Does your ABA clinic need a facility license in New Jersey? And how must records be kept?

When an ABA practice needs a facility license in New Jersey

New Jersey licenses health care facilities through the Department of Health under the Health Care Facilities Planning Act, N.J.S.A. 26:2H-1 and following, and the ambulatory care facility standards at N.J.A.C. 8:43A implement it. Whether an ABA practice is inside the Act is answered by two definitions in section 26:2H-2, and both turn on the physician.

The service definition is keyed to physician supervision and excludes a physician's private practice, with the surgical-practice provisions in section 26:2H-12 as the only carve-back. A practice of licensed applied behavior analysts offers no physician-supervised service and does not enter the Act. The practical rule is that no Department of Health license reaches an outpatient ABA clinic in New Jersey, and the entry gates are practitioner-side: the applied behavior analyst license and the Board rules the New Jersey licensing page covers, and Medicaid and commercial credentialing (N.J.S.A. 26:2H-2, 26:2H-12; N.J.A.C. 8:43A).

The two archetypes: psychologist, physician, or neither, and why it barely matters here

New Jersey's archetypes diverge less than in most states, because the Board of Applied Behavior Analyst Examiners wrote its rules to track the psychology board's.

• The practice with an in-house psychologist. It stays outside the Health Care Facilities Planning Act because a psychologist is not a physician. Its psychologist is bound by N.J.A.C. 13:42-8.1, which requires a permanent client record, contemporaneous entries, and retention for seven years from the last entry or until a minor turns 25, whichever is longer. Its applied behavior analysts are bound by N.J.A.C. 13:42B-6.5, which says the same thing. One retention schedule covers the chart.
• The practice with an in-house physician. A developmental pediatrician on staff is in private practice under section 26:2H-2(b) and does not pull the practice into the Act unless a surgical practice is being established under section 26:2H-12. The physician's records are governed by the Board of Medical Examiners' records rules, which carry their own minor endpoint; counsel should reconcile the two schedules before relying on either.
• The ABA-only practice. Since May 6, 2024 its licensees are bound by N.J.A.C. 13:42B, which supplies the recordkeeping rule, the informed consent rule at 13:42B-4.6, and the telehealth rules at subchapter 7. Persons licensed in another profession who practice within that profession's scope are outside the chapter, which is why a psychologist supervising ABA does not need the ABA license to do so.

The practical rule is that the archetype decision in New Jersey changes who signs the record, not how long it is kept. What the archetype does change is the entity analysis, which the New Jersey entity page explains is elective for behavior analysts and mandatory for none of the professions involved.

HIPAA, the breach statute, and the Board rules on confidentiality

HIPAA is the federal floor and applies uniformly. New Jersey layers three things on it.

• The breach statute. N.J.S.A. 56:8-163 applies to any business that conducts business in New Jersey and holds computerized personal information. It has no fixed day count, and it has a sequencing rule that most states do not.

The statute's definition of personal information in section 56:8-161 is identifier-based, built on a name combined with a Social Security number, driver's license number, account number with access code, or online credentials; it does not list medical information as an element. A breach of clinical records that exposes none of those identifiers is a HIPAA breach that may not be a New Jersey breach, and a breach that exposes them is both, with the State Police notice preceding the customer notice. Disclosure is not required where the business establishes that misuse of the information is not reasonably possible, and that determination should be documented. HIPAA's 60-day outer limit is the only fixed clock in the state, so a New Jersey practice should build its incident response to HIPAA's timing with the State Police step inserted before the individual notices (N.J.S.A. 56:8-161, 56:8-163).

• The Board rules. N.J.A.C. 13:42B-4.6 requires the licensed applied behavior analyst to obtain and document informed consent before delivering services, including the means of delivery, and to keep that documentation in the record. The psychology board's client-access rule at N.J.A.C. 13:42-8.3 and its confidentiality rules govern the psychologist's file. These are enforced by the Boards against the licensee.
• The New Jersey Data Privacy Act. Effective January 15, 2025, the Act regulates controllers of personal data at scale. Its treatment of HIPAA-covered information should be confirmed by counsel for the practice's configuration before it is relied on as an exemption; this page does not state its scope.

Records retention: the Board rule that mirrors the psychology rule

New Jersey wrote the behavior analyst recordkeeping rule to mirror the psychology rule, so an ABA practice carries one retention schedule regardless of archetype, plus the Medicaid rule.

The Board rule also prescribes minimum contents: an intake record, the dates of each service, quantitative data collection and analysis, a summary of each session, the name, title, and license number of the licensee who provided services, the client's safety level including instances of self-harm, aggression toward others, or contact with safety or health officials, and any referral to another health care professional. Corrections must be dated and initialed, and records must be produced to the Board on request. For a pediatric practice the age-25 rule governs: a three-year-old's intake is held for twenty-two years. Build the schedule to age 25, seven years for adults, five years for Medicaid claim support, and the litigation-hold overlay (N.J.A.C. 13:42B-6.5(a), (b), (d); N.J.A.C. 10:49-9.8(b)(1)).

Records ownership and custody on a change

New Jersey puts the recordkeeping duty on the licensee, and because the professional entity is elective, the custodian is whichever entity the licensee practices through. The psychology rule at N.J.A.C. 13:42-8.1(h) requires the licensee to establish procedures for preserving records and notifying patients on relocation, retirement, death, or separation from a group practice; the behavior analyst rule does not yet contain an equivalent provision, so counsel should build one into the practice's policies and any sale agreement. In a change of ownership, particularly an asset sale where the practice entity is not itself transferred, custody must be negotiated so that a licensed custodian remains, patients retain access, and the seven-year and age-25 obligations and the five-year Medicaid obligation survive the closing. Medicaid provider enrollment does not transfer with the assets, which is a records question as much as a revenue question (N.J.A.C. 13:42-8.1(h); N.J.A.C. 10:49-9.8).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either archetype. New Jersey adds that the recordkeeping duty belongs to the licensee under the Board rules, that the Board can demand the record from the licensee under N.J.A.C. 13:42B-6.5(d), and that the MSO therefore cannot be the custodian. The management agreement has to keep access under the licensee's control and allocate who answers a Board request and a Medicaid Fraud Division request. Because New Jersey's ownership rules are open for behavior analysts, the MSO structure is driven by fee-splitting and kickback constraints rather than by the facility layer, which the New Jersey ownership page covers.

Reading the New Jersey burden

Putting the pieces together, New Jersey is a light-facility, moderate-records state. On the lighter side, there is no Department of Health license for outpatient ABA under any archetype, the professional entity is elective, and the breach statute has no fixed clock. On the heavier side, the Board's May 2024 recordkeeping rule is specific about contents and long on retention, running to age 25 for a child, and it is enforced against the individual licensee; the State Police pre-notice is an unusual sequencing step; and Medicaid adds five years of claim support. The archetype decision changes little here because the Boards wrote parallel rules.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid and NJ FamilyCare enrollment carries the five-year retention rule and does not transfer with the assets on a sale. See the New Jersey Medicaid page.
• Licensing and credentialing. The applied behavior analyst license under N.J.S.A. 45:8B-96 and the Board rules at N.J.A.C. 13:42B, effective May 2024, are the credential that carries the recordkeeping duty. See the New Jersey licensing and credentialing page.
• Entity and ownership. The professional entity is elective for behavior analysts in New Jersey, so custody sits with the licensee and the entity the licensee chooses; a psychologist inside the practice brings the psychology board's custody procedures. See the New Jersey entity page and the New Jersey ownership page.
• Practice sale and expansion. Records custody, the licensee's Board obligations after separation, and non-transferable Medicaid enrollment are diligence items in any New Jersey transaction. See practice expansion and sale.

Getting set up in New Jersey: the sequence

1. Credential the analysts. Obtain and maintain licenses under N.J.S.A. 45:8B-96 and following, and adopt the N.J.A.C. 13:42B record template and informed consent documentation.
2. Form the entity and confirm the facility question. Form the entity of choice, professional or ordinary, and confirm that no physician-supervised or surgical configuration is being organized under N.J.S.A. 26:2H-2 or 26:2H-12.
3. Enroll and contract. Complete Medicaid and NJ FamilyCare enrollment and commercial credentialing, and adopt the five-year retention certification in N.J.A.C. 10:49-9.8.
4. Build the privacy program. Implement HIPAA and the Board confidentiality rules, and write the incident response plan with the Division of State Police report before individual notices under N.J.S.A. 56:8-163(c).
5. Set the retention schedule. Configure retention to seven years from the last entry and age 25 for minors under N.J.A.C. 13:42B-6.5 and 13:42-8.1, five years for Medicaid, with a litigation-hold overlay.
6. Fix custody and MSO terms. Name the custodian, adopt a relocation and separation procedure modeled on N.J.A.C. 13:42-8.1(h), sign the business-associate agreement, and keep access under the licensee's control.

New Jersey facility and records variables at a glance

Frequently asked questions