Mental health and behavioral health practices carry an extra layer of sensitivity beyond standard PHI — session notes and diagnosis-adjacent detail are the kind of information both HIPAA and, in the US, 42 CFR Part 2 (for substance use disorder treatment records specifically) treat with heightened protection. That makes this the vertical in the series where I am most conservative about what touches Acumatica at all.
Clinical content has no business in the ERP, full stop
Session notes, treatment plans, diagnosis codes, and anything resembling clinical documentation belong exclusively in an Electronic Health Record or practice management system built for behavioral health, ideally one built with 42 CFR Part 2's stricter consent-based disclosure rules in mind if substance use treatment is involved. Acumatica is a financial ERP; it has no clinical documentation capability and, more importantly, no consent-management framework for the kind of re-disclosure restrictions Part 2 imposes. There is no configuration that makes it appropriate for that content.
What legitimately crosses into Acumatica: billing summary only
Same integration shape as the medical billing and EHR pieces in this series, with a tighter filter: billed amount, service date, payer, and a claim/session reference number that lets someone reconcile back to the source system. No diagnosis code, no session content, no treatment-plan detail — and for Part 2-covered substance use treatment specifically, be more conservative still, since even the fact that a person received treatment at a specific type of facility can itself be sensitive under Part 2's rules.
{
"CustomerID": { "value": "PAYER-BCBS" },
"Details": [
{ "InventoryID": { "value": "THERAPY-SESSION" },
"Qty": { "value": 1 },
"UnitPrice": { "value": 145.00 },
"TranDesc": { "value": "Session ref SES-88213 — 2026-06-14" } }
]
}
-- No diagnosis code, no CPT modifier tied to a named patient beyond
-- what the payer relationship already requires, no clinician notes.If patient-level AR is unavoidable, isolate it hard
Small practices sometimes push back that they need patient-named AR for private-pay collections. If that requirement is genuinely unavoidable, isolate it aggressively: a restricted role that only the billing coordinator holds, field-level encryption on the patient-name field, audit trail turned on for that screen, and a written policy for who can query it. This is the same pattern as the mental-health-adjacent verticals in this series, just with a lower tolerance for exceptions given the sensitivity of what a "patient of this practice" fact alone can imply.
Part 2 (substance use disorder treatment records) has stricter consent and re-disclosure requirements than general HIPAA — a valid HIPAA-compliant configuration is not automatically Part 2-compliant. If a client's mental health practice includes substance use disorder treatment, that distinction needs a compliance professional's sign-off, not an ERP consultant's judgment call. I flag this explicitly to every behavioral health client and recommend they confirm scope with counsel before any patient-identifiable data path is finalized.
Wrapping up
Mental and behavioral health is the vertical in this series where the safest default is the strictest one: keep Acumatica to de-identified billing summaries, treat any patient-level exception as a deliberately isolated, encrypted, audited carve-out, and flag 42 CFR Part 2 explicitly if substance use treatment is in scope — that is a legal question, not a configuration question.
Independent software engineer in Nairobi specialising in Acumatica customisations, Laravel backends, and tax fiscalisation integrations across East and Southern Africa.