Does your ABA clinic need a facility license? A 30-state guide to licensure, HIPAA, and records

The real question: payor mix and service model, not the building

Operators often arrive at this topic expecting the facility question to be about the physical space, square footage, fire-marshal inspections, the number of exits. In ABA, that is usually the wrong frame. Across these 30 states, whether a license attaches depends much more on a few non-physical variables:

• Payor mix and how you bill. The single biggest driver is Medicaid, and specifically how Medicaid routes payment. In some states technician-delivered therapy must be billed through a licensed facility; in others, ABA flows through provider enrollment with no facility license at all. Commercial-only practices often face the lightest facility burden.
• Service model. A purely outpatient ABA practice is treated very differently from one that adds residential, day-treatment, crisis, or broader behavioral-health services. The moment a practice steps into those program types, a real facility-licensure framework usually applies.
• How the state defines a facility and a service. A few states define a behavioral-health facility or a licensable service so broadly that even modest configurations can fall within it; most do not.
• Who owns the practice. Two states, Florida and Massachusetts, write a general clinic statute that reaches any billing entity or any provider of ambulatory mental health services and then exempt only a practice wholly owned by the licensed practitioners who work in it. In those states the cap table, not the building, decides the facility question, and an investor or management company in the ownership ends the exemption.
• Practitioner licensure as the true entry point. In most of these states, the gating requirement is the behavior analyst's license or certification, not a facility license. The practitioner credential, plus Medicaid and insurer enrollment, is what actually lets you operate and bill.

Reframing the question this way is the most useful thing this spoke does. Before asking whether your building needs a license, ask what you will bill, to whom, and through what service model. The answer to the facility question usually follows from those.

The facility-burden spectrum, light to heavy

The 30 states sort onto a spectrum. At the light end, a standard outpatient ABA clinic needs no facility license and the regulation is practitioner-level. In the middle sit states where a facility or clinic certification can apply depending on configuration, so the answer is confirm rather than assume. At the heavy end sit states where providing ABA, in the ordinary way most practices operate, pulls in a facility or agency license.

• Light, practitioner-level. Texas, Virginia, Georgia, Missouri, the District of Columbia, Utah, Oregon, California, New York, New Jersey, Washington, Indiana, Connecticut, Louisiana, Nevada, and South Carolina keep the facility question light for outpatient ABA. Oregon is notable for the most complete practitioner-licensure system, licensing analysts and assistant analysts and registering even the technician tier; Virginia for having retired its old ABA facility license; California for a clinic definition that names five disciplines and omits behavior analysis; New York and New Jersey for facility statutes keyed to physician supervision; Louisiana for keeping ABA in its own Medicaid chapter outside the behavioral health provider license; and Connecticut for a clinic definition that reaches mental health services only in conjunction with medical care.
• Confirm-the-question, middle. Maryland, Michigan, Tennessee, Ohio, Wisconsin, Colorado, Minnesota, and Kentucky each leave a genuine facility, certification, or agency question that depends on configuration. Maryland's community-behavioral-health program licensure applies to program-style services; Michigan delivers Medicaid ABA through a public agency system; Tennessee's facility framework reaches non-residential clinics; Ohio applies a community-behavioral-health certification with a licensed-professional exemption; Wisconsin certifies outpatient mental-health clinics under a framework that may or may not reach a given ABA practice; Colorado now licenses center-based ABA as a day treatment facility after HB26-1425; Minnesota enrolls the practice as an EIDBI agency with a compliance officer, background studies, supervision ratios, and unannounced inspection but no building license; and Kentucky makes its Behavioral Health Services Organization license elective, required only if the practice chooses the organizational Medicaid pathway.
• Heavy, a real trigger. Arizona, North Carolina, Pennsylvania, Illinois, Florida, and Massachusetts pull a facility or agency license into ordinary ABA. Illinois sits heaviest, combining a new practitioner license, a center-based Medicaid certification, and the strictest privacy statute in the group. Florida and Massachusetts are heavy in a different way: the license is avoidable, but only by a practice wholly owned by its licensed practitioners, so the burden falls on ownership rather than on operations.

The spectrum is the organizing idea of this spoke. Knowing where your state sits tells you whether the facility analysis is a quick confirmation or a central part of your build.

The four mechanisms that trigger facility or agency licensure

What makes the heavy end instructive is that the facility license does not arrive the same way in each state. Four distinct mechanisms produce a similar outcome, and recognizing which one a state uses is the key to planning around it.

• A bespoke service-model agency license, Pennsylvania. Pennsylvania built a dedicated agency license for the service model. Providing ABA generally means becoming a licensed Intensive Behavioral Health Services agency, with ABA named on the certificate of compliance. The license is effectively the entry ticket, and in any sale it is the asset.
• A broad statutory definition of a facility, North Carolina. North Carolina's statutes define a facility so broadly that even a sole practitioner or home-visit provider can fall within the definition, which makes the facility question more live there than almost anywhere else, with licensure layered on top of a letter of support from the regional managed-care entity for many program types.
• A Medicaid billing structure, Arizona. Arizona reaches the same place through billing mechanics rather than a definition. Behavior technicians cannot bill Medicaid independently and must be affiliated with and billed through a licensed behavioral-health facility, so a technician-staffed ABA practice ends up operating through a licensed facility by the back door. Minnesota and Michigan are the softer versions of this mechanism: the Medicaid benefit enrolls and inspects an agency rather than licensing a building.
• A general clinic statute with an ownership exemption, Florida and Massachusetts. Florida's Health Care Clinic Act treats any entity that provides health care services and tenders charges for reimbursement as a clinic, and its licensed-owner exemption is open only to a practice wholly owned by practitioners licensed under listed chapters, which include psychology and exclude behavior analysis; an ABA-only practice's only exemption is Medicaid provider status. Massachusetts reaches any entity maintained to provide ambulatory mental health services, defines mental health by the DSM-5, and exempts only a practice wholly owned and controlled by its licensed practitioners, which includes licensed applied behavior analysts. In both states the facility question is answered on the cap table.

The lesson is that the same outcome, a facility or agency license, can come from a purpose-built license, a broad definition, a billing rule, or an ownership test. When evaluating a state, identify which mechanism is at work, because it determines how you structure around the requirement.

The 30-state comparison at a glance

Each state name links to its full page, with the verdict, a nine-criteria scorecard, verified statute citations, setup steps, and an FAQ. The summary below is a starting point, not a substitute for the state page or for counsel. States are grouped from the lightest facility burden to the heaviest.

HIPAA and the state privacy laws that supplement it

HIPAA is the federal floor and applies to every practice as a covered entity, with any management company that handles protected health information acting as a business associate under a business-associate agreement. The states then layer their own privacy law on top, and the differences matter for how an ABA practice designs consent, disclosure, and redisclosure procedures.

• The strong consent-based regimes. Illinois's Mental Health and Developmental Disabilities Confidentiality Act is the strictest in the group, reaching ABA by definition and carrying civil and criminal penalties. The District of Columbia's Mental Health Information Act and Wisconsin's treatment-records statute are also strong consent-driven regimes where they reach ABA records.
• The named medical-records statutes. Texas's Medical Records Privacy Act is unusually broad, and can make a management company that stores records a covered entity in its own right. Virginia, Maryland, Georgia, Arizona, Tennessee, and Oregon each have named statutes that add state obligations on top of HIPAA, several with mental-health or developmental-disability overlays directly relevant to autism records.
• The consumer-privacy overlay. Colorado, Utah, Connecticut, Minnesota, Nevada, and New Jersey add consumer-data privacy acts, and Washington and Nevada add consumer health data laws, that mostly carve out HIPAA-regulated data but can reach a practice's non-PHI consumer information. New York's Health Information Privacy Act passed both houses in January 2025 and was vetoed on December 19, 2025; a revised bill was introduced in 2026.
• The licensure-keyed statutes. California's Confidentiality of Medical Information Act, Washington's Uniform Health Care Information Act, Minnesota's Health Records Act, and Indiana's health records article each define their regulated provider by licensure, so whether they reach an ABA practice depends on whether the state licenses behavior analysts and whether a licensed psychologist is on staff. In California an ABA-only practice is outside the CMIA on the statute's text; in Washington and Minnesota the behavior analyst license places the practice inside the state act.
• The 30-day breach clocks. California (from January 1, 2026), New York (from December 2024), Florida, Washington, Colorado, and Illinois require notice to affected residents within 30 days of discovery, shorter than HIPAA's 60. Indiana sets 45 days; Connecticut and Louisiana set 60 with Attorney General notice; Massachusetts requires a written information security program before any breach occurs; New Jersey requires a State Police report before customers are told; South Carolina routes to the Department of Consumer Affairs and gives residents a private right of action. Build incident response to the state clock where it is shorter than HIPAA.

The practical rule everywhere is the same: build the privacy program to the stricter of HIPAA and the applicable state statute at each point, and confirm how far the state statute reaches your ABA records. The state pages identify the governing statute for each jurisdiction.

Records retention: the longest rule and the minor rule

ABA generates years of detailed documentation, and retention obligations come from several sources at once: state medical-records or board rules, Medicaid program-integrity rules, HIPAA's administrative-document rule, and any litigation hold. Two principles cut across all 30 states:

• The longest applicable rule governs. When several retention periods apply, you keep records for the longest of them. The HIPAA administrative six-year rule is about policies and agreements, not the clinical record, and should never drive destruction of the clinical record.
• For pediatric ABA, the minor rule controls. Because ABA is overwhelmingly delivered to children, the minor-records rule, retention until the patient reaches the age of majority plus an additional period, almost always governs and extends retention well beyond the adult baseline. Ohio's rule is unusually explicit: at least two years past majority or seven years after the last service, whichever is longer. Wisconsin sets a seven-year health-care-records floor. New York's Regents rule runs to one year past age 21 for every Education Law licensee including behavior analysts; New Jersey's behavior analyst and psychology boards both run to age 25; Nevada forbids destroying any record before the patient turns 23; Washington's psychology board runs to age 22; Massachusetts gives licensed applied behavior analysts seven years or one year past majority. California's Medi-Cal rule is ten years from the later of service, audit, or the end of the plan contract. The specific minor period varies, so confirm it for your state.
• Where the profession has no rule, Medicaid and HIPAA are the floor. Several states have no retention rule addressed to behavior analysts: California and Florida because they do not license the profession, Indiana because its records statute predates the 2021 license, Kentucky because its Board repealed its six-year rule in 2022 and incorporated the BACB Code instead, and Washington, Minnesota, Nevada, and South Carolina because their boards have not written one. In those states the psychologist archetype carries a statutory duty on the diagnostic file that the ABA-only practice does not, and the Medicaid provider agreement and HIPAA's six-year documentation rule supply the floor for the treatment file.

The safe design is to set the schedule to the minor rule, layer any longer Medicaid or board requirement on top, and apply a litigation or audit hold that overrides the schedule whenever a matter is pending or threatened.

Records custody and change of ownership

Two custody principles hold across the guide and become especially important in any sale or restructuring. First, the custodian of patient records must be the licensed clinical entity, never the management company; a management company can host the systems under a business-associate agreement, but it cannot be the records custodian, and in the agency-license states it cannot hold the license. Second, records cannot be transferred to a non-licensed entity, so in an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access.

Several states add explicit change-of-ownership and records-transfer rules. Wisconsin's clinic rules require notice of any change in ownership or control and the transfer of records on a client's request; Pennsylvania's agency license is itself the asset that must transfer; North Carolina's license follows the licensee. In Florida and Massachusetts the sale itself can end the facility exemption, because admitting a non-practitioner owner takes the practice outside the licensed-owner exemption on the day of closing, and Massachusetts treats a transfer of a majority interest in a clinic as a licensing event. Minnesota's Medical Assistance rule leaves the transferor responsible for the records unless a written agreement shifts the duty; Indiana's puts a three-year duty on the transferee; Connecticut requires newspaper notice and patient letters when a practitioner discontinues; and Nevada's destruction-notice duties travel with the records. These provisions are precisely the diligence items that the practice-sale spoke addresses, which is why facility licensure and records sit so close to any transaction.

How this connects to the rest of the compliance guide

This spoke sits within a larger compliance picture, and it connects most tightly to the others through the questions an operator actually asks. Place of service is the bridge between billing and the facility question, and Medicaid billing is the biggest facility-license driver, which is why this page and Medicaid and insurance mandates should be read together. In most states the true entry point is the practitioner credential covered in licensing and credentialing, not the building. The records custodian must be the licensed entity itself, which ties custody to the entity choice in entity structures and PLLCs, and explains why a management company examined in ownership, MSOs, and private equity can host records but cannot be the custodian or the license holder. And because facility licenses, records custody, and change-of-ownership rules are core diligence items, this spoke feeds directly into practice expansion, sale, and multistate operations.

Frequently asked questions