Does your ABA clinic need a facility license in Connecticut? And how must records be kept?

When an ABA practice needs a facility license in Connecticut

Connecticut licenses health care institutions through the Department of Public Health under chapter 368v, and section 19a-490 lists the institution types. Two of them could conceivably reach an ABA practice, and both are defined in a way that excludes the ordinary pediatric practice.

An ABA practice provides no medical or dental care, so its services cannot be mental health services in conjunction with medical or dental care under clause (3), and it is not an outpatient clinic under subsection (m). The behavioral health facility definition in the same section is written by age: it means a facility providing mental health services to persons eighteen years of age or older, or substance use disorder services to persons of any age, in an outpatient or residential setting. A practice whose ABA clients are children is outside it. The section's general catch-all for a facility engaged in providing services for the prevention, diagnosis, treatment, or care of human health conditions is the residual clause that the Department applies through its category definitions, and it has not been applied to professional offices (C.G.S. 19a-490(a), (m); DPH licensing categories).

The practical rule is that no Department of Public Health facility license reaches a pediatric outpatient ABA practice, and the entry gates are the behavior analyst license under section 20-185i and following, which the Connecticut licensing page covers, and Medicaid and commercial credentialing.

The two archetypes and the adult-services question

Connecticut's archetype fork is muted on the facility axis and sharp on the age axis.

• The practice with in-house diagnostics. A licensed psychologist on staff does not change the facility answer, because a psychologist providing mental health services to children is still outside both the outpatient clinic and behavioral health facility definitions. The psychologist is a Department of Public Health licensee under chapter 383 and is squarely within the practitioner records regulations at 19a-14-40 and following, which supply the seven-year retention schedule and the practice-closure procedure. Where a practice adds a physician, clause (3) of the outpatient clinic definition becomes live, because mental health services would then be provided in conjunction with medical care; that configuration should be reviewed against subsection (m) before it is built.
• The ABA-only practice. A practice of Department of Public Health licensed behavior analysts is outside both facility definitions for a pediatric population. Whether the practitioner records regulations reach the behavior analyst license, created in 2018 after the regulations were last revised, was not confirmed at the time of writing; the ABA-only practice should hold its records to the seven-year schedule anyway, because the psychologist archetype must and because a buyer's counsel will read the regulation as the standard.
• The adult-serving practice. A practice that delivers ABA to adults with autism is providing services to persons eighteen and older, and if those services are mental health services, it is a behavioral health facility. Connecticut does not define mental health services for this purpose in section 19a-490, and no published Department position on ABA was found. An adult-serving practice under either archetype should obtain that determination before it opens.

The Medicaid entry point is Department of Social Services enrollment and credentialing through the HUSKY Health autism spectrum disorder services program, which the Connecticut Medicaid page covers; neither requires a facility license.

HIPAA, the 60-day breach clock, and the Connecticut Data Privacy Act

HIPAA is the federal floor and applies uniformly. Connecticut layers a breach statute with a fixed clock and a consumer privacy act on it.

The Attorney General notice has no resident threshold; every breach that requires resident notice requires Attorney General notice at the same time. Residents identified after sixty days must be notified in good faith as expediently as possible. Notice is not required if, after an appropriate investigation, the person reasonably determines the breach will not likely result in harm. A person subject to and in compliance with HIPAA's privacy and security standards is deemed in compliance with the notice requirements, but the Attorney General notice survives that deeming. Failure to comply is an unfair trade practice under CUTPA. Because the state clock is sixty days and HIPAA's is sixty, the two run together, with the Connecticut Attorney General notice added on the same day as the resident notice (C.G.S. 36a-701b(b), (d), (h); C.G.S. 42-110b).

The Connecticut Data Privacy Act, sections 42-515 and following, added consumer health data provisions in 2023 that regulate health data outside HIPAA; its application to a covered entity's non-PHI data should be confirmed by counsel and is not stated on this page. The Department of Public Health's practitioner regulations add the confidentiality and access duties that attach to each licensed profession.

Records retention: the Department of Public Health schedule

Connecticut's retention rule for licensed practitioners lives in the Department of Public Health's regulations and is a single schedule, with a companion rule for what happens when a practice closes.

The schedule has no separate minor rule: seven years from the last treatment applies to a child's record as it does to an adult's. The discontinuance rule in 19a-14-44 is the unusual one: a practitioner who retires, relocates, or dies must publish notice in a local daily newspaper twice with at least seven days between insertions, send a letter to every patient seen in the prior three years, and hold the records at least sixty days after both notices before transferring or destroying them. Build the schedule to seven years from the last treatment across the chart, write the discontinuance procedure into the practice's policies and into any sale agreement, and add a litigation-hold overlay (Regs. Conn. State Agencies 19a-14-42, 19a-14-44).

Records ownership and custody on a change

Connecticut puts custody on the licensee, and the Department of Public Health's regulations tell the licensee what to do with the records when the practice ends. The 19a-14-44 procedure applies to a practitioner who discontinues practice; in a sale where the practitioners continue under a new owner, the records move with the practice, and where they do not, the newspaper-and-letter procedure applies. Section 19a-490b, in the facility chapter, adds a certified-document requirement for storage of and access to health records when an institution ceases operations, which reaches a licensed facility rather than an exempt practice. In an asset sale, custody must be negotiated so that a licensed custodian remains, the seven-year schedule survives, the 19a-14-44 notices are given if any practitioner is discontinuing, and Medicaid enrollment, which does not transfer, is re-established before the buyer bills (Regs. Conn. State Agencies 19a-14-44; C.G.S. 19a-490b).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement. Connecticut adds that the retention and discontinuance duties belong to the licensee under the Department of Public Health's regulations, so the MSO cannot be the custodian and the management agreement must keep access under the licensee's control and allocate who gives the Attorney General notice within the sixty-day window. The Connecticut ownership page covers the fee and control terms that follow from the state's open ownership position for behavior analysts.

Reading the Connecticut burden

Putting the pieces together, Connecticut is a light-facility, moderate-records state for pediatric ABA. On the lighter side, neither facility definition reaches a pediatric practice under either archetype, the retention rule is a single seven-year schedule without a minor extension, and the professional entity is elective. On the heavier side, the breach clock is a fixed sixty days with an Attorney General notice on every breach, the practice-closure procedure requires newspaper publication, and an adult-serving practice faces an unresolved behavioral health facility question. The archetype decision matters least here and the age of the caseload matters most.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Department of Social Services enrollment and HUSKY Health autism services credentialing are the Medicaid entry points, and the provider agreement carries the retention term to confirm. See the Connecticut Medicaid page.
• Licensing and credentialing. The Department of Public Health behavior analyst license under 20-185i places the profession with the agency that licenses facilities and writes the practitioner records regulations. See the Connecticut licensing and credentialing page.
• Entity and ownership. Connecticut's professional corporation and LLC statutes use a closed list that omits behavior analysts, so the entity is ordinary and the records duty sits with the licensee. See the Connecticut entity page and the Connecticut ownership page.
• Practice sale and expansion. The 19a-14-44 discontinuance procedure, non-transferable Medicaid enrollment, and the sixty-day breach log are diligence items in any Connecticut transaction. See practice expansion and sale.

Getting set up in Connecticut: the sequence

1. Credential the analysts. Obtain Department of Public Health behavior analyst licenses under 20-185i and following, and enroll with the Department of Social Services and the HUSKY Health autism program.
2. Confirm the facility question. Confirm the caseload is pediatric and no physician is providing medical care alongside ABA; if either changes, review against 19a-490(m) and the behavioral health facility definition before opening.
3. Decide the diagnostics model. If a psychologist will be on staff, adopt the 19a-14-40 practitioner regulations for the diagnostic file and apply the same schedule to the ABA file.
4. Build the privacy program. Implement HIPAA, set incident response to sixty days under 36a-701b with the Attorney General notice on the same day as the resident notice, and have counsel map the Data Privacy Act's consumer health data provisions.
5. Set the retention schedule. Configure retention to seven years from the last date of treatment under 19a-14-42, confirm the Medicaid provider agreement term, and add a litigation-hold overlay.
6. Fix custody and MSO terms. Write the 19a-14-44 discontinuance procedure into policies and any sale agreement, keep access under licensee control, and sign the business-associate agreement.

Connecticut facility and records variables at a glance

Frequently asked questions