Substance Abuse Billing Software: A Checklist for Vendor Demos

Three things: Part 2 records, payer-specific codes and authorizations by level of care.

Part 2 rules apply to any federally assisted program that provides SUD diagnosis, treatment or referral for treatment (HHS Part 2 overview). Being a participating provider in the Medicare program is one of the ways a program counts as federally assisted (42 CFR 2.12(b)).

With limited exceptions, Part 2 records may only be shared with the patient's written consent or a court order and subpoena or a similar legal mandate (HHS Part 2 consent summary). The 2024 final rule took effect April 16, 2024, and compliance was required by February 16, 2026 (Federal Register, 89 FR 12472).

Codes are the second difference. CMS lists the SUD H codes with status I, which means not valid for Medicare purposes (CMS RVU26D file). CMS also says certain H codes are used by state Medicaid agencies that state law requires to keep separate codes for mental health services such as alcohol and drug treatment (CMS HCPCS Level II coding procedures).

Authorizations are the third. SUD care can move between levels, and each level can need its own approval and review date. See how SUD billing changes across levels of care for the service side.

Next step: send each vendor your payer list and three real claims before the demo and ask them to run those live.

A written Part 2 consent can be paper or electronic, and it has to include a set list of elements (42 CFR 2.31(a)). Ask the vendor to open a consent record and show a field for each one:

• The patient's name.
• Who is allowed to make the use or disclosure.
• A specific and meaningful description of the information.
• The recipients. For one consent covering treatment, payment and health care operations (TPO), the rule accepts "my treating providers, health plans, third-party payers, and people helping to operate this program" or a similar statement.
• The purpose. "For treatment, payment, and health care operations" is enough for a TPO consent.
• The patient's right to revoke in writing and how to do it.
• An expiration date or event. "End of the treatment" or "none" is enough for TPO.
• The patient's signature and the date signed. Electronic signatures are allowed unless another law prohibits them.
• For a TPO consent, statements on the risk of redisclosure and what happens if the patient refuses to sign.

Then test the blocks. A disclosure may not be made on a consent that has expired, is known to have been revoked or on its face substantially fails the required elements (42 CFR 2.31(c)). Ask the vendor to try a disclosure on an expired consent and show it being stopped.

SUD counseling notes need their own consent. That consent can only be combined with another consent for counseling notes, and a program can't make it a condition of treatment or payment (consent rules for counseling notes, 42 CFR 2.31(b)). Ask whether the system keeps counseling notes under a separate consent.

This is general information, not legal advice. Work with counsel on your consent forms and policies.

Next step: bring a blank copy of your consent form to the demo and map each line to a field.

Every disclosure made with the patient's written consent has to go out with a written notice and with a copy of the consent or a clear explanation of its scope (42 CFR 2.32).

The rule gives two notice texts. The short one reads "42 CFR part 2 prohibits unauthorized use or disclosure of these records." Ask the vendor to export a claim attachment to a payer and show where the notice and consent scope go.

Under a TPO consent, a covered entity or business associate that receives the record may disclose it again as HIPAA allows, except for use in proceedings against the patient (42 CFR 2.33(b)(1)).

Patient restrictions matter for billing. A program must agree when a patient asks it not to disclose records to a health plan for payment or operations, if the disclosure isn't otherwise required by law and the patient or someone other than the plan paid in full for that item or service (42 CFR 2.26(a)(6)). Ask whether the system can flag that encounter and hold the claim from that plan.

This is general information, not legal advice. Work with counsel on your notice and restriction policies.

Next step: list every place records leave the program and check that each one carries the notice.

Not for everyone. A Part 2 program, covered entity or business associate that receives records based on a single TPO consent "is not required to segregate or segment such records" (42 CFR 2.12(d)(2)).

The 2024 rule removed the earlier language that required segmenting Part 2 data (Federal Register, 89 FR 12500). The records still can't be used in civil, criminal, administrative or legislative proceedings against the patient without consent or a court order (42 CFR 2.12(d)(1)).

The rule also says HHS is "not requiring specific technology or software solutions" for segmentation, tagging or tracking (89 FR 12559, GPO text). So what you test is whether the system keeps each disclosure inside its consent's scope and honors restrictions.

One useful test, not a Part 2 requirement: ask whether the product is certified to the ONC security tag criteria for summary of care send and receive (45 CFR 170.315(b)(7) and (b)(8)). These criteria tag a summary record as restricted and subject to redisclosure limits at the document, section and entry level. You can look up a product's certifications on ONC's Certified Health IT Product List.

Next step: ask each vendor to show a record received under a TPO consent and how its scope travels with it.

The system has to send the HIPAA standard claims and post the standard remittance. Those are the ASC X12 837 Professional (005010X222) and 837 Institutional (005010X223) claims (45 CFR 162.1102) and the 835 remittance advice (005010X221) (45 CFR 162.1602).

A program can send both claim types, for example clinician visits on professional claims and IOP or residential days on institutional claims with a revenue code.

Demo test: map one service to different codes by payer. An SUD assessment might go out as H0001 to a Medicaid plan that uses H codes and as 90791 to Medicare, because CMS lists H0001 as not valid for Medicare purposes and 90791 as active (RVU26D status codes).

The descriptions above are shortened from the CMS HCPCS October 2026 file.

On institutional claims, a Medicare contractor's revenue code table lists 0906 for chemical dependency in the behavioral health treatment family, next to 0905 for psychiatric intensive outpatient services, and 1002 for chemical dependency residential treatment (Noridian JE Part A revenue codes, Medicare contractor). Medicare contractor pages can also be searched in the CMS Medicare Coverage Database.

For more on how each level of care is billed, see how SUD services bill by level of care.

Next step: ask the vendor which code each of your top five payers takes for an assessment and a program day.

It should show the level of care, the days or units left and the next review date for every open authorization.

SUD authorizations can be approved for a level of care, a number of days or units and a review date. Days after a missed review, or after a step-down without a new authorization, can be denied. Payer rules differ, so the system should hold each payer's rules.

Demo test: move a patient to another level and ask the vendor to show what happens to the open authorization and the days left.

If reviews keep slipping, put authorization and concurrent review tracking in place before the next admission.

Next step: pull your open authorizations and check that each one has a review date on a calendar.

Ask for two kinds: revenue reports that show where claims stall and compliance logs that can answer a patient or a regulator.

• Denials by payer and reason code.
• Authorization days at risk.
• Unbilled encounters, meaning notes signed with no claim.
• A/R by payer.

These reports show the denial reasons that recur in behavioral health in your own data.

Part 2 gives patients the right to an accounting of disclosures made with consent in the 3 years before the request, and of TPO disclosures made through an electronic health record (42 CFR 2.25). The compliance date for that section is tolled until HHS revises the HIPAA accounting rule at 45 CFR 164.528 (89 FR 12476, GPO text). So build for it, but don't treat it as in force today.

Part 2 programs must have formal policies and procedures for electronic records, including how they are created, received, kept, sent and accessed (42 CFR 2.16(a)). HIPAA breach notification rules apply to Part 2 programs for breaches of unsecured records (breach rule, 42 CFR 2.16(b)). Ask the vendor for an access log that shows who opened a record and when.

Next step: ask the vendor to run each report live, not from a slide.

Use these 12 questions in every demo and score each answer.

Run the demo on your own payer mix and your own last month of claims. A free revenue audit of last month's SUD claims shows where your current claims stall before you change systems.

Next step: send this checklist to each vendor before the demo so the answers come back on your data.