Does your ABA clinic need a facility license in Kentucky? And how must records be kept?

When an ABA practice needs a facility license in Kentucky

Kentucky's health facility licensure runs through the Cabinet for Health and Family Services under KRS Chapter 216B, and the category that can reach a behavioral health practice is the Behavioral Health Services Organization, licensed by the Office of Inspector General under 902 KAR 20:430. Whether an ABA practice needs that license depends on which Medicaid pathway it uses, not on its building.

• The individual pathway. The Department for Medicaid Services enrolls a licensed behavior analyst as provider type 63, with assistant behavior analysts and technicians billing under the analyst's supervision. The requirements are licensure with the Applied Behavior Analyst Licensing Board, active Medicaid enrollment, and enrollment with the MCO of any beneficiary served, under the coverage provisions of 907 KAR 15:010. No facility license is involved (CHFS DMS, Licensed Behavioral Analyst provider type 63; 907 KAR 15:010).
• The organizational pathway. An organization that delivers ABA together with other behavioral health services may enroll as a Behavioral Health Services Organization under 907 KAR 15:020. To do so it must first be licensed under 902 KAR 20:430, which requires accreditation within one year of initial licensure, sets plan-of-care and staffing standards, lists the licensed behavior analyst among the professionals who may provide services, and provides that the license is denied or revoked if the organization is terminated from Medicaid under 907 KAR 1:671 (907 KAR 15:020, Sec. 2; 902 KAR 20:430).

The practical rule is that a Kentucky ABA practice chooses whether to carry a facility license, and most choose not to. The Kentucky licensing page covers the KRS 319C license that both pathways require.

The real hurdle: two Medicaid pathways and the two archetypes

Because the facility question is a pathway choice, the archetype fork in Kentucky runs through who signs the plan of care and who holds the record, not through whether a license is needed.

• The practice with in-house diagnostics. A licensed psychologist on staff does not change the pathway: the practice may still bill through its licensed behavior analysts as individual providers, and the psychologist bills under the psychologist's own enrollment. The psychologist's records are governed by the Board of Examiners of Psychology's rules in 201 KAR Chapter 26, which were not verified for this page and should be read for the diagnostic file. In a BHSO, the psychologist is one of the listed professionals and the organization's plan of care under 902 KAR 20:430 governs the whole chart.
• The ABA-only practice. Its analysts enroll individually and its records are governed by the Board's ethics regulation, which since October 2022 incorporates the BACB Ethics Code by reference rather than stating Kentucky-specific record rules. The practical effect is that the BACB Code's documentation and records provisions are Kentucky law for a licensed behavior analyst, enforceable by the Board, and that no Kentucky regulation states a retention period for the client record.

The organizational pathway is where the archetypes converge, because a BHSO is licensed and accredited as an entity and its records duties attach to the organization. The Kentucky Medicaid page covers the coverage and reimbursement differences between the two pathways.

HIPAA, the incorporated BACB Code, and the Kentucky breach statute

HIPAA is the federal floor and applies uniformly. Kentucky layers three things on it.

• The incorporated BACB Code. The Board's regulation makes the BACB January 1, 2022 Ethics Code mandatory for every Kentucky licensee and defines confidential information to include all protected health information and educational records. The Code's confidentiality, documentation, and data provisions therefore have the force of a Kentucky regulation and are enforced by the Board, not only by the certifying body.
• Kentucky additions. The regulation adds two state-specific duties that supersede anything in the BACB Code: familiarity with and compliance with the abuse-reporting statute, KRS 620.030, and a duty to disclose confidential information without consent where the licensee has a duty to warn under KRS 202A.400 or 645.270.

• The breach statute. KRS 365.732 requires an information holder to notify affected Kentucky residents of a breach of computerized personal information. Its timing standard was not verified against the codified text for this page; counsel should confirm whether a fixed day count applies and whether notice to a state agency is required. HIPAA's 60-day outer limit governs protected health information in any event (KRS 365.732; 201 KAR 43:040 Sec. 1(4)).

Records retention: the rule the Board repealed and the floors that remain

Kentucky is the one state in this pillar where the profession's own retention rule was written and then repealed. The Board's regulation carried a six-year rule for client records and supervision records until October 4, 2022; the amendment that incorporated the BACB Code struck it. What remains is below.

A repeal is not a permission. The former six-year rule reflected what the Board considered adequate, the BACB Code the Board now incorporates requires records to be kept in accordance with applicable law, and every payor contract the practice signs will state a period. Build the schedule to the longest of the Medicaid provider agreement term once confirmed, HIPAA's six years, and any commercial contract, and treat the repealed six-year rule as the practice standard a buyer's counsel will still expect to see. Add a litigation-hold overlay, and read the proposed amendment to 201 KAR 43:040 when it is adopted in case a records clause returns (201 KAR 43:040 history, eff. 10-4-2022; proposed version noted on the LRC site).

Records ownership and custody on a change

Kentucky puts custody on the licensee in the individual pathway and on the licensed organization in the BHSO pathway. The BHSO license carries a change-of-ownership process through the Office of Inspector General and is expressly revoked if the organization is terminated from Medicaid, so a sale of a BHSO is a licensing event as well as a records event. In the individual pathway, the analysts' enrollments are personal and do not transfer, and the records duty follows the licensee under the Board's regulation and the incorporated BACB Code. In an asset sale under either pathway, custody must be negotiated so that a licensed custodian remains, the Medicaid provider agreement term survives, and any BHSO change of ownership is filed before the buyer bills (902 KAR 20:430; 907 KAR 1:671, 1:672).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either pathway. Kentucky adds that the Board's regulation makes the licensee responsible for confidential information including all PHI, so MSO access must be under the licensee's control, and that in the BHSO pathway the licensed organization, not the MSO, must hold the individual case records the Medicaid regulation requires. The Kentucky ownership page covers the fee terms that follow from the state's open ownership position.

Reading the Kentucky burden

Putting the pieces together, Kentucky is a light-facility state with a thin records rule. On the lighter side, the individual licensed behavior analyst pathway carries no facility license, the BHSO license is elective, and ownership is open. On the heavier side, the Board's repeal of its records rule leaves a practice without a Kentucky-stated retention period and dependent on contract terms and HIPAA, the breach statute's timing has to be confirmed, and a practice that elects the BHSO pathway takes on licensure, accreditation, and a license tied to Medicaid participation. The archetype decision changes little; the pathway decision changes everything.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. The individual licensed behavior analyst pathway under 907 KAR 15:010 and the BHSO pathway under 907 KAR 15:020 are the two ways Medicaid ABA is delivered, and the provider agreement carries the retention term to confirm. See the Kentucky Medicaid page.
• Licensing and credentialing. The KRS 319C license is required for either pathway, and the Board's regulation makes the BACB Ethics Code mandatory Kentucky law for every licensee. See the Kentucky licensing and credentialing page.
• Entity and ownership. Kentucky's professional entity statutes omit behavior analysts and ownership is open, so custody sits with the licensee or the licensed BHSO rather than with an entity form. See the Kentucky entity page and the Kentucky ownership page.
• Practice sale and expansion. The BHSO license's change-of-ownership process and its revocation on Medicaid termination, non-transferable individual enrollments, and the absence of a stated retention period are diligence items in any Kentucky transaction. See practice expansion and sale.

Getting set up in Kentucky: the sequence

1. Credential the analysts. Obtain KRS 319C licenses, enroll with Medicaid as provider type 63 and with each MCO, and adopt the BACB Ethics Code and the Kentucky additions in 201 KAR 43:040 as practice policy.
2. Choose the pathway. Decide whether to bill through individual licensed behavior analysts or to license and accredit a Behavioral Health Services Organization under 902 KAR 20:430 and enroll under 907 KAR 15:020.
3. Decide the diagnostics model. If a psychologist will be on staff, read 201 KAR Chapter 26 for the diagnostic file and reconcile it with the practice schedule.
4. Build the privacy program. Implement HIPAA, the incorporated BACB Code's confidentiality provisions, KRS 620.030 reporting, and the duty-to-warn rule, and confirm the KRS 365.732 timing for incident response.
5. Set the retention schedule. Configure retention to the longest of the confirmed Medicaid term, HIPAA's six years, and commercial contracts, using the repealed six-year rule as the practice standard, with a litigation-hold overlay.
6. Fix custody and MSO terms. Name the custodian, file any BHSO change of ownership before a buyer bills, keep MSO access under licensee control, and sign the business-associate agreement.

Kentucky facility and records variables at a glance

Frequently asked questions