Does your ABA clinic need a facility license in Arizona? And how must records be kept?

When an ABA practice needs a facility license in Arizona

Arizona is less likely than a light-touch state to let an ABA practice operate without a facility license, and the reason is structural rather than ABA-specific. Behavior analysts are licensed in Arizona under A.R.S. Section 32-2091, and a licensed analyst directs and oversees ABA, supported by behavior analysis trainees and behavior technicians (A.R.S. Section 32-2091; AHCCCS AMPM 320S). The catch is that, under the AHCCCS behavioral-health structure, behavior technicians and paraprofessionals are not independent billers. They must be affiliated with a licensed behavioral health facility, and their services are billed through that facility's National Provider Identifier (AHCCCS behavioral health services structure). Because ABA at scale is delivered largely by technicians, a typical Arizona ABA practice ends up operating through an ADHS-licensed behavioral health facility, which the next section develops.

How the AHCCCS billing structure triggers facility licensure

The Arizona facility question turns on how services are staffed and billed:

• Technicians bill through a licensed facility. Behavior technicians and paraprofessionals cannot bill Medicaid independently; they must be affiliated with a licensed behavioral health agency, facility, clinic, or outpatient setting and bill through it. So a practice that relies on technician-delivered direct therapy needs a licensed facility in the structure (AHCCCS behavioral health services structure).
• ADHS licenses the facility. The ADHS Office of Behavioral Health Licensure licenses behavioral health outpatient and treatment facilities under A.A.C. R9-10 and A.R.S. Sections 36-422 and 36-424, with applications, physical-plant and operational standards, and inspections (A.A.C. R9-10; A.R.S. Sections 36-422, 36-424).
• Two Medicaid pathways. AHCCCS delivers ABA through the Complete Care plans and through the Division of Developmental Disabilities (DDD) within ALTCS, and both reference the licensed-facility and licensed-analyst structure (AHCCCS Complete Care; DDD/ALTCS).
• A licensed analyst billing alone is the narrow exception. A behavior analyst billing under an individual provider ID can be an independent biller, but that does not cover technician-delivered services, so it is not a workable model for a typical technician-staffed ABA practice.

The practical rule is that Arizona effectively requires a licensed behavioral health facility for a technician-staffed ABA practice billing AHCCCS, which places Arizona toward the heavier end of this spoke even though it has no ABA-specific agency license. Confirm your facility-licensure obligation with ADHS based on how you staff and bill.

HIPAA and Arizona's confidentiality statutes

HIPAA is the federal floor and applies uniformly. Arizona then layers two state sources on top:

• The medical-records statute. Arizona's medical-records law makes medical records and the information in them confidential and sets rules for their disclosure and for patient access, a state-law layer on top of HIPAA (A.R.S. Sections 12-2291 et seq.).
• Behavioral-health confidentiality. Arizona separately protects the confidentiality of behavioral-health information held by health-care entities, adding heightened protection for the kind of records an ABA practice keeps (A.R.S. Section 36-509), and the ADHS facility rules impose their own confidentiality and records requirements on licensed facilities (A.A.C. R9-10).

The operational takeaway is that an Arizona ABA practice builds its privacy program to HIPAA, the medical-records statute, the behavioral-health confidentiality statute, and the ADHS facility confidentiality rules, applying the stricter standard at each point. Arizona's privacy regime is a real named-statute layer, in the moderate range, more than the bare federal floor.

Records retention: the minor rule governs

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the ADHS facility rules and Medicaid audit requirements, means records must be kept securely for many years after a child's last service (Arizona medical-records retention; A.A.C. R9-10). Build your retention schedule to the minor rule and a litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

In Arizona the licensed facility or provider is the custodian of patient records, and for ADHS-licensed facilities the facility rules govern records care, retention, and disposal (A.A.C. R9-10; A.R.S. Sections 12-2291 et seq.). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the licensed facility is not part of the transaction, custody must be specifically negotiated and the ADHS licensing change addressed so a licensed custodian remains responsible and patients retain access. Because the facility license is tied to the operation, transaction structuring in Arizona must account for the license and its continuity. Plan custody and the licensing steps before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Arizona does not redefine that relationship the way some broad state statutes do. What Arizona adds is that any access to records must satisfy the medical-records and behavioral-health confidentiality statutes and the ADHS facility rules, and that the licensed facility, not the MSO, must be the records custodian and the license holder (A.R.S. Sections 12-2291 et seq.; 36-509; A.A.C. R9-10). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Arizona's confidentiality rules, and that the licensed facility retains custody and licensure. Structure the MSO relationship accordingly.

Reading the Arizona burden

Putting the pieces together, Arizona sits toward the heavier end of this spoke, with the weight on the facility axis. There is a behavior-analyst license, and, more consequentially, the AHCCCS billing structure means a technician-staffed ABA practice generally operates through an ADHS-licensed behavioral health facility, with physical-plant standards and inspections. Medicaid runs through two pathways, the Complete Care plans and DDD/ALTCS. On privacy, Arizona layers a medical-records statute, a behavioral-health confidentiality statute, and the ADHS facility rules on top of HIPAA, a moderate named-statute load. Retention is long under the minor rule. The practical read is that Arizona's facility requirement is real for any practice billing AHCCCS with technicians, so the facility and licensing analysis belongs at the front of the plan, not the end. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Arizona pays a home premium and, distinctively, reaches ABA with Electronic Visit Verification for home and community delivery, and place of service interacts with the licensed-facility structure. See the Arizona Medicaid page, which treats the home premium, EVV, and the two pathways in detail.
• Licensing and credentialing. The behavior-analyst license and the technician-affiliation rules are the credentialing layer beneath the facility license. See the Arizona licensing and credentialing page.
• Entity and ownership. The facility license and the records-custodian rule shape how the entity and any MSO are structured. See the Arizona entity page and the Arizona ownership page.
• Practice sale and expansion. The facility license and records custody are core diligence items in any Arizona transaction. See practice expansion and sale.

Getting set up in Arizona: the sequence

1. License the analysts. Obtain behavior-analyst licensure under A.R.S. Section 32-2091 through the Board of Psychologist Examiners.
2. Obtain the facility license. If you will staff with behavior technicians billing AHCCCS, obtain the appropriate ADHS Office of Behavioral Health Licensure facility license under A.A.C. R9-10.
3. Enroll for Medicaid. Register with AHCCCS and contract through the Complete Care plans and, where applicable, the DDD/ALTCS pathway, and implement EVV for home and community delivery.
4. Build the privacy program. Implement HIPAA plus the medical-records and behavioral-health confidentiality statutes and the ADHS facility confidentiality rules.
5. Set the retention schedule. Configure retention to the minor rule and the ADHS and Medicaid requirements, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed facility is the custodian and license holder, the business-associate agreement is in place, and access fits Arizona's confidentiality rules.

Arizona facility and records variables at a glance

Frequently asked questions