Does your ABA clinic need a facility license in Maine? And how must records be kept?

When an ABA practice needs a facility license in Maine

Maine's mental health agency licensing statute provides for licenses "to operate, conduct or maintain an agency or facility for the provision of mental health services as defined in section 3601," and the commissioner issues a full license to an applicant that has complied with the statute's requirements (34-B M.R.S. 1203-A). The definitions in section 3601 are broad: "agency" is any person, firm, association or corporation, and "mental health services" includes "other psychological, psychiatric, diagnostic or therapeutic services and other allied services" (34-B M.R.S. 3601).

An outpatient ABA practice organized as a firm or corporation could fall inside those words. The statute does not say whether the Department of Health and Human Services treats ABA as a mental health service, and the implementing rule (10-144 CMR chapter 123) returned an access error. This guide therefore cannot say an ABA-only practice is licensed or unlicensed in practice. It can say that the text does not exempt one, and that counsel should ask the Department before opening. A center-based or day-treatment ABA approval was not found.

The two archetypes: what changes between them

• The practice with in-house diagnostics. The exclusion from "agency" covers "the individual or corporate professional practice of one or more psychologists or psychiatrists" (34-B M.R.S. 3601). A practice of psychologists or psychiatrists is outside the definition. The text names only psychiatrists among physicians, and it does not say whether a mixed practice that also employs behavior analysts keeps the exclusion. A practice that adds behavior analysts to a psychologist practice should not assume it does.
• The ABA-only practice. No exemption applies on the text, which is the strongest facility hit in this batch. Maine has no Title 32 chapter for behavior analysts, so no board rule or licensure deadline applies to its records.

HIPAA and the Maine breach statute

HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.

Maine's breach statute is the shortest outer limit among the states in this batch. Notices "must be made no more than 30 days after the person ... becomes aware of a breach of security and identifies its scope" absent a law enforcement delay. Whenever resident notice is required, the person notifies the appropriate state regulators within the Department of Professional and Financial Regulation or, if not regulated by that department, the Attorney General, with no numeric threshold. Consumer reporting agencies are notified when more than 1,000 persons are notified at once. Covered personal information is Social Security number, driver's license or state identification number, account numbers, and passwords or access codes; medical and health insurance information are not listed, and no HIPAA deemed-compliance provision appears (10 M.R.S. 1347, 1348).

Maine also has a health care information confidentiality statute. It defines "health care practitioner" as "a person licensed by this State to provide or otherwise lawfully providing health care," and "health care" to include therapeutic care and counseling that "affects an individual's physical, mental or behavioral condition" (22 M.R.S. 1711-C). On those definitions an unlicensed behavior analyst practice appears to be reached, which is a reading of the definitions and not a stated holding. Health care information is confidential and may not be disclosed except as the statute allows. The statute was amended in 2025.

Records retention

Maine has no behavior analyst retention rule because it does not license behavior analysts. Psychologist and physician retention rules were not researched for this page, and the Medicaid floor could not be verified.

The verified floor is HIPAA's six years for required documents. A practice should add a pediatric benchmark and confirm the MaineCare term before setting the schedule.

Records ownership and custody on a change

No Maine statute or rule on records custody when a practice closes or is sold was found, and the Medicaid retention and ownership-change sources are on a blocked host. In an asset sale, the purchase agreement should name a custodian, carry the retention schedule, and address the confidentiality statute's limits on disclosure to the buyer.

The MSO question

A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. Maine's mental health agency license is held by the agency or facility providing the services, so an MSO should not be the licensed entity unless it delivers the services. The Maine ownership page covers who may own the clinical entity.

Reading the Maine burden

Maine is heavy at the front door. The agency license is the issue: a broad definition, a narrow exemption, and no readable agency rule. The 30 day breach limit and the regulator notice are tighter than most states in this batch, and the confidentiality statute appears to reach an unlicensed ABA practice. Records rules for the professions are unverified.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the Maine Medicaid page.
• Licensing and credentialing. Maine does not license behavior analysts, so there is no board custody rule or licensure deadline, and the agency license is the only state license layer in question. See the Maine licensing and credentialing page.
• Entity and ownership. Maine's agency license attaches to the person, firm, association or corporation providing the services, so the entity that delivers care is the one that may need it. See the Maine entity page and the Maine ownership page.
• Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any Maine transaction. See practice expansion and sale.

Getting set up in Maine: the sequence

1. Ask the Department. Before opening, ask the Department of Health and Human Services whether an ABA practice is a licensable mental health agency under 34-B M.R.S. 1203-A.
2. Decide the diagnostics model. If the practice is psychologists or psychiatrists, the exclusion may apply. If behavior analysts are added, get an answer for the mixed practice.
3. Build the privacy program. Implement HIPAA and write incident response to Maine's 30 day limit with regulator notice.
4. Set the retention schedule. Configure retention to HIPAA's six years at minimum, confirm the MaineCare term, and add a pediatric benchmark.
5. Settle custody. Name a custodian in any sale or closure agreement.

What this guide could not verify

Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:

• Whether the Department treats ABA as a licensable mental health service; the rule in 10-144 CMR chapter 123 returned an access error.
• A center-based or day-treatment ABA approval.
• Physician and psychologist retention rules; not researched.
• MaineCare retention and any records custody rule.
• Any amendment to 22 M.R.S. 1711-C after the Revisor extraction date.
• Whether the 2025 amendments changed the licensing statute's exemptions.

Maine facility and records variables at a glance

Frequently asked questions