Does your ABA clinic need a facility license in the District of Columbia? And how must records be kept?

When an ABA practice needs a license in the District

For a standard outpatient ABA practice, the District does not require a facility license. The District is governed at the city level rather than as a state, which makes its framework distinctive, and it has recently moved on practitioner licensure: the DC Code now includes a behavior-analyst licensure framework within the health-occupations provisions, where the District previously relied on national BACB certification (DC Code Title 3, ch. 12). ABA is delivered under that analyst license, registered behavior technicians work under supervision, and Medicaid services are billed through the Department of Health Care Finance and the managed-care plans. There is no facility license that applies to an ABA-only outpatient clinic by default, and the certification track that does exist, addressed next, is a separate public-system lane.

The DBH certification track and the Medicaid route

Two separate lanes are easy to confuse in the District:

• The Department of Behavioral Health certification track. DBH certifies Mental Health Rehabilitation Services (MHRS) providers under Title 22-A DCMR Chapter 34, a public-system framework that has long operated under a moratorium on new certifications. This track serves the District's public mental-health system and is generally distinct from autism ABA, so an ABA provider usually does not enter it (22-A DCMR ch. 34; DBH certification moratorium).
• The Medicaid route for ABA. Autism ABA is delivered as a Medicaid benefit through the Department of Health Care Finance and the managed-care plans (AmeriHealth Caritas DC, CareFirst Community Health Plan DC, and MedStar Family Choice), with the District's notably accommodating telehealth and daycare-inclusive setting mix. Participation is through Medicaid enrollment and MCO contracting, not a facility license (DC DHCF; DC Medicaid MCOs).
• General health-facility licensure. DC Health licenses health facilities generally, so a higher-intensity or multidisciplinary configuration could implicate facility licensure, but ordinary outpatient ABA does not.

The practical rule is that the District keeps outpatient ABA light on facility licensure: the operative requirements are the behavior-analyst license and Medicaid enrollment, and the DBH MHRS certification is a separate public-system track that autism ABA generally does not require.

HIPAA and the Mental Health Information Act

HIPAA is the federal floor and applies uniformly. The District then has one of the stronger state-level mental-health privacy statutes in the country, the Mental Health Information Act, and it is the distinctive element of District compliance (DC Code Section 7-1201.01 et seq.). Its features that matter for an ABA practice are:

• Consent-based confidentiality. The Act makes mental-health information confidential and generally permits disclosure only with the client's written authorization in the Act's form or under a specific statutory exception, which is stricter and more consent-driven than the HIPAA baseline.
• Limits on redisclosure. The Act restricts onward disclosure of information once shared, so each disclosure must independently satisfy the statute, and it provides remedies for violations.
• Scope to confirm. Whether and how the Act reaches a given ABA practice's records depends on its definitions of mental-health information and providers, so a District ABA practice should confirm the Act's application to its records and build to it where it applies.

The operational takeaway is that a District ABA practice should treat the Mental Health Information Act as a real, consent-driven layer on top of HIPAA wherever it reaches the practice's records, and build consent, disclosure, and redisclosure procedures to the stricter standard.

Records retention: the minor rule governs

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with Medicaid audit requirements, means records must be kept securely for many years after a child's last service (District records retention; DHCF requirements). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

The District treats the licensed practitioner or entity as the custodian of patient records, and the Mental Health Information Act governs how that information may be disclosed (DC Code Section 7-1201.01 et seq.; District custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and clients retain access and the Act's protections. Plan custody arrangements before a sale or restructuring.

The MSO question under a consent-based privacy regime

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement. The District adds that, where the Mental Health Information Act applies, the MSO's access to and any handling of mental-health information must satisfy the Act's consent and redisclosure rules, not merely a business-associate agreement, and that the MSO cannot be the licensed records custodian (DC Code Section 7-1201.01 et seq.). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must fit the Act where it applies, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the District burden

Putting the pieces together, the District is a light-facility, notable-privacy jurisdiction. On the lighter side, a standard outpatient ABA clinic needs no facility license, the regulation sits at the practitioner and Medicaid-enrollment level, the DBH MHRS certification is a separate public-system track that autism ABA generally does not require, and Medicaid billing does not trigger a facility survey. On the heavier side, DC's behavior-analyst licensure is recently established and implementation is ongoing, the Mental Health Information Act is a strong consent-based privacy regime where it reaches ABA records, and the minor-records rule extends retention for many years. The practical read is that the District keeps the entry light while placing real weight on privacy, so the compliance focus belongs on the Mental Health Information Act and on confirming the new analyst-licensure requirements. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. The District has notably accommodating telehealth and a daycare-inclusive setting mix, and the clinic setting is where any facility question would arise. See the District Medicaid page, which treats telehealth and place of service in detail.
• Licensing and credentialing. The new behavior-analyst license is the gating step, with implementation ongoing. See the District licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the Mental Health Information Act shape how the entity and any MSO are structured. See the District entity page and the District ownership page.
• Practice sale and expansion. Records custody and the Mental Health Information Act are diligence items in any District transaction. See practice expansion and sale.

Getting set up in the District: the sequence

1. License the analysts. Obtain DC behavior-analyst licensure under the DC Code health-occupations framework, confirming current implementation requirements.
2. Confirm the facility question. Confirm with DC Health and DBH that your outpatient configuration does not require a facility license or DBH certification.
3. Enroll for Medicaid. Complete DHCF Medicaid enrollment and contract with the managed-care plans.
4. Build the privacy program to the MHIA. Implement HIPAA plus the Mental Health Information Act where it applies, with consent and redisclosure procedures.
5. Set the retention schedule. Configure retention to the minor rule and Medicaid requirements, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and access fits the Mental Health Information Act.

District facility and records variables at a glance

Frequently asked questions