Quick Answer
SUD provider due diligence tests whether the business’s earnings, clinical operations, reimbursement and permissions support the transaction being proposed. Owners should reconcile claims to cash, control access to patient information, map ownership-change requirements and resolve material findings through documented decisions. The transition plan should establish who can operate, deliver care, bill, collect and support staff immediately after closing, with evidence for each critical dependency.
Begin SUD provider due diligence with a controlled plan
Once a buyer is testing a proposed acquisition, the questions become specific. Can reported revenue be collected? Are the services supported by records and authorizations? Will the acquiring organization have the approvals and people it needs to operate? What remains unresolved, and who bears that risk?
The seller’s role is to provide accurate, controlled evidence and make decisions when findings emerge. Uploading more files does not necessarily answer the buyer’s question. A useful response connects the source record to the issue, explains any limitation and identifies what still needs verification.
This guide addresses diligence execution and ownership transition for established U.S. addiction treatment and substance use disorder businesses. Requirements depend on the state, entity, services, payers and transaction structure. Qualified health care counsel, accountants and clinical leaders should apply this framework to the actual deal; it is not individualized legal or clinical advice.
Run diligence through one controlled workflow
Start by agreeing the scope and responsible people. Financial, reimbursement, legal, compliance, clinical, workforce and technology reviews should share a common issue log. Identify the seller’s coordinator, the buyer’s decision-maker and the advisers authorized to receive each class of information. A restricted legal review should not become a document accessible to every financial analyst.
For each request, record the question being tested, period covered, source system, preparer, reviewer and expected delivery date. Mark whether the response is complete, partial, unavailable or awaiting legal approval. Keep a revision history when a report changes. Quietly replacing a spreadsheet makes it harder to explain why two teams reached different conclusions. Planning staff and leadership continuity during a sale
Release information in stages. Begin with organizational records and appropriately aggregated financial and operating reports. Move to detailed testing when the review purpose and access permissions are established. Keep a separate process for sensitive personnel information, privileged communications and patient-level material. Do not allow the convenience of a single data-room upload to determine what is lawful to disclose.
Schedule focused sessions around unresolved issues rather than repeatedly reading the whole request list. For each finding, decide whether it is an explanation, an additional test, a correction, a contractual allocation or a potential closing blocker. Maintain a decision record with evidence and accountable owners. This lets the seller distinguish a genuine discovery from a repeated request or a negotiating position.
Preparing payer and reimbursement evidence for SUD buyer diligence
Build the financial review around a reproducible path from care delivered to cash received. The core connection is between encounters or service units, required authorizations, claims, payer adjudication, contractual adjustments, patient responsibility and deposits. Reconcile the billing-system totals to the general ledger, then reconcile cash postings to bank activity. Explain timing differences instead of forcing unlike periods to match.
Choose periods that reveal payment development. A current month’s claims will not have the same collection maturity as a prior-year cohort. Analyze services by date of service and follow their subsequent collections, adjustments and denials through an agreed cutoff. Separately show cash received during the period for older services. Without this distinction, a collection catch-up can look like an improvement in current operating performance.
Segment the analysis where economics differ: payer and product, location, service or level of care, contracted status and billing entity. A commercial payer’s separate products may have different rates and rules. A combined payer name can conceal the concentration that matters. For each material contract, connect the executed agreement and amendments to the rate assumptions used in the revenue model.
Test a defined sample under the approved privacy protocol. The reviewer should check whether the service was documented, any required authorization covered the relevant dates and units, the rendering personnel met applicable requirements, and the claim matched the supported service. Payment by a payer is one piece of evidence; it does not by itself resolve whether a claim was correctly submitted or could later be challenged.
Keep denied and unpaid claims visible. Show denial reason, appeal status, filing limits, age, subsequent recovery and reserve treatment. Separate contractual adjustments from bad debt and administrative write-offs. Reconcile credit balances, refunds and recoupments rather than presenting only favorable cash receipts. If a payer audit is open, describe its actual scope and status with counsel’s input; a reserve estimate and a final liability are different things. Preparing payer and reimbursement evidence for SUD buyer diligence
For illustration, suppose a location’s collections rise after several delayed claims are released. The diligence response should identify the affected service months, quantify the catch-up and show whether the backlog is now resolved. It should not label the entire improvement as a higher ongoing run rate. This is a hypothetical example, not a reported transaction result.
The final output should connect findings to decisions. A persistent denial pattern may require a revised earnings estimate, a receivables adjustment, additional sampling or a remediation obligation. A one-time payment delay may primarily affect working capital and closing liquidity. Agree how each issue is treated so it is neither ignored nor deducted twice in different parts of the transaction.
Give patient information its own disclosure gate
Identify the rules that apply before sharing patient-level data. HIPAA coverage and Part 2 coverage are separate analyses. Part 2 applies to qualifying records connected with federally assisted SUD programs and can impose obligations on recipients. Federal assistance is broader than direct grant funding. A SUD diagnosis alone does not make every medical record a Part 2 record. 42 CFR § 2.12.
Under HIPAA, health care operations include specified sales, transfers, mergers or consolidations involving a covered entity and another entity that is, or will become, a covered entity, plus related diligence. This is a defined permission, not blanket access for every prospective investor or adviser. Have counsel map the contemplated disclosure to the rule and the recipient’s role. 45 CFR § 164.501.
Where the HIPAA minimum-necessary standard applies, limit access and information to the review purpose. Start with aggregate information or properly de-identified data when it can answer the question. Removing names alone may leave identifying dates, locations, narrative details or codes. HHS describes two de-identification methods with specific requirements. HHS minimum-necessary guidance and HHS de-identification guidance.
The 2024 Part 2 rule’s compliance date was February 16, 2026. For a current transaction, check implementation rather than treating it as a future project. The rule permits a single consent for future treatment, payment and health care operations and certain HIPAA-aligned redisclosures by covered entities and business associates receiving records under that consent. Separately maintained SUD counseling notes generally require separate consent for use or disclosure and cannot be swept into a broad TPO consent. Review the actual forms, workflow and notices. HHS Part 2 final-rule fact sheet.
Part 2 also contains audit-and-evaluation provisions with specific conditions concerning recipients, written undertakings and permitted uses. Do not assume that calling acquisition diligence an audit establishes an exception. Counsel should identify a lawful route for each proposed disclosure, including applicable consents, recipient restrictions and state-law requirements. A transaction NDA alone does not establish that analysis. 42 CFR § 2.53.
Translate the legal analysis into access controls: named reviewers, separate folders, limited permissions, secure transfer, download restrictions where appropriate and an access log. Document how review copies will be returned or destroyed, subject to applicable retention duties. Screen narrative reports for identifiers before circulation. A buyer should receive the findings needed to evaluate the business without unnecessary patient details appearing in investment presentations.
Map each approval to the actual ownership change
Create an entity-and-location matrix showing what is being acquired, which entity currently operates each service and which entity will operate after closing. Match that structure to licenses, certifications, accreditation, payer contracts, government enrollment, leases and required transaction notices. A change in ownership, a change in control and an asset transfer may trigger different steps.
State requirements must be checked directly. For example, New York OASAS publishes distinct certification resources for a transfer of ownership and a change in ownership of 10 percent or more. That distinction illustrates why one national “license transfer” checklist is inadequate; it is not a rule for providers in other states. Verify the current application and approval path for your own program. OASAS program-certification resources.
For Medicare-enrolled entities, confirm the appropriate enrollment transaction, reporting requirements and contractor instructions. For Medicaid and commercial contracts, review the relevant agency and contract rules separately. Do not assume an active tax ID or NPI establishes authority for the post-closing entity to bill every payer. CMS Medicare provider-enrollment guidance.
OTPs need an additional program-specific workstream. SAMHSA requires notification of specified program changes. The route and supporting materials depend on the change; ownership changes require coordination with its Division of Pharmacologic Therapies or the relevant Compliance Officer. Coordinate the actual changes with applicable federal and state authorities and the accrediting body. An office-based practice prescribing medication for OUD is not automatically an OTP. SAMHSA OTP provider information.
Where DEA registration and controlled-substance transfers are involved, confirm the required sequence. Federal rules restrict transfer of registration authority and set requirements for certain transfers of business activities and inventory. Build these into the closing plan with qualified counsel and responsible registrants rather than treating medication access as an ordinary vendor handoff. 21 CFR § 1301.52.
Investigate findings without losing the evidence
Buyers may review licensure histories, survey findings, complaints, incidents, corrective-action plans, exclusion screening, marketing and referral arrangements, and billing-compliance work. Connect each issue to its supporting record and current status. An incident’s occurrence, the organization’s response and the evidence that a correction worked are separate questions.
If a review identifies a potential error or violation, preserve the underlying records and involve the appropriate legal and compliance advisers. Do not backdate documentation, rewrite source records to improve a sample or describe a disputed issue as resolved before it is. Counsel should determine whether obligations to investigate, repay, report or disclose arise. The deal timetable does not replace those obligations.
Use an issue register that states the observed fact, the affected population or period, what remains unknown, the person responsible and the next decision. Avoid prematurely extrapolating a small sample to the entire business. Equally, avoid dismissing a recurring problem as isolated without evidence. The response should be proportionate to what the review actually supports.
OIG’s General Compliance Program Guidance is a useful voluntary reference for evaluating how compliance responsibilities and controls function. For the transaction, the practical question is whether the buyer will inherit an understandable issue and a credible response, or an unexplained problem that continues after closing. OIG compliance guidance.
Planning staff and leadership continuity during a sale
Map the roles necessary to keep services operating and billing supported. Include medical and clinical leadership, prescribing coverage, nursing where applicable, counselors, supervisors, compliance, intake, authorization and revenue-cycle staff. Identify required credentials and supervision arrangements, vacancies, agency dependence and individuals whose departure would interrupt a function. Treat workforce diligence as operational planning, not just a payroll calculation.
Agree who will employ each person after closing and when offers or transfer communications will occur. Resolve compensation, accrued leave, benefits start dates, retirement-plan questions and the practical payroll cutoff with the relevant advisers. An employee should not have to discover on payday that the organizations assumed the other was responsible.
Retention arrangements should address specific continuity needs. Decide which roles require transition commitments, what the employee will receive, the service period and who pays. Keep any promise consistent with the documents and reviewed for applicable employment and health care requirements. A general request that everyone “stay positive” is no substitute for clarity about reporting lines and their own employment.
Plan communications around what is known. Managers need a factual answer to who owns the organization, who makes decisions, what changes immediately and where unanswered questions go. Avoid promising that nothing will change if integration decisions remain open. Coordinate the announcement with confidentiality obligations, transaction certainty and legal requirements.
The outgoing owner needs a handover of actual responsibilities: which payer relationships, staff decisions or clinical escalations still reach them, who takes over and when. Confirm the successor’s authority, not just their name. Staff continuity improves when people know how their work will be supported once the familiar owner is no longer the default problem-solver.
Building a SUD business ownership-transition plan
Organize the transition around the first operating day under new ownership. For each critical function, specify the accountable person, predecessor handoff, evidence of readiness, fallback and escalation route. The clinical lead, operations lead, billing lead and technology lead should test the plan together because their dependencies overlap.
For patient continuity, confirm schedules, staffing coverage, access to necessary records, medication-related arrangements where relevant, transportation and referral coordination. Determine what patients must be told, by whom and when. Preserve access for people already receiving services. Any change in care arrangements needs clinical and regulatory review rather than a purely administrative announcement.
For systems, verify the EHR, scheduling, phones, secure messaging, billing, payer portals and essential interfaces. Create authorized user access with appropriate controls and revoke obsolete access at the right point. Do not circulate a departing owner’s password as a transition solution. Test that staff can perform their assigned work before a vendor contract or account is turned off.
For cash operations, map claims for services before and after closing, remittance destinations, refunds, payroll funding and vendor payments. Where receivables stay with the seller, agree how billing support, collections and patient inquiries will be handled. Where the buyer acquires them, establish the supporting data and rights needed to collect and defend the claims.
A transitional-services agreement may be useful when one party temporarily supports billing, technology or another function. Define service levels, term, fees, data access, privacy responsibilities, incident response and an exit plan. It should not be used to improvise around a missing license or payer approval. Counsel must confirm that the arrangement is lawful and operationally workable.
Before closing, run a practical rehearsal: an existing patient arrives, a clinician needs the chart, an authorization expires, a claim is rejected, a staff member calls out and a critical vendor needs payment. Ask who resolves each situation in the post-closing organization. The rehearsal often identifies gaps that a list of completed documents will miss.
Use a closing gate and keep responsibility visible afterward
Maintain a short list of conditions that must be satisfied to close safely and as agreed. Distinguish an application submitted from an approval effective, a contract requested from a consent received, and a staffing plan drafted from coverage confirmed. Attach the evidence supporting each status. Unresolved items should go to named decision-makers rather than disappearing into the larger request list.
The parties and their advisers should decide whether a remaining issue can be addressed through an agreed adjustment, escrow, covenant or other lawful arrangement, or requires postponement. A commercial allocation cannot create a missing regulatory permission. Record the decision and the person responsible for monitoring any continuing obligation.
After closing, assign a regular review of collections, denial trends, staffing, service access, open approvals and transition incidents. The appropriate cadence and duration depend on the risks identified, rather than a universal number of days. Keep an escalation route for problems affecting patient care or the ability to operate.
Complete remaining receivables, working-capital, record-retention and access-transfer obligations using the agreement’s deadlines. Close each issue when the evidence supports closure. A smooth ownership transition means the organization can keep doing its work with clear responsibility even after the transaction team has stepped away.
Bring diligence and transition decisions together
For an owner preparing to address buyer diligence or a proposed ownership handoff, Olympic M&A’s behavioral health advisory team is a starting point for discussing transaction priorities and coordination. Bring the unresolved questions that could affect earnings, closing or continuity. Your legal, accounting and clinical advisers should remain involved in the decisions within their disciplines.
Frequently asked questions
What documents do buyers request in SUD provider due diligence?
Requests commonly cover financial statements, claims and collection reports, payer contracts, ownership records, licenses, workforce information, compliance matters and key vendor agreements. The exact scope depends on the services and transaction. Patient records require their own disclosure analysis and controlled review process rather than automatic inclusion in the general data room.
How does payer concentration affect buyer diligence?
It determines where a buyer may focus contract, reimbursement and continuity testing. Review concentration by payer product and service, not just insurer name. A major contract with uncertain post-closing status can matter more than its percentage alone. Connect the exposure to collections, authorization rules and the required approval path.
Does an NDA let a buyer review every patient record?
No. An NDA supports confidentiality but does not independently establish compliance with HIPAA, Part 2 or state privacy rules. Determine which rules cover the records, the lawful disclosure basis and the permitted recipients. Use appropriately limited information and access controls approved for the specific review.
Does Part 2 apply to every SUD provider?
Coverage requires analysis of the program, federal assistance, records and recipients. A SUD diagnosis by itself is insufficient to classify every record as Part 2-protected. Providers should obtain a documented determination and apply the relevant obligations to the covered records rather than assuming either universal coverage or a universal exemption.
Will licenses and payer contracts automatically transfer with the business?
Do not assume so. Requirements depend on the jurisdiction, program, contract and structure. Confirm whether notice, consent, an ownership update, a new application or another action is required, and when it must be effective. Record the evidence needed before closing and identify any post-closing obligations separately.
What should happen when diligence uncovers a billing problem?
Preserve the source records and involve the appropriate legal, billing and compliance professionals. Establish the facts, affected period and unresolved questions before deciding on remediation and transaction treatment. Any reporting or repayment obligations require their own analysis; a purchase-price adjustment does not itself resolve them.
Who should own the transition plan?
Name one coordinating leader and accountable owners for clinical continuity, staffing, regulatory approvals, billing and technology. The buyer and seller must agree the handoffs and escalation route. Responsibility should attach to specific people with decision authority, supported by readiness evidence and a tested fallback for critical functions.
