Does your ABA clinic need a facility license in Georgia? And how must records be kept?

When an ABA practice needs a facility license in Georgia

For a standard outpatient ABA practice, Georgia does not require a facility license. Georgia regulates ABA primarily through the Medicaid program: it enrolls Board Certified Behavior Analysts as Qualified Health Care Professionals (QHCPs) who provide autism-spectrum-disorder services and supervise assistant analysts and registered behavior technicians, with services billed through the four care management organizations and GAMMIS rather than through a standalone state behavior-analyst license (Georgia DCH ASD policy). The facility-licensure framework that does exist is built for higher-intensity program types, which the next section covers, and an ABA-only outpatient clinic generally falls outside it.

What would trigger a DBHDD or HFRD license

Georgia's facility-licensure framework targets specific program types rather than outpatient ABA:

• Mental-health facilities. DBHDD licenses mental-health residential treatment centers, partial-hospitalization programs, intensive-outpatient programs, and crisis stabilization units, with program descriptions, staffing, safety standards, and on-site inspections (Ga. Comp. R. & Regs. ch. 82).
• Substance-use facilities. The DCH Healthcare Facility Regulation Division licenses substance-use detox, residential, partial-hospitalization, and intensive-outpatient facilities.
• A 2026 consolidation. House Bill 584 transfers licensing and oversight of several facility types from DCH to DBHDD effective January 1, 2026, so during the transition some applications still route through DCH systems and are forwarded to DBHDD (HB 584, eff. Jan. 1, 2026).
• Ordinary outpatient ABA is not a licensed facility type. A purely outpatient ABA practice is regulated through Medicaid QHCP enrollment and care management organization contracting rather than a DBHDD or HFRD facility license; the facility framework engages only if you operate a residential, partial-hospitalization, intensive-outpatient, crisis, or substance-use program.

The practical rule is that Georgia is light on facility licensure for outpatient ABA: the operative requirements are QHCP enrollment and care management organization contracting, and the facility framework becomes relevant only for higher-intensity program types.

HIPAA and Georgia's confidentiality statutes

HIPAA is the federal floor and applies uniformly. Georgia then layers named state confidentiality statutes on top:

• Mental-health and developmental-disability confidentiality. Georgia protects the confidentiality of mental-health clinical records and, separately, developmental-disability records, the latter squarely relevant to autism services, with disclosure limited as the statutes allow (O.C.G.A. Sections 37-3-166, 37-4-125).
• The medical-records statute. Georgia's medical-records law governs the confidentiality, disclosure, and patient access of medical records generally, on top of HIPAA (O.C.G.A. Section 31-33).
• Agency policy for public-system providers. Providers in the DBHDD public system also follow DBHDD confidentiality and HIPAA policy, an additional layer for those entities.

The operational takeaway is that a Georgia ABA practice builds its privacy program to HIPAA, the mental-health and developmental-disability confidentiality statutes, and the medical-records statute, applying the stricter standard at each point. Georgia's privacy regime is a real named-statute layer in the moderate range.

Records retention: the minor rule and Medicaid

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the medical-records statute and the five-year Medicaid minimum, means records must be kept securely for many years after a child's last service (O.C.G.A. Section 31-33; Georgia DCH ASD policy). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter five-year Medicaid or six-year HIPAA-administrative periods drive early destruction of pediatric records.

Records ownership and custody on a change

Georgia treats the licensed practitioner or entity, the enrolled QHCP or facility, as the custodian of patient records, and Medicaid policy requires records to be maintained at approved service locations and available for review (Georgia DCH ASD policy; O.C.G.A. Section 31-33). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. Medicaid policy also requires providers to notify the enrollment unit of changes such as new locations, payee changes, or dissolution of a group practice. Plan custody and the enrollment notifications before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Georgia does not redefine that relationship the way some broad state statutes do. What Georgia adds is that any disclosure of records, including to or through an MSO, must satisfy the mental-health and developmental-disability confidentiality statutes and the medical-records statute, and that the MSO cannot be the licensed records custodian (O.C.G.A. Sections 37-3-166, 37-4-125, 31-33). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Georgia's confidentiality statutes, and that the enrolled QHCP or facility remains the custodian. Structure the MSO relationship accordingly.

Reading the Georgia burden

Putting the pieces together, Georgia is a light-facility, moderate-privacy state. On the lighter side, a standard outpatient ABA clinic needs no facility license, the operative requirements are QHCP enrollment and care management organization contracting, and Medicaid billing does not trigger a facility survey. On the heavier side, the facility framework is real for higher-intensity program types and is being consolidated under DBHDD in 2026, the named mental-health and developmental-disability confidentiality statutes add state privacy obligations on top of HIPAA, the minor-records rule extends retention well past the five-year Medicaid minimum, and the BACB supervision rule effective January 2026 affects staffing. The practical read is that Georgia keeps the entry light for outpatient ABA while maintaining a defined facility framework for broader configurations and a moderate named-statute privacy regime. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Georgia pays through the care management organizations and applies a distinctive telehealth rule limiting billing to providers in Georgia or within fifty miles of the border, and the clinic setting is where any facility question would arise. See the Georgia Medicaid page, which treats the telehealth rule and place of service in detail.
• Licensing and credentialing. The BCBA-as-QHCP model and the 2026 BACB supervision rule are the credentialing story. See the Georgia licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the confidentiality statutes shape how the entity and any MSO are structured. See the Georgia entity page and the Georgia ownership page.
• Practice sale and expansion. Records custody and the Medicaid enrollment notifications are diligence items in any Georgia transaction. See practice expansion and sale.

Getting set up in Georgia: the sequence

1. Credential the analysts. Maintain BCBA certification and enroll as a Qualified Health Care Professional; confirm the 2026 BACB supervision requirements for RBTs.
2. Confirm the facility question. Confirm with DBHDD that your outpatient configuration does not require a facility license, and obtain one if you add a residential, partial-hospitalization, crisis, or substance-use program.
3. Enroll for Medicaid. Complete DCH/GAMMIS enrollment and contract with the four care management organizations.
4. Build the privacy program. Implement HIPAA plus the mental-health and developmental-disability confidentiality statutes and the medical-records statute.
5. Set the retention schedule. Configure retention to the minor rule, the five-year Medicaid minimum, and the medical-records statute, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the enrolled QHCP or facility is the custodian, the business-associate agreement is in place, and access fits Georgia's confidentiality statutes.

Georgia facility and records variables at a glance

Frequently asked questions