Medical Billing Software for Behavioral Health Billing Companies

Short answer

Behavioral health billing runs on prior authorization, and software built for primary care or orthopedics usually breaks down here. The CPT codes matter, but the real difference is that almost every psychotherapy, intensive outpatient, and residential claim depends on an authorization that has to be obtained, tracked, and extended. Three things separate this specialty: authorization is pervasive rather than occasional, the Mental Health Parity and Addiction Equity Act (MHPAEA) creates a denial appeal pathway that needs a regulatory argument and not just clinical documentation, and substance use disorder records carry 42 CFR Part 2 privacy obligations that go beyond HIPAA and change what a billing company can touch.

A billing company evaluating software for a behavioral health book needs to confirm it tracks authorization across every client practice, routes parity-related denials to their own workflow, and has audit controls that fit Part 2 qualified service organization (QSO) obligations. Medi is a billing-company operating layer, not a behavioral health EHR; practices still need a clinical system for notes, treatment plans, and scheduling. The fit question is whether your revenue cycle work needs a billing-company-first layer on top of whatever clinical system your clients already run. See the Billing Company Software Evaluation Guide for the full framework.

What makes behavioral health billing different

Most of the intuitions built on primary care do not transfer to a behavioral health book. Five structural differences drive that.

**Two code systems, not one.** Outpatient psychotherapy uses CPT codes. Substance use disorder and community mental health services often use HCPCS Level II H-codes administered by state Medicaid programs. A mixed book of outpatient therapy, intensive outpatient (IOP), and residential treatment bills CPT and HCPCS for different clients against different payer systems with different authorization rules. The two code sets share no unified logic, and billing staff have to know both.

**Authorization is pervasive, not situational.** Most commercial plans and Medicaid managed care organizations require prior authorization for outpatient psychotherapy beyond an initial session or two, for all IOP and partial hospitalization (PHP) services, for residential treatment, and for medication-assisted treatment (MAT) programs. It is not a one-time event. Concurrent review is the norm: typically every three to seven days for residential, periodically for IOP. A billing company without authorization tracking in the workflow is running on a spreadsheet and hoping nothing expires over a long weekend.

**Documentation is higher and more specific.** Psychotherapy notes must reflect therapeutic modality, patient response, and medical necessity. Auditors flag heavy use of 90837 (60-minute individual psychotherapy) where the documentation does not support that duration. Residential claims require per-diem documentation of clinical hours, milieu services, and concurrent review decisions. When a documentation gap causes a behavioral health denial, the claim often cannot be corrected and resubmitted; the supporting record either exists or it does not.

**Payer rules conflict.** State Medicaid programs set their own H-code billing rules that override federal guidelines. Commercial plans define medical necessity for mental health in ways that differ from published APA or ASAM clinical criteria. Telehealth rules — which modifiers, which place-of-service codes, whether audio-only is covered — vary by payer, by plan, and by state. Medicare permanently covers audio-only behavioral health telehealth as of 2026, but commercial payers are not required to follow.

**Rates are lower and more variable.** Behavioral health has long been underpaid relative to complexity, and MHPAEA enforcement has not yet brought commercial reimbursement to parity with physical health. Lower rates plus higher authorization overhead produce thin per-claim margins, so an error rate that orthopedics absorbs can threaten a behavioral health practice.

The CPT and HCPCS codes that drive behavioral health revenue

Outpatient psychiatric evaluation

CPT 90791 is the psychiatric diagnostic evaluation without medical services, the initial intake by psychologists, LCSWs, LPCs, and other non-prescribing clinicians. CPT 90792 is the same evaluation with medical services, used by psychiatrists and other prescribers who review medication during the intake. These codes establish medical necessity for the ongoing treatment relationship and are often where documentation first breaks down. Payers look for diagnosis justification, prior treatment history, current functional impairment, and the plan of care.

Individual psychotherapy

CPT 90832 is 16 to 37 minutes of individual psychotherapy, 90834 is 38 to 52 minutes, and 90837 is 53 minutes or more. The psychotherapy add-on codes billed alongside an evaluation and management service are 90833 (with 90832) and 90836 (with 90834), each requiring a separate E&M base code. 90837 is the revenue driver for most outpatient therapy practices, and audits increasingly focus on it because practices sometimes bill it reflexively without documentation showing 53 or more minutes of face-to-face service. Monitor 90837 utilization per provider against documentation patterns.

Family and group psychotherapy

CPT 90846 is family psychotherapy without the patient present, 90847 is family psychotherapy with the patient present, and 90853 is group psychotherapy for multiple patients at once. Group billing carries its own authorization rules (some payers authorize group separately from individual) and place-of-service complexity for telehealth group delivery.

Add-on codes and interactive complexity

CPT 90785 is the interactive complexity add-on, used when communication barriers, third-party involvement, mandated reporting, or a legally complex situation materially complicates the work. It is billed alongside a primary psychotherapy code, never alone, and requires documentation of the specific complexity factor. Billing companies often leave it on the table: without that documented element, it does not survive audit.

HCPCS Level II H-codes: substance use disorder and community mental health

H-codes are maintained by CMS but used primarily by state Medicaid programs and some commercial payers for substance use disorder (SUD) and community behavioral health services. Federal definitions set a baseline; the billing rules are state-specific.

H0020 is a weekly bundle for licensed opioid treatment programs (OTPs) providing methadone. One unit equals one week, and billing it more than once per week per patient is wrong. It applies only to methadone in licensed OTP settings; buprenorphine administration uses separate codes, and billing H0020 for buprenorphine is a common error with payer and compliance consequences. Verify a program's licensing status before billing H0020, because unlicensed programs cannot use the code regardless of the services delivered.

H0015 is the IOP anchor code, but "per hour versus per diem" is not uniformly defined. Some state Medicaid programs pay H0015 per day of IOP; others pay per clinical hour within the session. A billing company serving IOP clients in multiple states cannot apply one billing pattern; it needs payer-specific rules per client practice jurisdiction.

Telehealth modifiers and place-of-service codes

Modifier 95 is the standard telehealth modifier for most commercial payers on synchronous audio-video sessions. Modifier GT was historically used for Medicare and is now largely obsolete. Place of service matters: Medicare and some commercial payers enforce POS 02 (telehealth, other than in-home) versus POS 10 (telehealth, patient in home). A claim with the correct CPT but the wrong POS or modifier is a rejection the billing company has to work, not an appeal, just a resubmission with the right data that still costs time. Payer-specific telehealth rule tables for each client practice are the difference between clean and dirty claims.

Authorization is the workflow that carries the revenue

Authorization in behavioral health works differently than in primary care. In primary care it is mostly a gateway check: is this procedure covered, and does this patient qualify? In behavioral health it is an ongoing conversation with the payer about medical necessity at every level of care.

Most commercial payers and Medicaid managed care organizations require prior authorization for:

• Initial psychotherapy beyond a small number of sessions (often 2 to 6 per calendar year without auth)
• All IOP and partial hospitalization (PHP) services from the first session
• All residential treatment (H0018, H0019) from the first day
• MAT programs, including OTP bundled services
• Psychological testing (96130-96139) for evaluations beyond a basic battery

Concurrent review is the ongoing piece. For residential treatment, payers typically require it every three to seven days: the treating clinician calls or submits clinical information showing that continued residential care is medically necessary. A patient on day twelve of a stay has usually had several concurrent review contacts, each one a decision to continue or step down. The billing company does not perform the review, but it has to know the authorization status at every point in the stay. An authorization that expired on day ten and went uncaught makes days eleven through discharge unbillable without a retro-authorization appeal, which many payers deny.

Authorization gaps are the primary driver of behavioral health denials. CARC CO-197 (precertification or authorization absent) and CO-198 (precertification or notification exceeded) are the leading denial codes in this specialty. Claims with authorization issues run well above the 11.8 percent average initial denial rate in the MGMA 2024 Cost and Revenue Report, and the Experian Health 2025 State of Claims survey reports that 41 percent of providers face a 10 percent or higher denial rate overall, with behavioral health practices frequently above that.

The authorization workflow is the revenue cycle for a behavioral health practice. Claim submission, ERA posting, and denial appeal are all downstream of how well the authorization was obtained, tracked, and extended.

So authorization tracking is core operational work, not a spreadsheet tab. The system has to show, for every active claim, whether authorization is in place, how many sessions or days it covers, when it expires, who to call for concurrent review, and what was decided last. That is the difference between a clean claim and a CO-197 the billing company has to appeal or absorb.

The Denial Management Workflow Guide covers CO-197 and CO-198 appeal patterns in detail. Authorization-related denials in behavioral health share the same CARC codes as other specialties but have a different recovery path: retro-authorization requests, which require medical necessity documentation and are frequently time-limited to 30 to 60 days post-service.

Mental Health Parity Act and what it means for denials

The Mental Health Parity and Addiction Equity Act (MHPAEA), enacted in 2008 and strengthened by final rules effective for plan years beginning January 1, 2025 (with more requirements phasing in for plan years beginning January 1, 2026), requires health plans to cover mental health and substance use disorder services at parity with medical and surgical benefits.

Parity is not only about benefit limits. It reaches non-quantitative treatment limitations (NQTLs), the administrative and clinical criteria that govern when and how benefits are authorized or denied. Prior authorization, concurrent review frequency, medical necessity criteria, and network adequacy standards are all NQTLs, and MHPAEA bars them from being more stringent for behavioral health than for analogous medical or surgical services in the same plan.

That creates a denial appeal pathway most general billing companies are not equipped for. When a payer denies a behavioral health service for medical necessity reasons that would not apply to an analogous physical health service, the denial is potentially a parity violation, and the appeal has a regulatory dimension on top of the clinical one. A strong parity appeal identifies the comparable medical or surgical benefit classification, shows that the payer's NQTLs are applied more stringently to the behavioral health service, and cites the statutory and regulatory framework.

The 2025 final rules added enforcement teeth: plans must collect and analyze NQTL data, take corrective action when they find disparities, and provide comparative analyses to regulators and enrollees on request. Plans must now make their behavioral health medical necessity criteria available, and that documentation is the primary evidence in a parity-based appeal.

The operational implication: route parity-based denials to a separate appeal workflow, not into routine CO-50 (not medically necessary) appeals that argue purely from clinical documentation. Appealing a parity violation on clinical documentation alone leaves the regulatory argument on the table.

A billing company cannot itself file a complaint with the Department of Labor or a state insurance commissioner, but it can document the pattern, advise the practice, and write appeal letters that raise the parity issue in language that puts the payer on notice. The Department of Labor MHPAEA page and the CMS MHPAEA overview are the authoritative sources.

42 CFR Part 2 and substance use disorder records

42 CFR Part 2 is a federal privacy law covering any program that specializes in diagnosis, treatment, or referral for substance use disorders. It is not HIPAA, and in several respects it is more protective.

The practical distinction for billing companies: a company that receives identifying information about patients in Part 2-covered programs is a qualified service organization (QSO) under the regulation, and the relationship must be governed by a written QSO agreement in which the billing company acknowledges it is bound by Part 2. Without that agreement, the practice sharing patient-identifying information may itself be violating Part 2.

The 2024 final rule (effective April 16, 2024, compliance required February 16, 2026) made changes relevant to billing operations. It now allows a single patient consent covering all future uses and disclosures for treatment, payment, and health care operations, aligning with the HIPAA structure billing companies already know. It also lets HIPAA covered entities and business associates that receive Part 2 records under that consent redisclose them under HIPAA, rather than staying permanently locked to Part 2 restrictions.

The remaining distinctions still matter. Part 2 information cannot be used in civil, criminal, administrative, or legislative proceedings against the patient without consent or a specific court order, a prohibition broader than HIPAA. SUD counseling notes, the Part 2 equivalent of psychotherapy notes, get heightened protection analogous to HIPAA's psychotherapy note rules and are not disclosable without specific consent.

As of August 25, 2025, the HHS Office for Civil Rights gained authority to enforce Part 2 under the same penalty structure as HIPAA: investigations, corrective action plans, and civil money penalties up to millions of dollars depending on severity and culpability. The first civil enforcement actions are already underway for violations occurring from February 16, 2026.

For billing companies, the practical checklist:

• Verify whether each behavioral health client's programs are Part 2-covered (the client's legal counsel or compliance officer should confirm, not the billing company)
• Execute written QSO agreements before beginning any billing work for Part 2-covered programs
• Ensure the BAA in place with the practice also addresses Part 2 obligations if the practice and its billing operations are both subject to Part 2
• Do not store Part 2 patient records in systems that have not been scoped for Part 2 obligations
• Do not respond to subpoenas or court orders for Part 2 records without involving the practice's legal counsel

The authoritative source for Part 2 obligations is SAMHSA and the HHS HIPAA and Part 2 integration page. This guide does not constitute legal advice; billing companies serving SUD practices should obtain qualified legal review of their Part 2 compliance posture.

How Medi handles behavioral health billing-company workflows

Medi is a billing-company operating layer, not a behavioral health EHR or a SUD treatment platform. It has no clinical documentation, treatment planning, group note templates, or clinical workflow. Practices still need a separate clinical system (SimplePractice, Kipu, Alleva, or a state-specific Medicaid-integrated platform) for clinical operations. Medi handles the revenue cycle: claims, payments, denials, appeals, underpayments, authorization tracking, and reporting.

The workflow for behavioral health billing companies in Medi:

**One workspace for the whole book.** Each practice is a scoped tenant. A company managing five behavioral health practices works from one workspace, routes denials to a shared denial-specialist queue, sees every ERA exception in one review surface, and runs A/R aging across the full book in one report. Switching client practices does not require a separate login.

**Authorization tracked per claim and encounter.** When an authorization covers a set number of sessions or a date range, the claim submission workflow references the active authorization. When one nears expiration, the system surfaces the risk before the claim goes out with an expired or missing auth number.

**Denial routing by CARC.** CO-197 and CO-198 denials route to an authorization follow-up queue where the investigation starts from the authorization record, not general claim data. That is separated from CO-50 (not medically necessary) denials, which need clinical documentation review, and from PR-1/PR-2 (patient responsibility) items, which route to statement workflows.

**Per-diem and group ERA exceptions.** H0018 and H0019 claims often carry per-diem rates across a multi-day stay. When an ERA posts partial payment or adjusts a per-diem line, the exception lands in the held-line review queue with CARC and RARC context instead of auto-posting silently. Group therapy claims with multiple patient identifiers on a single claim are handled as line-item exceptions when payers split or adjust individual lines.

Medi's BAA is executed before any PHI workflow goes live. For Part 2-covered programs, the QSO agreement is the client practice's responsibility to structure; Medi's BAA does not substitute for the QSO agreement that must exist between the practice and any billing company it engages.

Audit log retention is seven years, aligned with HIPAA Security Rule §164.312(b). PHI access is permissioned at practice and provider level, so a biller can be scoped to specific client practices without seeing others. The platform uses Stedi as the clearinghouse for 837 claim submission, 835 ERA processing, 270/271 eligibility, and 278 authorization transactions.

Medi is not currently certified for SOC 2 Type II or HITRUST. Billing companies whose clients require vendor certification at those levels should factor that into the timeline and ask directly about the roadmap.

Pricing is per client practice, not per provider, so adding providers inside a practice never changes the fee. The rate is $20 per client practice per month, with volume pricing available. Behavioral health books skew toward many small, low-volume practices, so per-practice pricing ties cost to the number of clients rather than headcount. EDI usage is billed separately by transaction volume. Migration is free with a 12-month commitment or $100 per practice (one-time, capped at $3,000) month-to-month; data export is always free and there is no early termination fee. The full schedule is at /pricing, or schedule a review to walk through a specific book.

What should a behavioral health billing company verify in software?

The Billing Company Software Evaluation Guide covers the general framework. The questions above are the behavioral health-specific layer on top of it.

When Medi is not the right fit

Medi is built for billing companies, not individual practices. A solo therapist who manages their own billing and sees 20 clients a week is better served by a practice-management system with scheduling, notes, and billing in one product, such as SimplePractice or TherapyNotes.

A single outpatient behavioral health group of six therapists that bills internally is the same case: practice-management software with billing built in fits better than a billing-company operating layer, which assumes a separation between the clinical practice and the billing operation.

Medi is also wrong for practices that need an EHR from the same vendor as their billing system. Behavioral health practices with complex clinical documentation needs (group homes, ACT teams, crisis stabilization units) often want a clinical platform deeply integrated with billing. Medi does not provide that; it connects to whatever clinical system the practice uses through data import and claim output, not a shared clinical workflow.

If your clients are mostly individual practitioners or small groups that expect scheduling and clinical documentation from you alongside billing, integrated practice-management systems are the right tools. For billing companies whose clients bring their own clinical systems and want a billing-company-first layer on top, Medi fits the structural need.

For OTP programs billing bundled MAT services under the Medicare G-code series (G2067 through G2075, covering weekly methadone and buprenorphine bundles by route of administration), confirm the software you evaluate handles bundled OTP claims correctly. They have a different structure than standard CPT or H-code claims and require CMS-enrolled OTP provider billing credentials separate from standard Medicare enrollment.

Frequently asked questions

What CPT codes do outpatient behavioral health practices bill most?

The highest-volume CPT codes are 90791 (initial psychiatric evaluation without medical services), 90837 (53+ minute individual psychotherapy), and 90834 (38-52 minute individual psychotherapy). Prescribers who combine medication management with psychotherapy bill 90792 for the initial evaluation and 90833 (psychotherapy add-on with E&M) with the appropriate E&M level code. Group therapy bills under 90853, and family therapy with the patient present bills under 90847.

What HCPCS H-codes are used in substance use disorder billing?

The primary SUD H-codes are H0001 (assessment), H0004 (individual counseling, per 15 minutes), H0005 (group counseling), H0015 (IOP, per hour or per diem), H0018 (short-term residential), H0019 (long-term residential), and H0020 (methadone administration in licensed OTP settings). These are used mostly in Medicaid billing. Commercial payers may accept H-codes or require CPT equivalents depending on the plan.

Why does behavioral health have a higher denial rate than primary care?

Several factors compound. Prior authorization is more pervasive: nearly every higher-level-of-care service and most commercial psychotherapy beyond a few sessions needs authorization that has to be obtained and maintained. Medical necessity criteria are more subjective and more often contested than for comparable physical health services. Documentation tied to therapeutic modality and session duration creates audit exposure. And MHPAEA violations (payers applying more stringent criteria to behavioral health than to physical health) add a parity denial category that does not exist in general medical billing.

What is 42 CFR Part 2 and why does it affect billing companies?

42 CFR Part 2 is a federal confidentiality law protecting records from programs that specialize in substance use disorder treatment. It is more protective than HIPAA in certain respects, including restrictions on using patient information in legal proceedings. A billing company that receives patient-identifying information from a Part 2-covered program must execute a qualified service organization (QSO) agreement with that program before touching any patient data. The 2024 final rule (effective April 16, 2024; compliance required February 16, 2026) aligned Part 2 more closely with HIPAA for payment and operations, but the QSO requirement and legal-proceedings prohibition remain. HHS Office for Civil Rights enforcement began February 16, 2026.

How is MHPAEA relevant to billing companies?

MHPAEA requires health plans to apply prior authorization, concurrent review frequency, and medical necessity criteria for behavioral health no more stringently than for comparable medical or surgical services. When a payer denies a behavioral health claim for reasons that would not apply to a physical health service in the same plan, the denial may be a parity violation, and a billing company that spots the pattern can build an appeal on the regulatory argument, not just the clinical one. The final rules effective for plan years beginning January 1, 2025 strengthened enforcement and required plans to provide comparative data analyses to regulators and enrollees.

What is the difference between CO-197 and CO-50 in behavioral health billing?

CO-197 (precertification or authorization absent) means the payer has no valid authorization. The investigation starts from the authorization record: was an auth obtained, is the number correct on the claim, is it still valid for the date of service, and was the service within the authorized scope? CO-50 (non-covered per medical necessity) means the payer adjudicated the service and found it does not meet medical necessity criteria. CO-197 is administrative; CO-50 is clinical and may need a medical necessity appeal documenting the patient's condition and treatment history. Both are common in behavioral health, and they belong in separate workflows because the first action differs.

Does Medi include behavioral health EHR or clinical documentation?

No. Medi handles billing operations: claim submission, ERA posting, denial management, appeals, underpayment detection, authorization tracking, and reporting. Practices still need a separate clinical system for therapy notes, treatment plans, group note templates, and scheduling, such as SimplePractice, TherapyNotes, Kipu, Alleva, or a state-specific Medicaid platform. Medi works alongside them by accepting claim data and managing the revenue cycle from claim creation through collection.

What should a billing company check before taking on a residential treatment center as a client?

Verify payer enrollment: residential centers bill under a facility NPI, not an individual provider NPI, and may need commercial-payer enrollment that differs from outpatient. Confirm which H-codes the state Medicaid program accepts and the billing unit (per diem is standard for H0018 and H0019 but can vary). Review the concurrent review schedule with the top three payers, since residential auth typically requires review every three to seven days. Assess whether the facility has 42 CFR Part 2 obligations (most SUD residential programs do) and confirm QSO agreements are in place before billing begins. See billing-company operations for the onboarding checklist.

Is Medi priced per provider or per practice for behavioral health billing companies?

Per client practice, not per provider, so adding providers inside a practice does not change the fee. A client with ten providers costs the single per-practice rate, with no per-provider fee on top. The rate is $20 per client practice per month, with volume pricing available. EDI usage (claim submission, ERA, eligibility) is billed separately by transaction volume. See /pricing for details, or schedule a demo to discuss your specific book.