Behavioral Health Practice Due Diligence Checklist

Request three years of payer-level revenue reports from the EHR and practice management system.

Confirms whether revenue is diversified across commercial, Medicare, Medicaid, and private pay or dangerously concentrated.

Red flag: More than 40% of collections from a single payer, especially Medicaid managed care with pending rate renegotiations.

Obtain and review all current payer contracts, fee schedules, and reimbursement rates by CPT code.

Identifies below-market reimbursement rates or payer contracts that may not survive an ownership change.

Red flag: Verbal payer agreements, expired contracts, or rates significantly below regional benchmarks for outpatient therapy.

Analyze historical claim denial rates, write-offs, and accounts receivable aging by payer.

High denial rates signal billing and coding errors that inflate gross revenue while suppressing actual collections.

Red flag: Denial rates above 15% or AR aging showing more than 30% of balances over 90 days outstanding.

Request monthly revenue and session volume data for the trailing 24 months by clinician.

Reveals revenue concentration in specific providers and identifies seasonal trends or patient census declines.

Red flag: Single clinician generating more than 30% of total collections with no documented succession plan.

Obtain credentialing files for every licensed clinician including CAQH profiles, NPI numbers, and panel enrollment letters.

Gaps in credentialing documentation can cause billing interruptions lasting 90–180 days post-closing.

Red flag: Clinicians billing under the owner's NPI rather than their own individual provider numbers.

Confirm transferability of payer contracts under an asset purchase or MSO structure with each major payer.

Many payer contracts terminate or require re-enrollment upon change of ownership, halting reimbursement.

Red flag: Payer contracts with explicit termination-on-transfer clauses and no re-enrollment guarantee language.

Verify credentialing status and expiration dates for all state licenses, DEA registrations, and board certifications.

Expired or lapsed credentials can disqualify clinicians from billing and trigger payer audits retroactively.

Red flag: Any clinician with a lapsed license, expired DEA registration, or open licensing board complaint.

Assess the timeline and cost to re-credential new clinicians hired post-acquisition with existing payer panels.

Re-credentialing can take 90–180 days, meaning new hires cannot bill during ramp-up without revenue loss.

Red flag: Payers with closed panels that will not accept new provider applications in the practice's geographic market.

Obtain a legal opinion on the state's corporate practice of medicine doctrine and the practice's current entity structure.

Many states prohibit non-clinicians from owning behavioral health practices without an MSO structure.

Red flag: No MSO structure in place in a CPOM state, requiring costly post-closing restructuring to complete transfer.

Review state behavioral health facility licensure, outpatient clinic certifications, and any IOP or substance use disorder program permits.

Facility licenses are often non-transferable and require reapplication, causing operational delays post-closing.

Red flag: Outstanding regulatory violations, probationary license status, or facility operating without required state certification.

Review telehealth service delivery compliance including state licensure for out-of-state patients and platform BAA coverage.

Post-pandemic telehealth growth added compliance risk if clinicians treat patients across unlicensed state lines.

Red flag: Clinicians providing telehealth to patients in states where they are not individually licensed.

Confirm no active or historical Medicaid or Medicare audits, OIG exclusions, or False Claims Act investigations.

Government payer audits can result in recoupment demands, exclusion, or criminal liability transferring with acquisition.

Red flag: Any provider on the OIG exclusion list or practice with open CMS or state Medicaid audit correspondence.

Map all revenue by clinician and calculate the percentage attributable to the selling owner-clinician.

Owner providing more than 50% of billable services creates catastrophic revenue risk if they exit post-closing.

Red flag: Owner-clinician with no transition plan, no patient handoff protocol, and no employment agreement post-close.

Review employment agreements, independent contractor agreements, and non-solicitation clauses for all clinical staff.

Without non-solicitation agreements, departing clinicians can legally recruit patients and referral sources away.

Red flag: No non-solicitation or non-compete agreements in place for any W-2 or 1099 clinical staff.

Conduct confidential one-on-one retention conversations with top three revenue-generating clinicians during late diligence.

Verbal confirmation of retention intent from key clinicians de-risks post-closing revenue continuity significantly.

Red flag: Key clinicians expressing uncertainty about staying or already interviewing with competing group practices.

Review referral source documentation including hospital relationships, EAP contracts, school partnerships, and physician referrals.

Referral relationships tied to the owner personally — not the practice brand — will not survive ownership transfer.

Red flag: All referral sources communicating exclusively with the owner-clinician with no staff relationship backup.

Request the most recent HIPAA risk assessment and review all Business Associate Agreements with vendors and billing companies.

Undisclosed HIPAA violations or missing BAAs expose the buyer to regulatory penalties and OCR investigations post-close.

Red flag: No documented HIPAA risk assessment in the past two years or missing BAAs with EHR and billing vendors.

Audit the EHR system for completeness of clinical documentation, treatment plans, and billing code alignment.

Mismatched billing codes and incomplete documentation indicate fraud risk and potential payer audit liability.

Red flag: Session notes regularly completed days after service dates or CPT codes inconsistent with documented treatment plans.

Confirm the EHR platform is transferable or assess migration costs if the seller uses a proprietary or hosted system.

EHR migration post-closing can disrupt billing for 30–90 days and requires careful patient data transition planning.

Red flag: EHR data owned by a third-party management company that retains data rights upon ownership change.

Review patient consent forms, release of information protocols, and breach notification history for the past three years.

Undisclosed data breaches or non-compliant consent forms create post-closing regulatory and reputational liability.

Red flag: Any unreported patient data breach or consent forms that do not meet current HIPAA Notice of Privacy Practices standards.