Does your ABA clinic need a facility license in Maryland? And how must records be kept?

When an ABA practice needs a facility license in Maryland

For a standard outpatient ABA practice, Maryland generally regulates at the practitioner level rather than through a facility license. Behavior analysts are licensed by the Maryland Board of Professional Counselors and Therapists, registered behavior technicians work under their supervision, and Medicaid ABA is delivered through provider enrollment and the State's administrative services organization rather than a facility survey (Md. behavior-analyst licensure; Maryland Medicaid ABA). There is no separate Maryland license that applies to an ABA-only outpatient clinic as such. The facility question becomes live only when a practice operates as a licensed behavioral-health program, which the next section addresses.

What would trigger a Behavioral Health Administration license

Maryland has a developed framework for licensing community behavioral-health programs through the Behavioral Health Administration under COMAR Title 10, Subtitle 63, which is more built-out than the framework in light-touch states (MDH BHA; COMAR 10.63). A facility or program license becomes relevant when an ABA practice takes on a configuration that fits a licensed program category:

• A licensed behavioral-health program model. Operating as a community behavioral-health program, rather than as outpatient ABA delivered by licensed analysts, can bring a practice within the BHA program-licensure framework.
• Multidisciplinary or broader mental-health scope. Adding psychotherapy, psychiatry, or a broader mental-health-clinic model alongside ABA increases the likelihood that a program license applies, where ABA-only generally would not.
• Residential or day-program settings. Higher-intensity settings map to their own licensure categories, which an outpatient ABA clinic does not.
• Medicaid, generally, is not itself the trigger. Maryland Medicaid ABA runs through provider enrollment and the administrative services organization that manages the benefit, so Medicaid billing by itself does not usually require a facility license, although it does bring its own enrollment, prior-authorization, and diagnostic-gating requirements.

The practical rule is that Maryland is moderate: an outpatient ABA clinic is generally light on facility licensure, but Maryland's program-licensure framework is real enough that a multidisciplinary or program-style configuration should be checked carefully with BHA before launch.

HIPAA and the Confidentiality of Medical Records Act

HIPAA is the federal floor and applies uniformly. Maryland then adds a named state privacy law, the Confidentiality of Medical Records Act, codified at Health-General Sections 4-301 through 4-309, which was enacted to bolster patient privacy and to set clear rules for disclosure (Md. Code, Health-Gen. Sections 4-301 to 4-309). The features that matter for an ABA practice are:

• A confidentiality-by-default rule. Health-care providers must keep medical records confidential and may disclose them only as Maryland law allows, which is a state-law obligation layered on top of HIPAA rather than a restatement of it (Md. Code, Health-Gen. Section 4-302).
• A distinct, more protective regime for mental-health records. Section 4-307 sets specific permissive and mandatory disclosure rules for mental-health records, and Maryland courts have recognized a heightened privacy interest in mental-health records, so the records of behavioral services receive extra protection beyond ordinary medical records (Md. Code, Health-Gen. Section 4-307).
• State remedies. A provider or other person who knowingly violates the Act is liable for actual damages, a state-law exposure in addition to HIPAA enforcement.

The operational takeaway is that a Maryland ABA practice should build its privacy program to the stricter of HIPAA and the Confidentiality of Medical Records Act at each point, treating ABA documentation with the heightened care Maryland gives mental-health records. The Maryland regime is more protective than the federal floor but is not the absolute written-consent system that the strictest states impose, which places Maryland in the middle of this spoke's privacy range.

Records retention: seven years, longer for minors

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and extends retention well beyond the adult seven-year baseline (Md. Code, Health-Gen. Section 4-403). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact minor period with counsel, and do not let the shorter Medicaid or HIPAA-administrative periods drive early destruction.

Records ownership and custody on a change

Maryland law and board rules treat the licensed clinical entity (or provider) as the custodian of patient records, which has consequences when ownership changes (Md. Code, Health-Gen. Section 4-301 et seq.; Maryland custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not itself part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. Because Maryland attaches actual-damages liability to knowing improper disclosure, custody and transfer mechanics should be handled deliberately. Plan custody arrangements before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Maryland does not redefine that relationship the way some broad state statutes do. What Maryland adds is that any disclosure of records, including to or through an MSO, must satisfy the Confidentiality of Medical Records Act, with extra care for mental-health records under Section 4-307 (Md. Code, Health-Gen. Sections 4-302, 4-307). The practical effects are that the MSO needs a HIPAA business-associate agreement, that MSO access must remain within the Act's disclosure rules, and that the MSO cannot be the licensed records custodian. Structure the MSO relationship so the clinical entity remains custodian, the business-associate agreement is in place, and disclosures fit the Act.

Reading the Maryland burden

Putting the pieces together, Maryland is a moderate-burden state. On the lighter side, a standard outpatient ABA clinic generally needs no separate facility license, the regulation sits at the practitioner and enrollment level, and Medicaid billing does not usually trigger a facility survey. On the heavier side, Maryland's Behavioral Health Administration program-licensure framework is developed enough that a multidisciplinary or program-style configuration must be checked, the Confidentiality of Medical Records Act gives ABA records heightened state protection with its own remedies, and the minor-records rule extends retention well past the seven-year adult baseline. The practical read is that Maryland sits between the light-touch and the strict states: more privacy and program structure than a minimal state, less than the strictest. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit downstream of several other decisions in this guide:

• Medicaid and place of service. The place-of-service mix drives the facility question: the clinic setting is where any facility and physical-plant questions arise, while home, school, and telehealth delivery generally avoid them. See the Maryland Medicaid page, which treats place of service and the telehealth-tier rule in detail.
• Licensing and credentialing. The analyst license through the Board of Professional Counselors and Therapists is the foundation. See the Maryland licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the Confidentiality of Medical Records Act shape how the entity and any MSO are structured. See the Maryland entity page and the Maryland ownership page.
• Practice sale and expansion. Records custody on a change of ownership is a core diligence and structuring item. See practice expansion and sale.

Getting set up in Maryland: the sequence

1. License the analysts. License behavior analysts through the Maryland Board of Professional Counselors and Therapists.
2. Form the entity and confirm the facility question. Form the corporate entity and confirm with BHA whether your configuration is outpatient ABA or a licensed behavioral-health program.
3. Enroll for Medicaid if applicable. Complete Maryland Medicaid enrollment and the administrative-services-organization process, which is the Medicaid pathway rather than a facility license.
4. Build the privacy program to the CMRA. Implement HIPAA plus the Confidentiality of Medical Records Act, with heightened care for mental-health records under Section 4-307.
5. Set the retention schedule. Configure retention to the seven-year adult rule and the longer minor rule, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and disclosures fit the Act.

Maryland facility and records variables at a glance

Frequently asked questions