Does your ABA clinic need a facility license in Massachusetts? And how must records be kept?

When an ABA practice needs a facility license in Massachusetts

Massachusetts licenses clinics through the Department of Public Health under M.G.L. c.111 sections 51 through 56, implemented by 105 CMR 140.000. The definition of a clinic is broad and the exemption is narrow, and both are in the statute.

The regulation supplies the definitions that decide whether an ABA practice is inside the first sentence and whether it can use the exemption in the second.

Autism spectrum disorder is a DSM-5 condition. An ABA practice is maintained for the purpose of treating it. Nothing in section 52 or in 105 CMR 140.000 says that behavior-analytic treatment of a DSM-5 condition is something other than a mental health service, and the Department's own reminder to licensees in January 2024 states the rule the other way: any entity providing ambulatory services that is not wholly owned and controlled by its practitioners is subject to clinic licensure. The practical rule is that a Massachusetts ABA practice should assume it is inside the definition and work from the exemption, and the Massachusetts licensing page covers the practitioner licenses that make the exemption available.

The exemption is the archetype: who owns and controls the practice

The exemption is written in terms of ownership and control by the practitioners so associated, and the regulation's definition of a practice makes clear what control means: supervision and direction of clinical staff, assignment of patients, and maintenance of records are part of the practice, while billing, space, and equipment services from a non-practitioner do not by themselves give the non-practitioner a share of control. That produces three positions.

• The practice wholly owned by its licensed practitioners. A practice owned entirely by licensed applied behavior analysts, or by psychologists, or by a combination of c.112 licensees who diagnose and treat mental health problems within their scope, is a group practice under the exemption, provided it does not use clinic, dispensary, or institute in its name. This is the only configuration that is outside section 52 on its face. The diagnostics archetype and the ABA-only archetype are both available here; what matters is that every owner is a practitioner.
• The practice with a non-practitioner owner. A practice with a lay founder, an investor, a management company, or a holding company in its ownership is not wholly owned and controlled by its practitioners and cannot use the exemption. It is a clinic under section 52 if ABA is a mental health service, and it must then hold a DPH license with the mental health service designation, meet the multidisciplinary staffing rule in 105 CMR 140.530, and submit to unannounced inspection under 140.110. The only alternative is to establish, with counsel and if necessary with the Department, that ABA for autism is not a mental health service within the statute. No published DPH position supporting that reading was found at the time of writing.
• The practice that uses a regulated name. Any entity that calls itself a clinic, dispensary, or institute and suggests that mental health services are rendered is a clinic regardless of ownership. A practitioner-owned ABA practice that puts clinic on the door forfeits the exemption.

The Massachusetts entity page explains that the professional form is elective for licensed applied behavior analysts; this page adds that the ownership test in section 52 is not elective, and that it is the test a buyer's counsel will run first (M.G.L. c.111 s.52; 105 CMR 140.020, Practice, Solo or Group Practice; 105 CMR 140.110, 140.530).

HIPAA, chapter 93H, and the mandatory written information security program

HIPAA is the federal floor and applies uniformly. Massachusetts layers a breach statute and a security regulation on it, and the regulation is the unusual one.

• Chapter 93H. Any person that owns or licenses data including personal information about a Massachusetts resident must, on knowledge of a breach, notify the affected residents, the Attorney General, and the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay. There is no fixed day count. The notice to residents must not state the nature of the breach or the number of residents affected, and a sample copy goes to the Attorney General and OCABR, which posts it publicly within one business day. Personal information is identifier-based, built on a name with a Social Security number, license number, financial account with access code, or biometric data; a breach of clinical records with none of those elements is a HIPAA breach that may not be a chapter 93H breach (M.G.L. c.93H ss.1, 3).
• 201 CMR 17.00. Every person that owns or licenses personal information about a Massachusetts resident must develop, implement, and maintain a comprehensive written information security program with a designated coordinator, a risk assessment, employee training, third-party service provider contract terms, and the technical safeguards the regulation lists. A HIPAA Security Rule program will cover most of it, but the WISP must exist as a Massachusetts document, and the Attorney General enforces it through chapter 93A at up to $5,000 per violation (201 CMR 17.03, 17.04; M.G.L. c.93A).
• Board confidentiality rules. The Board of Allied Mental Health requires licensees to notify clients in writing at the start of services that treatment records will be maintained and how, and holds licensees to the confidentiality standards it adopts. MassHealth providers are also holders of personal data under M.G.L. c.66A and must inform employees of those duties and secure the data physically (262 CMR 8.02(1)(c); 130 CMR 450.205(I)).

Records retention: two board rules and the MassHealth rule

Massachusetts has a specific retention rule for licensed applied behavior analysts, a shorter one for psychologists, and a MassHealth rule that overrides both when longer. The diagnostics archetype carries two board rules on one chart.

The Allied Mental Health rule binds the licensed applied behavior analyst personally and requires the record to be kept in a form a former client or successor licensee can access. For a pediatric practice the seven-year floor governs until the child is about eleven, after which the majority-plus-one rule takes over; either way the LABA rule is longer than the psychologist rule, so a combined practice should hold the whole chart to seven years. MassHealth's rule defers to the longer provider-type standard, which means 262 CMR 8.02 is also the MassHealth period for an ABA provider. Build the schedule to seven years or majority plus one, six years for MassHealth claim support, and a litigation-hold overlay (262 CMR 8.02(1)(b); 251 CMR 1.10; 130 CMR 450.205(G)).

Records ownership and custody on a change

Massachusetts puts custody on the licensee and, for an exempt practice, on the practitioner-owned entity, because the exemption itself requires that the practitioners control the maintenance of records. The Allied Mental Health rule requires the record to remain accessible to the client or a successor licensee, and the psychology board rule contains the same requirement. In a change of ownership the facility question and the custody question collapse into one: an asset sale to a non-practitioner buyer takes the practice out of the section 52 exemption on the day of closing, and a stock sale that admits a non-practitioner owner does the same. Custody must be negotiated so that a licensed custodian remains, the seven-year and majority-plus-one duties survive, and the six-year MassHealth duty is honored, and the buyer's counsel will read 105 CMR 140.020's transfer-of-ownership definition, which treats a transfer of a majority interest in a clinic as a licensing event (262 CMR 8.02(1)(b); 251 CMR 1.10; 105 CMR 140.020, Transfer of Ownership).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement and must also sit inside the practice's 201 CMR 17 program as a third-party service provider with contractual security obligations. Massachusetts adds the section 52 constraint: the regulation says that billing, space, and equipment services from a non-practitioner do not by themselves give the non-practitioner a share of control, but supervision of clinical staff, assignment of patients, and maintenance of records are part of the practice. An MSO that holds the record system for an exempt practice must hold it as the practitioners' agent, under their direction, with no ownership interest in the practice and no authority over clinical staffing or patient assignment. The Massachusetts ownership page covers how the management agreement is drawn to stay on the right side of that line.

Reading the Massachusetts burden

Putting the pieces together, Massachusetts is a heavy-burden state for a lay-owned ABA practice and a moderate one for a practitioner-owned practice. On the heavier side, the clinic statute reaches ambulatory mental health services, the regulation defines mental health by the DSM-5, the exemption turns on whole practitioner ownership and control, and DPH has told licensees it will refer unlicensed operators to the Attorney General. The WISP is mandatory and the Allied Mental Health retention rule is seven years to a licensee's name. On the lighter side, a practice wholly owned by its LABAs or psychologists is outside section 52 without any filing, MassHealth's retention rule defers to the profession's, and the breach statute has no fixed clock. The ownership decision is the facility decision here.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. MassHealth covers ABA as a defined service under 101 CMR 358 and requires six years of records under 130 CMR 450.205, deferring to the longer profession-specific rule. See the Massachusetts Medicaid page.
• Licensing and credentialing. The c.112 applied behavior analyst license is what makes a LABA a practitioner under 105 CMR 140.020 and what makes the section 52 exemption available. See the Massachusetts licensing and credentialing page.
• Entity and ownership. The professional form is elective for LABAs, but the section 52 exemption requires whole practitioner ownership and control, which is a stricter test than any entity statute imposes. See the Massachusetts entity page and the Massachusetts ownership page.
• Practice sale and expansion. Whether the exemption survives the transaction, the 105 CMR 140.020 transfer-of-ownership definition, and the WISP are diligence items in any Massachusetts transaction. See practice expansion and sale.

Getting set up in Massachusetts: the sequence

1. Map the cap table. Confirm that every owner is a c.112 practitioner who diagnoses and treats within scope, or obtain a written legal position on whether ABA is a mental health service under section 52 before admitting any other owner.
2. Name the practice. Keep clinic, dispensary, and institute out of the name; a regulated name is a clinic regardless of ownership.
3. Credential and enroll. Obtain c.112 licenses for analysts and assistants, enroll with MassHealth as an ABA provider, and adopt the 262 CMR 8.02 written notice at intake.
4. Write the WISP. Develop the 201 CMR 17.00 written information security program with a designated coordinator, risk assessment, training, and third-party provider terms, alongside the HIPAA Security Rule program.
5. Set the retention schedule. Configure retention to seven years or majority plus one under 262 CMR 8.02, five years under 251 CMR 1.10 for any psychologist file held to the shorter rule, six years for MassHealth, with a litigation-hold overlay.
6. Fix custody and MSO terms. Keep supervision of clinical staff, assignment of patients, and maintenance of records under practitioner control, put the MSO under the WISP as a service provider, and sign the business-associate agreement.

Massachusetts facility and records variables at a glance

Frequently asked questions