Medical Billing Software for Behavioral Health Billing Companies

Short answer

Behavioral health billing companies face a different operational profile than general medical billing companies, and software that works well for primary care or orthopedics frequently underperforms in this specialty. The difference is not primarily the CPT codes, though those matter. The difference is that behavioral health revenue cycle work is authorization-driven, documentation-intensive, privacy-layered, and denial-prone in ways that reward specialized workflows. Prior authorization is the load-bearing step for virtually every psychotherapy, intensive outpatient, and residential claim. The Mental Health Parity and Addiction Equity Act (MHPAEA) creates a distinct denial appeal pathway that requires regulatory framing, not just clinical documentation. Substance use disorder practices carry privacy obligations under 42 CFR Part 2 that go beyond HIPAA, and that affects what data a billing company can touch and how. The billing company evaluating software for a behavioral health client book needs to verify that the system handles authorization tracking across multiple practices, routes parity-related denials correctly, and has audit controls that can accommodate Part 2 qualified service organization (QSO) obligations. Medi is a billing-company operating layer, not a behavioral health EHR, and behavioral health practices still need a clinical system for notes, treatment plans, and scheduling. The fit question is whether your revenue cycle work needs a billing-company-first operating layer on top of whatever clinical system your clients use. See the Billing Company Software Evaluation Guide for the full framework.

What makes behavioral health billing different

A billing company that adds a behavioral health client quickly discovers that most of the intuitions built on primary care do not transfer cleanly. Several structural differences drive this.

The service taxonomy is fragmented across two code systems. Outpatient psychotherapy uses CPT codes. Substance use disorder and community mental health services often use HCPCS Level II H-codes administered by state Medicaid programs. A single billing company managing a mixed book — outpatient therapy, intensive outpatient (IOP), and residential treatment — may be billing CPT and HCPCS for different clients against different payer systems with different authorization rules. The code sets do not have a unified logic; billing staff need to understand both.

Authorization requirements are pervasive rather than situational. Most commercial plans and Medicaid managed care organizations require prior authorization for outpatient psychotherapy beyond an initial session or two, for all IOP and partial hospitalization (PHP) services, for residential treatment, and for medication-assisted treatment (MAT) programs. The authorization is not a one-time event. Concurrent review — typically every three to seven days for residential, periodically for IOP — is the norm. A billing company managing behavioral health clients without authorization tracking built into the workflow is running on a spreadsheet and hoping nothing expires during a long weekend.

Documentation requirements are higher and more specific. Psychotherapy session notes must reflect therapeutic modality, patient response, and medical necessity. Auditors have flagged excessive use of 90837 (60-minute individual psychotherapy) in practices where the documentation does not support that duration. Residential treatment claims require per-diem documentation of clinical hours, milieu services, and concurrent review decisions. When documentation gaps cause denials in behavioral health, the denial often cannot be corrected and resubmitted — the supporting documentation either exists or it does not.

Payer rules are fragmented and often contradictory. State Medicaid programs have their own H-code billing rules that override federal guidelines. Commercial plans have plan-specific definitions of medical necessity for mental health that differ from what appears in published APA or ASAM clinical criteria. Telehealth rules for behavioral health — which modifiers apply, which place-of-service codes, whether audio-only is covered — vary by payer, by plan, and by state. Medicare now permanently covers audio-only behavioral health telehealth as of 2026, but commercial payers are not required to follow Medicare's lead.

Reimbursement rates are lower and more variable than in medical specialties. Behavioral health has historically been underpaid relative to complexity, and MHPAEA enforcement has not yet normalized commercial reimbursement to parity with physical health. The combination of lower rates and higher authorization overhead produces thin margins on individual claims; billing error rates that are acceptable in orthopedics become practice-threatening in behavioral health.

The CPT and HCPCS codes that drive behavioral health revenue

Outpatient psychiatric evaluation

CPT 90791 covers psychiatric diagnostic evaluation without medical services — the initial intake by psychologists, LCSWs, LPCs, and other non-prescribing clinicians. CPT 90792 covers the same evaluation with medical services included, used by psychiatrists and other prescribers who review medication as part of the intake. These codes are the gateway to establishing medical necessity for an ongoing treatment relationship and are often the codes where documentation first breaks down. Payers look for diagnosis justification, prior treatment history, current functional impairment, and the plan of care.

Individual psychotherapy

CPT 90832 is 16 to 37 minutes of individual psychotherapy; CPT 90834 is 38 to 52 minutes; CPT 90837 is 53 minutes or more. The 90832 and 90834 codes are frequently add-on codes billed alongside an evaluation and management service (90833 and 90836 respectively, which require a separate E&M code base). The 90837 code is the revenue driver for most outpatient therapy practices. Audits increasingly focus on 90837 because practices sometimes bill it reflexively without documentation reflecting 53 or more minutes of face-to-face therapeutic service. A billing company managing outpatient therapy clients should monitor 90837 utilization per provider against documentation patterns.

Family and group psychotherapy

CPT 90846 is family psychotherapy without the patient present; CPT 90847 is family psychotherapy with the patient present. CPT 90853 is group psychotherapy for multiple patients simultaneously. Group therapy billing has its own authorization requirements — some payers require separate authorization for group versus individual — and has place-of-service complexity for telehealth group delivery.

Add-on codes and interactive complexity

CPT 90785 is an add-on code for interactive complexity, applicable when communication barriers, third-party involvement, mandated reporting, or a legally complex situation materially complicates the therapeutic work. It is billed alongside a primary psychotherapy code, not alone, and requires documentation of the specific complexity factors. It is a legitimate code that billing companies often leave on the table because it requires the clinician to document a specific complexity element — without that documentation, it does not survive audit.

HCPCS Level II H-codes: substance use disorder and community mental health

H-codes are maintained by CMS but are primarily used by state Medicaid programs and some commercial payers for substance use disorder (SUD) and community behavioral health services. Federal definitions provide a baseline, but the billing rules are state-specific.

H0020 is a weekly bundled code for licensed opioid treatment programs (OTPs) providing methadone. One billing unit equals one week of treatment, and billing it more than once per week per patient is incorrect. H0020 applies only to methadone in licensed OTP settings; buprenorphine administration uses separate codes. Billing H0020 for buprenorphine is a common error with payer and compliance consequences. A billing company that takes on an OTP client needs to verify the program's licensing status before billing H0020, because unlicensed programs cannot use this code regardless of the services delivered.

H0015 is the IOP anchor code, but "per hour versus per diem" is not uniformly defined. Some state Medicaid programs pay H0015 per day of IOP; others pay per clinical hour within the IOP session. A billing company serving IOP clients in multiple states cannot apply a single billing pattern — it requires payer-specific rules per client practice jurisdiction.

Telehealth modifiers and place-of-service codes

Modifier 95 is the standard telehealth modifier for most commercial payers for synchronous audio-video sessions. Modifier GT was historically used for Medicare but is now largely obsolete. The place-of-service code matters: POS 02 (telehealth, other than in-home) versus POS 10 (telehealth, patient in home) is a distinction Medicare and some commercial payers enforce. A claim submitted with the correct CPT code but the wrong POS or wrong modifier is a rejection the billing company has to work — not an appeal, just a resubmission with the right data, but it costs time. Payer-specific telehealth rule tables for each client practice are not optional overhead; they are the difference between clean and dirty claims.

Authorization is the load-bearing workflow

Authorization in behavioral health is qualitatively different from authorization in primary care. In primary care, authorization is often a gateway check: is this procedure covered, and does this patient qualify? In behavioral health, authorization is an ongoing conversation with the payer about medical necessity at every level of care.

Most commercial payers and Medicaid managed care organizations require prior authorization for:

• Initial psychotherapy beyond a small number of sessions (often 2 to 6 per calendar year without auth)
• All IOP and partial hospitalization (PHP) services from the first session
• All residential treatment (H0018, H0019) from the first day
• MAT programs, including OTP bundled services
• Psychological testing (96130-96139) for evaluations beyond a basic battery

Concurrent review is the authorization system's ongoing review mechanism. For residential treatment, payers typically require concurrent review every three to five days, meaning the treating clinician must call or submit clinical information to the payer demonstrating that continued residential care is medically necessary. A patient on day twelve of a residential stay has usually had three to five concurrent review contacts, each one producing a decision to continue or step down the level of care. The billing company does not perform concurrent review, but it needs to know the authorization status at every point in the stay. An authorization that expired on day ten that the billing team did not catch means days eleven through discharge are unbillable without a retro-authorization appeal, which many payers deny.

Authorization gaps are the primary driver of behavioral health denials. CARC CO-197 (precertification or authorization absent) and CO-198 (precertification or notification exceeded) are the leading denial codes in this specialty. Denial rates for behavioral health claims with authorization issues run substantially higher than the overall 11.8 percent average initial denial rate per the MGMA 2024 Cost and Revenue Report. The Experian Health 2025 State of Claims survey reports that 41 percent of providers face 10 percent or higher denial rates overall; behavioral health practices frequently run higher than that average.

The authorization workflow is the revenue cycle for a behavioral health practice. Everything downstream — claim submission, ERA posting, denial appeal — is a consequence of how well the authorization was obtained, tracked, and extended.

For a billing company, this means authorization tracking is a first-class operational function, not a task that lives in a spreadsheet tab. The system needs to show, for every active claim, whether authorization is in place, how many sessions or days it covers, when it expires, who to call for concurrent review, and what was decided at the last review. That information is the difference between a clean claim and a CO-197 denial that the billing company has to appeal or absorb.

The Denial Management Workflow Guide covers CO-197 and CO-198 appeal patterns in detail. Authorization-related denials in behavioral health share the same CARC codes as other specialties but have a different recovery path: retro-authorization requests, which require medical necessity documentation and are frequently time-limited to 30 to 60 days post-service.

Mental Health Parity Act and what it means for denials

The Mental Health Parity and Addiction Equity Act (MHPAEA), enacted in 2008 and substantially strengthened by final rules effective for plan years beginning January 1, 2025 (with additional requirements phasing in for plan years beginning January 1, 2026), requires health plans to cover mental health and substance use disorder services at parity with medical and surgical benefits.

The parity requirement is not just about benefit limits. It extends to non-quantitative treatment limitations (NQTLs) — the administrative and clinical criteria that govern when and how benefits are authorized or denied. Prior authorization requirements, concurrent review frequency, medical necessity criteria, and network adequacy standards are all NQTLs. MHPAEA says that these limitations cannot be more stringent for behavioral health services than they are for analogous medical or surgical services in the same plan.

In practice, this creates a specific denial appeal pathway that most general billing companies are not equipped for. When a commercial payer denies a behavioral health service for medical necessity reasons that would not apply to an analogous physical health service, the denial is potentially a MHPAEA parity violation. The appeal is not purely clinical — it has a regulatory dimension. A well-constructed parity appeal identifies the comparable medical or surgical benefit classification, demonstrates that the payer's NQTLs are applied more stringently to the behavioral health service than to the comparable physical health service, and cites the relevant statutory and regulatory framework.

The 2025 final rules increased the enforcement teeth on MHPAEA by requiring plans to collect and analyze data on NQTLs, take corrective action when disparities are found, and provide comparative analyses to regulators and enrollees who request them. Plans are now required to make their medical necessity criteria available for behavioral health services. This documentation is the primary evidence in a parity-based appeal.

For billing companies serving behavioral health clients, the operational implication is clear: parity-based denials should be routed to a separate appeal workflow, not combined with routine CO-50 (not medically necessary) appeals that argue purely from clinical documentation. Appealing a parity violation with clinical documentation alone leaves the regulatory argument on the table.

A billing company cannot itself file a complaint with the Department of Labor or a state insurance commissioner, but it can document the pattern, advise the practice, and construct appeal letters that raise the parity issue in language that puts the payer on notice. The Department of Labor MHPAEA page and the CMS MHPAEA overview are the authoritative sources for the regulatory framework.

42 CFR Part 2 and substance use disorder records

42 CFR Part 2 is a federal privacy law that applies to any program that specializes in providing diagnosis, treatment, or referral for treatment of substance use disorders. It is not the same as HIPAA and, in several respects, is more protective than HIPAA.

The distinction matters for billing companies in a specific and practical way: billing companies that receive identifying information about patients in Part 2-covered programs are qualified service organizations (QSOs) under the regulation, and the relationship must be governed by a written QSO agreement in which the billing company acknowledges it is bound by 42 CFR Part 2. Without that agreement in place, the practice sharing patient-identifying information with the billing company may be violating Part 2.

The 2024 final rule updating 42 CFR Part 2, which became effective April 16, 2024, with compliance required by February 16, 2026, made several changes relevant to billing operations. The rule now allows a single patient consent covering all future uses and disclosures for treatment, payment, and health care operations — aligning more closely with the HIPAA structure that billing companies are already familiar with. It also allows HIPAA covered entities and business associates that receive Part 2 records under that consent to redisclose the records under HIPAA, rather than remaining permanently locked to Part 2 restrictions.

That alignment helps, but the distinctions that remain are significant. Part 2 information cannot be used in civil, criminal, administrative, or legislative proceedings against the patient without consent or a specific court order. That prohibition is more expansive than HIPAA. SUD counseling notes — the Part 2 equivalent of psychotherapy notes — receive heightened protection analogous to HIPAA's psychotherapy note rules and are not disclosable without specific consent.

As of August 25, 2025, the HHS Office for Civil Rights received authority to enforce Part 2 with the same penalty structure used for HIPAA violations: investigations, corrective action plans, and civil money penalties up to millions of dollars depending on the severity and culpability of the violation. The first civil enforcement actions are already underway for violations occurring from February 16, 2026.

For billing companies, the practical checklist:

• Verify whether each behavioral health client's programs are Part 2-covered (the client's legal counsel or compliance officer should confirm, not the billing company)
• Execute written QSO agreements before beginning any billing work for Part 2-covered programs
• Ensure the BAA in place with the practice also addresses Part 2 obligations if the practice and its billing operations are both subject to Part 2
• Do not store Part 2 patient records in systems that have not been scoped for Part 2 obligations
• Do not respond to subpoenas or court orders for Part 2 records without involving the practice's legal counsel

The authoritative source for Part 2 obligations is SAMHSA and the HHS HIPAA and Part 2 integration page. This guide does not constitute legal advice; billing companies serving SUD practices should obtain qualified legal review of their Part 2 compliance posture.

How Medi handles behavioral health billing-company workflows

Medi is a billing-company operating layer, not a behavioral health-specific EHR or a SUD treatment platform. The product does not include clinical documentation, treatment planning, group note templates, or any clinical workflow. Behavioral health practices still need a separate clinical system — SimplePractice, Kipu, Alleva, or a state-specific Medicaid-integrated platform — for clinical operations. Medi handles the revenue cycle side: claims, payments, denials, appeals, underpayments, authorizations tracking, and reporting.

The workflow structure for behavioral health billing companies in Medi:

The practice is a scoped tenant inside the billing company's workspace. A billing company managing five behavioral health practices works from one workspace, routing denials to a shared denial specialist queue, seeing all ERA exceptions in one review surface, and generating A/R aging across the full book in one report. Switching between client practices does not require a separate login.

Authorization data is tracked per claim and per encounter. When an authorization covers a defined number of sessions or a date range, the claim submission workflow can reference the active authorization. When an authorization approaches expiration, the system surfaces the risk before the claim goes out the door with an expired or missing auth number.

Denial routing distinguishes CARC codes. CO-197 and CO-198 denials route to an authorization follow-up queue where the investigation step starts with the authorization record, not with general claim data. The workflow separates these from CO-50 (not medically necessary) denials that require clinical documentation review, and from PR-1/PR-2 (patient responsibility) items that route to statement workflows.

The ERA review surface handles the per-diem structures common in residential billing. H0018 and H0019 claims often carry per-diem rates across a multi-day stay; when an ERA posts partial payment or adjusts a per-diem line, the exception appears in the held-line review queue with CARC and RARC context rather than being auto-posted silently. Group therapy claims with multiple patient identifiers on a single claim are handled as line-item exceptions when payers split or adjust individual lines differently.

Medi's BAA is executed before any PHI workflow goes live. For behavioral health clients who are Part 2-covered programs, the QSO agreement layer is the client practice's responsibility to structure; Medi's BAA does not substitute for the QSO agreement that must exist between the practice and any billing company it engages.

Audit log retention is seven years, aligned with HIPAA Security Rule §164.312(b). Access to PHI within the platform is permissioned at practice and provider level — an offshore biller can be scoped to specific client practices without accessing others. The platform uses Stedi as the clearinghouse for 837 claim submission, 835 ERA processing, 270/271 eligibility, and 278 authorization transactions.

Medi is currently not certified for SOC 2 Type II or HITRUST. Billing companies whose clients require vendor certification at those levels should factor that into the evaluation timeline and ask directly about the certification roadmap.

For pricing: Medi charges a flat $300 per month platform fee for the billing company, plus EDI usage. Provider count and client practice count do not increase the platform fee. See /pricing or schedule a review to discuss the specific volume profile for a behavioral health client book.

What should a behavioral health billing company verify in software?

The Billing Company Software Evaluation Guide covers the full general evaluation framework. The questions above are specific to behavioral health billing-company workflows that go beyond the general evaluation.

When Medi is not the right fit

Medi is built for billing companies, not individual practices. A solo therapist who manages their own billing and sees 20 clients a week is better served by a practice-management system that includes scheduling, notes, and billing in one product — SimplePractice, TherapyNotes, or a comparable integrated tool.

A single outpatient behavioral health group that employs six therapists and does its own billing internally is similarly better served by practice-management software with billing built in, not by a billing-company operating layer that assumes a separation between the clinical practice and the billing operation.

Medi is also not suited for practices that need an EHR from the same vendor as their billing system. Behavioral health practices with complex clinical documentation requirements — group homes, ACT teams, crisis stabilization units — often need a clinical platform that is deeply integrated with billing. Medi does not provide that; its relationship with whatever clinical system the practice uses is through data import and claim output, not through a shared clinical workflow.

If your behavioral health clients are primarily individual practitioners or small groups that expect you to deliver scheduling and clinical documentation alongside billing, the right tools are integrated practice-management systems. For billing companies whose clients have their own clinical systems and want a billing-company-first operating layer on top of those systems, Medi fits the structural need.

For the specific question of OTP programs billing bundled MAT services under G-codes (G2067, G2068, G2069 for weekly, biweekly, and monthly buprenorphine bundles respectively under Medicare), verify that the software you evaluate handles bundled OTP claims correctly. These claims have a different structure than standard CPT or H-code claims and require CMS-enrolled OTP provider billing credentials that are separate from standard Medicare enrollment.

Frequently asked questions

What CPT codes do outpatient behavioral health practices bill most?

The highest-volume CPT codes in outpatient behavioral health are 90791 (initial psychiatric evaluation without medical services), 90837 (60-minute individual psychotherapy), and 90834 (45-minute individual psychotherapy). Psychiatric prescribers who combine medication management with psychotherapy bill 90792 for the initial evaluation and combinations of 90833 (psychotherapy add-on with E&M) with the appropriate E&M level code. Group therapy bills under 90853. Family therapy with the patient present bills under 90847.

What HCPCS H-codes are used in substance use disorder billing?

The primary H-codes for SUD billing are H0001 (assessment), H0004 (individual counseling, per 15 minutes), H0005 (group counseling), H0015 (IOP, per hour or per diem), H0018 (short-term residential), H0019 (long-term residential), and H0020 (methadone administration in licensed OTP settings). These are primarily used in Medicaid billing. Commercial payers may accept H-codes or may require CPT equivalents depending on the plan.

Why does behavioral health have a higher denial rate than primary care?

Several factors compound. Prior authorization requirements are more pervasive — virtually every higher-level-of-care service and most commercial psychotherapy beyond a few sessions requires authorization that must be obtained and maintained. Medical necessity criteria for behavioral health are more subjective and more frequently contested by payers than for comparable physical health services. Documentation requirements are specific to therapeutic modality and session duration in ways that create audit exposure. MHPAEA violations — payers applying more stringent criteria to behavioral health than to physical health — are common and add a parity denial category that does not exist in general medical billing.

What is 42 CFR Part 2 and why does it affect billing companies?

42 CFR Part 2 is a federal confidentiality law that protects patient records from programs that specialize in substance use disorder treatment. It is more protective than HIPAA in certain respects, including restrictions on use of patient information in legal proceedings. A billing company that receives patient-identifying information from a Part 2-covered program must execute a qualified service organization (QSO) agreement with that program before touching any patient data. The 2024 final rule (effective April 16, 2024; compliance required February 16, 2026) aligned Part 2 more closely with HIPAA for payment and operations purposes, but the QSO agreement requirement and legal-proceedings prohibition remain. Enforcement by HHS Office for Civil Rights began February 16, 2026.

How is MHPAEA relevant to billing companies?

MHPAEA requires that health plans apply prior authorization requirements, concurrent review frequency, and medical necessity criteria for behavioral health services in a way that is no more stringent than for comparable medical or surgical services. When a payer denies a behavioral health claim for reasons that would not apply to a physical health service in the same plan, the denial may be a parity violation. Billing companies that recognize this pattern can construct appeals that raise the regulatory argument, not just the clinical one. The final rules effective for plan years beginning January 1, 2025 strengthened enforcement and required plans to provide comparative data analyses to regulators and enrollees.

What is the difference between CO-197 and CO-50 in behavioral health billing?

CO-197 (precertification or authorization absent) means the payer has no valid authorization for the service. The investigation step is the authorization record: was an auth obtained, is the auth number correct on the claim, is the auth still valid for the date of service, and was the service within the authorized scope? CO-50 (non-covered service per medical necessity) means the payer has adjudicated the service and determined it does not meet medical necessity criteria. CO-197 is an administrative problem — the authorization wasn't in place or wasn't cited correctly. CO-50 is a clinical problem — the service may require a medical necessity appeal with documentation of the patient's clinical condition and treatment history. Both are common in behavioral health; billing companies should route them to separate workflows because the first-action investigation is different for each.

Does Medi include behavioral health EHR or clinical documentation?

No. Medi handles the billing operations side: claim submission, ERA posting, denial management, appeals, underpayment detection, authorizations tracking, and reporting. Behavioral health practices still need a separate clinical system for therapy notes, treatment plans, group note templates, and scheduling. Common clinical systems in behavioral health include SimplePractice, TherapyNotes, Kipu, Alleva, and state-specific Medicaid platforms. Medi works alongside those systems by accepting claim data and managing the revenue cycle from claim creation through collection.

What should a billing company check before taking on a residential treatment center as a client?

Verify the facility's payer enrollment status: residential treatment centers bill under a facility NPI, not an individual provider NPI, and may require separate enrollment with commercial payers that differs from outpatient enrollment. Confirm which H-codes the state Medicaid program accepts and at what unit of billing (per diem is standard for H0018 and H0019 but may vary). Review the concurrent review schedule with the top three payers — residential auth typically requires review every three to seven days. Assess whether the facility has 42 CFR Part 2 obligations (most SUD residential programs do) and confirm QSO agreements are in place before billing begins. See billing-company operations for the client onboarding checklist.

Is Medi priced per provider or per practice for behavioral health billing companies?

Medi charges a flat $300 per month for the billing company, regardless of provider count or client practice count. EDI usage — claim submission, ERA, eligibility — is billed separately based on transaction volume. A billing company that adds a behavioral health client with ten providers does not pay an additional per-provider fee on top of the platform fee. See /pricing for the current transaction rates, or schedule a demo to discuss the cost model for your specific book.