Why residential is different
Most behavioral health EHRs were designed for outpatient care: a clinician, a client, a scheduled appointment, a note, a claim. A group home, a residential treatment center, or a behavioral health residential facility works differently:
- The program never closes, and the record is written across three shifts a day.
- Most documentation is by direct care staff, many of them new.
- Billing is often a daily rate against an authorization, not a code per visit.
- Staffing, credentials, and drills are licensing requirements, not HR details.
- Families and placing agencies are part of the picture.
Software built for appointments can be bent to fit, but the bending is done every day by your staff. Start the evaluation from how your program actually runs.
Ten areas to evaluate, and what to ask
Documentation built for shifts
Most of a residential record is written by direct care staff during the shift, not by clinicians after an appointment.
- Can staff document a whole shift, with observations for each resident, in one note?
- Does it work on the phones and tablets staff actually carry?
- Is each note signed by the person who wrote it, with a date and time?
Treatment plans
Licensing reviewers and payers both read the treatment plan first, and most rules put deadlines on it.
- Does a plan carry measurable objectives, signatures, and a review date?
- Is a signed plan locked, with earlier versions kept?
- Can you see which plans are due for review across the program?
Behavior and incidents
Behavior data is how the clinical team knows whether the plan is working, and incidents are what reviewers ask about first.
- Can staff record antecedent, behavior, and consequence, with severity and duration?
- Are notifications (who was told, and when) part of the record?
- Can you review behavior and incidents across residents and weeks?
Staffing for a 24/7 program
Nights and weekends are where coverage breaks, and coverage is a licensing requirement.
- Can you build the schedule, fill open shifts, and approve swaps in the same system?
- Is time and attendance recorded against scheduled shifts?
- Can staff see their own shifts without calling the office?
Credentials and training
An expired CPR card or a missing background check is a citation waiting to happen.
- Are licenses, certifications, and training tracked with expiry dates?
- Can you see every expiring credential on one screen?
- Can you produce a staff member's personnel file for a reviewer quickly?
Authorizations and billing
Residential stays are often billed per day against an authorization, and claim formats differ by state and payer.
- Which claim formats does it produce: CMS-1500 and 837P (professional), UB-04 and 837I (institutional), or both? Which do your payers require?
- Are authorizations tracked by units approved, used, and remaining?
- How are denials tracked through appeal?
Families and guardians
Families and placing agencies expect updates; the clinical record is not theirs to read.
- Can you share specific categories of information with a guardian, resident by resident?
- Does guardian access require multi-factor authentication, and does it expire?
More than one site
Growth breaks spreadsheets first, then systems that were set up for one house.
- Does it model the organization, facilities, and units?
- Can leadership see census and documentation status across sites?
Your data
You may leave one day, and the records have to stay usable for years after.
- Can you export all of your records in a usable format, at any time?
- What happens to your data when the contract ends?
- Who migrates your existing records in, and how is the result checked?
Implementation and support
The rollout decides whether staff use the system or work around it.
- Who configures the system, and who trains each role?
- Does your current system keep running until cutover?
- Who do staff call at 2 am, and what happens when they do?
Security, HIPAA, and Part 2
A business associate agreement is not optional
A software vendor that creates, receives, maintains, or transmits protected health information for you is a business associate under HIPAA, and you need a business associate agreement with it before any PHI goes in.[1][2][6] If a vendor hesitates to sign one, stop there.
There is no official “HIPAA certified”
HHS does not certify any person or product as HIPAA compliant, and does not recognize private organizations' certifications of Security Rule compliance.[3][4] Treat “HIPAA certified” as a marketing phrase and ask what the vendor actually does: encryption, role-based access, multi-factor authentication, audit logs, backups, and who can reach your data.
Substance use disorder records
If your program provides substance use disorder treatment, its records may also fall under 42 CFR Part 2, which adds confidentiality rules beyond HIPAA.[5] HHS's 2024 final rule brought Part 2 closer to HIPAA, including a single patient consent for future uses for treatment, payment, and health care operations, with compliance required by February 16, 2026.[7][8] Ask how the vendor records Part 2 consent and handles redisclosure for those records.
Audit logs
The HIPAA Security Rule requires mechanisms that “record and examine activity in information systems that contain or use electronic protected health information.”[6] In a residential program, that log is also how you show a reviewer who wrote, viewed, and signed each note.
Questions to ask about security:
- Will you sign our business associate agreement, or provide yours for our counsel to review?
- Is PHI encrypted at rest and in transit, and at what level?
- Can access be limited by role, and is multi-factor authentication available?
- What is logged when someone views, edits, or signs a record, and can we see it?
- Where is data hosted, how is it backed up, and what is the incident response process?
- What independent security testing or attestation do you have today?
Red flags
- No business associate agreement, or a long delay before one.
- “HIPAA certified” offered as the answer to security questions.
- No way to export your own records.
- A demo that never shows a shift note, a treatment plan, or a schedule with your kind of program in it.
- Claim formats your payers do not accept.
- Implementation that starts after the contract is signed, with no plan before it.
Printable buyer's checklist
Bring one copy to each demo and score every vendor the same way.
Residential software buyer's checklist
| Area | Vendor A | Vendor B | Vendor C |
|---|---|---|---|
| Documentation built for shifts | |||
| Treatment plans | |||
| Behavior and incidents | |||
| Staffing for a 24/7 program | |||
| Credentials and training | |||
| Authorizations and billing | |||
| Families and guardians | |||
| More than one site | |||
| Your data | |||
| Implementation and support | |||
| Signs our BAA | |||
| Part 2 handling (if SUD) | |||
| Full data export |
From dacnushealth.com/resources/choosing-residential-treatment-software. Score each area 0 (missing), 1 (workaround), or 2 (built for it).
How Dacnus answers
We built Dacnus for residential programs, so here is how it answers the list, plainly:
- Shifts: one shift note per house with observations for each resident (mood, meals, sleep, medications administered), signed each shift; ABC behavior logs with severity, duration, witnesses, and who was notified.
- Treatment plans: measurable objectives, signed and locked, with version history.
- Staffing: schedules from shift templates, open shifts and swaps through approval, time and attendance, and a staff view on the phone.
- Credentials: expiry tracking on one screen, and a personnel file as a single PDF.
- Billing: authorizations by units approved, used, and remaining; CMS-1500 PDFs and 837P files; denials logged with appeal deadlines. Ask us about institutional (UB-04) claims if your payers require them.
- Families: a guardian portal with five permissions, each off until staff turn it on, multi-factor authentication, and access that expires after 90 days.
- Security: field-level encryption of PHI at rest, role-based access, MFA, and an audit trail of views, edits, and signatures. What to ask us about security.
How it fits a particular kind of program: Dacnus for residential treatment programs and Dacnus for therapeutic group homes.