Does your ABA clinic need a facility license in Colorado? And how must records be kept?

When an ABA practice needs a license in Colorado

Colorado was light at the entry for years, and is now tightening on both fronts. The state had no behavior-analyst licensure, after the Office of Policy, Research and Regulatory Reform reviewed the question and found regulation unjustified, but the legislature reversed that in 2026: the Applied Behavior Analysis Practice Act licenses behavior analysts, with the practice license required on and after July 1, 2028 (HB26-1425). Until that date BACB certification is the basis for practice, registered behavior technicians work under supervision, and for Medicaid the provider meets Health First Colorado attestation requirements. On the facility side, there has historically been no general facility license applying to an ABA-only outpatient clinic by default, but the same act directs the Department of Human Services to prescribe and publish separate standards for licensing ABA clinics and amends the day-treatment-facility definition, so a practice newly captured by that definition must apply on or before August 1, 2026 and be licensed before August 1, 2027 (HB26-1425, adding C.R.S. 26-6-909.5). Two questions therefore require care: whether the amended day-treatment definition reaches your setting, and the Behavioral Health Entity license addressed in the next section.

The BHE framework, Medicaid attestation, and a system in transition

Colorado is in the middle of a significant behavioral-health regulatory transition, which is the key context for the facility question:

• The Behavioral Health Entity license. As of 2024, the Behavioral Health Administration oversees Behavioral Health Entity (BHE) licenses under 2 CCR 502-1, replacing the legacy substance-use treatment license and the community mental-health center and clinic designations. BHEs are defined around treatment units, community mental-health centers and clinics, and crisis stabilization units, so the framework is oriented toward mental-health and substance-use treatment entities rather than outpatient ABA (2 CCR 502-1; BHA, effective Jan. 1, 2024). An ABA-only provider should confirm with the BHA whether its configuration falls within BHE licensure or is regulated through Medicaid enrollment, because the framework is new and broad.
• Medicaid as the operative track for ABA. Outpatient ABA is delivered as a pediatric behavioral-therapy benefit through Health First Colorado, with provider attestation and, distinctively, mandatory Electronic Visit Verification for home, community, and telehealth delivery, where a claim without EVV will not pay. Medicaid participation, not a facility license, is the operative requirement for most ABA providers (Health First Colorado; HCPF EVV).
• A system still settling. In late 2025, the Medicaid agency issued a behavior-technician certification memo requiring technicians to hold ABAT or RBT certification, which providers and the state behavior-analysis association challenged as procedurally improper and disruptive to the workforce. This is a credentialing matter rather than a facility-license one, but it illustrates that Colorado's requirements are actively moving (2025 HCPF behavior-technician certification memo; COABA challenge).

The practical rule is that Colorado keeps the facility entry light for outpatient ABA while building out a broader BHE framework for treatment entities: confirm your BHE status with the BHA, and treat Medicaid enrollment, EVV, and the evolving technician-certification rules as the live requirements.

HIPAA, Colorado confidentiality, and the Colorado Privacy Act

HIPAA is the federal floor and applies uniformly. Colorado then layers several state obligations:

• BHA confidentiality and records rules. For licensed or designated entities, the BHA rules require compliance with state and federal confidentiality statutes and set records-care and confidentiality requirements, and a violation of federal confidentiality law is itself a violation of BHA rules (2 CCR 502-1, Rules 21.170.1 and 21.170.2).
• Mental-health confidentiality. Colorado's behavioral-health statutes protect the confidentiality of mental-health treatment information, adding a state layer to HIPAA for behavioral records (C.R.S. 27-65).
• The Colorado Privacy Act. For personal data that falls outside HIPAA-regulated PHI, the Colorado Privacy Act imposes consumer-data obligations, including heightened treatment of sensitive data such as health information; HIPAA-covered data is largely carved out, but a practice's non-PHI consumer data can be in scope (Colorado Privacy Act, C.R.S. 6-1-1301 et seq.).

The operational takeaway is that an ABA practice in Colorado builds to HIPAA, the Colorado mental-health confidentiality rules, the BHA confidentiality rules where it is a licensed entity, and the Colorado Privacy Act for any non-PHI consumer data, applying the stricter standard at each point. Colorado has no single broad medical-records privacy statute on the model of some states, so the privacy load is moderate.

Records retention: BHA rules and the minor rule

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with any BHA and Medicaid requirements, means records must be kept securely for many years after a child's last service (Colorado medical-records retention; 2 CCR 502-1). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

Colorado treats the licensed entity or provider as the custodian of patient records, and for BHE-licensed entities the BHA records rules govern care, retention, and disposal (2 CCR 502-1, Rule 21.170.1; Colorado custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. Because Colorado is mid-transition to the BHA framework, confirm how licensure and records obligations carry over on any change. Plan custody arrangements before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Colorado does not redefine that relationship the way some broad state statutes do. What Colorado adds is that any access to records must satisfy the Colorado confidentiality rules and, for a licensed entity, the BHA rules, and that the MSO cannot be the licensed records custodian (2 CCR 502-1, Rules 21.170; C.R.S. 27-65). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within the confidentiality rules, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the Colorado burden

Putting the pieces together, Colorado is a light-to-moderate state on this spoke, with the qualifier that its rules are actively consolidating. On the lighter side, there is no behavior-analyst license, no facility license for ordinary outpatient ABA, and Medicaid participation rather than a building survey is the operative requirement. On the heavier and more uncertain side, the new BHE framework is broad and an ABA provider must confirm whether it applies, Medicaid carries the distinctive mandatory-EVV requirement, the late-2025 technician-certification dispute shows the rules are moving, and privacy spans HIPAA, Colorado confidentiality, the BHA rules, and the Colorado Privacy Act. Retention is long under the minor rule. The practical read is that Colorado is light today for outpatient ABA but requires watching, because the BHA transition and Medicaid rule changes can shift the requirements. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility and entity licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Place of service interacts with the distinctive Colorado mandatory-EVV rule, since EVV attaches to home, community, and telehealth delivery, and the clinic setting is where any facility question would arise. See the Colorado Medicaid page, which treats EVV and place of service in detail.
• Licensing and credentialing. Colorado's no-analyst-license model and the evolving technician-certification rules are the credentialing story. See the Colorado licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the BHA framework shape how the entity and any MSO are structured. See the Colorado entity page and the Colorado ownership page.
• Practice sale and expansion. Records custody and the BHA transition are diligence items in any Colorado transaction. See practice expansion and sale.

Getting set up in Colorado: the sequence

1. Credential the analysts. Maintain BACB certification; there is no state analyst license, and confirm current behavior-technician certification requirements.
2. Confirm the BHE question. Check with the BHA whether your configuration requires a Behavioral Health Entity license or is regulated through Medicaid enrollment.
3. Enroll for Medicaid if applicable. Complete Health First Colorado attestation and implement mandatory EVV for home, community, and telehealth delivery.
4. Build the privacy program. Implement HIPAA plus Colorado confidentiality, the BHA rules if licensed, and the Colorado Privacy Act for non-PHI data.
5. Set the retention schedule. Configure retention to the minor rule and any BHA and Medicaid requirements, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and access fits the confidentiality rules.

Colorado facility and records variables at a glance

Frequently asked questions