Does your ABA clinic need a facility license in Iowa? And how must records be kept?

When an ABA practice needs a facility license in Iowa

Iowa's chapter 135C licenses "health care facilities," defined as residential care facilities, nursing facilities, and intermediate care facilities for persons with mental illness or an intellectual disability, the last being "an institution or distinct part of an institution with a primary purpose to provide health or rehabilitative services to three or more individuals" (Iowa Code 135C.1). An outpatient ABA office with no residents is none of those.

That does not settle the question. Iowa also licenses hospitals under chapter 135B, which this guide did not read, and the Department of Health and Human Services accredits some mental health providers under 441 IAC chapter 24, also not read. A center-based or day-treatment approval for ABA was not found. Counsel should confirm those two sources before treating an outpatient ABA site as unlicensed.

The two archetypes: what changes between them

• The practice with in-house diagnostics. The same chapter 135C definition does not describe an outpatient office where a psychologist or physician does diagnostics. The psychologist records rule and the physician records rule below apply to that file, and chapter 228 applies to mental health information.
• The ABA-only practice. The behavior analyst licensure chapter, 481 IAC 880, has no record-retention rule; its clinical-records provisions concern supervisor access and countersignature. Whether chapter 228 reaches an ABA-only practice depends on whether a behavior analyst's degree counts as "a mental health field," which the statute does not say.

HIPAA and the Iowa breach statute

HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.

The Iowa breach statute sets no day count: consumer notification is made "in the most expeditious manner possible and without unreasonable delay." When more than 500 Iowa residents must be notified, the consumer protection division of the Attorney General's office gets written notice within five business days after consumers are told. The statute's personal information elements are Social Security number, government identification number, financial account numbers, electronic identifiers and biometric data. Medical and health insurance information are not listed. A person subject to and complying with the federal HIPAA breach regulations is outside the section (Iowa Code 715C.1, 715C.2).

Chapter 228 is the Iowa mental health information statute. It provides that "a mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility shall not disclose or permit the disclosure of mental health information" except as authorized. The definition of mental health professional expressly includes physicians and doctoral psychologists, and also covers anyone with a master's degree in "a mental health field, including but not limited to psychology, counseling and guidance, nursing, and social work" who meets licensure and two years of supervised experience (Iowa Code ch. 228, 2025 Code). A reach to behavior analysts is possible and unconfirmed. The Iowa Consumer Data Protection Act's HIPAA carve-out was not read.

Records retention

Iowa has specific rules for psychologists and physicians and none for behavior analysts.

For a practice with no psychologist or physician, the Medicaid five years and HIPAA's six years set the floor. A practice with a psychologist on staff carries the longer of seven years from last service or three years after a minor turns 18.

Records ownership and custody on a change

The only custody rule found is the physician rule: "upon a physician's death or retirement, the sale of a medical practice, or a physician's departure from the physician's medical practice," records must be transferred to another physician or entity "held to the same standards of confidentiality" that agrees to act as custodian, and active patients must be notified (653 IAC 13.7(8)). No custody rule for behavior analysts, psychologists or Medicaid was found. An asset sale should name a custodian in writing and carry the retention periods above into the purchase agreement.

The MSO question

A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The Iowa ownership page covers who may own the clinical entity.

Reading the Iowa burden

Iowa's burden is moderate and mostly in the privacy layer. The facility chapter read is residential, the hospital chapter is the open point, records rules are clear for psychologists and physicians, and the five business day Attorney General notice is a short clock to run against. Chapter 228 is the item most likely to surprise an ABA-only practice.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the Iowa Medicaid page.
• Licensing and credentialing. Iowa licenses behavior analysts through chapter 154D and 481 IAC 880, which decides who may supervise and hold the clinical file. See the Iowa licensing and credentialing page.
• Entity and ownership. Iowa's facility question is about the site, not the owner, and chapter 228 applies by profession, not by entity form. See the Iowa entity page and the Iowa ownership page.
• Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any Iowa transaction. See practice expansion and sale.

Getting set up in Iowa: the sequence

1. Confirm the facility question. Have counsel read chapter 135B and 441 IAC chapter 24 for any center-based site.
2. Decide the diagnostics model. If a psychologist is on staff, hold the file to 481 IAC 884.2(5). If a physician is, hold it to the seven year rule.
3. Build the privacy program. Implement HIPAA, write incident response to the five business day Attorney General notice above 500 residents, and have counsel check chapter 228.
4. Set the retention schedule. Configure retention to the longest of HIPAA's six years, the Medicaid five years and any licensee rule.
5. Settle custody. Name a custodian in any sale or closure agreement.

What this guide could not verify

Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:

• Chapter 135B (hospitals) and 441 IAC chapter 24 (mental health accreditation).
• A center-based or day-treatment ABA approval.
• Whether chapter 228 reaches licensed behavior analysts.
• The Iowa Consumer Data Protection Act HIPAA carve-out (chapter 715D).
• The current codified location of the physician records rule.
• Any rule on records custody for behavior analysts, psychologists or Medicaid.

Iowa facility and records variables at a glance

Frequently asked questions