Does your ABA clinic need a facility license in Minnesota? And how must records be kept?

When an ABA practice needs a facility license in Minnesota

Minnesota has no outpatient clinic license that reaches a professional practice; the Department of Health licenses hospitals, outpatient surgical centers, and similar facilities, and the Department of Human Services licenses residential and home-and-community-based programs under chapter 245D. An outpatient ABA practice is none of those. Behavior analysts have been licensed by the Board of Psychology under sections 148.9981 to 148.9995 since January 1, 2025, with psychologists exempt from the requirement, which the Minnesota licensing page covers (Minn. Stat. 148.9981-148.9995; Minn. Stat. ch. 245D).

What Minnesota has instead of a facility license is the EIDBI benefit. An agency delivering EIDBI services must enroll with Minnesota health care programs and meet a list of agency duties that reads like a facility standard without the building. The statute defines the agency broadly enough to include a single licensed professional practicing independently.

The practical rule is that Minnesota replaces the facility-license question with an agency-enrollment question for Medical Assistance ABA, and that the agency standards, not any physical-plant survey, are where the weight sits.

The real hurdle: EIDBI agency enrollment and the two archetypes

The EIDBI benefit is a chain with three named roles, and the archetype fork is at the first link.

• The practice with in-house diagnostics. A licensed psychologist is a mental health professional under section 245I.04 and can be the comprehensive multidisciplinary evaluation provider, can complete or confirm the diagnostic assessment under subdivision 4, and can serve as the qualified supervising professional. The practice opens its own cases, develops its own individual treatment plans, and submits its own six-month progress monitoring under subdivision 7 without an outside evaluator in the loop.
• The ABA-only practice. A licensed behavior analyst with 2,000 hours may be the qualified supervising professional since the statute was amended to name the license, and the practice's level I, II, and III providers deliver the intervention. But a licensed behavior analyst is not a mental health professional under 245I.04 and cannot be the CMDE provider, so every case depends on an outside physician, nurse practitioner, physician assistant, or mental health professional for the evaluation that establishes medical necessity, and the progress monitoring the CMDE provider may require.

Both archetypes carry the agency duties in subdivision 16: enrollment under Minnesota Rules 9505.0195, a designated compliance officer, an office in Minnesota or a border state, background studies through NETStudy 2.0 before direct contact, maltreatment reporting and training, written incident reports kept on file five years, a written description of the treatment modality and staff levels before services start, clinical supervision of at least one hour per sixteen hours of direct treatment, and observation and direction at least monthly with no more than two consecutive months by telehealth. Subdivision 18 gives the commissioner the right to conduct unannounced on-site inspections and to withhold payment or terminate enrollment for noncompliance. The Minnesota Medicaid page covers the covered-service definitions and the four recognized modalities (Minn. Stat. 256B.0949 subds. 4, 5a, 7, 13, 15, 16, 16a, 18).

HIPAA, the Minnesota Health Records Act, and the breach statute

HIPAA is the federal floor and applies uniformly. Minnesota layers a health records statute and a breach statute on it, and the health records statute is stricter than HIPAA.

• The Minnesota Health Records Act. Sections 144.291 to 144.298 require a provider to obtain the patient's signed and dated consent before releasing health records, with exceptions that are narrower than HIPAA's treatment, payment, and operations permissions, and set the rules for patient access, record locator services, and representation of minors. The Act's coverage is a list of regulated professions.

Behavior analysts are licensed under sections 148.9981 to 148.9995, which sit in chapter 148, and psychologists are licensed under the same chapter. Since the licensing requirement took effect on January 1, 2025, both archetypes are providers under the Act, and an ABA practice that built its release practices on HIPAA alone must add the Minnesota consent rule for disclosures that HIPAA would permit without authorization. Counsel should map the section 144.293 exceptions against the practice's actual disclosure flows before the first payer audit request arrives (Minn. Stat. 144.291 subd. 2(i); 144.293; 148.9986).

• The breach statute. Section 325E.61 requires a business that owns or licenses data including personal information to disclose a breach in the most expedient time possible and without unreasonable delay, consistent with law enforcement needs and the time needed to determine scope and restore integrity. It sets no day count and does not require notice to the Attorney General, but it requires notice to the consumer reporting agencies within 48 hours when more than 500 persons are notified at one time. HIPAA's 60-day outer limit is the only fixed clock (Minn. Stat. 325E.61).
• The EIDBI rights and data rules. Subdivision 14 gives each person the protections of the health care bill of rights in section 144.651, the right to designate an advocate, and the right to be free from seclusion and restraint except emergency manual restraint under 245D.02; subdivision 16(a)(10) requires the agency to comply with data requests under the Government Data Practices Act and sections 256B.064 and 256B.27. The Minnesota Consumer Data Privacy Act took effect July 31, 2025; its treatment of HIPAA-covered information should be confirmed by counsel and is not stated on this page.

Records retention: the Medical Assistance rule governs

Minnesota has no retention rule addressed to behavior analysts, and no psychology board retention rule was located in this review. The Medical Assistance rule and the EIDBI statute supply the floors that bind an ABA practice.

The Medical Assistance rule runs from the initial date of billing rather than the date of service, and it follows the vendor out of the program: a vendor that withdraws or is terminated must still retain or produce the records. For a pediatric practice without a profession-specific minor rule, five years after billing is the state floor and HIPAA's six years for required documentation sits beside it. Build the schedule to the longer of the two across the chart, keep incident reports the full five years the EIDBI statute requires, and add a litigation-hold overlay (Minn. R. 9505.2190; Minn. Stat. 256B.0949 subd. 16(a)(13)).

Records ownership and custody on a change

Minnesota puts custody on the enrolled agency, because the EIDBI statute makes the agency the legal entity responsible for its employees' compliance and the Medical Assistance rule makes the vendor responsible for the records. On a change of ownership the rule is explicit: the transferor remains responsible for maintaining, preserving, and producing the records to the department unless law or a written agreement with the transferee provides otherwise. That is the opposite default from Indiana's, and it means a Minnesota seller that walks away without a records clause keeps the five-year duty. The Health Records Act adds that the records belong to the patient for access purposes and that any transfer to a successor must honor the consent rules. In an asset sale, custody must be negotiated in writing so that the transferee assumes the 9505.2190 duty, the agency's incident files and background-study documentation move with the program, and the EIDBI enrollment itself, which does not transfer, is re-established before the transferee bills (Minn. R. 9505.2190 subp. 3; Minn. Stat. 256B.0949 subd. 2(c), 16a).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement. Minnesota adds that disclosures to the MSO are disclosures by a provider under the Health Records Act, so the MSO's access must fit a 144.293 exception or be covered by patient consent, and that the EIDBI agency must disclose, on the commissioner's request, its use of billing agencies and consultants who do not provide EIDBI services and produce their contracts. The MSO cannot be the agency and cannot be the custodian. The Minnesota ownership page covers the fee and control terms; this page adds only that the management agreement will be read by DHS under subdivision 16(b) and should be drawn with that in mind.

Reading the Minnesota burden

Putting the pieces together, Minnesota is a moderate-burden state whose weight sits in the benefit rather than the building. On the lighter side, there is no clinic license for outpatient ABA, the retention rule is five years from billing, and the breach statute has no fixed clock. On the heavier side, EIDBI enrollment brings a compliance officer, background studies, supervision ratios, incident files, monthly observation, and unannounced DHS inspection, the Health Records Act now reaches behavior analysts and requires consent where HIPAA does not, and the CMDE provider rule keeps the ABA-only practice dependent on an outside evaluator for every case. The archetype decision is a throughput decision: the practice with a mental health professional on staff controls the front door of the benefit.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. EIDBI agency enrollment, the CMDE and QSP roles, the four recognized modalities, six-month progress monitoring, and DHS inspection are the operating structure of Medical Assistance ABA in Minnesota. See the Minnesota Medicaid page.
• Licensing and credentialing. The chapter 148 behavior analyst license is what qualifies a licensed behavior analyst as a QSP and what places the profession inside the Health Records Act. See the Minnesota licensing and credentialing page.
• Entity and ownership. Minnesota's professional firms act closed list omits behavior analysts, so the entity is ordinary and the agency, not the entity form, carries the compliance obligations. See the Minnesota entity page and the Minnesota ownership page.
• Practice sale and expansion. The 9505.2190 transferor rule, non-transferable EIDBI enrollment, and the agency's incident and background-study files are diligence items in any Minnesota transaction. See practice expansion and sale.

Getting set up in Minnesota: the sequence

1. Credential the team. Obtain chapter 148 licenses for behavior analysts, confirm the QSP's 2,000 hours, and staff the level I, II, and III roles to subdivision 15.
2. Decide the diagnostics model. If a mental health professional will be on staff, build the CMDE and diagnostic assessment workflow in-house under subdivisions 4 and 5; if not, establish referral relationships with outside CMDE providers.
3. Enroll as an agency. Enroll under Minn. R. 9505.0195, designate the compliance officer, initiate NETStudy 2.0 background studies before direct contact, and confirm the Minnesota or border-state office.
4. Build the privacy program. Implement HIPAA and the Health Records Act consent rule, adopt the subdivision 14 person's rights document, and write incident response to HIPAA's clock with the 48-hour consumer reporting agency notice above 500 persons.
5. Set the retention schedule. Configure retention to five years from billing under 9505.2190 and six years for HIPAA documentation, keep incident reports five years, and add a litigation-hold overlay.
6. Fix custody and MSO terms. Write the 9505.2190 transferor rule into any sale agreement, keep MSO access inside a 144.293 exception or patient consent, disclose billing agents as subdivision 16(b) requires, and sign the business-associate agreement.

Minnesota facility and records variables at a glance

Frequently asked questions