Insurance Coverage for PHP and IOP

What PHP and IOP are, in hours

Medicare's statute defines a PHP as an organized, intensive treatment service that offers less than 24-hour daily care outside the patient's home or an inpatient or residential setting. An IOP is more intense than outpatient day treatment and less intense than a PHP.

Medicare sets the PHP minimum at 20 hours a week of therapeutic services, certified by a physician. It sets the IOP minimum at 9 hours a week. Other payers write their own.

Blue Cross and Blue Shield of Mississippi. PHP runs at least six hours a day, five days a week.
Blue Cross Blue Shield of Michigan. The intensive PHP level is 21 or more hours a week. The less intensive level is 20 or fewer. An IOP typically runs at least three days a week for three hours a day.
Ohio Medicaid. Substance use IOP is 9 to 19 hours a week. Substance use PHP is 20 or more.

The same schedule can meet one payer's definition and miss another's. The American Society of Addiction Medicine (ASAM) now calls its Level 2.5 High Intensity Outpatient. It says PHP is a misnomer because the services are not delivered in a hospital.

Commercial plans: what parity does and does not require

The federal parity law is the Mental Health Parity and Addiction Equity Act (MHPAEA). Parity means comparable treatment. The law generally keeps group health plans and insurers that provide mental health or substance use benefits from putting less favorable limits on them than on medical and surgical benefits. It does not require a plan to cover those benefits.

A plan that does cover them faces two kinds of rules: financial requirements, which are the member's costs such as coinsurance and copays, and treatment limits, such as visit limits. Generally, neither can be tighter than the typical costs and limits the plan puts on nearly all of its medical and surgical benefits in the same classification. A classification is a part of the plan, such as inpatient or outpatient care.

The 2013 federal parity rule applies to group health plans of private employers with more than 50 employees, to non-federal governmental plans of that size, and to individual-market coverage. It does not apply directly to small employer group plans. Its requirements reach them indirectly through the Affordable Care Act (ACA). The ACA requires non-grandfathered individual and small group plans, which are not older plans that kept their earlier status, to cover mental health and substance use disorder services. They are one of ten essential health benefit categories, the kinds of care those plans must include. The federal list of those categories names behavioral health treatment but does not name partial hospitalization.

Parity also reaches limits that are not numbers, such as prior authorization. Prior authorization is the payer's approval, obtained before services begin. A plan cannot apply such a limit to mental health or substance use benefits unless its processes and evidence are comparable to, and applied no more stringently than, those used for medical and surgical benefits in the same class. Some states may have parity rules stricter than the federal ones.

Medicare: the PHP and IOP benefits

Medicare may cover PHP when a hospital outpatient department or a Medicare-certified community mental health center (CMHC) provides it. It may cover IOP when a hospital outpatient department, a CMHC, a rural health clinic, a federally qualified health center or an opioid treatment program provides it. Since January 1, 2024, Medicare pays hospital and CMHC IOP as a per diem. A per diem is one payment for a whole program day, not a payment for each service. Medicare pays PHP the same way.

For PHP, a physician certifies that the patient needs PHP services for at least 20 hours a week and would otherwise need inpatient psychiatric care. A physician recertifies, meaning certifies the need again, as of the 18th day of services and then no less often than every 30 days. The patient must not need 24-hour supervision and must have an adequate support system outside the program.

For IOP, a physician certifies the need for at least 9 hours a week of services. Medicare says IOP patients do not require inpatient psychiatric care in the absence of the services, unlike PHP patients.

Medicaid: coverage by state, with four examples

Medicaid is not a group health plan, but certain federal parity requirements reach the managed care plans that contract with state Medicaid programs. In all four states below, Medicaid is the payer of last resort, so other insurance is generally billed first. A provider that accepts a Medicaid member must accept Medicaid's payment, plus any cost sharing the plan requires (a deductible, coinsurance or copayment), as payment in full.

Ohio

Ohio Medicaid pays substance use IOP as a per diem for days of at least 2 hours and 1 minute. It pays substance use PHP as a per diem for days of at least 3 hours and 1 minute. Substance use PHP needs prior authorization for adults and adolescents.

Ohio's new rules ask for authorization only when a member's use of a service passes a threshold. For substance use IOP, billing code H0015, the threshold is 30 units in one calendar year. For now, they apply only to members of Ohio Medicaid managed care plans, which start on dates between July 1, 2026 and January 1, 2027. They apply only at community mental health agencies and substance use agencies, not at hospitals or professional medical groups.

Iowa

Most Iowa Medicaid members are in Iowa Health Link, which joins physical, behavioral and long-term care in one program. Iowa's B3 manual covers a separate set of behavioral health services, and says a provider does not have to enroll in B3 before providing mental health PHP or IOP. It also says H0015, the substance use IOP code, is a covered Medicaid benefit that will not be added to that manual.

Iowa Total Care, one of the Iowa Medicaid plans, requires authorization for the PHP and IOP billing codes H0035 and S9480 and for the facility revenue codes 912 and 913.

Rhode Island

Most Rhode Island Medicaid members get services from a managed care plan: Neighborhood, Tufts Health RITogether or UnitedHealthcare Community Plan. Neighborhood publishes one PHP coding table for all its lines of business, pairing H0035 with revenue code 0912 or 0913. It lists S9480 with revenue code 0905 for mental health IOP and H0015 with 0906 for substance use IOP. Out-of-network behavioral health providers must get authorization from Neighborhood before services.

Tufts Health RITogether wants notice after the first PHP day. It lists no authorization or notification for IOP from in-network providers, the ones in its network.

Utah

Utah enrolls Medicaid members automatically in the prepaid mental health plan for their county, and those plans cover most counties. For a service a managed care plan covers, Utah says the claim goes to the plan.

The state's behavioral health manual, updated September 2026, has no IOP or PHP chapter. It lists group codes such as 90853 and H2017 in 15-minute units rather than an IOP or PHP per diem. A September 2026 bulletin says that from January 1, 2027, IOP and PHP claims go on the 837I electronic facility claim at one unit per day.

What a verification of benefits settles before admission

A verification of benefits (VOB) is the check of eligibility, coverage and authorization criteria before the first service. A family can ask a plan the same questions. A useful VOB settles five things.

Whether the level of care is a benefit. Tufts covers medically necessary inpatient and intermediate levels of care, including PHP, as the member's benefit plan document defines them.
Who decides. UnitedHealthcare Community Plan in Rhode Island runs its mental health and substance use benefit through United Behavioral Health, operating under Optum. For behavioral health services before September 1, 2025, Neighborhood told providers to send claims to Optum. So the company named on the card may not be the one that authorizes or processes the claim.
What kind of plan. In a self-insured plan the employer takes on the cost of paying claims. It may hire an outside administrator, so the name on the card and the party that pays can differ.
What the member owes. A deductible is the amount the member pays for covered services before the plan starts to pay.
What needs approval. Blue Cross Blue Shield of Michigan and Blue Care Network require prior authorization for PHP. They do not require it for IOP, with an exception for some Blue Care Network members treated outside Michigan.

A VOB records what the plan said on the day it was asked. It is not a promise of payment.

Authorization and concurrent review

A concurrent review is the payer's check on medical necessity while the patient is still in treatment. The payer approves a set number of days. The clinical team has to support a continued stay to get more.

Magellan says to call for preauthorization before the member is admitted. It also asks facilities to contact it before the current authorized period ends when more services, including PHP or IOP, will be needed.
Tufts Health RITogether has the admitting PHP contact it on the first business day after the first day of treatment, to give notice and complete a medical necessity review for more days. Out-of-network providers must request authorization before starting services.
New Mexico Medicaid asks for continued-stay authorization for PHP only when a stay passes 45 days. The request must say why a lower level of outpatient services would not be advised.
Ohio Medicaid requires at least 20 hours a week in substance use PHP. If services fall below 20 hours a week after the first four consecutive weeks of treatment, it rescinds the authorization. Those services may still be paid at a lower level of care, up to 19.9 hours a week.

Under federal rules that apply from 2026, a state may not allow a standard Medicaid managed care authorization decision to take more than 7 calendar days. An expedited decision may not take more than 72 hours. Either clock can be extended by up to 14 days in set cases. Neighborhood accepts a post-service request, one made after the service was given, within 7 calendar days of the service and before a claim is received, or in extenuating circumstances.

For a family, the question is who bears a missed authorization. Blue Cross Blue Shield of Michigan lists a PHP admission without prior authorization before the admission among the services it does not pay for. It says an in-network facility cannot then bill the member for it. Iowa Total Care says its providers are contractually prohibited from holding a member liable for a service it denied because the provider did not get timely authorization.

Where PHP and IOP coverage breaks

Five patterns recur.

The level of care. A level-of-care denial means the payer decided PHP was not the right setting for a day, and that day's claim goes with it. Medicare lets a program appeal a denial that PHP was not reasonable and necessary, which is Medicare's phrase for medical necessity.
A missing or lapsed authorization. Tufts Health Public Plans administratively denies payment, meaning it denies for a missed step rather than a clinical reason, when an in-network provider fails to get a required authorization or give a required notice. It says the provider must confirm that authorization was obtained.
Hours that fall short. Arizona says a member who is late or leaves early and misses the three-hour day is not billed under S9480, the code for the IOP day. The provider bills the individual services instead. Indiana says services under three hours cannot be billed as intensive outpatient treatment but may be billed as psychotherapy if provider qualifications and program standards are met.
Authorization that does not match the claim. Magellan says the level of care authorized must match the care billed. It can deny a preauthorized service when the codes or place of service differ from the authorization.
Rules that move. Utah's January 2026 bulletin gave July 1, 2026 for its new claim method. Its September 2026 bulletin says January 1, 2027.

What we do about it

We run PHP and IOP billing under HRI Managed, our billing engagement. We verify benefits and track authorization and concurrent review to the date. We build each claim to the payer's codes, units and hour documentation before it goes out. A denied or stuck claim runs through our seven-point diagnostic. When an appeal is warranted, we build the medical-necessity and parity arguments from the payer's own denial letter, the plan's coverage document and the payer's medical-necessity policy. We report every claim to you each Friday, with its status, age and next action. We do not promise a payer's decision, and the level of care a patient gets is a decision for your clinical team.

Insurance coverage for PHP and IOP: commercial plans, Medicare and Medicaid.

What decides whether a plan pays.