2. The QSOA has to specify permitted uses of SUD patient identifying information, breach notification obligations, and the prohibition on redisclosure. Given that healthcare breach costs average $9.8 million, the paperwork here is not administrative overhead; it is loss prevention.
References
- SAMHSA, 2022 N-SUMHSS Substance Use Treatment Services State Profile. United States
- SAMHSA, N-SUMHSS 2024 Annual Report on Substance Use and Mental Health Treatment Facilities
- Healthcare Dive, Average Cost of Healthcare Data Breach Nearly $10M in 2024 (IBM/Ponemon)
- TechTarget, Average Cost of a Healthcare Data Breach Sits at $9.77M (IBM 2024)
- MedHeave, Behavioral Health RCM Metrics and KPI Benchmarks (HFMA-aligned)
- Analytic Healthcare Solutions, Behavioral Health Billing Denial Rate Benchmarks
- Persistex, Healthcare Revenue Cycle Management Benchmarks and KPIs (HFMA / MGMA)
- KFF, A Look at Substance Use and Mental Health Treatment Facilities Across the U.S.