"These regulations do not apply to the following: offices and treatment rooms of licensed private practitioners" (8.370.18 NMAC, effective July 1, 2024). Records periods: six years from the payment date for Medicaid (8.302.1 NMAC), five years after the last service for psychologists (16.22.2 NMAC), and ten years after last treatment for physicians, with minors' records kept until age 21 (16.10.17 NMAC).
All rules were read as compiled NMAC parts from the State Records Center. The outpatient facility rule is new as of July 1, 2024, and the Medicaid ABA section was replaced December 10, 2024. No New Mexico statute was read: the legislature's site has blocked requests, and no official copy of the breach or health information statutes surfaced. Items this guide could not verify are listed in the section titled “What this guide could not verify,” below. Treat this as a point-in-time overview, not a determination for your practice. Confirm the current requirements with the agencies named on this page and qualified New Mexico counsel before you build, bill, or sell.
The nine facility-and-records criteria at a glance
- When an ABA practice needs a facility license in New Mexico
- The two archetypes: what changes between them
- HIPAA and the New Mexico breach statute
- Records retention
- Records ownership and custody on a change
- The MSO question
- Reading the New Mexico burden
- How this connects to the rest of your compliance stack
- Getting set up in New Mexico: the sequence
- New Mexico facility and records variables at a glance
- Frequently asked questions
- Where professional advice is essential
When an ABA practice needs a facility license in New Mexico
New Mexico's outpatient facility licensing rule applies to "public, profit or nonprofit outpatient facilities, ambulatory surgical centers, diagnostic and treatment centers, or infirmaries," and a facility is "a building or buildings in which outpatient medical services are provided to the public and which is licensed pursuant to this rule." A diagnostic and treatment center "provides a service to the public on an outpatient basis for the diagnosis and treatment of medical conditions not requiring hospitalization." The rule then states: "These regulations do not apply to the following: offices and treatment rooms of licensed private practitioners" (8.370.18 NMAC, N 7/1/2024).
Two points follow. New Mexico does not license behavior analysts, per the state's licensing research, so the private practitioner exclusion does not on its face cover an ABA-only practice. And the text does not say whether ABA is an "outpatient medical service." Other New Mexico behavioral health facility rules were not checked. For Medicaid, ABA is rendered through an enrolled ABA provider agency, and no separate center-based or day-treatment ABA license appears in the section read (8.321.2.13 NMAC).
The two archetypes: what changes between them
- The practice with in-house diagnostics. The same exclusion covers offices and treatment rooms of licensed private practitioners, which on its face includes licensed psychologists and physicians practicing in their own offices. A psychologist's records fall under a five-year rule and a physician's under a ten-year rule, below.
- The ABA-only practice. There is no behavior analyst license and no board retention rule. The exclusion above does not reach it on its face, which is the unresolved point, and the Medicaid six years is the verified floor.
HIPAA and the New Mexico breach statute
HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.
New Mexico has a breach notification statute (NMSA 57-12C) and a health information confidentiality statute (NMSA 14-6-1), but this guide could not read either from an official source. The legislature's site blocked requests, and searches returned only secondary summaries, which this guide does not rely on. The state deadline, any Attorney General notice threshold, whether medical information is covered, and who is a covered provider under the confidentiality statute are all unverified. Run incident response to the HIPAA clock and have counsel check the state statutes at the same time.
Records retention
New Mexico has specific rules for each licensee group and a Medicaid floor.
| Source | Requirement |
|---|---|
| Physician records (diagnostics variant) | "at least ten (10) years after the date of last treatment or the time frame set by state or federal insurance laws or by medicare and medicaid regulation"; records for minors "must be retained until the date that the patient is twenty-one (21) years old" (16.10.17.10 NMAC, A 1/1/09) |
| Psychologist records (diagnostics variant) | "a period of not less than five years after the last date that service was rendered," plus any longer legal requirement; no minor-specific period in the text (16.22.2.8 NMAC, amended through 1/08/2023) |
| Behavior analyst records | No license, so no board rule |
| Medicaid provider records | "at least six years from the payment date" (8.302.1 NMAC, replaced 7/1/2024) |
| HIPAA administrative documents | 6 years |
| Litigation or audit hold | Preserve regardless of schedule while pending or threatened |
The physician rule is the longest, and a minor's file must be kept until age 21 if a physician is on staff. A practice with only behavior analysts takes six years from the Medicaid payment date.
Records ownership and custody on a change
Two rules matter on a change. For Medicaid, a provider must report changes in "corporate name or corporate ownership" and the agency "must receive this information at least 60 calendar days before the change," with a statement of continuing liability for recoverable obligations. This is an ownership-change notice, not a records-custody rule (8.302.1 NMAC). For physicians, when a practice is sold "all active patients must be notified that the physician is transferring the practice to another physician or entity who will retain custody of their records," at least 30 days before closing, selling, relocating or leaving a practice (16.10.17.9 NMAC). No custody rule for psychologists or Medicaid was found.
The MSO question
A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The New Mexico ownership page covers who may own the clinical entity.
New Mexico's outpatient facility exclusion protects licensed practitioners' offices, and behavior analysts are not licensed.
Reading the New Mexico burden
New Mexico's records rules are clear and its facility answer is unresolved for an ABA-only practice. The breach statute is the unverified gap. A practice should get the facility question answered by the Department of Health before opening a center-based site, and plan the 60 day Medicaid ownership-change notice into any sale timeline.
How this connects to the rest of your compliance stack
Facility licensure and records sit alongside several other decisions in this guide:
- Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the New Mexico Medicaid page.
- Licensing and credentialing. New Mexico does not license behavior analysts, so the private practitioner exclusion in the facility rule is the question for an ABA-only practice. See the New Mexico licensing and credentialing page.
- Entity and ownership. The outpatient facility rule turns on the site and the practitioners, not the owner, so entity choice does not change the answer. See the New Mexico entity page and the New Mexico ownership page.
- Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any New Mexico transaction. See practice expansion and sale.
Getting set up in New Mexico: the sequence
- Ask the Department. Before opening a center-based site, ask the Department of Health whether an ABA practice is an outpatient medical services facility.
- Decide the diagnostics model. If a psychologist is on staff, keep the file five years; if a physician is, ten years, with minors until age 21.
- Build the privacy program. Implement HIPAA and have counsel confirm the breach and health information statutes.
- Set the retention schedule. Configure retention to the longest of HIPAA's six years, the Medicaid six years and any licensee rule.
- Plan the Medicaid notice. Report any ownership change at least 60 days ahead and settle custody in the sale agreement.
What this guide could not verify
Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:
- NMSA 57-12C (breach notification): deadline, Attorney General threshold, covered data.
- NMSA 14-6-1 (health information): who is a covered provider.
- Whether ABA is an outpatient medical service under 8.370.18 NMAC, and other New Mexico behavioral health facility rules.
- A records custody rule for psychologists or Medicaid.
- The status of 2025 legislation affecting health care consolidation and corporate practice; not checked here.
- Whether the physician and psychologist rules were amended after the dates shown.
New Mexico facility and records variables at a glance
| Variable | New Mexico value |
|---|---|
| Separate facility license for commercial-only outpatient ABA? | Unresolved: 8.370.18 NMAC excludes offices of licensed private practitioners; ABA not licensed |
| Does Medicaid billing trigger facility licensure? | Not verified; Medicaid ABA runs through an enrolled provider agency |
| Licensing / oversight agencies | Department of Health; Regulation and Licensing Department; Health Care Authority; Attorney General |
| What would trigger a facility license | An outpatient facility or diagnostic and treatment center providing outpatient medical services |
| Physical-plant / survey layer | Facility rule exists; ABA coverage unresolved |
| State privacy law beyond HIPAA | Breach and health information statutes not verified |
| Records retention (pediatric) | Physician 10 years (minors to 21); psychologist 5 years; Medicaid 6 years |
| Records custodian | Physician notice on sale; Medicaid ownership change 60 days ahead |
| MSO treatment | Business associate agreement; keep clinical control with the licensed entity |
| Key authorities | 8.370.18, 8.321.2, 8.302.1, 16.10.17, 16.22.2 NMAC |
Frequently asked questions
Does an outpatient ABA clinic need a facility license in New Mexico?
How long must records be kept in New Mexico?
What is New Mexico's breach deadline?
How early must Medicaid hear of an ownership change?
Where professional advice is essential, not optional
New Mexico's facility answer for an ABA-only practice should come from the Department of Health, and the breach statute should be read before incident response is written. Have qualified New Mexico counsel confirm both. Treat this page as an orientation, not a determination, and not legal advice.
The governing authorities to know are 8.370.18 NMAC, 8.302.1 NMAC, 16.10.17 NMAC and 16.22.2 NMAC, read together with federal HIPAA.
This page describes licensure, privacy, and retention rules that change and that depend on your configuration. The New Mexico Department of Health, the Health Care Authority, the Regulation and Licensing Department, the Attorney General, and qualified New Mexico counsel are the authoritative sources. Neither this page nor any secondary source should be relied on in place of direct verification and legal advice.