Does your ABA clinic need a facility license in Nevada? And how must records be kept?

When an ABA practice needs a facility license in Nevada

Nevada licenses health facilities through the Division of Public and Behavioral Health under chapter 449 of the Nevada Revised Statutes, which covers medical facilities and facilities for the dependent. A professional office delivering outpatient ABA is not a licensed category under that chapter, and Nevada regulates the profession instead: behavior analysts, assistant behavior analysts, and registered behavior technicians are licensed or registered under chapter 641D by the Board of Applied Behavior Analysis, which the Nevada licensing page covers (NRS ch. 449; NRS ch. 641D).

What Nevada does have for every provider of health care is a records statute with specific duties that go beyond retention. The health care records statute requires retention for five years, forbids destruction of a young patient's records, and requires the provider to tell patients about its destruction practices in two ways.

The practical rule is that no Nevada facility license reaches an outpatient ABA practice under either archetype, and the entry gates are the chapter 641D credential and Medicaid and commercial enrollment. The records statute is the layer that does the work a facility rule does elsewhere, and its reach turns on a definition discussed next.

The two archetypes and the question of who is a provider of health care

NRS 629.051 binds each provider of health care, and NRS 629.031 defines that term by listing the licensing chapters whose licensees are included. The archetypes split on whether their clinicians are on the list.

• The practice with in-house diagnostics. Psychologists are licensed under chapter 641 and are within the definition of a provider of health care. The psychologist's records are therefore squarely under NRS 629.051: five years from receipt or production, no destruction before the patient turns 23, a posted sign, and a written statement at the first visit. The Board of Psychological Examiners may add its own records rules, which were not verified for this page.
• The ABA-only practice. Chapter 641D was enacted after the records statute's definition was last read for this page, and whether NRS 629.031 has been amended to list 641D licensees was not confirmed. If it has, the ABA-only practice is inside the statute on its own account; if it has not, the practice is bound by HIPAA and its contracts and should adopt the 629.051 standard anyway, because a combined practice cannot run two destruction rules on one chart and because the boards' public statements under NRS 629.053 set the expectation a buyer's counsel will apply.

The Medicaid layer is the Division of Health Care Financing and Policy's provider enrollment for ABA, which the Nevada Medicaid page covers; the provider type and its documentation rules were not verified for this page. Neither archetype needs a facility license to enroll (NRS 629.031; NRS 629.051; NRS 629.053).

HIPAA, the breach statute, and the consumer health data law

HIPAA is the federal floor and applies uniformly. Nevada layers a breach statute, a security statute, and a consumer health data law on it.

• The breach statute. NRS 603A.220 requires a data collector that owns or licenses computerized personal information to disclose a breach to affected residents in the most expedient time possible and without unreasonable delay, with notice to the consumer reporting agencies when more than 1,000 residents are notified. It sets no day count and no Attorney General notice. HIPAA's 60-day outer limit is the fixed clock for protected health information. The statute's current text was not fetched for this page and the summary should be confirmed before it is written into a policy.
• The security statute. NRS 603A.210 and following require reasonable security measures and, for data collectors doing business in Nevada, encryption of personal information transmitted electronically outside the secure system or moved on a data storage device beyond the collector's control.
• The consumer health data law. Senate Bill 370 of the 2023 session, effective March 31, 2024, regulates consumer health data held by regulated entities outside HIPAA, with consent, privacy policy, and deletion rights and a ban on geofencing near health facilities. Its treatment of a HIPAA covered entity's data should be confirmed by counsel and is not stated on this page.

The records statute adds two notice duties that are Nevada-specific. The provider must post a sign about record destruction, and must give a first-time patient a written statement that records may be destroyed after the retention period, in the form the State Board of Health prescribes by regulation. The licensing boards named in NRS 629.053 must publish the destruction rules on their websites (NRS 603A.210, 603A.220; SB 370 (2023); NRS 629.051; NRS 629.053).

Records retention: five years, and never before age 23

Nevada's retention rule is short for adults and long for children, and it applies by the patient's age rather than by years past majority. The table states the rule and flags the definitional question.

For a pediatric ABA practice the age-23 rule is the operative one: a two-year-old's intake is held for twenty-one years, and the five-year clock for that record does not begin to matter until the patient is 18. The five-year rule runs from receipt or production rather than from the last visit, which is shorter than most states for adult records. Build the schedule to age 23 for every patient under 18 at intake, five years from production for adults, the Medicaid term once confirmed, and a litigation-hold overlay, and post the sign and issue the written statement from the first visit (NRS 629.051(1), (7); NRS 629.053).

Records ownership and custody on a change

Nevada puts custody on the provider of health care, and its records statute assumes the provider will control destruction, which is why it requires the destruction notices. The Board of Psychological Examiners and the Board of Applied Behavior Analysis may add custody and practice-closure rules, which were not verified for this page. In an asset sale, custody must be negotiated so that a provider of health care remains custodian, the age-23 rule survives for every pediatric record, the Medicaid enrollment, which does not transfer, is re-established before the buyer bills, and the destruction-notice obligations are carried by the successor. A buyer's counsel will read NRS 629.051 as the standard regardless of which archetype the seller ran (NRS 629.051; NRS 629.053).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either archetype. Nevada adds that the security statute requires encryption of personal information leaving the secure system, which reaches data flows between the practice and the MSO, and that the records statute's retention and destruction duties belong to the provider of health care, so the MSO cannot be the custodian and cannot destroy a record on its own schedule. The Nevada ownership page covers the professional entity option and the fee terms that follow.

Reading the Nevada burden

Putting the pieces together, Nevada is a light-facility state with a long minor rule. On the lighter side, there is no facility license for outpatient ABA, ownership is open with an elective professional entity, and the breach statute has no fixed clock. On the heavier side, the age-23 rule makes every pediatric record a two-decade obligation, the destruction-notice duties are unusual and easy to miss, and the definitional question about 641D licensees has to be answered before a practice knows whether it is inside the statute on its own account. The archetype decision matters mostly through that definition.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid ABA runs through Division of Health Care Financing and Policy provider enrollment, with a provider type and retention term to confirm; no facility layer is involved. See the Nevada Medicaid page.
• Licensing and credentialing. The chapter 641D license is the credential, and whether it places a behavior analyst inside the NRS 629.031 definition of a provider of health care is the records question. See the Nevada licensing and credentialing page.
• Entity and ownership. Nevada's professional entity is elective and ownership is open, so custody sits with the provider of health care rather than with an entity form. See the Nevada entity page and the Nevada ownership page.
• Practice sale and expansion. The age-23 rule on pediatric records, the destruction-notice duties, and non-transferable Medicaid enrollment are diligence items in any Nevada transaction. See practice expansion and sale.

Getting set up in Nevada: the sequence

1. Credential the team. Obtain chapter 641D licenses and registrations from the Board of Applied Behavior Analysis and enroll with Medicaid and the managed care plans.
2. Answer the definitional question. Have counsel confirm whether NRS 629.031 lists 641D licensees; adopt the NRS 629.051 standard as practice policy either way.
3. Confirm the facility question. Confirm the outpatient configuration is not a chapter 449 medical facility.
4. Build the privacy program. Implement HIPAA and the NRS 603A security and encryption rules, confirm the breach statute's current text, map the consumer health data law with counsel, post the destruction sign, and issue the first-visit written statement.
5. Set the retention schedule. Configure retention to no destruction before age 23 for every pediatric record, five years from production for adults, the Medicaid term once confirmed, and a litigation-hold overlay.
6. Fix custody and MSO terms. Name the provider of health care as custodian, prohibit MSO-initiated destruction, encrypt data flows to the MSO, and sign the business-associate agreement.

Nevada facility and records variables at a glance

Frequently asked questions