Does your ABA clinic need a facility license in California? And how must records be kept?

When an ABA practice needs a facility license in California

California licenses clinics through the Department of Public Health under Chapter 1 of Division 2 of the Health and Safety Code. Whether an ABA practice is a clinic is answered by the definition, which names five disciplines and does not name behavior analysis.

Section 1200.1 adds psychology clinics to the chapter, but only the kind described in section 1204.1, and that kind is narrow: a tax-exempt nonprofit charging on a sliding fee scale under the direction of a clinical psychologist. A for-profit practice cannot hold that license and does not need it. The ordinary professional office is then removed from the chapter altogether by the exemption in section 1206(a), whatever it is called on the door.

The result is that no California facility license reaches an outpatient ABA clinic. The Department of Public Health's 15-business-day breach reporting rule in Health and Safety Code 1280.15 follows the license and reaches only clinics and facilities licensed under sections 1204, 1250, 1725, and 1745, so it does not apply either. The entry gates that do apply are practitioner-side and payor-side: Department of Developmental Services vendorization under 17 CCR 54342 for regional center clients, Medi-Cal enrollment, and plan credentialing under the autism mandate in Health and Safety Code 1374.73 (17 CCR 54342; Cal. Health & Safety Code 1374.73).

The two archetypes: why licensure, not the building, decides everything else

California does not license behavior analysts. Every state rule on this page beyond the clinic chapter is keyed to a license under Division 2 of the Business and Professions Code, so the question that decides an ABA practice's obligations is whether it has a Division 2 licensee inside it. That produces two archetypes with different answers.

• The practice with in-house diagnostics. A practice that employs a California-licensed psychologist to perform diagnostic evaluations is an office of a licensed practitioner under section 1206(a), which settles the facility question, and it is a provider of health care under the Confidentiality of Medical Information Act, which opens the privacy question. The psychologist's records are governed by Business and Professions Code 2919 and the Board of Psychology's expectations. In practice the CMIA standard and the 2919 retention rule have to be applied to the whole chart, because the diagnostic file and the treatment file are not separable in an audit or a breach. A practice that brings diagnostics in-house through a physician rather than a psychologist adds the Medical Board's records rules and, if it organizes the location as a medical clinic, re-enters section 1204.
• The ABA-only practice. A practice whose clinicians are BCBAs and technicians never enters the clinic chapter, because it provides none of the section 1200(a) disciplines. It is not a CMIA provider of health care on the text of section 56.05(p). It has no state retention statute. What binds it is HIPAA, the general breach statute in Civil Code 1798.82, and the retention clauses in its Medi-Cal provider agreement, its regional center vendor agreement, and its commercial contracts.

The practical rule is that adding a licensed diagnostician to a California ABA practice adds no facility license but converts the CMIA and a seven-year retention statute from best practice into binding law for the practice as operated. The California licensing page covers the vendorization and credentialing entry points that both archetypes share.

HIPAA, the CMIA, and the 30-day breach clock

HIPAA is the federal floor and applies uniformly to both archetypes. California then layers two statutes on top of it, and their reach differs.

• The Confidentiality of Medical Information Act. Civil Code 56 and following is stricter than HIPAA in its authorization form, its marketing rules, and its remedies, which include a private right of action and administrative penalties under section 56.36. Its application turns on one definition.

A licensed psychologist, marriage and family therapist, clinical social worker, or physician is a Division 2 licensee and a CMIA provider. A behavior analyst is not, and an unlicensed ABA practice is not a licensed clinic. The in-house diagnostics archetype is therefore inside the CMIA through its licensee; the ABA-only archetype is outside it on the statute's text, and HIPAA governs its use and disclosure of records.

• The general breach statute. Civil Code 1798.82 applies to any business that conducts business in California and holds computerized personal information, a term that includes medical information, so it reaches both archetypes. Senate Bill 446, Chapter 319 of the Statutes of 2025, replaced the old open-ended timing standard with a fixed deadline effective January 1, 2026.

A business that must notify more than 500 California residents also submits a sample notice to the Attorney General within 15 calendar days of notifying consumers. The statute deems a HIPAA covered entity that has complied with the HITECH breach rule to have satisfied the content requirements of the California notice; it does not displace the 30-day clock, which is shorter than HIPAA's 60. A California ABA practice runs incident response to 30 days from discovery. Patient access requests follow the CMIA and Health and Safety Code 123100 and following for the diagnostics archetype and HIPAA's 30-day access rule for the ABA-only archetype, with California's parental-access and minor-consent rules governing who controls a child's record in both.

Records retention: three rules on one chart

ABA documentation in California is governed by several retention rules at once, and the longest applicable one controls the chart. There is no rule addressed to behavior analysts, because there is no behavior analyst license to attach it to.

Two features of these rules bite in a pediatric practice. The 2919 minor clause means a four-year-old's diagnostic evaluation is held until the patient is 25. And the Medi-Cal trigger includes the end of the plan contract, so a practice in a managed care network cannot start its ten-year clock on any record while it remains in network. Build the retention schedule to the longest rule that applies to any part of the chart, and do not let the shorter HIPAA-administrative period drive early destruction (Cal. Bus. & Prof. Code 2919; Cal. Welf. & Inst. Code 14124.1; 17 CCR 50605).

Records ownership and custody on a change

California puts custody where the license is. In the diagnostics archetype the psychologist is the CMIA provider of health care and the licensee bound by section 2919, so the licensed clinician or the professional entity that employs the clinician is the custodian, and the Board of Psychology expects a written plan for the records if the psychologist leaves, retires, or dies. In the ABA-only archetype there is no license to anchor custody, so the custodian is the covered entity that holds the Medi-Cal provider agreement and the regional center vendorization, and the record follows those enrollments. In a change of ownership, particularly an asset sale where the clinical entity is not itself transferred, custody must be negotiated so that a responsible custodian remains, patients retain access, and the ten-year Medi-Cal obligation and the five-year regional center obligation survive the transaction. Regional center vendorization does not transfer with a sale under 17 CCR 54326, which is a records question as much as a revenue question (17 CCR 54326; Cal. Welf. & Inst. Code 14124.1).

The MSO question

A management services organization that hosts the practice's record system is a HIPAA business associate under a business-associate agreement in either archetype. California adds that if a Division 2 licensee is inside the practice, the CMIA governs every disclosure to the MSO, and section 56.10 rather than HIPAA sets the terms on which the MSO may use the information. Because the CMIA's penalties attach to the licensee, the diagnostics archetype should write the management agreement so that the licensee controls access and the MSO cannot be the custodian. The ABA-only archetype has more room on the text, but a buyer will read it to the CMIA standard anyway, and the California ownership page explains why the MSO fee has to be fixed at fair market value regardless of which archetype signs it.

Reading the California burden

Putting the pieces together, California is a light-facility, heavy-records state. On the lighter side, there is no clinic license for outpatient ABA under either archetype, no facility survey, and no practitioner license for behavior analysts, so the building-and-credential entry is among the lightest in the country. On the heavier side, the retention rules are among the longest, with a ten-year Medi-Cal clock that does not start while the practice is in network and a psychologist rule that runs to age 25 for a child, and the breach clock is now a hard 30 days. The archetype decision is the burden decision: a practice that adds a licensed psychologist gains diagnostic control and takes on the CMIA and section 2919 for the whole chart.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medi-Cal enrollment carries the ten-year retention rule and the managed care contract terms that keep the clock from starting. See the California Medicaid page.
• Licensing and credentialing. California has no behavior analyst license; DDS vendorization and plan credentialing are the entry gates, and the absence of a license is what keeps the ABA-only practice outside the CMIA. See the California licensing and credentialing page.
• Entity and ownership. The same licensing gap keeps the professional corporation window closed to behavior analysts and makes the LLC the ordinary vehicle; a psychologist inside the practice changes the custody and CMIA analysis. See the California entity page and the California ownership page.
• Practice sale and expansion. Records custody, the CMIA position, the breach log with its 30-day timestamps, and the non-transferability of regional center vendorization are diligence items in any California transaction. See practice expansion and sale.

Getting set up in California: the sequence

1. Decide the archetype. Decide whether the practice will employ a Division 2 licensee for diagnostics, because that choice decides whether the CMIA and section 2919 bind the practice.
2. Confirm the facility question. Confirm that the outpatient configuration is outside Health and Safety Code 1200(a), and that no physician-led medical clinic is being organized under section 1204.
3. Vendorize and enroll. Complete DDS vendorization for regional center clients, Medi-Cal enrollment and plan contracting, and commercial credentialing under Health and Safety Code 1374.73.
4. Build the privacy program. Implement HIPAA, adopt the CMIA authorization and disclosure standard if a licensee is inside the practice, and set incident response to the 30-calendar-day breach clock with the 15-day Attorney General follow-up.
5. Set the retention schedule. Configure retention to the longest applicable rule: section 2919 for the psychologist's file, ten years under section 14124.1 for Medi-Cal, five years under 17 CCR 50605 for regional center records, with a litigation-hold overlay.
6. Fix custody and MSO terms. Name the custodian, sign the business-associate agreement, and write MSO access to the CMIA standard where a licensee is inside the practice.

California facility and records variables at a glance

Frequently asked questions