Does your ABA clinic need a facility license? A 17-state guide to licensure, HIPAA, and records

The real question: payor mix and service model, not the building

Operators often arrive at this topic expecting the facility question to be about the physical space, square footage, fire-marshal inspections, the number of exits. In ABA, that is usually the wrong frame. Across these 17 states, whether a license attaches depends much more on a few non-physical variables:

• Payor mix and how you bill. The single biggest driver is Medicaid, and specifically how Medicaid routes payment. In some states technician-delivered therapy must be billed through a licensed facility; in others, ABA flows through provider enrollment with no facility license at all. Commercial-only practices often face the lightest facility burden.
• Service model. A purely outpatient ABA practice is treated very differently from one that adds residential, day-treatment, crisis, or broader behavioral-health services. The moment a practice steps into those program types, a real facility-licensure framework usually applies.
• How the state defines a facility and a service. A few states define a behavioral-health facility or a licensable service so broadly that even modest configurations can fall within it; most do not.
• Practitioner licensure as the true entry point. In most of these states, the gating requirement is the behavior analyst's license or certification, not a facility license. The practitioner credential, plus Medicaid and insurer enrollment, is what actually lets you operate and bill.

Reframing the question this way is the most useful thing this spoke does. Before asking whether your building needs a license, ask what you will bill, to whom, and through what service model. The answer to the facility question usually follows from those.

The facility-burden spectrum, light to heavy

The 17 states sort onto a spectrum. At the light end, a standard outpatient ABA clinic needs no facility license and the regulation is practitioner-level. In the middle sit states where a facility or clinic certification can apply depending on configuration, so the answer is confirm rather than assume. At the heavy end sit states where providing ABA, in the ordinary way most practices operate, pulls in a facility or agency license.

• Light, practitioner-level. Texas, Virginia, Georgia, Missouri, Colorado, the District of Columbia, Utah, and Oregon keep the facility question light for outpatient ABA. Oregon is notable for the most complete practitioner-licensure system, licensing analysts and assistant analysts and registering even the technician tier; Virginia is notable for having retired its old ABA facility license in favor of practitioner licensure.
• Confirm-the-question, middle. Maryland, Michigan, Tennessee, Ohio, and Wisconsin each leave a genuine facility or certification question that depends on configuration. Maryland's community-behavioral-health program licensure applies to program-style services; Michigan delivers Medicaid ABA through a public agency system; Tennessee's facility framework reaches non-residential clinics; Ohio applies a community-behavioral-health certification with a licensed-professional exemption; and Wisconsin certifies outpatient mental-health clinics under a framework that may or may not reach a given ABA practice.
• Heavy, a real trigger. Arizona, North Carolina, Pennsylvania, and Illinois pull a facility or agency license into ordinary ABA. Illinois sits heaviest, combining a new practitioner license, a center-based Medicaid certification, and the strictest privacy statute in the group.

The spectrum is the organizing idea of this spoke. Knowing where your state sits tells you whether the facility analysis is a quick confirmation or a central part of your build.

The three mechanisms that trigger facility or agency licensure

What makes the heavy end instructive is that the facility license does not arrive the same way in each state. Three distinct mechanisms produce a similar outcome, and recognizing which one a state uses is the key to planning around it.

• A bespoke service-model agency license, Pennsylvania. Pennsylvania built a dedicated agency license for the service model. Providing ABA generally means becoming a licensed Intensive Behavioral Health Services agency, with ABA named on the certificate of compliance. The license is effectively the entry ticket, and in any sale it is the asset.
• A broad statutory definition of a facility, North Carolina. North Carolina's statutes define a facility so broadly that even a sole practitioner or home-visit provider can fall within the definition, which makes the facility question more live there than almost anywhere else, with licensure layered on top of a letter of support from the regional managed-care entity for many program types.
• A Medicaid billing structure, Arizona. Arizona reaches the same place through billing mechanics rather than a definition. Behavior technicians cannot bill Medicaid independently and must be affiliated with and billed through a licensed behavioral-health facility, so a technician-staffed ABA practice ends up operating through a licensed facility by the back door.

The lesson is that the same outcome, a facility or agency license, can come from a purpose-built license, a broad definition, or a billing rule. When evaluating a state, identify which mechanism is at work, because it determines how you structure around the requirement.

The 17-state comparison at a glance

Each state name links to its full page, with the verdict, a nine-criteria scorecard, verified statute citations, setup steps, and an FAQ. The summary below is a starting point, not a substitute for the state page or for counsel. States are grouped from the lightest facility burden to the heaviest.

HIPAA and the state privacy laws that supplement it

HIPAA is the federal floor and applies to every practice as a covered entity, with any management company that handles protected health information acting as a business associate under a business-associate agreement. The states then layer their own privacy law on top, and the differences matter for how an ABA practice designs consent, disclosure, and redisclosure procedures.

• The strong consent-based regimes. Illinois's Mental Health and Developmental Disabilities Confidentiality Act is the strictest in the group, reaching ABA by definition and carrying civil and criminal penalties. The District of Columbia's Mental Health Information Act and Wisconsin's treatment-records statute are also strong consent-driven regimes where they reach ABA records.
• The named medical-records statutes. Texas's Medical Records Privacy Act is unusually broad, and can make a management company that stores records a covered entity in its own right. Virginia, Maryland, Georgia, Arizona, Tennessee, and Oregon each have named statutes that add state obligations on top of HIPAA, several with mental-health or developmental-disability overlays directly relevant to autism records.
• The consumer-privacy overlay. Colorado and Utah add consumer-data privacy acts that mostly carve out HIPAA-regulated data but can reach a practice's non-PHI consumer information.

The practical rule everywhere is the same: build the privacy program to the stricter of HIPAA and the applicable state statute at each point, and confirm how far the state statute reaches your ABA records. The state pages identify the governing statute for each jurisdiction.

Records retention: the longest rule and the minor rule

ABA generates years of detailed documentation, and retention obligations come from several sources at once: state medical-records or board rules, Medicaid program-integrity rules, HIPAA's administrative-document rule, and any litigation hold. Two principles cut across all 17 states:

• The longest applicable rule governs. When several retention periods apply, you keep records for the longest of them. The HIPAA administrative six-year rule is about policies and agreements, not the clinical record, and should never drive destruction of the clinical record.
• For pediatric ABA, the minor rule controls. Because ABA is overwhelmingly delivered to children, the minor-records rule, retention until the patient reaches the age of majority plus an additional period, almost always governs and extends retention well beyond the adult baseline. Ohio's rule is unusually explicit: at least two years past majority or seven years after the last service, whichever is longer. Wisconsin sets a seven-year health-care-records floor. The specific minor period varies, so confirm it for your state.

The safe design is to set the schedule to the minor rule, layer any longer Medicaid or board requirement on top, and apply a litigation or audit hold that overrides the schedule whenever a matter is pending or threatened.

Records custody and change of ownership

Two custody principles hold across the guide and become especially important in any sale or restructuring. First, the custodian of patient records must be the licensed clinical entity, never the management company; a management company can host the systems under a business-associate agreement, but it cannot be the records custodian, and in the agency-license states it cannot hold the license. Second, records cannot be transferred to a non-licensed entity, so in an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access.

Several states add explicit change-of-ownership and records-transfer rules. Wisconsin's clinic rules require notice of any change in ownership or control and the transfer of records on a client's request; Pennsylvania's agency license is itself the asset that must transfer; North Carolina's license follows the licensee. These provisions are precisely the diligence items that the practice-sale spoke addresses, which is why facility licensure and records sit so close to any transaction.

How this connects to the rest of the compliance guide

This spoke sits within a larger compliance picture, and it connects most tightly to the others through the questions an operator actually asks. Place of service is the bridge between billing and the facility question, and Medicaid billing is the biggest facility-license driver, which is why this page and Medicaid and insurance mandates should be read together. In most states the true entry point is the practitioner credential covered in licensing and credentialing, not the building. The records custodian must be the licensed entity itself, which ties custody to the entity choice in entity structures and PLLCs, and explains why a management company examined in ownership, MSOs, and private equity can host records but cannot be the custodian or the license holder. And because facility licenses, records custody, and change-of-ownership rules are core diligence items, this spoke feeds directly into practice expansion, sale, and multistate operations.

Frequently asked questions