IOP and PHP Billing Operations: Running the Program Day So Authorized Days Get Paid

An intensive outpatient program (IOP) or partial hospitalization program (PHP) does not bill like a therapy practice. There is no single session to code and submit. There is a program day — several hours of structured treatment, delivered by a team, paid (in most arrangements) as one per-diem amount — and that day only pays if four things line up: the patient was in the right benefit, the day was authorized, attendance and hours met the program definition, and the claim carried the code set the payer’s contract requires.

Fastora’s IOP and PHP billing codes page covers the code tables. This article covers the operations around them — the daily workflow that keeps authorized days from becoming unpaid days — inside our wider behavioral health medical billing work. One caution applies throughout: program billing rules vary by payer, plan, state program, and how your program is licensed and enrolled. Nothing below replaces the payer’s contract and policy.

The two programs in billing terms

The billing difference between IOP and PHP is intensity, measured in hours. Under Medicare’s definitions, as summarized by Noridian, a Medicare Administrative Contractor, an IOP provides 9 to 19 hours of services per week, while a PHP requires 20 or more; neither involves an overnight stay. A physician must certify that the patient needs at least nine hours per week for IOP. Commercial and Medicaid programs use their own level-of-care definitions — many align with these thresholds, but the authorized level is decided against the payer’s policy criteria and the documented clinical picture. That is why level-of-care documentation (including ASAM criteria for substance use programs, where required) is a billing document, not only a clinical one.

Setting decides the claim form. Hospital outpatient departments and community mental health centers billing Medicare submit institutional claims, report IOP with condition code 92 (PHP uses 41), bill services line by line, and are paid a per diem based on the number of services furnished that day. Freestanding programs billing Medicaid or commercial payers more often bill a per-diem HCPCS code — H0015 for substance use IOP, S9480 for psychiatric IOP, H0035 or S0201 for PHP, depending on the payer — often paired with a revenue code. Medicare does not pay H or S codes, so a program serving both Medicare and commercial patients runs two billing setups for the same clinical day.

Admission: verify the program benefit, not just insurance

Program denials are usually born at admission. Confirming “active coverage” is not enough for a level of care that can run five days a week. At intake, verify:

• The behavioral health benefit itself, including carve-outs. Many plans administer behavioral health through a separate company with its own authorization and claims address. Billing the medical plan for a carved-out benefit is a guaranteed, slow denial.
• Level-of-care coverage. Confirm IOP and PHP are covered benefits for this member, in this setting, under this license — and whether the program must be in network or hold a specific enrollment.
• Authorization requirements and the review cadence. How many days the initial authorization covers, what clinical information the reviewer needs, and when the first concurrent review falls due.
• Patient responsibility at program intensity. Deductible and coinsurance on a per diem, several days a week, accumulate far faster than weekly therapy. Start the payment conversation in week one.
• For substance use programs, consent to bill. Programs subject to 42 CFR Part 2 need the patient’s written consent before records can be disclosed for payment. No consent, no claim — set up the alternative at intake, not at claim time.

Authorization and concurrent review

IOP and PHP authorizations are short and conditional. An initial approval may cover a set of days or a date range, and continued stay depends on concurrent review: updated documentation showing the patient still needs this level of care, is participating, and has a step-down plan. Miss the review date and the days after it are unauthorized — delivered, documented, and unpaid.

Run authorization as a census discipline, not a filing task:

1. Log every admission the day it happens — payer, carve-out administrator if any, authorized days and dates, next review date, reviewer contact.
2. Calendar concurrent reviews with a buffer. Prepare the update — attendance, hours, symptom and functioning measures, medication changes, step-down plan — before the authorized days run out.
3. Reconcile the census to authorizations weekly. Every attended day should map to an authorized day. Discrepancies found in the same week are fixable; at month-end they are appeals.
4. Document step-downs and discharges the day they happen. A patient who stepped down clinically but stayed on the program census creates an authorization problem and an audit problem.

Our guide to behavioral health prior authorization documentation covers the clinical packet in detail.

The program day: attendance and hours are claim data

A per diem is a promise that the day met the program definition, which makes the attendance record a billing document. For each patient-day, the record should show the services furnished, start and stop times or total hours, and who provided them. Days that fall short of the program’s minimum hours may not support the full per diem; follow the payer’s policy for partial days rather than billing the day as complete.

Two habits protect the per diem. First, do not bill individual therapy codes for services already included in the per-diem rate unless the contract expressly allows it; unbundling a program day is a common audit finding. Second, for Medicare IOP and PHP, respect the structural rules: claims are submitted in sequence for a continuing course of treatment, line-item dates of service are reported for each service, and physician recertification is required at least every 60 days for IOP, per the Noridian guidance above. Telehealth counts toward a program day only where the payer and setting allow it — confirm the rule per payer before counting a remote day.

Denial patterns specific to programs — and the A/R routine

Program denials cluster in predictable places:

• Unauthorized days — services after an authorization lapsed or a review was missed. Prevention is the weekly census reconciliation; recovery is an appeal built on the clinical record, filed inside the payer’s deadline.
• Level of care not met — hours, attendance, or documentation do not support IOP/PHP intensity. The fix is day-level documentation discipline, not a better appeal letter.
• Wrong code set or claim form for the setting — an H code sent to a payer that requires an S code, or a per diem billed where the payer pays line-item services. Setup errors repeat on every claim until the payer-specific rule is corrected in the billing system.
• Benefit carved out — the claim went to the medical plan. Rebill the carve-out administrator promptly and watch timely-filing limits; the original submission date does not always protect the corrected one.
• Duplicate or bundled services — component services billed alongside the per diem contrary to contract.

Because a program bills many patient-days under a handful of contracts, A/R follow-up should be organized by payer and week of service, not by claim alone. A single setup error can sit across a month of program days; spotting it in the first week’s remittances beats working denials one by one a month later. Work program A/R in this order: authorization-expiry denials first (shortest deadlines, largest dollars per day), then systematic code/form denials (one fix clears a batch), then level-of-care appeals. A structured denial management routine keeps that queue from aging past appeal deadlines.

IOP/PHP operations checklist

Run this check weekly:

1. Every admission has a program-level eligibility check on file — benefit, carve-out administrator, level-of-care coverage, patient responsibility.
2. Every admission has an authorization logged with days, dates, and the next review date calendared.
3. The census reconciles to authorizations: no attended day is unauthorized, no authorized day undocumented.
4. Each patient-day’s record shows services, hours, and providers sufficient to support the per diem.
5. Partial or short days follow the payer’s policy, not billed as full days by default.
6. No component service is billed separately from the per diem unless the contract allows it.
7. Claims use the code set, revenue codes, and claim form the payer requires for this setting — and Medicare days never carry H or S codes.
8. Concurrent reviews go in before authorized days expire; step-downs and discharges are recorded the day they occur.
9. The week’s remittances are reviewed for pattern denials before the next week’s claims go out.
10. Program A/R is aged by payer and week of service, authorization-expiry items first.

Frequently asked questions

Is IOP billed per session or per day?

Usually per day. Most Medicaid and commercial arrangements pay a per-diem rate for the program day, using codes such as H0015 (substance use IOP) or S9480 (psychiatric IOP). Medicare also pays IOP per diem in eligible settings, but the claim is built line by line from the services furnished that day, with condition code 92 — and Medicare does not use H or S codes. Your contract decides which model applies.

Does Medicare cover intensive outpatient programs?

Yes, in defined settings. Medicare covers IOP services furnished by hospital outpatient departments, community mental health centers, federally qualified health centers, rural health clinics, and — for opioid use disorder — opioid treatment programs, effective January 1, 2024. A freestanding program that is none of those settings cannot bill Medicare for IOP, however it is licensed by its state.

What is the difference between IOP and PHP billing?

Intensity and, with it, the authorized level of care. IOP is 9 to 19 hours per week under Medicare’s definitions; PHP is 20 or more. Medicare PHP claims carry condition code 41 (IOP uses 92), and commercial and Medicaid payers use different per-diem codes for the two levels — for example H0035 or S0201 for PHP where H0015 or S9480 is used for IOP.

How often do IOP and PHP authorizations need review?

It is payer-specific. Initial authorizations are typically short, and continued days depend on concurrent reviews submitted before the authorized period expires. Medicare IOP also requires physician recertification at least every 60 days.

Can program services be delivered by telehealth and still count toward the day?

Only where the payer and setting allow it. Telehealth policies for program services differ sharply by payer; some count specified services delivered remotely, others require in-person attendance. Confirm the current rule per payer.

Why did a whole week of program claims deny at once?

Program claims share setup: one wrong code set, one missed carve-out, or one lapsed authorization repeats across every patient-day it touches. Read the denial reason across the batch, fix the gap at its source, and rebill or appeal the batch together inside the payer’s deadlines.

Conclusion

IOP and PHP billing pays for disciplined operations: verify the program benefit and its carve-out at admission, run authorization and concurrent review against the census weekly, treat attendance and hours as claim data, and read remittances for patterns before they become a month of denials. The codes matter — but the workflow around them decides whether authorized days turn into paid days.

If your program is carrying authorization lapses, level-of-care denials, or aging per-diem A/R, a free medical billing audit can show where the workflow is breaking.