Notice to residents "must be made without unreasonable delay but not later than 60 days after determination of the breach of security," and the Attorney General must be told, "not later than the time when notice is provided to the resident," when more than 500 residents must be notified (6 Del. C. 12B-102(c), (d)). The chapter's history ends with 85 Del. Laws, c. 464 (2026), whose effective date was not checked.
The statutes were read from the Delaware Code Online. Title 24 shows all acts enacted as of October 1, 2026, through 85 Del. Laws, c. 550. The breach chapter was amended by 85 Del. Laws, c. 464 (2026), and the effective date was not checked. The privacy act shows two versions of section 12D-103, effective until and from January 1, 2027. Items this guide could not verify are listed in the section titled “What this guide could not verify,” below. Treat this as a point-in-time overview, not a determination for your practice. Confirm the current requirements with the agencies named on this page and qualified Delaware counsel before you build, bill, or sell.
The nine facility-and-records criteria at a glance
- When an ABA practice needs a facility license in Delaware
- The two archetypes: what changes between them
- HIPAA and the Delaware breach statute
- Records retention
- Records ownership and custody on a change
- The MSO question
- Reading the Delaware burden
- How this connects to the rest of your compliance stack
- Getting set up in Delaware: the sequence
- Delaware facility and records variables at a glance
- Frequently asked questions
- Where professional advice is essential
When an ABA practice needs a facility license in Delaware
No Delaware facility licensing definition was read. Searches pointed to 16 Del. C. 122(3), which authorizes licensing of free standing birthing, surgical and emergency centers, through session laws and agency forms, but the current Title 16 text was not read, so no definition or office exemption is quoted here. That gap is why the facility cell on this page is open rather than a no.
Two context points. Delaware does not license behavior analysts: there is no Title 24 chapter or board, and the only use of the term is inside the psychology practice definition. And the Medicaid autism benefit's final order states that "these services are designed to be delivered primarily in the home or in other community settings," which suggests but does not prove that no center-based approval applies (20 DE Reg 291, 10/01/16).
The two archetypes: what changes between them
- The practice with in-house diagnostics. The psychology chapter defines the practice of psychology to include "behavior analysis and therapy," and provides that nothing in the chapter may be construed to prevent "an individual who is a qualified member of other recognized professions from rendering services consistent with the individual's professional training" (24 Del. C. ch. 35). A psychologist on staff brings the psychologist records rule below. A physician brings the physician records rule.
- The ABA-only practice. There is no behavior analyst license, so no board retention rule or licensure deadline applies. The practice takes its records floor from the Medicaid manual, HIPAA, and its payer contracts.
HIPAA and the Delaware breach statute
HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.
Delaware layers a breach statute on top. Notice goes to residents without unreasonable delay and no later than 60 days after determination of the breach, with exceptions for a shorter federal deadline and for law enforcement delay. When more than 500 residents must be notified, the Attorney General is told at the same time. Personal information includes "medical history, medical treatment by a health-care professional, diagnosis of mental or physical condition by a health care professional" and health insurance identifiers when combined with a name (6 Del. C. 12B-101 to 12B-103).
HIPAA-regulated persons with breach procedures are deemed to comply with the timing subsection 12B-102(c) if they notify affected residents under those procedures. The text read does not extend that deemed compliance to the Attorney General notice in 12B-102(d), so a covered entity should plan to give that notice. Delaware's Personal Data Privacy Act exempts HIPAA protected health information as data, in both the version effective until January 1, 2027 and the version effective from that date (6 Del. C. 12D-103).
Records retention
Delaware has specific records rules for physicians and psychologists, and none for behavior analysts because they are not licensed.
| Source | Requirement |
|---|---|
| Physician records (diagnostics variant) | Seven years from the last entry in the patient's record when the patient leaves without a transfer request, after which records may be permanently disposed of in a manner that insures confidentiality (24 Del. C. 1761(c)). No minor-patient extension is stated. |
| Psychologist records (diagnostics variant) | A licensee may permanently dispose of a record seven years after listed events, including the last entry once the relationship ends (24 Del. C. 3533(g)). No minor-patient extension is stated. The chapter carries a note that its amended text applies as provided in 85 Del. Laws, c. 317, § 25, which was not read. |
| Behavior analyst records | No license, so no board rule; the psychology chapter does not restrict other qualified professions |
| Medicaid provider records | The general policy manual requires "keeping records necessary to verify the services provided" and access for federal and state representatives; no retention period was found in the manual or the final order |
| HIPAA administrative documents | 6 years |
| Litigation or audit hold | Preserve regardless of schedule while pending or threatened |
Without a stated minor extension, a practice that treats children should consider keeping pediatric files longer than seven years from the last entry. That is a prudence point, not a Delaware rule.
Records ownership and custody on a change
Delaware has closure rules for physicians and psychologists. A physician closing a practice when records will no longer be at the place of business must give the Board of Medical Licensure and Discipline "notice of how former patients may obtain medical records," records not claimed within seven years may be disposed of, and the Board may appoint a custodian of an abandoned practice's records (24 Del. C. 1761, 1761A). A psychologist closing a practice "shall notify the Board of how former patients can obtain the patient's records" (24 Del. C. 3533(a)(4)). No custody rule for behavior analysts or for Medicaid was found. An asset sale should name a custodian, require the buyer to give patients access, and respect the notice rules for any physician or psychologist file.
The MSO question
A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The Delaware ownership page covers who may own the clinical entity.
Delaware's breach clock is 60 days, and its Attorney General notice rule still applies to a HIPAA-covered practice.
Reading the Delaware burden
Delaware is a light-records, specific-breach state with an open facility question. The seven-year physician and psychologist rules are clear, the Medicaid retention period was not found, and the breach statute's Attorney General notice is easy to miss because the HIPAA deemed-compliance clause covers only the timing subsection. The facility answer needs a Title 16 read before a center-based site opens.
How this connects to the rest of your compliance stack
Facility licensure and records sit alongside several other decisions in this guide:
- Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the Delaware Medicaid page.
- Licensing and credentialing. Delaware does not license behavior analysts, so there is no licensure deadline or board custody rule to plan around. See the Delaware licensing and credentialing page.
- Entity and ownership. Delaware's facility question turns on what the site is, not who owns it, so entity choice does not change the answer. See the Delaware entity page and the Delaware ownership page.
- Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any Delaware transaction. See practice expansion and sale.
Getting set up in Delaware: the sequence
- Confirm the facility question. Have counsel read the Title 16 licensing definitions for any center-based site.
- Decide the diagnostics model. If a physician or psychologist is on staff, hold that file to the seven-year rule and notify the Board on closure.
- Build the privacy program. Implement HIPAA and write incident response to the 60 day state limit with the Attorney General notice above 500 residents.
- Set the retention schedule. Configure retention to the longest of HIPAA's six years, the seven-year licensee rules and payer terms, with a longer pediatric benchmark.
- Settle custody. Name a custodian in any sale or closure agreement.
What this guide could not verify
Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:
- Title 16 facility licensing definitions and any office exemption.
- A center-based or day-treatment approval; the Medicaid final order is context only.
- Delaware Medicaid record retention period.
- The effective date of 85 Del. Laws, c. 464 (2026), which amended the breach chapter.
- When the amended psychology chapter applies under 85 Del. Laws, c. 317, § 25.
- A general Delaware medical records confidentiality statute reaching behavior analysts.
Delaware facility and records variables at a glance
| Variable | Delaware value |
|---|---|
| Separate facility license for commercial-only outpatient ABA? | Not verified; Title 16 definitions were not read |
| Does Medicaid billing trigger facility licensure? | Not verified; ASD benefit designed for home and community delivery |
| Licensing / oversight agencies | Division of Health Care Quality; Board of Medical Licensure and Discipline; Board of Examiners of Psychologists; Attorney General (breach) |
| What would trigger a facility license | Not verified |
| Physical-plant / survey layer | Not verified |
| State privacy law beyond HIPAA | 6 Del. C. ch. 12B: 60 days, AG above 500; 12D exempts HIPAA PHI as data |
| Records retention (pediatric) | Physician and psychologist: 7 years; no minor extension stated; no BA rule |
| Records custodian | Board notice on closure for physicians and psychologists; contract otherwise |
| MSO treatment | Business associate agreement; keep clinical control with the licensed entity |
| Key authorities | 6 Del. C. ch. 12B; 24 Del. C. 1761, 1761A, 3533 |
Frequently asked questions
Does an outpatient ABA clinic need a facility license in Delaware?
How long must records be kept in Delaware?
What is Delaware's breach deadline?
Does HIPAA compliance excuse Attorney General notice?
Where professional advice is essential, not optional
Delaware's breach and records rules are specific, and its facility answer is open. Have qualified Delaware counsel read Title 16 for any center-based site and confirm the effect of the 2026 amendment to the breach chapter. Treat this page as an orientation, not a determination, and not legal advice.
The governing authorities to know are 6 Del. C. chapter 12B (breach), 6 Del. C. chapter 12D (privacy act), 24 Del. C. 1761, 1761A and 3533 (records), read together with federal HIPAA.
This page describes licensure, privacy, and retention rules that change and that depend on your configuration. The Delaware Division of Health Care Quality, the Attorney General, the Division of Professional Regulation, the Division of Medicaid and Medical Assistance, and qualified Delaware counsel are the authoritative sources. Neither this page nor any secondary source should be relied on in place of direct verification and legal advice.