Behavioral Health EHR Development: What to Build (2026)

Behavioral health EHR development means building a record system around how therapy and addiction care actually run. That covers treatment plans with measurable goals, notes for group sessions, scored questionnaires such as the PHQ-9 tracked over time, and consent rules for substance use disorder records that are stricter than HIPAA. A focused build on Nirmitee's published pricing is a Specialty EHR at $90K to $160K over 4 to 6 months, or a Launch MVP at $45K to $70K in 10 to 12 weeks for one workflow. Build when your care model, payer mix or consent rules do not fit an off-the-shelf product. If a standard therapy EHR covers your workflow, buy it. Our custom EHR vs off-the-shelf guide compares the paths and their five-year costs.

If your practices already use SimplePractice, see our SimplePractice API and integration guide.

This guide covers what a behavioral health EHR must do that a general EHR does not, and what to build for each. Every rule links to the regulator's own page.

Why a general EHR falls short in behavioral health

A general EHR is organized around the visit. Behavioral health care runs on episodes that can last months. Progress is measured by the patient's own answers on standard scales. One clinician may run a session with eight patients at once. Some of the notes are protected more tightly than the rest of the chart, and some records cannot move to another provider without a specific kind of consent.

A general EHR can be bent to fit this with templates. In our experience the workarounds break at three points: consent, group notes and outcome tracking. For the wider build process (architecture, FHIR, hosting, team), see our guide to custom EHR software development.

The requirements, side by side

This table is our own summary. Each row is explained in the sections below, with sources.

Treatment plans and goals

In behavioral health the treatment plan is the center of the chart. A typical plan lists problems, a long-term goal for each, short-term objectives that can be measured, and the interventions the team will use. Notes then report progress against those objectives.

Build the plan as structured data rather than a PDF. Each objective gets a target, a measure and a review date. Each progress note lets the clinician tick the objectives worked on and record progress. A supervisor can then find every plan overdue for review with a query instead of reading charts.

Medicare's collaborative care codes show how closely payers tie billing to the plan. CMS lists "development of an individualized treatment plan" and "monitoring patient outcomes using validated rating scales" among the required elements of CPT 99492 and 99493 in its Behavioral Health Integration Services booklet (MLN909432, January 2026).

Measurement-based care: PHQ-9, GAD-7 and trends

Measurement-based care means giving patients a standard questionnaire at regular points and using the scores to adjust treatment. For accredited programs it is a requirement. The Joint Commission's R3 Report, Issue 13 (6 February 2018) states that from 1 January 2018, standard CTS.03.01.09 requires that an accredited behavioral health care organization "uses a standardized tool or instrument to monitor the individual's progress," and uses the data to inform the goals of the individual's plan. This report is from 2018, so check the current manual.

The two most common tools have simple, published scoring:

• PHQ-9 (depression). Nine items, each scored 0 to 3. In the original validation study, scores of 5, 10, 15 and 20 marked mild, moderate, moderately severe and severe depression, and a score of 10 or more had 88% sensitivity and 88% specificity for major depression (Kroenke, Spitzer and Williams, J Gen Intern Med, 2001).
• GAD-7 (anxiety). Seven items, each scored 0 to 3. The University of Washington's National HIV Curriculum lists 0 to 4 as minimal, 5 to 9 mild, 10 to 14 moderate, and higher scores severe (GAD-7 page), citing the original 2006 paper by Spitzer and colleagues. The page also notes a suggested screening cut-point of 8, so store the threshold as a setting your clinical lead controls.

What to build:

1. A questionnaire engine. Store each instrument as data (items, scores, bands), so adding a new tool is configuration. FHIR's Questionnaire and QuestionnaireResponse resources fit this.
2. Automatic scoring with standard codes. Save the total as an observation with its LOINC code, so the score can be exchanged and charted. The total score codes are 44261-6 for the PHQ-9 and 70274-6 for the GAD-7 (checked against the National Library of Medicine LOINC lookup on 27 October 2026).
3. Patient self-entry and a trend view. Send the questionnaire before the session, and chart scores beside the plan goal ("PHQ-9 under 10 by week 12").
4. A safety rule on PHQ-9 item 9. Item 9 asks about thoughts of self-harm. The National HIV Curriculum's PHQ-9 page states that a patient who answers yes "needs further assessment for suicide risk by an individual who is competent to assess this risk." Any positive answer should alert the clinician at once and record that the alert was seen. Your clinicians' protocol decides the response.

Group therapy notes

Group sessions are where we see general EHRs struggle most. One session with eight attendees needs eight notes. Much of the content is shared: the topic, the intervention, the start and stop times. Each patient's participation and progress is individual. The hard rule is privacy. One patient's chart must never carry another patient's name or story.

What to build:

• A group session record that holds the shared fields once: date, facilitator, topic, intervention, times.
• Attendance taken in the session, which creates one draft note per attendee who was present.
• An individual section per patient for participation, response and progress against that patient's own goals.
• A redaction check before signing that flags any other attendee's name typed into a note.
• Billing per attendee using the group psychotherapy code, CPT 90853, which CMS lists among covered psychotherapy services in the billing article cited below.

Psychotherapy notes under HIPAA

HIPAA treats one kind of therapy note differently from the rest of the chart. Under 45 CFR 164.501, psychotherapy notes are notes by a mental health professional "documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record." The definition excludes medication, session times, modality and frequency, test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress.

Two rules follow from this. A covered entity must get the patient's authorization for most uses and disclosures of psychotherapy notes, with narrow exceptions such as use by the note's author for treatment (45 CFR 164.508(a)(2)). And psychotherapy notes are excluded from the patient's right of access under 45 CFR 164.524(a)(1).

The protection depends on the notes being kept apart. So the software has to keep them apart:

• A separate note type and store, visible only to its author by default.
• Excluded from every outbound path: patient portal, record exports, FHIR APIs, health information exchange and claims attachments.
• No copying of psychotherapy note text into the progress note, and a clear on-screen label for each note type.

42 CFR Part 2: consent and segmentation for substance use disorder records

42 CFR Part 2 protects records of substance use disorder treatment from federally assisted programs. It is stricter than HIPAA in several places. In 2024 HHS rewrote it to align more closely with HIPAA.

The facts, from the final rule in the Federal Register (89 FR 12472, published 16 February 2024):

• Dates. The rule took effect on 16 April 2024. Organizations subject to it had to comply by 16 February 2026.
• Who it covers. Records that contain substance use disorder information obtained by a federally assisted substance use disorder program (a "part 2 program") for treatment, diagnosis or referral for treatment (section 2.12).
• One consent for treatment, payment and health care operations. A patient can now give a single consent for all future uses and disclosures for treatment, payment and health care operations, until revoked in writing (section 2.33).
• Segmentation. A part 2 program, covered entity or business associate that receives records under that single consent is not required to segregate or segment them (section 2.12).
• Counseling notes. The rule adds "SUD counseling notes," defined much like HIPAA psychotherapy notes, and requires a separate consent for their use and disclosure (sections 2.11 and 2.31).
• Legal proceedings. A separate consent is required to use or disclose records in civil, criminal, administrative or legislative proceedings (section 2.31).
• Every disclosure carries its consent. Each disclosure made with written consent must be accompanied by a copy of the consent or a clear explanation of its scope (section 2.32).
• Breaches and penalties. HIPAA breach notification rules now apply to breaches of Part 2 records (section 2.16), and Part 2 now references HIPAA's civil and criminal penalty tiers (section 2.3).
• Accounting of disclosures. Patients get a right to an accounting of disclosures made with consent for up to three years, though the compliance date for that section is paused until HIPAA's own accounting rule is revised (section 2.25).

What it means for the build:

1. Know which records are Part 2. Not every behavioral health record is. Tag records at the source by program, so a Part 2 program's notes carry a label from the moment they are written. HL7 has codes for this in its ActCode system, including 42CFRPart2 for the regulation and SUD for substance use disorder information. The HL7 FHIR Data Segmentation for Privacy (DS4P) guide explains how to apply such labels to FHIR resources. That guide is still marked draft (version 1.0.0, 17 April 2023).
2. Model consent as data. Store who consented, for which purposes (treatment, payment, operations, legal proceedings, counseling notes), to which recipients, and until when. Check it on every disclosure as well as at intake.
3. Send the consent with the data. When records leave, attach the consent copy or scope statement and the required notice.
4. Log every disclosure, even while the Part 2 accounting section is paused.
5. Keep segmentation as a capability. The single-consent rule removes the duty to segment only for some recipients. You will still handle other consents, state laws and counseling notes. Labels added at the start take little effort; adding them later is a rebuild.

Treat this as a build checklist and have counsel confirm how the rule applies to your programs.

Telehealth for behavioral health

Medicare has permanent telehealth rules for behavioral health. CMS's Telehealth FAQ (updated 8 October 2026) says:

• The Consolidated Appropriations Act, 2021 permanently removed geographic and place-of-service restrictions for behavioral health telehealth, so patients in rural and urban areas can be seen at home, and audio-only is permitted for these services.
• For services after 31 December 2027, the law requires an in-person, non-telehealth visit within 6 months before the first mental health telehealth service in the home. CMS says it does not believe this applies to patients who began home mental health telehealth before 1 January 2028; those patients instead need at least one in-person visit every 12 months after 31 December 2027.
• From 1 January 2028, home audio-only behavioral health visits need a reason: the patient cannot use, or does not consent to, video.

What to build: video and audio-only visits, modality and patient location on each encounter, the patient's video refusal recorded, and a tracker for each Medicare patient's next in-person visit. Keep these dates in configuration, because the rules change often.

Billing codes specific to behavioral health

Behavioral health billing is mostly about time. A Medicare billing article from the contractor First Coast Service Options, A57520, Billing and Coding: Psychiatric Diagnostic Evaluation and Psychotherapy Services (revision effective 1 October 2026), sets out:

• Start and stop times, or total time, must be documented for psychotherapy codes 90832, 90834 and 90837.
• The time bands are 16 to 37 minutes (90832), 38 to 52 minutes (90834) and 53 minutes or more (90837). Psychotherapy under 16 minutes is not reported.
• Group psychotherapy is 90853. Interactive complexity, 90785, is an add-on with its own documentation rule.

Collaborative care counts minutes across a month. Per CMS's MLN909432 booklet, CPT 99492 covers the first 70 minutes of behavioral health care manager time in the first month, 99493 the first 60 minutes in later months, and 99494 each extra 30 minutes. General behavioral health integration, 99484, needs at least 20 minutes a month. The same booklet says patient consent can be verbal but must be documented in the record.

Who can bill also changed. Since 1 January 2024, marriage and family therapists and mental health counselors can bill Medicare directly, paid at 75% of the clinical psychologist rate, and addiction counselors who meet the counselor requirements can enroll (CMS page on MFTs and MHCs).

What to build: required start and stop times, a code suggestion from documented minutes, monthly minute counters for collaborative care, consent capture, and provider credentials the claim engine can check. Medicaid and commercial rules differ by state and payer, so keep code rules in tables.

Prior authorization

Some behavioral health services need payer approval before they start, depending on the payer and plan. The federal rules for that process changed in 2026. Under CMS's Interoperability and Prior Authorization Final Rule, CMS-0057-F (released 17 January 2024), impacted payers (Medicare Advantage, Medicaid and CHIP programs and plans, and qualified health plans on the federal exchanges) must, from 1 January 2026, decide urgent requests within 72 hours and standard requests within 7 calendar days, and give a specific reason for any denial. The exchange plans are excluded from the timelines. A Prior Authorization API is required from 1 January 2027. Drugs are excluded from these policies.

Payers publish the list of services that need approval, and those lists are hard to read by machine. Our study of what payers publish in their prior authorization code lists covers that problem.

What to build: an authorization record tied to the treatment plan, with approved units, units used, dates and payer reference, and an alert before units run out or the approval expires.

Where AI note drafting fits

Therapy notes take clinician time, and AI drafting is now a common request for behavioral health software. Our view, offered as judgement and not as a rule:

• The clinician reviews and signs every draft. The AI produces a draft; it never produces a signed note.
• The draft goes into the progress note. Psychotherapy note content should not be generated into, or copied into, the progress note.
• For Part 2 programs, the drafting pipeline must respect the same consent labels as the rest of the record. A summary of a Part 2 note is still Part 2 information.

Build, buy or extend

Buy when a standard therapy EHR covers your workflow and payer mix. In our experience, most solo and small group practices fit that case.

Build or extend when your care model is unusual (collaborative care in primary care, or mental health and addiction programs with different consent rules), when the record system is part of your product, or when outcome tracking, consent and billing must work as one system.

Extending often costs less and ships sooner. A headless EHR with a FHIR API (see our open source EHR comparison) gives you the core record, and you build the behavioral health layer on top. Nirmitee's open-source headless EHR with a FHIR R4 API and SMART App Launch passed 47 of 47 ONC (g)(10) SMART App Launch tests in Inferno on 11 June 2026. If you are weighing openEHR for the clinical model instead, our post on building a mental health platform with openEHR covers that route.

What it costs and how long it takes (Nirmitee published pricing; we confirm a fixed price after a short discovery):

The mapping of behavioral health scope to these tiers is our estimate. Your discovery sets the real scope.

Choosing a partner

Ask any vendor how they keep psychotherapy notes out of exports, how they gate Part 2 records, how scores are coded, and how billing knows the session length. A team that has built this will answer each in a sentence.

Our own behavioral health work: we took over a live platform for a US behavioral health practice group, hardened its clearinghouse connection (claim checks, acknowledgements and remittances), and added a claims assistant that tells billers what to fix before a claim goes out. The claims case study has the details. Nirmitee.io is ISO 27001:2022 certified, and our mental health solutions page shows the kinds of products we build. If you want a team that has shipped this, talk to us as your custom EHR development company.

Planning a behavioral health EHR? See prices and example screens on our custom EHR development services page, or talk to our team.