Does your ABA clinic need a facility license in Missouri? And how must records be kept?

When an ABA practice needs a facility license in Missouri

For a standard outpatient ABA practice, Missouri does not require a facility license. Missouri regulates ABA at the practitioner level: behavior-service providers must be licensed in the state, typically as Licensed Behavior Analysts or Licensed Assistant Behavior Analysts under the Behavior Analyst Advisory Board's rules, and ABA is delivered under those licenses through MO HealthNet (20 CSR 2063-4.005; 20 CSR 2063-5.010). Two enrollment details shape practice structure: a clinic specialty code requires at least two enrolled analysts on staff, and a provisional licensee may not practice independently, receive direct payment, or own an ABA business (MO HealthNet provider enrollment). There is no facility license that applies to an ABA-only outpatient clinic by default, and the Department of Mental Health certification tracks that do exist, covered next, are a separate lane.

The DMH certification tracks and the Medicaid route

The Missouri facility question turns on telling two systems apart:

• DMH certification is for specific program types. The Department of Mental Health certifies organizations for Comprehensive Substance Treatment and Rehabilitation (CSTAR), Community Psychiatric Rehabilitation (CPR), and the certified community behavioral health clinic model, which are eligibility gates for those particular Medicaid programs, and Missouri operates a large network of certified community behavioral health clinics. Missouri does not require certification for non-contracted agencies providing mental-health or substance-use services unless they receive county mental-health funds, so outpatient ABA does not enter these tracks (Mo. DMH certification).
• Residential licensure is separate. The Department of Mental Health licenses residential programs and developmental-disability day programs, with surveys and standards, but these are not outpatient ABA (9 CSR).
• The Medicaid route for ABA. ABA is delivered through MO HealthNet by enrolled analysts, by way of both the state-plan benefit and the developmental-disability waiver, with behavioral health carved out of managed care and billed fee-for-service. Participation is through licensure and MO HealthNet enrollment, not a facility license.

The practical rule is that Missouri is light on facility licensure for outpatient ABA: the operative requirements are analyst licensure and MO HealthNet enrollment, and the DMH certification and residential-licensure tracks become relevant only if you operate those specific program types or take county mental-health funds.

HIPAA and Missouri's confidentiality rules

HIPAA is the federal floor and applies uniformly. Missouri then layers state confidentiality on top:

• Department of Mental Health client-record confidentiality. Missouri protects the confidentiality of client records in the Department of Mental Health system, a state-law layer relevant where an ABA practice operates within or alongside that system (RSMo Section 630.140).
• General medical-records confidentiality. Missouri's broader medical-records and physician-patient confidentiality rules apply to the clinical record and govern disclosure on top of HIPAA.
• Substance-use overlay. Where any substance-use information is involved, the federal 42 CFR Part 2 confidentiality rules add a stricter consent-and-redisclosure regime.

The operational takeaway is that a Missouri ABA practice builds its privacy program to HIPAA, the Department of Mental Health client-record confidentiality, and the general medical-records rules, applying the stricter standard at each point. Missouri has no single broad medical-records privacy statute on the model of some states, so the privacy load is in the moderate range.

Records retention: the minor rule and Medicaid

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the five-year Medicaid minimum, means records must be kept securely for many years after a child's last service (Missouri records retention; MO HealthNet). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter five-year Medicaid or six-year HIPAA-administrative periods drive early destruction of pediatric records.

Records ownership and custody on a change

Missouri treats the licensed practitioner or entity as the custodian of patient records, and the confidentiality rules govern how that information may be disclosed (RSMo Section 630.140; Missouri custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. MO HealthNet also requires providers to notify the Missouri Medicaid Audit and Compliance provider-enrollment unit of changes such as a new address, additional locations, a change in payee, or the dissolution of a group practice. Plan custody and the enrollment notifications before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Missouri does not redefine that relationship the way some broad state statutes do. What Missouri adds is that any access to records must satisfy the Department of Mental Health and medical-records confidentiality rules, and that the MSO cannot be the licensed records custodian (RSMo Section 630.140). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Missouri's confidentiality rules, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the Missouri burden

Putting the pieces together, Missouri is a light-facility, moderate-privacy state. On the lighter side, a standard outpatient ABA clinic needs no facility license, the regulation sits at the analyst-license and MO HealthNet-enrollment level, the DMH certification and residential-licensure tracks are separate lanes that outpatient ABA does not enter, and Medicaid billing does not trigger a facility survey. On the heavier side, the enrollment rules shape practice structure through the two-analyst clinic code and the provisional-licensee limits, the Department of Mental Health and medical-records confidentiality rules add state privacy obligations on top of HIPAA, and the minor-records rule extends retention past the five-year Medicaid minimum. The practical read is that Missouri keeps the entry light for outpatient ABA, with the operational care going into licensure, enrollment, and privacy rather than a facility survey. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Missouri runs ABA through two lanes, the state-plan benefit and the developmental-disability waiver, pays the supervising analyst rather than reimbursing parents, and has statutory audio-only telehealth parity that helps rural delivery; the clinic setting is where any facility question would arise. See the Missouri Medicaid page, which treats the two lanes and place of service in detail.
• Licensing and credentialing. The analyst-licensure rules, the two-analyst clinic code, and the provisional-licensee limits are the credentialing story. See the Missouri licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the confidentiality rules shape how the entity and any MSO are structured. See the Missouri entity page and the Missouri ownership page.
• Practice sale and expansion. Records custody and the MO HealthNet enrollment notifications are diligence items in any Missouri transaction. See practice expansion and sale.

Getting set up in Missouri: the sequence

1. License the analysts. Obtain Licensed Behavior Analyst or Licensed Assistant Behavior Analyst licensure under the Behavior Analyst Advisory Board's rules.
2. Confirm the facility question. Confirm that your outpatient configuration does not require DMH certification or residential licensure, which apply to specific program types or county-funded entities.
3. Enroll for Medicaid. Complete MO HealthNet enrollment for the state-plan benefit and, where applicable, the developmental-disability waiver, meeting the two-analyst clinic-code rule if relevant.
4. Build the privacy program. Implement HIPAA plus the Department of Mental Health and medical-records confidentiality rules, with a 42 CFR Part 2 overlay if any substance-use information is involved.
5. Set the retention schedule. Configure retention to the minor rule and the five-year Medicaid minimum, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and you can meet the MO HealthNet change notifications.

Missouri facility and records variables at a glance

Frequently asked questions