Does your ABA clinic need a facility license in Illinois? And how must records be kept?

When an ABA practice needs a license or certification in Illinois

Illinois changed meaningfully in 2025. The Behavior Analyst Licensing Act (225 ILCS 6) became operational in January 2025, so behavior analysts and assistant behavior analysts must now hold an IDFPR license to practice, where previously the state relied on national certification alone (225 ILCS 6; IDFPR, operational Jan. 15, 2025). That practitioner license is now the entry requirement. Above it, there is no single facility license that applies to every ABA setting, but Illinois adds a certification layer for certain configurations, particularly center-based and Medicaid delivery, which the next section covers. A commercial-only outpatient practice with licensed analysts and a proper entity generally does not need a separate facility license, but it must satisfy the new analyst-licensure requirement, and center-based Medicaid delivery is a different matter.

What triggers certification: center-based and Medicaid

Unlike states where outpatient ABA is light across the board, Illinois attaches additional requirements to Medicaid and center-based delivery:

• Medicaid center-based certification. The HFS Adaptive Behavior Services benefit has carried additional certification requirements for center-based service delivery, which advocates have flagged as a barrier for families seeking out-of-home ABA. So delivering center-based ABA to Medicaid members involves a certification layer beyond the analyst license (Illinois HFS Adaptive Behavior Services rules).
• The narrow practitioner and supervision rule. Illinois Medicaid historically required that the behavior analyst overseeing ABA be a licensed clinical professional or be supervised by one, a requirement that produced waitlists and thin provider networks. Combined with the new IDFPR license, the practitioner and supervision requirements are a real gating step for Medicaid participation.
• Program-type licensure. As in other states, residential, day-treatment, and community mental health configurations map to their own licensure or certification categories (for example through IDHS), which a purely outpatient ABA clinic would not trigger.

The practical rule is that Illinois is heavier than a light-touch state: the analyst license is now mandatory, and center-based and Medicaid delivery carry a certification layer on top. Confirm your specific configuration with IDFPR and HFS, because the requirements differ between commercial-only outpatient, center-based, and Medicaid delivery.

HIPAA and the MHDDCA: the strictest privacy law

HIPAA is the federal floor and applies uniformly. Illinois then imposes the strictest state privacy regime in the country, the Mental Health and Developmental Disabilities Confidentiality Act (MHDDCA), and it squarely covers ABA (740 ILCS 110/1 et seq.). Two features make it the heavy element of Illinois compliance:

• It covers ABA by definition. The MHDDCA applies to records and communications of mental health and developmental disabilities services, defined to include evaluation, treatment, training, and habilitation. Because autism is a developmental disability and ABA is a habilitative service, ABA records fall squarely within the Act (740 ILCS 110/2; 405 ILCS 5/1-100 et seq.).
• It is a deep written-consent regime, not a HIPAA-style permission set. The Act's baseline is that all records and communications are confidential and may not be disclosed except as the Act allows, which generally requires written consent in the Act's specific form, restricts redisclosure, and imposes a special rule that no one may comply with a subpoena for these records unless it is accompanied by a court order or the recipient's written consent (740 ILCS 110/3; 740 ILCS 110/10). Violations carry civil and criminal penalties.

There are nuances for minors, including limited independent rights for those aged 12 to 17 and specific provisions where a child receives special-education services under the School Code, but the operational message is that an Illinois ABA practice must build consent, disclosure, and subpoena-handling procedures to the MHDDCA standard, which is stricter and more consent-driven than HIPAA, and must apply the stricter rule at every point.

Records retention: the minor rule and MHDDCA

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor-records rule governs and, layered with the MHDDCA's custody and confidentiality obligations, means records must be kept securely for many years after a child's last service (Illinois medical-records retention; 740 ILCS 110). Build your retention schedule to the minor rule and the litigation-hold overlay, and confirm the exact period with counsel, because the shorter Medicaid and HIPAA-administrative periods will mislead a practice into purging too early.

Records ownership and custody on a change

The MHDDCA refers throughout to the custodian of the records, and Illinois board rules treat the licensed clinical entity (or provider) as that custodian, which has consequences when ownership changes (740 ILCS 110; Illinois custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not itself part of the transaction, custody must be specifically negotiated so that a licensed custodian remains responsible and recipients retain access and confidentiality protections. Because the MHDDCA attaches criminal as well as civil liability to improper disclosure, getting custody and transfer mechanics right is not merely a contractual nicety in Illinois. Plan custody arrangements before a sale or restructuring.

The MSO question under a deep-consent regime

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement. Illinois adds a stricter overlay: because the MHDDCA tightly restricts who may access and redisclose mental health and developmental disabilities records and imposes criminal penalties, an MSO's access to ABA records is bound by the Act's consent and redisclosure framework, not merely by a business-associate agreement (740 ILCS 110/3; 740 ILCS 110/10). The practical effects are that the MSO still needs a HIPAA business-associate agreement, that any MSO access must fit within the MHDDCA's consent and disclosure rules, and that the MSO cannot be the licensed records custodian. Structure the MSO relationship so the clinical entity remains custodian, the business-associate agreement is in place, and any MSO access is consistent with the MHDDCA.

Reading the Illinois burden

Putting the pieces together, Illinois is a heavy-burden state on both axes of this spoke, the inverse of a light-facility, federal-floor-privacy state. On licensure, the new IDFPR analyst license is mandatory, and Medicaid and center-based delivery carry a certification layer and a narrow practitioner rule that gate participation. On privacy, the MHDDCA is the strictest state regime in the country, covers ABA by definition, runs on deep written consent, and carries criminal penalties. Retention is long under the minor rule, and custody must stay with a licensed entity under a statute that criminalizes improper disclosure. The practical read is that Illinois requires more compliance investment than most states, concentrated in certification for center-based and Medicaid delivery and in a consent-driven privacy program, and that the cost of getting privacy wrong is higher here than almost anywhere. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility, certification, and records sit alongside several other decisions in this guide:

• Medicaid and place of service. The center-based certification requirement is exactly where the Medicaid place-of-service question and the facility question meet, since center-based delivery carries the heaviest certification load. See the Illinois Medicaid page, which treats the access friction and place of service in detail.
• Licensing and credentialing. The new IDFPR analyst license and the narrow supervision rule are the gating steps in Illinois. See the Illinois licensing and credentialing page.
• Entity and ownership. Illinois has unusually strict ownership rules, and the records-custodian and MHDDCA constraints shape how the entity and any MSO are structured. See the Illinois entity page and the Illinois ownership page.
• Practice sale and expansion. Records custody and MHDDCA compliance are core diligence items in any Illinois transaction. See practice expansion and sale.

Getting set up in Illinois: the sequence

1. License the analysts. Obtain IDFPR behavior-analyst and assistant-analyst licenses under the Behavior Analyst Licensing Act (225 ILCS 6).
2. Confirm the certification layer. If delivering center-based or Medicaid ABA, confirm and meet the HFS center-based certification and supervision requirements.
3. Enroll and contract for Medicaid if applicable. Complete HFS enrollment and managed-care contracting, clearing the practitioner and supervision rules.
4. Build the privacy program to the MHDDCA. Implement HIPAA plus MHDDCA: written-consent forms, redisclosure limits, and the subpoena rule, with criminal-penalty exposure in mind.
5. Set the retention schedule. Configure retention to the minor rule with a litigation-hold overlay, confirming the exact period with counsel.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and any MSO access fits the MHDDCA.

Illinois facility and records variables at a glance

Frequently asked questions