Does your ABA clinic need a facility license in Kansas? And how must records be kept?

When an ABA practice needs a facility license in Kansas

The Kansas facility licensing act, administered by the Department of Health and Environment, licenses "medical care facilities," and "medical care facility" means "a hospital, ambulatory surgical center or recuperation center." A general hospital is "an establishment with an organized medical staff of physicians" with "permanent facilities that include inpatient beds," and an ambulatory surgical center likewise requires an organized medical staff and surgical facilities (K.S.A. 65-425). An outpatient practice staffed only by behavior analysts and technicians has neither.

That reading covers the definitions in that section. It does not cover other behavioral health facility types the state disability agency licenses, which this guide did not check. Vendor sites assert that an outpatient license from that agency may be needed, but they cite no rule, and this guide does not rely on them. A center-based or day-treatment approval for ABA was not found.

The two archetypes: what changes between them

• The practice with in-house diagnostics. The ambulatory surgical center definition provides that "nothing in this section shall be construed to require the office of a physician or physicians to be licensed under this act as an ambulatory surgical center" (K.S.A. 65-425). That exclusion names physician offices. No psychologist office exclusion was quoted, but the definitions as a whole do not describe a diagnostic office either. A licensed psychologist's communications with a client are privileged on the same basis as attorney-client communications under the 2012 compilation read (K.S.A. 74-5323).
• The ABA-only practice. The facility definitions above do not describe it. No confidentiality or privilege section in the behavior analyst licensure act was found, and no general Kansas medical records statute was found, so HIPAA is the privacy rule that is certain.

HIPAA and the Kansas breach statute

HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.

The Kansas breach statute requires notice to the affected resident once an investigation finds that misuse of information "has occurred or is reasonably likely to occur." Notice "must be made in the most expedient time possible and without unreasonable delay." There is no fixed day count, and there is no Attorney General or regulator notice requirement in the section. When more than 1,000 consumers are notified at one time, nationwide consumer reporting agencies must also be told, and the Attorney General may sue to enforce. Personal information is limited to Social Security number, driver's license or state identification number, and financial account or card numbers; medical and health insurance information are not covered. An entity regulated by state or federal law that maintains breach procedures under its primary or functional regulator's rules "is deemed to be in compliance" (K.S.A. 50-7a01, 50-7a02). The statute does not name HIPAA, so a covered entity following the federal breach rule plausibly falls within the clause, but counsel should confirm it.

Records retention

Kansas retention rules for the professions could not be verified, which leaves the Medicaid agreement and HIPAA as the verified floor.

Until the board rules are read, the practical standard is the longest of HIPAA's six years and the Medicaid five years, with a longer benchmark for children's files.

Records ownership and custody on a change

The Kansas Medicaid provider agreement says changes of ownership or tax identification number terminate the agreement, and "upon a change of ownership, the new provider must notify the SMA ... where the old provider's records will be located" (KMAP provider agreement, revised 03.2011). A search summary described a medical board rule requiring licensees to report the storage location of patient records within 30 days of closing a practice, but the board's page was blocked and this guide does not rely on it. In an asset sale, the purchase agreement should name who holds the old provider's records and when the new provider tells Medicaid.

The MSO question

A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The Kansas ownership page covers who may own the clinical entity.

Reading the Kansas burden

Kansas looks light on facility licensure and light on breach regulation, with a gap in verified record rules. The state breach statute does not require a regulator notice and does not list medical data, which shifts the real clock to HIPAA. The open items are the professional board rules and any behavioral health license from the state disability agency.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the Kansas Medicaid page.
• Licensing and credentialing. Kansas licenses behavior analysts, which decides who may supervise and act as custodian of the clinical file. See the Kansas licensing and credentialing page.
• Entity and ownership. Kansas facility definitions turn on the site and its staff, not the owner, so entity choice does not change the answer. See the Kansas entity page and the Kansas ownership page.
• Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any Kansas transaction. See practice expansion and sale.

Getting set up in Kansas: the sequence

1. Confirm the facility question. Have counsel check whether the state disability agency licenses outpatient behavioral health sites for ABA.
2. Decide the diagnostics model. If a physician or psychologist is on staff, confirm their board's records rules, which this guide could not verify.
3. Build the privacy program. Implement HIPAA and set incident response to its 60-day clock, noting that Kansas requires no regulator notice.
4. Set the retention schedule. Configure retention to the longest of HIPAA's six years and the Medicaid five years, with a pediatric benchmark.
5. Settle custody. Name who holds records on a sale and tell Medicaid where they are.

What this guide could not verify

Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:

• Other Kansas behavioral health facility types licensed by the state disability agency.
• A psychologist office exclusion in the facility definitions.
• Physician, psychologist and behavior analyst record retention rules.
• A center-based or day-treatment ABA approval.
• The current text of K.S.A. 74-5323; only a 2012 compilation was read.
• The current Medicaid provider agreement; the form read is from 2011.

Kansas facility and records variables at a glance

Frequently asked questions