How to Vet Compliance and Licensing Before Closing on a Rehab
Rehab compliance due diligence is the process that separates a smart acquisition from a costly mistake. Compliance risk is the number one deal-killer in rehab acquisitions. A facility that looks profitable on paper can turn into a financial nightmare if hidden compliance issues surface after you close. Billing irregularities, licensing violations, and HIPAA breaches do not disappear when ownership changes. In many cases, the new owner inherits the liability.
This guide walks you through the compliance due diligence process step by step. If you are buying an addiction treatment center, this is the checklist that protects you from acquiring someone else’s problems. Done well, rehab compliance due diligence protects you from acquiring someone else’s regulatory problems.
Why Rehab Compliance Due Diligence Matters More in Behavioral Health
The addiction treatment industry has a higher regulatory burden than most healthcare sectors. Treatment centers are subject to: For federal oversight standards, see the Substance Abuse and Mental Health Services Administration (SAMHSA).
- State licensing requirements (different in every state)
- Federal and state billing regulations
- HIPAA privacy and security rules
- DEA registration (for facilities prescribing controlled substances)
- Accreditation standards (CARF, Joint Commission)
- Payer-specific compliance requirements
- Anti-kickback and patient brokering statutes
A single violation in any of these areas can result in license suspension, insurance contract termination, financial penalties, or criminal prosecution. During an acquisition, undisclosed compliance issues are the most common reason deals fall apart or buyers end up overpaying for a facility that is actually worth less than they thought.
Step 1: Verify State Licensing
Every treatment center must hold a valid state license. This is the most fundamental compliance check and should be the first thing you verify.
What to Request
- Current state license (confirm it is active, not expired or provisional)
- All levels of care covered by the license (detox, residential, IOP, outpatient, MAT)
- History of license renewals and any conditions placed on the license
- Any pending applications for additional levels of care
- Correspondence between the facility and the licensing agency for the past 3 years
Red Flags
- License is provisional or conditional (state has concerns)
- Gaps in licensing history (facility operated without a license at some point)
- Pending investigations or corrective action plans
- License does not cover all levels of care currently being provided
Check state behavioral health licensure links to verify licensing status directly with each state agency.
Step 2: Review Accreditation Status
While not required by every state, accreditation from CARF or The Joint Commission is expected by most commercial insurance payers and signals clinical quality.
What to Request
- Current accreditation certificate and expiration date
- Most recent survey results and any findings or recommendations
- Corrective action plans submitted in response to survey findings
- History of accreditation decisions (full accreditation vs. provisional)
What It Means for You
If the facility is accredited, verify that the accreditation will transfer to the new ownership or confirm the process for maintaining it through the ownership change. If the facility is not accredited, factor in the cost and 6-12 month timeline to achieve accreditation. This may limit your ability to bill certain payers in the interim.
Step 3: Audit Billing and Revenue Cycle Compliance
Billing compliance is where the most serious risks hide. Insurance fraud, upcoding, unbundling, and improper out-of-network billing practices have led to facility closures, multi-million dollar settlements, and criminal charges across the industry.
What to Request
- Billing policies and procedures manual
- Internal audit results for the past 3 years
- External audit results from insurance companies
- Explanation of Benefits (EOB) samples for each payer
- Claims denial and appeal data
- Revenue by billing code (CPT code breakdown)
- Out-of-network billing volume and collection rates
Red Flags
| Red Flag | Why It Matters |
|---|---|
| Out-of-network revenue exceeds 40% of total | Regulatory risk, potential for clawbacks |
| High denial rates on specific codes | May indicate improper coding |
| No internal billing audits conducted | Lack of compliance infrastructure |
| Revenue spikes that don’t correlate with census | Possible upcoding or billing manipulation |
| Active insurance company investigations | Direct financial and licensing risk |
If the facility has a history of billing issues, do not assume they are resolved. Request documentation of corrective actions and verify that the issues have not recurred.
Step 4: Review HIPAA Compliance
HIPAA violations carry severe penalties and reputational damage. As the new owner, you will be responsible for the facility’s ongoing HIPAA compliance and may inherit liability for past breaches. Review the official requirements from the U.S. Department of Health & Human Services (HHS).
What to Request
- HIPAA compliance policies and procedures
- Privacy officer designation and training records
- Breach notification history (any reported breaches to HHS)
- Business Associate Agreements (BAAs) with vendors
- Physical security measures for patient records
- IT security assessment (especially for electronic health records)
- Staff HIPAA training records and frequency
Red Flags
- No designated privacy officer
- Missing or outdated BAAs with vendors
- History of reported breaches
- No documented security risk assessment
- Paper records stored without adequate physical security
Step 5: Check Anti-Kickback and Patient Brokering
The Anti-Kickback Statute (AKS) and state patient brokering laws prohibit paying for referrals. This is an area where the addiction treatment industry has faced significant enforcement action, particularly in Florida and California.
What to Investigate
- Referral source agreements and compensation structures
- Marketing contracts with lead generation companies
- Relationships with sober living operators
- Any commissions, bonuses, or incentives tied to admissions volume
- Compliance with the Eliminating Kickbacks in Recovery Act (EKRA)
If the facility pays for referrals in any form, this is a serious risk. Even arrangements that were common in the industry five years ago may now violate federal or state law.
Step 6: Review Employment and Clinical Compliance
What to Request
- Staff licensure verification (all clinical staff must hold current, valid licenses)
- Background check records for all employees
- Clinical supervision documentation
- Incident reports and their resolution
- Patient complaint records and response protocols
- Staff-to-patient ratios compared to state minimums
Red Flags
- Staff members with expired licenses
- Incomplete or missing background checks
- Pattern of incident reports without corrective action
- Patient complaints about quality of care
Rehab Compliance Due Diligence Checklist
| Area | Key Documents | Priority |
|---|---|---|
| State licensing | Active license, inspection reports, correspondence | Critical |
| Accreditation | Certificate, survey results, corrective actions | High |
| Billing compliance | Audit results, denial data, CPT breakdowns | Critical |
| HIPAA | Policies, breach history, BAAs, security assessment | High |
| Anti-kickback | Referral agreements, marketing contracts, EKRA compliance | Critical |
| Employment | Staff licenses, background checks, supervision docs | High |
| DEA registration | Current registration, controlled substance logs | High |
| Insurance contracts | Payer agreements, credentialing status, rate schedules | Medium |
When to Walk Away
Some compliance issues are fixable. Others are not worth the risk. Walk away if you find:
- Active federal or state investigation into billing practices
- Unresolved patient brokering allegations
- License revocation or suspension history within the past 3 years
- Significant unreported HIPAA breaches
- Revenue heavily dependent on questionable billing practices
The cost of buying a facility with serious compliance exposure far exceeds the cost of walking away and finding a cleaner deal. For help evaluating compliance risk in a potential acquisition, contact Addiction-Rep for a confidential consultation.
Frequently Asked Questions
How long does compliance due diligence take?
Compliance due diligence typically runs concurrently with financial due diligence, taking 30-60 days. Complex facilities with multiple levels of care or multistate operations may require 60-90 days. The timeline depends heavily on how organized the seller’s documentation is.
Who should conduct compliance due diligence?
Ideally, your team should include a healthcare attorney experienced in behavioral health, a billing compliance consultant, and an M&A advisor who understands the treatment industry. General business attorneys often miss industry-specific compliance risks.
Can compliance issues be negotiated into the deal price?
Yes. Minor issues that are documented and have clear resolution paths can be factored into the price as a discount rather than a deal-breaker. Major issues (active investigations, unresolved billing fraud) should not be negotiated around. They should be resolved before closing or the deal should be abandoned.
Do I inherit the previous owner’s compliance liabilities?
In a stock sale (where you buy the entity), yes. You inherit all liabilities, including undisclosed ones. In an asset sale (where you buy only the assets), you generally do not inherit entity-level liabilities, but you may still face successor liability in some jurisdictions. Discuss the structure with your healthcare attorney.
