Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Short Answer
Behavioral health operators who split licensing, accreditation, HIPAA, IT, credentialing, and HR across four or five separate vendors lose money, miss deadlines, and get cited by regulators. A single accountable operating partner closes the seams those vendors leave behind.
That is not a marketing claim. Our team hears it every week when a founder in Florida or Tennessee calls after a HIPAA breach, a CARF one-year decision, or a Medicaid SIU audit letter lands on the desk.
Behavioral health operators sit at the worst end of the fragmentation curve because 42 CFR Part 2, state licensure, and payer credentialing all touch the same chart. Split the vendors, and you split the accountability. Regulators do not care where the seam is. They find it anyway.
What Fragmentation Actually Costs
The pattern is boringly consistent. Licensing lives with one consultant. Accreditation prep lives with another. IT and cybersecurity sit with a managed services provider that has never read a state behavioral health rule. HR sits with a PEO. Billing sits with a third-party RCM.
Then something breaks. On February 21, 2024, the HHS Office for Civil Rights announced a $40,000 settlement with Green Ridge Behavioral Health, a Maryland practice that provides psychotherapy, medication management, and psychiatric evaluations. Green Ridge filed a breach report with OCR in 2019 after a ransomware attack that impacted the protected health information of over 14,000 individuals, and OCR is monitoring the corrective action plan for three years.
On July 7, 2025, OCR announced a $225,000 settlement with Deer Oaks and a two-year corrective action plan. A threat actor breached the Deer Oaks network in August 2023, claimed to have exfiltrated data, and demanded payment to avoid posting the ePHI on the dark web, leading to breach notifications to 171,871 affected individuals.
Both settlements pointed at the same root cause. OCR concluded that Deer Oaks failed to conduct an accurate and thorough risk analysis, in violation of the HIPAA Security Rule. Green Ridge got the same finding, plus failures to implement security measures and to monitor system activity.
That artifact, the risk analysis, is exactly what falls through the cracks when the compliance vendor thinks the IT vendor owns it, and the IT vendor thinks the compliance vendor owns it. Founders end up deficient because five vendors each assumed someone else was holding the pen. OCR Director Paula M. Stannard put it plainly in the Deer Oaks announcement: “Identifying potential risks and vulnerabilities to ePHI is a key step in preventing or mitigating breaches of protected health information.” That is the single most-cited HIPAA finding OCR keeps writing up against behavioral health providers, and OCR has already resolved seventeen investigations with settlements or civil monetary penalties in 2025, collecting more than $7 million in fines.
The Enforcement Environment Is Not Slowing Down
Operators sometimes ask whether the federal appetite for behavioral health enforcement is real or a talking point. It is real.
On June 30, 2025, the Department of Justice announced its 2025 National Health Care Fraud Takedown. Prosecutors charged 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, in 50 federal districts and 12 State Attorneys General’s Offices across the United States, for their alleged participation in various health care fraud schemes involving over $14.6 billion in intended loss. That figure more than doubled the prior record of $6 billion set in 2020.
Alongside the criminal cases, CMS said it successfully prevented over $4 billion from being paid in response to false and fraudulent claims and suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown. Attorney General Pamela Bondi called it a “record-setting Health Care Fraud Takedown”.
Behavioral health sat squarely in the crosshairs. DOJ partnered with CMS, DEA, and other enforcement agencies, including Medicaid Fraud Control Units, for the 2025 Takedown. When an MFCU investigator or an OCR investigator asks for documentation, they do not care that your credentialing sits with one company and your policies with another. They want the record. Now.
Why the Fragmented Model Keeps Failing
Founders end up with five vendors doing overlapping work for structural reasons. Behavioral health billing is genuinely complicated. Commercial plans carve out behavioral health benefits to MBHOs like Optum, Carelon, and Magellan, and SUD records fall under 42 CFR Part 2, which imposes stricter confidentiality rules than standard HIPAA. Add ASAM Criteria, level of care documentation, state licensure quirks, and CARF or Joint Commission standards, and it is easy to see why founders reach for a specialist for each lane.
Here is the problem. Drift happens in the gaps between vendors. EHR documentation templates fall out of sync with updated CARF standards. Terminated employees stay in the EMR because HR never told IT. The HIPAA risk analysis never gets refreshed because everyone assumed someone else owned it. That is exactly what OCR keeps citing.
The clinical leadership tax is real, too. Woolhandler and Himmelstein, in a peer-reviewed study published in the International Journal of Health Services, quantified this. Psychiatrists spent the highest proportion of their time on administration (20.3%), followed by internists (17.3%) and family/general practitioners (17.3%), while pediatricians spent the least, at 14.1 percent. A follow-up piece in Psychiatric News noted that psychiatrists spend an average of 10.6 hours per week (20.3% of working hours) on administrative tasks, almost three hours more than the average physician, at 8.7 hours per week.
When your medical director also referees fights between the compliance consultant and the IT vendor, you are burning the wrong hours. CARF Section 1 (ASPIRE to Excellence) findings pile up because founders let operational drift accumulate between accreditation cycles.
What a Single Operating Partner Actually Does
Licensing, accreditation, compliance, credentialing, IT, and HR all connect. That is not a philosophical position. A state surveyor demonstrates it when the surveyor asks, in the same 20 minutes, to see your terminated-employee EMR access log, your fire drill documentation, your governing body minutes, and the CV of your medical director. Those four artifacts sit in four different vendor silos in most treatment centers our team walks into.
At Atlantic Health Strategies, our team built the MSO to hold all of it. Our team maps licensing renewal calendars to HR onboarding. Our team maps cybersecurity controls to the HIPAA risk analysis OCR keeps citing. Our team maps credentialing files to payer contracts and to the personnel file CARF surveyors will pull.
In the Deer Oaks resolution, OCR itself required Deer Oaks to conduct and annually update its HIPAA risk analyses, develop and implement a risk management plan to address identified vulnerabilities, maintain and revise HIPAA-compliant policies and procedures, and provide annual workforce training on HIPAA requirements. Founders cannot do that with five vendors who do not talk to each other.
Founders should run clinical care and growth. Our team makes sure nothing between those two things collapses. If you operate in Florida, Texas, Georgia, or Colorado and you can name five vendors touching your operations, you have a fragmentation problem. It is not a matter of if a surveyor or an investigator finds the seam. It is when.
Frequently asked questions
How many vendors is too many for a behavioral health treatment center?
If you cannot name a single person accountable for the intersection of licensing, accreditation, HIPAA, credentialing, and IT, you already have too many. Most operators our team works with came in with four to six separate vendors and could not tell us which one owned the HIPAA risk analysis. That is the exact gap OCR cited in the $225,000 Deer Oaks settlement announced July 7, 2025 (171,871 individuals affected) and the $40,000 Green Ridge Behavioral Health settlement announced February 21, 2024 (over 14,000 individuals affected).
Is the federal government actually enforcing against behavioral health providers, or is this hype?
Not hype. DOJ’s 2025 National Health Care Fraud Takedown, announced June 30, 2025, charged 324 defendants tied to over $14.6 billion in intended loss, more than doubling the prior $6 billion record set in 2020. CMS also prevented more than $4 billion in fraudulent payments and suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown. State Medicaid Fraud Control Units ran parallel tracks alongside federal partners.
What is the biggest hidden cost of running with fragmented vendors?
Clinical leadership time and documentation drift. Woolhandler and Himmelstein’s peer-reviewed research in the International Journal of Health Services (2014) found psychiatrists spend 10.6 hours per week (20.3% of working hours) on administration, the highest of any specialty, versus 14.1% for pediatricians. When medical directors and clinical VPs also referee between compliance, IT, and HR vendors, that percentage climbs and CARF Section 1 (ASPIRE to Excellence) findings pile up between surveys. That drift is why so many organizations receive a one-year rather than a three-year accreditation decision.
Does an MSO model make sense for a smaller, single-site operator, or only for multi-site groups?
Both, for different reasons. Multi-site and PE-backed operators need the MSO to standardize policies, credentialing, and payer contracting across locations. Single-site founders in states like Florida, Tennessee, or Colorado use the MSO to get enterprise-grade compliance and IT support without hiring a compliance officer, an IT director, and an HR generalist on day one. The failure mode is identical in either case: nobody owns the seams, and OCR, CARF, and state Medicaid Fraud Control Units find that out at the worst possible moment.
References
- HHS OCR Resolution Agreement and Corrective Action Plan: Green Ridge Behavioral Health, LLC (February 21, 2024)
- HHS OCR Press Release: Settlement with Deer Oaks – The Behavioral Health Solution (July 7, 2025)
- U.S. Department of Justice: 2025 National Health Care Fraud Takedown (June 30, 2025)
- CMS Press Release: 2025 National Health Care Fraud Takedown
- Woolhandler S, Himmelstein DU. Administrative Work Consumes One-Sixth of U.S. Physicians’ Working Hours and Lowers their Career Satisfaction. International Journal of Health Services, 2014
- Psychiatric News: The Growing Problem of Administrative Burdens (2025)
- McKnight’s Long-Term Care News: Long-term care behavioral health provider pays $225K to settle HIPAA case