Contracted Services Oversight for Behavioral Health Operators: Building Vendor Files That Survive a Survey

Ask a behavioral health operator for their contracted services list and you usually get one of two answers: someone opens a shared drive folder named Contracts and starts scrolling, or the CFO says the agreements are with the attorney. Neither helps during a survey. The surveyor is not asking whether you have contracts. They are asking whether you know what you handed off, and whether you have evidence the people you handed it to are doing the job.

This is one of the quieter findings in behavioral health accreditation and licensure, and one of the most common. It rarely comes from a dramatic failure. It comes from a program that grew – a second house, telehealth psychiatry, a new lab, a per diem nursing agency on weekends – and never updated the list of who is doing what on its behalf.

Start With an Inventory, Not the Contract Folder

Build the inventory from operations, not from paperwork. Walk the program day and write down every function nobody on your payroll performs. In a typical residential program the list runs longer than leadership expects:

• Laboratory and toxicology, including specimen collection and courier service
• Pharmacy services, medication delivery, and pharmacist consultation
• Telehealth psychiatry and after-hours prescriber coverage
• Per diem and travel clinical staffing agencies
• Dietary and food service
• Transportation to outside appointments and court dates
• Housekeeping, laundry, and biohazard waste removal
• Fire alarm, sprinkler, and extinguisher inspection; generator service
• Medical records storage, release-of-information processing, and transcription
• Billing, revenue cycle, and outsourced utilization review
• Electronic health record hosting, IT support, and backup
• Consulting clinicians who read labs, sign physicals, or serve as contract medical director

Two categories cause the most trouble. The first is anything a clinician touches – contracted prescribers, agency nurses, a contract medical director – because credentialing and privileging obligations do not disappear when the person is paid on a 1099. The second is anything that handles records, where privacy paperwork is most often incomplete.

What a Surveyor Samples First

Surveyors do not read every contract. They pick, and the pattern is predictable: they ask for the list, scan it for services that could directly affect a client, and pull two or three. Contracted psychiatry gets pulled almost every time. Dietary gets pulled in residential settings. Transportation gets pulled if clients leave the building. Fire and life safety vendors get pulled because their reports are dated and easy to check against a calendar.

Then the questions get specific. Who owns this relationship? What are you paying them to do, in terms concrete enough that you would notice if they stopped? How did you determine they were qualified? What have you looked at in the past year to confirm the service is acceptable? And when something went wrong – a missed lab pickup, an agency nurse without a current license – what did you do, and can you show me?

That last question separates programs. Most operators can produce a signed agreement. Far fewer can produce evidence that anyone reviewed the vendor after the ink dried. Both The Joint Commission and CARF International expect organizations to evaluate the contracted services they use rather than simply procure them. The exact expectations live in their current standards manuals, and the language differs by accreditor and level of care, so read the manual that applies to you rather than a summary of it.

The Documents That Belong in Every Vendor File

Keep one file per vendor, all in the same place, each thin enough that a staff member can hand it to a surveyor in under a minute. Five things belong in it.

The current signed agreement, with a scope of work stated in measurable terms. Provide laboratory services is not a scope of work. Collect specimens Monday, Wednesday, and Friday by 10 a.m., return routine results within 48 hours, and notify the nurse on duty of critical values within one hour is a scope you can actually evaluate against.

Proof of qualification. For clinical vendors: primary source license verification, DEA registration where controlled substances are involved, malpractice coverage, and for agency clinicians the same credentialing file you would build for an employee. For facility vendors: state licensure or certification where required, general liability, and workers compensation.

Privacy agreements. Covered in the next section.

Performance evidence. Something dated within the last twelve months showing a human being looked at how the vendor performed.

A named owner. One person accountable for the relationship. Unowned vendors are how a program ends up with a fire inspection that expired eight months ago and nobody noticed.

Privacy Paperwork Is Where Substance Use Programs Get Caught

Every vendor that creates, receives, maintains, or transmits protected health information on your behalf needs a business associate agreement. Operators generally know this. Where programs fall down is scope: the shredding company, the answering service, the IT contractor with remote access to the record system, and the billing vendor all qualify, and all get missed. The U.S. Department of Health and Human Services publishes guidance on business associates, including sample contract provisions.

Substance use programs carry a second obligation. Records protected by the federal confidentiality rules for substance use disorder patient records – commonly called 42 CFR Part 2 – are not addressed by a business associate agreement alone. Contractors that need access to those records generally require a qualified service organization agreement, and the two documents are not interchangeable. A program that treats substance use disorders and holds a BAA with no corresponding QSOA has a finding waiting to happen. SAMHSA publishes guidance on Part 2 that is the right starting point, and complex cases belong in front of counsel.

The practical test takes an afternoon: put your executed BAA list and your vendor inventory side by side and look for rows on one and not the other. It finds something almost every time.

Evaluating Performance Without Building a Research Project

Programs stall here because they picture a formal vendor scorecard with weighted metrics and quarterly business reviews. You do not need one. You need one page per vendor per year, dated and signed, answering two questions: did the service meet the scope of work, and what did we do about the gaps.

Use evidence that already exists. For a lab, turnaround complaints logged by nursing and the number of recollections. For dietary, the last two health department inspection reports and any client grievances about food. For a staffing agency, how many placements arrived without complete credentials. For fire and life safety, the inspection reports and whether deficiencies were closed. For telehealth psychiatry, documentation timeliness from the chart audits you already run.

Tie the review cycle to your compliance calendar rather than to contract anniversary dates, or it will not happen. Assign a month, batch the reviews, and route the output to the vendor file and to whichever committee reviews quality data at your organization. Oversight that was never reported anywhere is hard to characterize as oversight.

When a Vendor Fails

Oversight is only credible when there is a record of it working. Keep documentation of vendor problems in the vendor file, not only in the incident log: the email to the lab about the missed Friday pickup, the agency response about the lapsed license, the corrective commitment, the follow-up confirming it held. Three exchanges like that do more for your file than a flawless contract.

If a vendor cannot be fixed, document the decision to replace them and the transition plan, particularly for anything client-facing. Surveyors respond well to a program that identified a problem and acted, and poorly to one that clearly knew and did nothing – which is what a silent file implies.

A Realistic First Pass

1. Week one: build the inventory from operations and name an owner for every row.
2. Week two: locate the current signed agreement for each row. Flag three conditions – expired, auto-renewed without review, missing entirely.
3. Weeks three and four: reconcile the inventory against executed BAAs and, if you treat substance use disorders, against QSOAs.
4. Month two: pull qualification documents and rewrite any scope of work that cannot be measured.
5. Month three: complete a one-page annual review for every vendor that touches clients directly and report results to your quality committee and governing body.

Where to Get Help

Contracted services oversight is unglamorous work that pays off the moment a surveyor asks for the list. Circa works through vendor inventories, privacy agreements, and evaluation cycles with operators regularly – inside Joint Commission accreditation consulting and CARF accreditation consulting engagements, and on an ongoing basis through a fractional compliance officer. Call (888) 458-6619 to talk through where your files stand.

A vendor file review can be scoped in one call: (888) 458-6619, or see our compliance services.

This article is operational guidance for behavioral health operators, not legal advice. Requirements vary by accreditor, state, program type, and payer. Verify against your current standards manual, your state licensing authority, and the primary sources linked above, and involve counsel on privacy agreement questions.