Does your ABA clinic need a facility license in Indiana? And how must records be kept?

When an ABA practice needs a facility license in Indiana

Indiana's facility licensure runs through the Department of Health under IC 16-21, which licenses hospitals, ambulatory outpatient surgical centers, and a small set of other facility types. An outpatient ABA office is not among them, and Indiana has no general clinic license of the kind Florida or Massachusetts imposes. The state regulates the profession rather than the building: behavior analysts and assistant behavior analysts are licensed under IC 25-8.5 by the Behavioral Health and Human Services Licensing Board, with a practice restriction that the Indiana licensing page covers, and the Board's implementing rules were still in promulgation at the last check (IC 16-21-2; IC 25-8.5; PLA notice Dec. 30, 2024).

The health records article, IC 16-39, does the work that a facility statute does elsewhere. It sets the retention duty, the patient access rules, and the mental health records regime, and it does so by naming providers. That is where the archetype fork appears, and it is covered below. The practical rule is that no Indiana facility license reaches an outpatient ABA practice under either archetype, and the entry gates are the practitioner license and IHCP enrollment.

The real hurdle: IHCP enrollment and the two archetypes

Indiana Medicaid covers ABA under 405 IAC 5-22-12, amended effective March 1, 2019, for members with an autism spectrum disorder diagnosis through age 20, with prior authorization under 405 IAC 5-3. The IHCP enrolls an applied behavior analysis therapist as a provider specialty, and the credential at the top of the chain is either an HSPP license or BCBA certification.

• The practice with in-house diagnostics. A health service provider in psychology on staff can hold the IHCP ABA therapist specialty in that capacity, can perform the diagnostic evaluation the benefit requires, and can supervise assistants and technicians. The psychologist's records are then governed by IC 16-39-7-1's seven-year rule and by the mental health records chapter in IC 16-39-2, which carries its own consent form and noncustodial-parent access rule. The diagnostic file and the treatment file sit under one statutory retention duty.
• The ABA-only practice. A BCBA holds the IHCP specialty in that capacity and must supervise BCaBA and RBT services directly. Behavior analysts are not on the IC 16-39-7-1 provider list, so no state statute tells the practice how long to keep the clinical record. The seven-year duty arrives through the Medicaid provider agreement instead, and it binds the enrolled provider rather than the licensee.

The IHCP module requires the treatment plan to be signed by the lead analyst and the parent or guardian, progress notes documenting necessity and effectiveness, and ongoing evaluations that redefine goals. The practical rule is that Indiana swaps the facility license for a provider-specialty chain with documentation requirements that are enforced through recoupment (405 IAC 5-22-12; 405 IAC 5-3; IHCP Behavioral Health Services module).

HIPAA, the Indiana health records article, and the 45-day breach clock

HIPAA is the federal floor and applies uniformly. Indiana layers two things on it.

• The health records article. IC 16-39 governs release of health records to patients and authorized persons, and its chapter 2 governs mental health records with a more detailed release form than HIPAA requires and an express rule that a noncustodial parent has access to a child's records absent a court order. IC 16-39-1-7 gives custodial and noncustodial parents equal access to a child's health records unless a court order limits it and the provider has the order. For a pediatric ABA practice that rule decides most access disputes before they start (IC 16-39-1-7; IC 16-39-2-5; IC 16-39-2-9).
• The breach statute. IC 24-4.9 applies to any database owner holding Indiana residents' personal information. It was amended to add a fixed outer limit.

Delay is reasonable only to restore system integrity, to discover the scope of the breach, or at the request of the Attorney General or law enforcement. A database owner that notifies residents must also notify the Attorney General, and must notify the consumer reporting agencies above 1,000 affected consumers. A person that maintains its own disclosure procedures under HIPAA that require notice to Indiana residents without unreasonable delay is deemed compliant with the state notice rule, which for a covered entity means HIPAA's 60-day outer limit does not extend the state 45-day clock if the practice's own policy sets a shorter one. The safer reading is to run incident response to 45 days from discovery (IC 24-4.9-3-1; IC 24-4.9-3-3; IC 24-4.9-3-4).

Records retention: seven years, but the statute names the psychologist

Indiana's general retention statute is seven years, but it applies only to the providers it names. Psychologists are named; behavior analysts are not. The Medicaid rule closes the gap for enrolled providers.

The provider list in IC 16-39-7-1 predates the 2021 behavior analyst licensing act and has not been amended to add the profession, so the statute's seven-year duty and its disciplinary hook reach the psychologist in the diagnostics archetype and not the behavior analysts in either archetype. For a Medicaid provider the practical difference is small, because 405 IAC 1-1.4-2 imposes the same seven years on the whole chart. For a commercial-only ABA practice it is the difference between a statutory duty and a contractual one. Build the schedule to seven years from the date of service across the chart, with a litigation-hold overlay, and confirm whether the Board's forthcoming rules under IC 25-8.5 add a retention clause (IC 16-39-7-1; 405 IAC 1-1.4-2).

Records ownership and custody on a change

Indiana puts custody on the licensee in the diagnostics archetype, because IC 16-39-7-1(c) makes premature destruction an offense for which the psychologist's board may discipline the psychologist, and on the enrolled provider in the ABA-only archetype, because the seven-year duty arrives through the provider agreement. The Medicaid rules contain an express change-of-ownership provision: the transferee takes possession of the transferor's Medicaid records and safeguards them for at least three years from the last claim reimbursed or until any pending appeal closes, whichever is longer. That rule does not shorten the seven-year duty on the transferor; it adds a floor on the transferee. In an asset sale, custody must be negotiated so that a responsible custodian remains, the noncustodial-parent access rule continues to be honored, and both the 405 IAC 1-1.4-2 seven years and the 405 IAC 1-20-5 three years survive the closing (IC 16-39-7-1(c); 405 IAC 1-20-5).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either archetype. Indiana adds that the MSO cannot be the custodian, because the retention duty sits with the licensee under IC 16-39-7-1 or with the enrolled provider under 405 IAC 1-1.4-2, and that the mental health records chapter's release form governs any disclosure of a psychologist's file to the MSO. The management agreement should keep access under the licensee's control and allocate who answers an FSSA records request within the deadline the agency sets. The Indiana ownership page covers the fee-splitting limits on how the MSO is paid.

Reading the Indiana burden

Putting the pieces together, Indiana is a light-facility, moderate-records state. On the lighter side, there is no facility license for outpatient ABA under any archetype, the profession is licensed as a profession, and the retention numbers are uniform at seven years for anyone Medicaid touches. On the heavier side, the general records statute has not caught up with the 2021 licensing act, the breach clock is a fixed 45 days, and the IHCP documentation rules are enforced through recoupment with the claim form expressly excluded as proof. The archetype decision changes who carries the statutory duty, not how long the record is kept.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. IHCP enrollment as an applied behavior analysis therapist, the 405 IAC 5-22-12 coverage rules, and the seven-year records rule with the claim form excluded as proof are the operating structure of Medicaid ABA in Indiana. See the Indiana Medicaid page.
• Licensing and credentialing. The IC 25-8.5 license carries the practice restriction; the Board's rules were still in promulgation at the last check and may add a records clause. See the Indiana licensing and credentialing page.
• Entity and ownership. Indiana's professional corporation form is elective and the health care professional definition lets a psychologist and a licensed behavior analyst co-own, which decides which licensee holds custody. See the Indiana entity page and the Indiana ownership page.
• Practice sale and expansion. The 405 IAC 1-20-5 transferee rule, the transferor's continuing seven-year duty, and the noncustodial-parent access rule are diligence items in any Indiana transaction. See practice expansion and sale.

Getting set up in Indiana: the sequence

1. Credential the analysts. Obtain IC 25-8.5 licenses as the Board's application process allows and enroll with the IHCP under the applied behavior analysis therapist specialty on an HSPP license or BCBA certification.
2. Decide the diagnostics model. If a health service provider in psychology will be on staff, adopt the IC 16-39-2 mental health records release form and the IC 16-39-7-1 seven-year duty for the diagnostic file.
3. Confirm the facility question. Confirm that the outpatient configuration is not an IC 16-21 facility type.
4. Build the privacy program. Implement HIPAA and IC 16-39, adopt the equal-parental-access rule in IC 16-39-1-7, and set incident response to the 45-day clock in IC 24-4.9-3-3 with the Attorney General notice.
5. Set the retention schedule. Configure retention to seven years from the date of service across the chart under 405 IAC 1-1.4-2 and IC 16-39-7-1, with records independent of the claim form and a litigation-hold overlay.
6. Fix custody and MSO terms. Name the custodian, write the 405 IAC 1-20-5 transferee obligation into any sale agreement, sign the business-associate agreement, and keep access under licensee control.

Indiana facility and records variables at a glance

Frequently asked questions