Does your ABA clinic need a facility license in Alabama? And how must records be kept?

When an ABA practice needs a facility license in Alabama

Alabama's Department of Public Health licenses "hospitals" as defined in Ala. Code 22-21-20, and the licensure article provides that "no person shall establish, conduct or maintain any hospital as defined in Section 22-21-20 without first obtaining the license provided in this article." The definition lists named types: general and specialized hospitals, independent clinical laboratories, rehabilitation centers and ambulatory surgical treatment facilities. It ends with a catch-all for "other related health care institutions when such institution is primarily engaged in offering to the public generally, facilities and services for the diagnosis and/or treatment of injury, deformity, disease, surgical or obstetrical care" (Ala. Code 22-21-20, 22-21-22, as reproduced in Ala. Admin. Code 420-5-17-A2).

An ABA clinic is not a named type. Whether the catch-all reaches one is not answered by the text, and this guide found no Department statement either way. Do not read the silence as a clear no. Counsel should ask the Department of Public Health before opening a center-based site. A center-based or day-treatment license or approval specific to ABA was not found.

The two archetypes: what changes between them

• The practice with in-house diagnostics. The definition provides that "the term 'hospitals' relates to health care institutions and shall not include the private offices of physicians or dentists, whether in individual, group, professional corporation or professional association practice" (Ala. Code 22-21-20). The exemption names physicians and dentists only. It does not name psychologists, so a practice built around a psychologist should not assume the same protection.
• The ABA-only practice. The question is the catch-all above. Behavior analyst licensing rules (chapter 580-5-30B) were read and contain no facility rule. Act 2026-144 moved licensing to the Department of Mental Health and renamed the board an advisory council, so those rules may be revised.

HIPAA and the Alabama breach statute

HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.

Alabama has a breach notification statute, but this guide could not verify its terms from an official source. The Attorney General's copy of the act returned a 404, and searches returned only law firm and vendor summaries, which this guide does not rely on. No Alabama statute reaching behavior analysts' health information was found. Until counsel confirms the state deadline and any Attorney General notice threshold, run incident response to the HIPAA clock and have counsel check the state statute at the same time.

Records retention

Alabama has a clear physician rule, a board statement for psychologists, and no retention period for behavior analysts.

The Medicaid term is shorter than the physician term and shorter than HIPAA's six years for required documents. A practice with no physician should still keep clinical files at least as long as the longest rule it can be held to, plus a pediatric benchmark, and a buyer's counsel will read the physician rule as the benchmark even where it does not bind.

Records ownership and custody on a change

The only custody rule found is the physician rule. On retirement or closing, a physician "must take reasonable steps for all medical records to be transferred to the custody of his or her active patients, to another physician, or to a HIPAA-compliant entity that agrees in writing to act as custodian of the records." A physician practice may sell the elements that comprise it, and abandoning a practice without providing for the records is a violation (Ala. Admin. Code 540-X-9-.10). The rule treats a sale of equity in a practice that keeps operating differently from a sale of the practice. No custody rule for behavior analysts or for the Medicaid program was found, so an asset sale should settle custody in the purchase agreement and keep a licensed clinician as custodian.

The MSO question

A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The Alabama ownership page covers who may own the clinical entity.

Reading the Alabama burden

Alabama's burden is uncertain at the front door and light at the back. The facility catch-all is broad enough that an ABA-only center should get a Department answer before it opens. Records rules for physicians are specific, the Medicaid floor is short, and nothing fixes a period for behavior analysts. The state breach statute is the gap in this page, and it should be filled before incident response is written.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the Alabama Medicaid page.
• Licensing and credentialing. Behavior analyst licensing is moving to the Department of Mental Health under Act 2026-144, which affects who may act as custodian of a clinical file. See the Alabama licensing and credentialing page.
• Entity and ownership. Alabama's facility catch-all is about the institution, not the owner, so the entity choice does not change the facility answer. See the Alabama entity page and the Alabama ownership page.
• Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any Alabama transaction. See practice expansion and sale.

Getting set up in Alabama: the sequence

1. Ask the Department. Before opening a center-based site, ask the Department of Public Health whether an ABA clinic is a licensed health care institution under the catch-all.
2. Decide the diagnostics model. If a physician is on staff, hold that file to the 540-X-9-.10 periods. If a psychologist is, confirm the Board's current position.
3. Build the privacy program. Implement HIPAA and have counsel confirm the state breach statute and any Attorney General notice.
4. Set the retention schedule. Configure retention to the longest of HIPAA's six years, the Medicaid term, and any physician rule, with a pediatric benchmark and a litigation-hold overlay.
5. Settle custody. Name a licensed custodian in any sale or closure agreement and write the transfer notice.

What this guide could not verify

Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:

• Current codified text of Ala. Code 22-21-20; the text read is a rule appendix with a 1997 amendment note.
• Whether the Department of Public Health treats ABA clinics as licensed institutions.
• The Alabama breach statute and any Attorney General notice threshold.
• A center-based or day-treatment ABA license or approval; Medicaid alerts on the point were on a blocked site.
• Any state statute on health information privacy reaching behavior analysts.
• Whether the Behavior Analyst rules (580-5-30B) were revised after Act 2026-144.

Alabama facility and records variables at a glance

Frequently asked questions