A denial lands on your biller's desk: the payer wants "supporting documentation" for a psychological testing claim before it pays. Your biller pulls the chart, sees a full evaluation write-up tied to a bipolar disorder test, and asks you what to send. That question — what leaves the building, in what format, to whom — is the whole job. This article maps the administrative path a behavioral health evaluation takes through your practice: the codes that carry the diagnosis, the vendors that touch the file, the release rules that differ from primary care, and the documents you need on file before any of it happens.

No clinical guidance here. This is about records custody and claims plumbing.

What a Bipolar Disorder Test Actually Generates in Your Systems

Operators tend to think of an evaluation as one chart note. It is usually four or five distinct data artifacts, and they live in different places with different access rules.

The intake instrument

Most practices push screening questionnaires to the patient before the visit, often through a portal, a tablet app, or a texted link. That instrument — with the patient's name, DOB, and item-level responses — is PHI the moment it is created, and if a third-party intake vendor hosts it, that vendor is a business associate. Check whether responses are stored on the vendor's servers or passed through and discarded. The answer changes your breach-notification exposure and your data map.

The evaluation record and scoring output

Standardized instruments are frequently scored on cloud platforms. The scoring report is a discrete PDF or data record, often stored outside the EHR in a downloads folder or a separate testing account. Shadow storage like this is the single most common finding I see in behavioral health risk analyses. If a scoring platform holds identifiable results, it belongs on your vendor inventory.

The claim

The claim is the artifact that travels furthest. It carries a diagnosis code, procedure codes, units, dates, rendering provider, and the patient's identifiers — and it moves to at least three organizations before payment posts.

Which CPT Codes Typically Appear on a Claim for a Bipolar Disorder Test

Code selection belongs to your clinician and certified coder under current CPT guidance and payer policy. But as an administrator you should recognize the families, because each one implies a different documentation packet if the claim is reviewed.

  • 90791 / 90792 — psychiatric diagnostic evaluation, without or with medical services.
  • 96127 — brief emotional/behavioral assessment with scoring and documentation, per standardized instrument.
  • 96130 / 96131 — psychological testing evaluation services by a physician or other qualified health professional, first hour and each additional hour.
  • 96136 / 96137 — test administration and scoring by a physician or QHP.
  • 96138 / 96139 — test administration and scoring by a technician.
  • 96146 — automated administration with an automated result only.

On the diagnosis side, a screening encounter that does not confirm a condition may be coded to a Z-code for a mental health or behavioral screening encounter; a confirmed diagnosis moves into the F31 family. The practical point for your front office: the diagnosis code on the claim is visible to the payer, the clearinghouse, and anyone who reads the explanation of benefits. Time-based testing codes also invite unit audits, so your documentation must support the minutes billed.

The Chain of Custody: Every Organization That Sees the Claim

Walk one claim end to end and count the handoffs. For a typical practice running a bipolar disorder test through insurance:

  1. Front desk runs a 270 eligibility inquiry; the 271 response returns behavioral health benefit detail. Some payers return benefit categories that themselves signal the service type.
  2. Clinician and coder finalize the encounter. If you use an outside coding or audit firm, that firm reads the full note.
  3. Practice management system builds the 837P claim.
  4. Clearinghouse scrubs and forwards it. The clearinghouse is a business associate and frequently subcontracts.
  5. Payer adjudicates. Utilization management staff may request records — a 278 prior authorization exchange or a manual portal upload.
  6. Payer returns an 835 remittance; your RCM vendor posts it.
  7. Subscriber receives an EOB listing the service.
  8. Patient statement goes out — often through a print-and-mail vendor.
  9. Unpaid balance may route to a collections agency.

That is up to eight external organizations for one evaluation. Every one of them needs a signed business associate agreement, and every one of them needs to be on the asset list you use for your risk analysis. CMS maintains reference material on the standard transactions in its Administrative Simplification program if you need to brief your board on why these formats are mandatory rather than optional.

Psychotherapy Notes Are Not the Same as Test Results

This is the distinction that trips up front-desk staff more than any other in behavioral health.

Under the Privacy Rule, "psychotherapy notes" means the provider's separately maintained notes documenting or analyzing the contents of a counseling session. Most uses and disclosures require a specific patient authorization, and you cannot condition treatment or payment on getting one.

But the definition excludes several things by rule, including results of clinical tests, medication prescription and monitoring, session start and stop times, modalities and frequency, diagnosis, functional status, symptoms, prognosis, and progress to date. In plain operational terms: the scored output of a bipolar disorder test is generally part of the designated record set, not a protected psychotherapy note — and it is therefore reachable by a patient's right of access and by ordinary treatment, payment, and operations disclosures.

Two consequences for your workflows:

  • If your clinicians want psychotherapy-note protection, the notes must actually be maintained separately from the rest of the record. A note flagged "private" inside the same chart does not automatically qualify.
  • Your release-of-information staff need a written rule for splitting a behavioral health chart into releasable and authorization-required components. Do not leave that judgment to whoever opens the fax.

HHS publishes a dedicated overview of HIPAA and information related to mental health that is worth putting in your training folder verbatim.

The Self-Pay Restriction Request You Must Honor

A patient who pays out of pocket in full for a service has the right to restrict disclosure of that service to their health plan, and unlike most restriction requests, you are required to agree. Behavioral health evaluations are one of the most common places this comes up, because patients do not want a diagnosis code flowing to an employer-sponsored plan or onto a shared EOB.

Your operational obligations:

  • A documented intake path — who can accept the request, in what form, and where it is recorded.
  • A hard flag in the practice management system that stops the claim from generating. Manual sticky notes fail.
  • A rule for what happens when a later encounter is bundled with the restricted one.
  • A rule for downstream disclosure: if you send records to a referred specialist, the restriction travels with the patient's expectation even though it does not automatically bind the other provider.

Separately, patients may request confidential communications by alternative means or at alternative locations. For a dependent adult on a parent's plan, that request is often about the mailing address for statements. Build the field into your registration screen instead of handling it by exception.

The Vendor List for a Single Behavioral Health Encounter

Sit down and write out every company that could see a record from one bipolar disorder test. A realistic list for a mid-size practice:

  • EHR and practice management host
  • Digital intake / questionnaire platform
  • Test scoring or administration platform
  • Telehealth platform, if the evaluation was remote
  • Transcription or ambient documentation service
  • Outsourced coding or billing company
  • Clearinghouse
  • Statement print-and-mail vendor
  • Answering service
  • Release-of-information vendor
  • Document shredding and IT support
  • Collections agency

Now check your contract file. In most practices I have reviewed, two or three of those have no executed agreement — usually the newest one, adopted by a clinician who signed up with a credit card. If you find a gap, close it before the next patient encounter rather than at renewal. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX in a single sitting; it is a one-time purchase, not another subscription line item. HHS also publishes sample BAA provisions if you want to compare required elements clause by clause.

Records Requests After the Claim Is Paid

Behavioral health evaluations attract requests from parties that are not treating providers and not payers: disability insurers, attorneys, courts, schools, licensing boards, employers. None of those are treatment, payment, or health care operations. They require a valid authorization or a specific legal process, and your staff must be able to tell the difference between a subpoena signed by an attorney and a court order signed by a judge.

The patient's own request

When the patient asks for their record, the access clock is 30 days, with one 30-day extension if you notify them in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount. OCR has pursued a long series of right-of-access enforcement actions against providers who ignored requests or overcharged, and behavioral health practices are not exempt. Review the agency's guidance on the individual right of access with whoever staffs your records inbox.

Accounting of disclosures

Patients may request a six-year accounting of disclosures outside treatment, payment, and operations. If your only record of a disability-insurer release is a note in a chart free-text field, you cannot produce that accounting on demand. Keep a disclosure log with date, recipient, description, and purpose — a spreadsheet with restricted access is acceptable if it is actually maintained.

A Practical Assignment Sheet

Put names next to these six items this quarter:

  1. Vendor inventory owner — maintains the list above, reviews it when any clinician adopts new software.
  2. BAA custodian — holds executed agreements, tracks subcontractor flow-down language.
  3. Records release lead — applies the psychotherapy-note split, logs non-TPO disclosures, tracks the 30-day access clock.
  4. Restriction handler — processes self-pay restriction and confidential communication requests, sets the system flag.
  5. Payer documentation reviewer — decides what goes into a records request from a utilization reviewer, applying minimum necessary rather than sending the whole chart.
  6. Incident intake — receives reports of misdirected faxes, statements, and EOB complaints within 24 hours.

That last role matters more in behavioral health than anywhere else. A statement mailed to the wrong address in a dermatology practice is a bad day; the same error attached to a bipolar disorder test claim is a materially different harm assessment under the breach-notification risk factors, and your documentation should show you understood the difference.

Next Step

Pull one paid claim from a recent behavioral health evaluation and trace it through every organization listed above. Wherever you cannot name the company, name the contract, and name the person who reviews it, you have found this quarter's work. Start by closing the missing business associate agreements, then bring the rest of your documentation set — risk analysis, policies, disclosure log — into one place with automated HIPAA compliance documentation. The evaluation already happened. The paperwork trail is the part you still control.