Are You Making These Common Virginia and Maryland Audit Mistakes? 2026 Findings Explained

If you are a behavioral health provider in Virginia or Maryland, you already know how complex the current regulatory landscape has become. Between the Virginia Department of Behavioral Health and Developmental Services (DBHDS) and Maryland’s Behavioral Health Administration (BHA), the pressure to stay compliant is at an all-time high.

As we move through the first quarter of 2026, the data from recent state and federal audits is revealing a clear pattern: auditors are no longer just looking for the existence of policies: they are looking for the functional application of those policies. At KBBG Systems LLC, we’ve lived in this landscape alongside you. We understand the sleepless nights that come with a surprise audit notification, and we know that "close enough" is no longer an acceptable standard for behavioral health regulations.

In this guide, we’ll break down the specific findings we are seeing across the DMV (D.C., Maryland, Virginia) region in 2026 and how you can protect your practice.

The 2026 Audit Landscape: Why Now?

The surge in oversight isn't accidental. With the 2026 Medicaid audit surge in full swing, state agencies are under pressure to recoup overpayments and ensure quality of care. In Maryland, recent state-wide audits discovered millions of dollars in payroll and benefit mismanagement within state agencies themselves, leading to a "trickle-down" effect of increased scrutiny on third-party healthcare providers to ensure every dollar is accounted for.

Whether you are seeking accreditation through The Joint Commission (TJC), CARF, or the Council on Accreditation (COA), the expectations are converging. Auditors are looking for a unified "Golden Thread" that connects your assessments to your treatment plans and your progress notes.

1. The Documentation "Golden Thread" Breakdown

The most common deficiency in 2026 remains the lack of clinical necessity documentation. In Virginia, DMAS (Department of Medical Assistance Services) auditors are frequently citing providers for progress notes that do not reference the specific goals outlined in the Individualized Service Plan (ISP).

Common Mistakes:

• Vague Objectives: Using phrases like "Patient will feel better" instead of measurable, time-bound goals.

• Copy-Paste Progress Notes: Auditors in Maryland are using software to flag "cloned" notes that look identical from week to week.

• Missing Signatures: It sounds simple, but missing or late electronic signatures remain a top-five reason for recoupment in both states.

The Fix: Implement a peer-review system. Use a complete internal audit checklist to ensure that every note justifies the level of care provided.

2. Telehealth Compliance and Multi-State Licensing

For providers operating in the DMV area, telehealth is a lifeline. However, Maryland and Virginia have updated their specific requirements for audio-only and video-telehealth services as of early 2026.

Auditors are finding that many providers are still using "Public Health Emergency" era shortcuts that are no longer valid. Key findings include:

• Lack of State-Specific Consents: Failing to have a Maryland-specific consent for a patient residing in Baltimore while the provider is in Virginia.

• Inadequate Platform Security: Utilizing platforms that do not meet the 2026 HIPAA-plus standards.

• Documentation of Location: Failing to document both the provider's and the patient's physical location during the session.

If you are expanding across state lines, you must navigate the growing state-by-state regulatory landscape carefully to avoid "unauthorized practice" citations during your next mental health compliance review.

3. Personnel Files and Credentialing Gaps

One of the most surprising findings from recent Maryland audits involved widespread failures in payroll and benefits management at the state level. This has resulted in a renewed focus on provider HR files. If the state is being audited for its employees, you can bet they are looking at yours.

In 2026, DBHDS in Virginia is cracking down on:

• Primary Source Verification: You cannot just have a copy of a license; you must document that you verified it with the state board.

• Lapsed Fingerprinting: Criminal background checks must be kept current according to the specific state renewal cycles.

• Training Gaps: For Residential Treatment Centers (RTC) and Partial Hospitalization Programs (PHP), staff must have documented training in emergency preparedness 2.0 standards.

✅ Pro-Tip: Don't wait for a surveyor to tell you a file is incomplete. Conduct an internal audit of your managers' files today to catch these gaps before they become "findings."

4. Specialized Care: Eating Disorders and SUD Programs

Whether you are running a Substance Use Disorder (SUD) program or an Eating Disorder treatment facility, the 2026 standards have shifted.

For SUD providers, the 42 CFR Part 2 deadline has passed, and auditors are checking for the specific "consent for disclosure" language required under the new alignment with HIPAA.

For Eating Disorder facilities, auditors are focusing on:

• Medical Necessity for Higher Levels of Care: Ensuring that Residential or PHP levels of care are backed by daily vitals and specialized dietary monitoring documentation.

• Coordination of Care: Documentation showing communication between the behavioral health team and the primary care or nutritional team.

Failure to show this multidisciplinary approach is a quick way to fail a CARF or Joint Commission survey in 2026.

5. Financial Management and Payor Split

We often see providers focus heavily on Medicaid and ignore the specific nuances of Medicare and Commercial payors. In 2026, this is a dangerous game.

• Medicare: Auditors are focusing on "incident-to" billing and the specific supervision requirements for mid-level practitioners.

• Medicaid: The focus remains on "fraud, waste, and abuse" (FWA), particularly regarding over-utilization of services.

• Commercial Payors: They are increasingly adopting NCQA-style standards for network adequacy and clinical outcomes.

We know the landscape because we’ve lived in it. Our behavioral health consulting services are designed to help you balance these varying requirements without burning out your staff.

How to Avoid These Mistakes: A 3-Step Action Plan

We aren't here to just point out problems; we’re here to help you build solutions. Here is how you can proactively address these 2026 findings:

Step 1: Conduct a Root Cause Analysis (RCA)

If you’ve already had a finding, don’t just patch the hole. Use a simple framework for CAPAs (Corrective and Preventive Actions) to understand why the mistake happened. Was it a lack of training? A software glitch? Or a systemic process failure?

Step 2: Leverage Data-Driven Quality Improvement (QAPI)

Directors in 2026 are expected to use data to drive decisions. Use QAPI for Directors to track your compliance trends. If your audit shows that 30% of your charts are missing signatures, that’s a data point that requires a targeted intervention.

Step 3: Partner with Trusted Experts

The complexity of behavioral health regulations in Virginia and Maryland is too much for any one person to manage while also running a business. We specialize in cutting through the chaos. Whether it’s preparing for a COA accreditation or cleaning up your documentation for a DMAS review, we are your partners in growth.

👉 Ready to secure your practice?Achieve regulatory compliance with KBBG Systems' guidance and turn audit anxiety into audit readiness.

Conclusion: Solution-Focused Optimism

The audit findings of 2026 don't have to be a death sentence for your facility. By understanding the patterns: the focus on the "Golden Thread," the scrutiny of telehealth, and the rigorous HR standards: you can elevate your practice above the competition.

At KBBG Systems LLC, we believe that compliance isn't a hurdle; it's a foundation. When your documentation is solid and your processes are streamlined, you can focus on what really matters: delivering life-changing care to your patients in Maryland and Virginia.

Let's build something better together. If you’re worried about your next audit, don’t wait. We can help you maximize your behavioral health services by ensuring your compliance is bulletproof. Visit us at www.kbbgsystems.com to learn more.