Florida does not license behavior analysts, so the licensed-owner exemption is closed to an ABA-only practice on the statute's own list of chapters, and the Agency for Health Care Administration has denied the exemption where the licensed owner could not supervise within license scope (Fla. Stat. 400.9905(4)(g); AHCA informal hearing No. 22-006PH). The Medicaid-provider exemption in paragraph (q) is the working answer for most ABA-only practices, and it means the Health Care Clinic question and the Medicaid enrollment question are the same question. A platform operating in five or more other states with $90 million or more in behavioral health revenue has a third path in paragraph (p) (Fla. Stat. 400.9905(4)(p), (q)).
The Health Care Clinic Act, breach, and retention rules on this page reflect Florida law current through August 2026 and were verified against the 2025 Florida Statutes on the Senate's site and the Board of Psychology rules in that month. The Health Care Clinic Act's exemption list was last amended in 2020 and AHCA's application of the licensed-owner exemption is developing through informal hearings rather than rulemaking. Treat this as a point-in-time overview, not a determination for your practice. Confirm the current requirements with AHCA, the Department of Health, and qualified Florida counsel before you build, bill, or sell.
The nine facility-and-records criteria at a glance
- When an ABA practice needs a facility license in Florida
- The exemption is the archetype: paragraph (g) versus paragraph (q)
- HIPAA, FIPA's 30-day breach clock, and section 456.057
- Records retention: the psychology rule and the Medicaid rule
- Records ownership and custody on a change
- The MSO question
- Reading the Florida burden
- How this connects to the rest of your compliance stack
- Getting set up in Florida: the sequence
- Florida facility and records variables at a glance
- Frequently asked questions
- Where professional advice is essential
When an ABA practice needs a facility license in Florida
Florida regulates outpatient health care businesses through the Health Care Clinic Act, Part X of Chapter 400, administered by the Agency for Health Care Administration. The Act's reach is set by a definition that turns on billing, not on the discipline practiced.
An ABA practice that bills a health plan tenders charges for reimbursement. Unless one of the seventeen exemptions that follow that colon applies, it is a clinic, and a clinic must hold a Health Care Clinic license, appoint a medical director or clinic director, and submit to AHCA inspection. The exemptions that can matter to an ABA practice are three: paragraph (g), the licensed-owner exemption; paragraph (q), Medicaid providers; and paragraph (p), the large multistate behavioral health operator. A 501(c)(3) or (c)(4) entity is exempt under paragraph (e). Everything else on the list is written for hospitals, physician groups, and other licensed facility types.
The licensed-owner exemption has three elements and all three must be met: the services are provided by practitioners licensed under one of the listed chapters, the entity is wholly owned by such practitioners or by them together with a spouse, parent, child, or sibling, and a licensed owner supervises the business and is legally responsible for compliance. The last sentence is the one AHCA enforces.
Behavior analysts appear on none of the listed chapters. Florida does not license them; it recognizes BACB certification for Medicaid and APD purposes under Florida Administrative Code rule 65G-4.0011 and section 393.17, which the Florida licensing page covers. A practice owned by BCBAs is therefore not owned by licensed health care practitioners within paragraph (g), and a lay-owned practice is not either. The practical rule is that for an ABA-only practice the Health Care Clinic question is answered by paragraph (q) or not at all.
The exemption is the archetype: paragraph (g) versus paragraph (q)
The two archetypes do not merely differ in Florida; they sit under different exemptions with different lifespans.
- The practice wholly owned by Florida-licensed psychologists. Chapter 490 is on the paragraph (g) list, so a practice wholly owned by licensed psychologists, with a psychologist owner supervising the business, meets the ownership and supervision elements. The scope element is the one that has to be argued, and the psychology practice act supplies the argument.
Because behavioral analysis and therapy is within the psychology scope, a supervising psychologist owner is not supervising services beyond the scope of the license when the practice's BCBAs deliver ABA. AHCA has not issued guidance addressing ABA specifically, and it has denied the exemption on the supervision-within-scope element where a physical therapist assistant owned the entity and could not supervise a physical therapist, so the position should be documented in the operating agreement and the supervision structure before it is relied on. The exemption is lost the day a non-licensee, an MSO, or an investor takes an ownership interest, which is why the Florida ownership page treats paragraph (g) as an ownership constraint rather than a facility rule (AHCA informal hearing No. 22-006PH, Obstetric Physical Therapy Center v. AHCA).
- The ABA-only practice. Its exemption is paragraph (q), two words long, and it rides entirely on the Medicaid provider agreement. A practice that is enrolled in Florida Medicaid is not a clinic; a practice that loses that enrollment, or that never obtained it because its payor mix is commercial and private pay, is a clinic the moment it tenders a charge to an insurer. The practical consequence is that a commercial-only ABA practice in Florida either holds a Health Care Clinic license or is operating one without a license, and that a Medicaid termination is a facility-licensure event as well as a revenue event.
- The multistate platform. Paragraph (p) exempts an entity owned by a behavioral health care provider operating in at least five other states with $90 million or more in total annual behavioral health revenue, where a Florida-licensed practitioner is responsible for operations and compliance. It is written for consolidated platforms and it is the reason a large acquirer can hold a Florida ABA practice that a smaller buyer cannot.
HIPAA, FIPA's 30-day breach clock, and section 456.057
HIPAA is the federal floor and applies uniformly. Florida layers two statutes on it.
- The Florida Information Protection Act. Section 501.171 applies to any covered entity that acquires, maintains, or uses personal information, a term that includes medical history and health insurance information, so both archetypes are inside it. The deadlines are fixed.
The department is the Department of Legal Affairs, the Attorney General's office. Notice to the consumer reporting agencies is required above 1,000 individuals. The civil penalty runs $1,000 per day for the first 30 days of violation and $50,000 for each subsequent 30-day period, capped at $500,000. Because the state clock is 30 days and HIPAA's is 60, a Florida practice runs incident response to the state deadline (Fla. Stat. 501.171(3), (4), (9)).
- Section 456.057. The Department of Health's records confidentiality and access statute applies to health care practitioners, a term section 456.001(4) defines by the same list of licensing chapters that paragraph (g) uses. Psychologists are inside it; behavior analysts are not. The psychologist archetype therefore answers access requests and third-party disclosures under section 456.057 and the Board of Psychology's release rules in Florida Administrative Code rule 64B19-19.005, while the ABA-only archetype answers them under HIPAA.
Records retention: the psychology rule and the Medicaid rule
Florida has no retention rule addressed to behavior analysts, because there is no license to attach one to. The Board of Psychology has a specific rule, and every Medicaid provider agreement carries one.
| Source | Florida requirement |
|---|---|
| Psychologist's records (psychologist-owned archetype) | Complete records for at least 3 years after the later of completion of planned services or last contact, then complete records or a summary for an additional 4 years, under Fla. Admin. Code r. 64B19-19.003(3) |
| Behavior analyst's records | No state rule; HIPAA six-year documentation rule and payor contract terms govern |
| Medicaid provider records | 5 years, under the provider agreement required by Fla. Stat. 409.907(3)(c) and the integrity provisions of 409.913 |
| Health Care Clinic licensee | Clinic responsibilities under Fla. Stat. 400.9935 apply to a licensed clinic; confirm the current records provisions if the practice holds the license |
| HIPAA administrative documents | 6 years (policies, BAAs, training records, risk analyses) |
| Litigation or audit hold | Preserve regardless of schedule while pending or threatened |
Subsection (4) of that rule is worth reading in the psychologist-owned archetype: a psychologist is not required to retain records where the patients were assigned by a business entity that agrees to maintain them to the Board's confidentiality standard, which is the provision that lets the practice entity rather than the individual psychologist be the custodian. The Medicaid provider agreement adds a five-year obligation that binds both archetypes and runs to the Attorney General's Medicaid Fraud Control Unit as well as AHCA. Build the schedule to seven years for the psychologist's file, five years for Medicaid claim support, and the litigation-hold overlay, and do not let the HIPAA-administrative period drive early destruction (Fla. Admin. Code r. 64B19-19.003; Fla. Stat. 409.907(3)(c)).
Records ownership and custody on a change
Custody in Florida follows the exemption the practice relies on. In the psychologist-owned archetype the licensed owner is legally responsible for the entity's compliance under paragraph (g), the Board of Psychology holds the psychologist responsible for the records unless a qualifying business entity has assumed them under rule 64B19-19.003(4), and rule 64B19-19.004 prescribes public notice and a records-transfer path when a psychologist's practice closes or relocates. In the ABA-only archetype the enrolled Medicaid provider is the custodian and the paragraph (q) exemption travels with the provider agreement, which under section 409.907(6) AHCA may revoke on a change of ownership. A change of ownership is therefore the moment the exemption can fail: a psychologist-owned practice loses paragraph (g) the instant a non-licensee buys in, and a Medicaid-enrolled practice can lose paragraph (q) if the provider agreement does not survive the transaction. Records custody has to be negotiated with both of those facts on the table (Fla. Stat. 409.907(6); Fla. Admin. Code r. 64B19-19.003(4), 19.004).
The MSO question
A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either archetype. In Florida the MSO question is inseparable from the exemption question. An MSO cannot own any part of a practice that relies on paragraph (g), because the exemption requires whole ownership by listed licensees and their immediate family. An MSO serving an ABA-only practice does not affect paragraph (q), which turns on enrollment rather than ownership, but the MSO's fee has to survive the patient-brokering and kickback statutes that the Florida ownership page covers. In both archetypes the MSO cannot be the custodian: in the first because the licensed owner is legally responsible for compliance, in the second because the enrolled provider is.
In Florida the facility question and the ownership question are the same question: a practice wholly owned by licensed psychologists can stand outside the Health Care Clinic Act on the psychology scope, and an ABA-only practice can stand outside it only for as long as its Medicaid provider agreement lasts.
Reading the Florida burden
Putting the pieces together, Florida is a heavy-burden state for the ABA-only practice and a conditional one for the psychologist-owned practice. On the heavier side, the Health Care Clinic Act reaches any billing practice by default, the only exemption open to an ABA-only practice is the Medicaid provider agreement, and a commercial-only practice must hold the license or is operating a clinic without one. The FIPA breach clock is a hard 30 days with per-day penalties. On the lighter side, a practice wholly owned by licensed psychologists has a documented path out of the Act, and Florida's retention rules are shorter than most: seven years for the psychologist, five for Medicaid. The archetype decision is the licensure decision here more than in any other state on this site.
How this connects to the rest of your compliance stack
Facility licensure and records sit alongside several other decisions in this guide:
- Medicaid and place of service. Medicaid enrollment is the paragraph (q) exemption for an ABA-only practice, so the enrollment, its survival on a change of ownership, and its five-year records rule are facility questions as well as revenue questions. See the Florida Medicaid page.
- Licensing and credentialing. Florida does not license behavior analysts, which is why they appear on none of the chapters in paragraph (g); BACB recognition under rule 65G-4.0011 and APD certification under section 393.17 are the entry gates. See the Florida licensing and credentialing page.
- Entity and ownership. Whole ownership by listed licensees is the price of the paragraph (g) exemption, which turns the entity and ownership decision into the facility decision for the psychologist-owned archetype. See the Florida entity page and the Florida ownership page.
- Practice sale and expansion. Whether the exemption survives the transaction, the Medicaid provider agreement's revocation on change of ownership, and the FIPA breach log are diligence items in any Florida transaction. See practice expansion and sale.
Getting set up in Florida: the sequence
- Identify the exemption. Determine whether the practice will rely on paragraph (g) through whole ownership by licensed psychologists, on paragraph (q) through Medicaid enrollment, or on paragraph (p) as part of a qualifying platform, or whether it must apply for a Health Care Clinic license.
- Structure ownership to the exemption. For paragraph (g), keep ownership wholly with listed licensees and immediate family and name the supervising licensed owner; for paragraph (q), enroll in Medicaid before tendering any third-party charge.
- Document the scope position. For the psychologist-owned archetype, record in the operating agreement and supervision plan that the psychologist owner supervises ABA within the section 490.003(4) scope.
- Build the privacy program. Implement HIPAA, set incident response to the 30-day FIPA clock with the Department of Legal Affairs notice above 500 individuals, and adopt section 456.057 and rule 64B19-19.005 for the psychologist's records.
- Set the retention schedule. Configure retention to seven years under rule 64B19-19.003 for the psychologist's file, five years under section 409.907 for Medicaid, and a litigation-hold overlay.
- Fix custody and MSO terms. Name the custodian consistent with the exemption, keep any MSO out of the ownership of a paragraph (g) entity, and sign the business-associate agreement.
Florida facility and records variables at a glance
| Variable | Florida value |
|---|---|
| Separate facility license for commercial-only outpatient ABA? | Yes; a practice that tenders charges for reimbursement is a clinic under 400.9905(4) unless exempt, and a commercial-only ABA-only practice has no exemption |
| Does Medicaid billing trigger facility licensure? | The reverse: Medicaid provider status under paragraph (q) is the exemption that removes an ABA-only practice from licensure |
| Licensing / oversight agencies | Agency for Health Care Administration (Health Care Clinic Act and Medicaid); Department of Health and the Board of Psychology (chapter 490); Agency for Persons with Disabilities (section 393.17) |
| What would trigger a facility license | Billing insurers without Medicaid enrollment; losing Medicaid enrollment; admitting a non-licensee owner into a paragraph (g) entity |
| Physical-plant / survey layer | Full Health Care Clinic licensure with a medical or clinic director and AHCA inspection if no exemption applies; none if exempt |
| State privacy law beyond HIPAA | FIPA (501.171): 30 days to individuals, 30 days to the Department of Legal Affairs above 500, penalties to $500,000; section 456.057 for licensed practitioners (psychologists), not behavior analysts |
| Records retention (pediatric) | Psychologist: 3 years complete then 4 years complete or summary under rule 64B19-19.003; Medicaid: 5 years under 409.907(3)(c); no behavior analyst rule; HIPAA administrative documents 6 years |
| Records custodian | The licensed supervising owner or a qualifying business entity under rule 64B19-19.003(4) in the psychologist archetype; the enrolled Medicaid provider in the ABA-only archetype; exemption and provider agreement may not survive a change |
| MSO treatment | HIPAA business associate; cannot own any part of a paragraph (g) entity; cannot be the custodian; fee constrained by patient-brokering and kickback statutes |
| Key authorities | Fla. Stat. 400.9905(4)(e), (g), (p), (q); 400.9935; 490.003(4); 456.001(4); 456.057; 501.171; 409.907; 409.913; 393.17; Fla. Admin. Code r. 64B19-19.003 to 19.005, 65G-4.0011 |
Frequently asked questions
Does an outpatient ABA clinic need a Health Care Clinic license in Florida?
Why can't a BCBA-owned practice use the licensed-owner exemption?
What happens to our exemption if we lose Medicaid enrollment?
What is the breach notification deadline in Florida?
How long must pediatric ABA records be kept in Florida?
Can an MSO or investor own part of our psychologist-owned practice?
Where professional advice is essential, not optional
Florida is the state where a facility-licensure mistake is a licensure violation rather than a paperwork gap, and where the exemption a practice relies on can disappear at a change of ownership or a Medicaid termination. Have qualified Florida counsel confirm which paragraph of section 400.9905(4) the practice relies on, document the supervision-within-scope position if it is paragraph (g), confirm the Medicaid provider agreement's survival terms if it is paragraph (q), set incident response to the 30-day FIPA clock, and write the retention schedule to rule 64B19-19.003 and section 409.907. Treat this page as an orientation, not a determination, and not legal advice.
The governing authorities to know are Florida Statutes 400.9905(4) and its exemptions in paragraphs (e), (g), (p), and (q), section 490.003(4) (the psychology scope), section 456.001(4) and 456.057 (practitioner records), section 501.171 (FIPA), sections 409.907 and 409.913 (Medicaid provider agreements and program integrity), and Florida Administrative Code chapter 64B19-19 (psychology records), read together with federal HIPAA.
This page describes licensure, privacy, and retention rules that change and that depend on your configuration. The Agency for Health Care Administration, the Department of Health and the Board of Psychology, the Agency for Persons with Disabilities, and qualified Florida counsel are the authoritative sources. Neither this page nor any secondary source should be relied on in place of direct verification and legal advice.