How to choose an EHR for an IOP or PHP program

Write down how your program runs first

Most bad EHR decisions start with a polished demo of features the program doesn't use. Before you talk to a vendor, write one page about your program. Every answer below changes what you need:

• Levels of care. PHP, IOP, outpatient, and whether you also run detox, residential or recovery housing. An outpatient-only EHR won't have a bed board or a medication administration record; a residential EHR may be heavy for an IOP.
• Substance use, mental health or both. Substance use records bring 42 CFR Part 2. Mental health IOPs often bill different codes (S9480 instead of H0015).
• Your payers and the claim form each one wants. Many commercial contracts pay a program day on a professional claim (CMS-1500, 837P) with a HCPCS code; others want a facility claim (UB-04, 837I) with revenue codes. Medicaid managed care plans set their own rules. Check your contracts.
• How you count a billable day. The hours a PHP or IOP day must document, and whether individual sessions count toward them or are billed separately.
• Census and staff. Clients in the program on a busy day, and how many counselors, nurses, prescribers, billers and front-desk staff need logins.
• Who bills. In-house billers, an outside billing company, or both. An outside biller needs a login or a clean export.
• Accreditation and surveys. Joint Commission or CARF, and your state licensing survey (in Texas, HHSC under 26 TAC 564). Surveyors read the chart, so the chart has to read well.

Opening a program, not just picking software? Our guide on how to start an IOP or PHP in Texas covers the license, staffing and contracts that drive these answers.

The checklist, criterion by criterion

Each criterion says why it matters, what good looks like, and the red flag to listen for. Score them in the sheet below.

1. Levels of care and step-down

Why: a client moves PHP to IOP to outpatient (the 2024 Medicare outpatient rule added IOP alongside PHP for hospitals and community mental health centers, and commercial plans authorize each level separately), and every rule follows the level: required hours, billing code, authorization and review dates. Good: the level of care lives on the client with its start date, each level carries its own day and week hours and its code, and a step-down keeps one continuous chart. Red flag: a level is just a label or a "program" tag, and hours and codes are tracked in a spreadsheet. On Cima's Program plan, each level carries its own hours and code in Settings → Program.

2. Group notes with each client's own entry

Why: groups are most of an IOP's documentation, and payers deny or claw back group notes that are identical for everyone in the room. Good: the facilitator writes the topic and summary once, then each client present gets their own entry: attendance and time, participation, response, and the treatment-plan goal worked on. One signature signs them all. Better: the system warns, or refuses, when entries are copy-pasted. Red flag: one group note "attached" to every client's chart, or a separate full note per client with nothing shared.

3. Attendance that drives per diem billing

Why: a per diem claim says the client received a full program day. If the hours on the claim come from a sign-in sheet and the notes don't add up, that's an overpayment. Good: each client-day's hours are counted from signed notes, a day that meets its level's hours becomes one per diem charge, and a short day is flagged instead of billed. Red flag: attendance is a checkbox separate from the notes, or per diem charges are entered by hand. Payer auditors pull the notes behind a billed day; the chart audit checklist shows how they read them.

4. Claims: UB-04 / 837I as well as 837P

Why: if even one of your contracts wants a facility claim, the EHR has to produce one: revenue codes by level, type of bill, an attending provider. Good: both the professional (837P) and institutional (837I) claim, checked before they go out, sent to a clearinghouse, with electronic remittances (ERAs) posting payments back. Ask: which clearinghouse, what each claim and ERA costs, and whether you can export the claim file for an outside biller. Red flag: "we export to your billing company" as the only answer, or UB-04 printed on paper only.

The common codes are H0015 for a substance use IOP day, S9480 for a mental health IOP day, S0201 for a PHP day, and revenue codes such as 0905/0906 (IOP) and 0912/0913 (PHP) on a UB-04, but each payer decides. The billing section of our IOP guide has the table.

5. Authorizations and utilization review

Why: an authorization that lapses unnoticed is days of care you deliver and don't get paid for. Good: each authorization on the chart with its level, number, dates and units; a reminder days before the last authorized day; and a continued-stay review that asks for what reviewers ask for: progress, current symptoms and risk, each ASAM dimension, why a lower level isn't enough yet, and the step-down plan. Red flag: authorizations tracked only on the billing side, invisible to the counselor who writes the review. Our sister site's prior authorization guide covers the payer side.

6. 42 CFR Part 2

Why: a federally assisted program that treats substance use disorders must follow Part 2, and HHS's updated Part 2 rule had a compliance date of February 16, 2026. The consent requirements in §2.31 are what your release form has to carry. Good: consents and releases with the elements Part 2 requires, records released only under a current consent or another legal basis that's recorded, the required notice attached to what's disclosed, and a log of each disclosure. Ask: what changed in the product for the 2024 rule. Red flag: "we're HIPAA compliant" as the whole answer. HIPAA and Part 2 are different rules.

7. Treatment plans and documentation integrity

Why: surveyors and payer auditors read plans and notes together. Good: plans with problems, measurable objectives, target dates and review dates; notes that ask about progress on the plan's goals; signed notes locked, with dated addenda for corrections; late notes marked as late entries, never backdated; and supervisor co-signature for interns and associates. Red flag: anyone can edit a signed note, or the signature date can be changed.

8. ASAM, screenings and safety

Why: level-of-care decisions and continued-stay reviews lean on the ASAM Criteria's six dimensions, now in a 4th edition, and safety screening is a survey focus. Good: ASAM dimensions in the assessment and review templates, standard screening tools scored in the chart, and an alert when a screening shows risk. Ask which tools are built in (for example PHQ-9, GAD-7, the Columbia suicide screen, AUDIT, DAST) and whether you can add your own.

9. Reporting

Why: you'll run the program from a handful of numbers. Good: census and attendance by level, notes signed on time, authorizations ending soon, claims billed, paid and denied with reasons, money owed by payer and age, and outcomes. Every report exportable. Ask whether reports your state or accreditor wants come out of the box, or need a custom build at extra cost.

10. Security, roles and the BAA

Why: HIPAA requires a business associate agreement (45 CFR 164.308(b)) with any vendor that holds your clients' records, and the Security Rule expects access controls and audit logs, and a program has staff who should see different things. Good: a BAA at sign-up, multi-factor sign-in, roles (a biller sees claims but not therapy notes), and a log of every view of a chart. Our security page lists what Cima does, and the compliance calendar puts the yearly HIPAA risk analysis on your schedule.

11. Migration and getting your data out

Why: you're choosing your next exit as much as your next system. Good: a plain answer on what imports (clients, insurance, diagnoses, open authorizations) and what doesn't (usually past notes), help with cutover, and a full export of your data at any time without a fee. Ask what you get when you leave, in what format, and how long you can still read records after cancelling. Our guide to switching EHRs has a two-week cutover plan.

12. Pricing model and total cost

Why: program EHRs charge in very different ways: per clinician, per client or census, per claim, plus setup, training and add-ons. Two quotes can't be compared until each is written as a monthly total for your program. Ask for every line in writing, including clearinghouse fees and anything charged per transaction. Our guide to how EHR pricing works walks through it.

13. Contract terms

Why: the contract decides what happens when the software disappoints you. Read for: the length of the commitment and whether it auto-renews, how much notice a price increase needs, termination for cause, what an export or "data extraction" costs at the end, how long records stay readable after you cancel, the uptime and support commitments, and the BAA. Have your attorney read anything multi-year.

14. Telehealth, e-prescribing, labs and billing services

Only score these if you need them. Ask whether video is built in or bring-your-own, whether e-prescribing covers controlled substances (EPCS) and is live today, whether lab orders and results are integrated, and whether "billing" means software or a service paid as a percentage of collections. If a billing company would take a percentage, have your attorney approve the arrangement.

Run a real program day through the demo

A vendor's demo shows the vendor's best path. Ask instead to watch them do your day, with made-up clients, on a live system:

1. Admit a client to PHP with an authorization for 10 days. Write the intake and a treatment plan.
2. Run a group of 8 with two late arrivals. Write the group note with individual entries and sign it once.
3. Show the day's attendance: who met PHP hours, who didn't, and what will bill.
4. Build the per diem claim on the form your biggest contract uses (837P or 837I). Show what the claim checker catches.
5. Show how the counselor learns the authorization ends in 5 days, and write the continued-stay review.
6. Step the client down to IOP. Show that hours, codes and the next authorization follow.
7. Release records to a referral source under a Part 2 consent. Show what's attached and logged.
8. Pull the report you'd look at on Monday morning. Then export one chart and the whole program.

Time each step and count the clicks. Anything they can't show live, get in writing with a date.

Questions to ask every vendor

• Which levels of care do you support, and where do each level's hours and billing codes live?
• How are group notes built? Does each client get their own entry, and what stops copy-paste?
• Are billable hours counted from signed notes? What happens to a short day?
• Can you send an 837I with our revenue codes and type of bill, and an 837P from the same system?
• Which clearinghouse do you use, and what does each claim, ERA and eligibility check cost?
• How are authorizations tracked, who is reminded, and how far ahead? What's in your continued-stay review template?
• What changed in the product for the 2024 Part 2 rule? Show me a release with the notice attached.
• Which screening tools are built in? What happens when a score shows risk?
• Can a signed note be edited? How are late entries and supervisor co-signs handled?
• Which reports come standard? Which ones cost extra to build?
• What imports from our current system? Who does the work, and what does it cost?
• What do we get when we leave, in what format, at what cost, and for how long can we read records?
• What is the total monthly cost for our program, every line, for the first year and after?
• How long is the contract, does it renew on its own, and how much notice do you give before a price increase?
• Will you sign our BAA, or yours? Where is the data hosted, and is sign-in multi-factor?
• What's on your roadmap that we'd be counting on, and is it dated in writing?
• Can we talk to two programs our size, on our payers, that have used you for a year?

The scoring sheet

Give each criterion a weight for your program (0 means you don't need it, 3 means you can't run without it), then score each vendor 0 to 3 from what you saw live, not what you were told. The totals update as you go. Nothing is sent anywhere or saved; print the page to keep a copy.

Without JavaScript the choices still work and print; only the totals are missing. A tie on the sheet usually breaks on two things: the reference calls and the total cost.

Where Cima fits, and where it doesn't

We built Cima EHR's Program plan for outpatient programs like the one we run. Here is how it answers the checklist, from the app's own settings and screens:

Criterion	Cima EHR today
Levels of care	PHP, IOP and OP on the client, each with its own day and week hours and per diem code (defaults: PHP 4 hours a day with S0201, IOP 3 hours with H0015; change them to match your contracts). Step-down on the same chart.
Group notes	Topic and summary once, each client's own entry with the treatment-plan goal, one PIN signs them all. Entries that read 80% alike are stopped before signing.
Attendance and per diem	Hours from signed notes; one per diem charge for each day that meets its hours; short days shown in red. Individual sessions are part of the per diem by default, or billed separately if your contracts pay them.
Claims	837P, or 837I for program days with your revenue code per level and type of bill. Claims are checked before sending; ERAs post payments. Claims, ERAs and eligibility checks are billed at the clearinghouse's standard rate: 30¢, 20¢ and 30¢.
Authorizations and UR	Tracked on the chart; the continued-stay review comes up 5 days before the last authorized day (adjustable), with ASAM dimensions 1 to 6 required in it.
Part 2	Releases need a recorded consent or other legal basis; a program's releases carry the 42 CFR 2.32 notice to the recipient; disclosures are recorded.
Documentation integrity	Signed notes locked, corrections as dated addenda, notes signed over 72 hours after the visit marked late, associates' notes co-signed by a supervisor.
Screenings	PHQ-9 and GAD-7, on the client's phone or in session, with an immediate alert on the PHQ-9 self-harm question. The Columbia (C-SSRS) isn't built in yet.
Reports	Visits and no-shows, notes signed on time, attendance, money owed by age, claims and denial reasons, caseloads and PHQ-9 outcomes, each downloadable as a CSV.
Migration and export	Client list imports from a CSV with a preview. Past notes don't import. Export the whole practice, or one chart as a PDF, free, any time, and for at least 90 days after you cancel.
Price and contract	$399 a month for up to 25 clients in the program, plus $39 for each clinician after the first. No setup fee, month to month, cancel any time, 30 days' notice of any price change. Pricing.
What it doesn't do yet	No built-in video (you add your own HIPAA-ready video link to the visit). E-prescribing is coming soon, not live. No lab orders, no Columbia screening, no psychological testing codes. No detox, residential or recovery-housing levels: Cima's levels are PHP, IOP and OP. Over 25 clients, talk to us before you buy.

If one of those gaps is a must-have for you, a different EHR is the right answer today, and we'd rather tell you now. If they aren't, take the tour or read Cima for IOP and PHP programs, then run the demo day above on a free trial.

Questions

What is the best EHR for an IOP?

The one that fits how your program runs. Write down your levels of care, payers, claim forms and census, then score each vendor on the criteria above from what you see in a live demo of your own program day. A large multi-level organization and a 20-client outpatient program usually land on different answers.

Does an IOP need an EHR that bills on a UB-04?

Only if one of your contracts asks for a facility claim. Many commercial plans pay IOP and PHP days on a professional claim (837P) with a HCPCS code; others, and some Medicaid plans, want an institutional claim (837I, the electronic UB-04) with revenue codes. Check each contract, and choose an EHR that can do both if you're unsure.

Can one EHR run our program and our outpatient therapy?

It should. Clients step down from PHP to IOP to outpatient sessions, and two systems mean two charts, two schedules and two sets of claims. Ask each vendor to show a step-down to weekly individual sessions on the same chart, with the treatment plan and authorizations carried over.

How long does switching EHRs take for a program?

The setup can be done in about two weeks; the longest step is usually enrolling with each payer for electronic payments. Load each current client's level of care, authorization and treatment plan before the first group on the new system. Keep the old system until its last claims are paid.

Should our billing company choose the EHR?

Their input matters, because they'll work in it every day. But the counselors write the notes the claims depend on. Weigh both, and make sure the biller gets its own login or a clean claim export whichever EHR you choose.

Sources

1. eCFR, 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records, and §2.31 (consent requirements).
2. Baker Donelson, HHS compliance deadline for updated Part 2 record protections (February 16, 2026).
3. American Society of Addiction Medicine, The ASAM Criteria, 4th edition.
4. HHS, HIPAA Security Rule; 45 CFR 164.308 (including business associate contracts).
5. Cima EHR's own behavior: the app's program settings, claim builder, templates and reports (alturaops server/solo), checked October 24, 2026.

General information, not legal or billing advice. Payer rules differ by plan and contract; confirm codes and claim forms with each payer.