Does your ABA clinic need a facility license in New York? And how must records be kept?

When an ABA practice needs a facility license in New York

New York's facility license for outpatient care is the Article 28 operating certificate issued by the Department of Health. Whether an ABA practice needs one is answered by the article's definition of a hospital, which is built around the physician.

A practice whose services are rendered by licensed behavior analysts, or by a psychologist and behavior analysts, is not engaged in providing services by or under the supervision of a physician, so it does not enter Article 28. The Office of Mental Health's Article 31 license and the OPWDD Article 16 clinic license are program tracks an organization may elect; neither is a precondition to an LBA practice operating under its Education Law licenses. Where a physician is present, the Department applies a regulation that separates a private medical practice from a facility that must be established under Article 28.

The practical rule is that no Article 28 certificate is required for an outpatient ABA practice as ordinarily built, and the entry gates are practitioner-side: the Article 167 license and its exemptions, which the New York licensing page treats in detail, and Medicaid and commercial credentialing (N.Y. Educ. Law arts. 153, 167; 10 NYCRR 600.8).

The two archetypes: psychologist, physician, or neither

New York's archetype fork runs on which licensed profession performs diagnostics, because the Public Health Law, the Education Law, and the state access statute each draw their lines by profession.

• The practice with an in-house psychologist. It stays outside Article 28 because a psychologist is not a physician. It is bound by Regents Rule 29.2 for both the psychologist's file and the behavior analysts' files, and by the Board of Psychology's recordkeeping guidance for the diagnostic file. It is inside Public Health Law 18, the state access statute, because psychologists are on that statute's practitioner list, so it must meet the ten-day inspection window for the whole chart.
• The practice with an in-house physician. A developmental pediatrician or psychiatrist on staff is the one variant that must be reviewed against 10 NYCRR 600.8. The indicia the Department weighs include whether patients contact the facility rather than the individual physician, whether admission decisions are made by the facility, and whether the patient registry is larger than an individual practice would carry. An ABA organization with a corporate front door and hundreds of enrolled children matches several of those indicia at once. The physician's retention rule also differs: Education Law 6530(32) rather than Rule 29.2.
• The ABA-only practice. A practice of Article 167 licensees is outside Article 28, Article 31, and Article 16, and outside Public Health Law 18 because behavior analysts are not on its list. Its regulatory life is the Education Law: the license, Rule 29.2, and the mandatory professional entity the New York PLLC page explains. The Regents rule binds each LBA personally and its violation is professional misconduct.

The practical rule is that adding a psychologist changes the access statute and the recordkeeping standard, and adding a physician changes whether the facility question is closed at all. Counsel should review a physician arrangement against 600.8 before the physician sees the first patient, because the remedy for getting it wrong is an establishment proceeding, not a fine.

HIPAA, the SHIELD Act, the vetoed NYHIPA, and the 30-day breach clock

HIPAA is the federal floor and applies uniformly. New York layers three things on it, and one thing it does not.

• The SHIELD Act. General Business Law 899-bb requires any business holding the private information of New York residents to maintain reasonable safeguards. A HIPAA covered entity that complies with the Security Rule is deemed compliant with the safeguard requirement, so for an ABA practice the SHIELD Act adds a state enforcement path rather than a new standard.
• The breach statute. General Business Law 899-aa was amended by S2659B, signed December 24, 2024 and effective immediately, to require notice to affected residents within 30 days after discovery, with delay permitted only for law enforcement; the prior allowance for time to determine scope and restore integrity was removed. A companion amendment, S2376B, added medical information and health insurance information to the definition of private information, effective in March 2025, so a breach of clinical records is within the statute even without a Social Security number. A February 14, 2025 amendment limited the new Department of Financial Services notice to DFS-regulated entities, which an ABA practice is not. Notices to the Attorney General, the Department of State, and the State Police are unchanged. Because the state clock is 30 days and HIPAA's is 60, a New York practice runs incident response to the state deadline. Confirm the consolidated text of section 899-aa before quoting it in a policy, because the amendments were enacted through separate chapters (N.Y. Gen. Bus. Law 899-aa, 899-bb; L. 2024 S2659B, S2376B; L. 2025 S804).
• Profession-specific confidentiality. The Education Law and the Regents rules attach confidentiality duties to each licensed profession, and Mental Hygiene Law 33.13 attaches confidentiality rules to facilities licensed by OMH and OPWDD, which is one reason the elective Article 31 and Article 16 tracks carry more than they appear to.
• What New York does not have. The New York Health Information Privacy Act, S929 and A2141, passed both houses in January 2025 and was vetoed on December 19, 2025, the veto memorandum citing the breadth of the bill and uncertainty about which information it would regulate. A revised bill was introduced in the 2026 session and is not law. An ABA practice should not build to it.

Patient access runs on two tracks. Public Health Law 18 requires a covered provider to give a qualified person the opportunity to inspect the record within ten days of a written request, and its coverage is a list.

The Department of Health's own summary of the statute names physicians, psychologists, social workers, speech pathologists, and other listed practitioners, and states that practitioners not on the list are not covered by section 18 but may be covered by 8 NYCRR 29.2. Behavior analysts are not on the list. The psychologist archetype is therefore inside section 18 and its ten-day window; the ABA-only archetype answers access requests under HIPAA's 30-day rule and Rule 29.2. A combined practice should adopt the ten-day standard for the whole chart.

Records retention: the Regents rule binds the behavior analyst directly

New York is the rare state where the retention rule is the same for the behavior analyst and the diagnostician, because it lives in the Rules of the Board of Regents and reaches every profession licensed under Title VIII of the Education Law. Behavior analysis has been an Article 167 profession since 2014, so the rule binds the LBA exactly as it binds the psychologist.

The minor clause is the one that governs an ABA practice and it is misquoted constantly. The rule runs to one year after the patient reaches 21, which means age 22, not 18 and not 21. A three-year-old's intake must be held for nineteen years. Because the rule is framed as unprofessional conduct, its enforcement path is the Office of Professional Discipline against the individual licensee, so the retention policy has to be written so that each LBA can show compliance for that LBA's caseload, including after the LBA leaves (8 NYCRR 29.2(a)(3); N.Y. Educ. Law 6509).

The word contemporaneous is enforced literally by OMIG; a session note written a week later is a record that does not demonstrate the right to payment, and OMIG extrapolates from a sample. Build the schedule to age 22 for minors, six years for adults, and the longer of the Medicaid rule and the plan contract for claim support, with a litigation-hold overlay, and do not let the HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

New York puts custody where the Education Law puts responsibility: on the licensee and on the professional entity the licensee is required to practice through. Records of an LBA practice are held by the PLLC or professional corporation, and the individual licensee remains answerable to the Office of Professional Discipline for the records of that licensee's patients. In a change of ownership, particularly an asset sale where the professional entity is not itself transferred, custody must be negotiated so that a licensed custodian remains, patients retain the section 18 or HIPAA access right, and the six-year OMIG obligation and any ten-year plan obligation survive the closing. Because the professional entity is mandatory and its owners must be licensees, the records cannot be handed to a lay-owned acquisition vehicle; the New York entity page explains why the entity form makes that allocation of responsibility explicit (N.Y. Ltd. Liab. Co. Law 1207; 8 NYCRR 29.2).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either archetype. New York adds that the MSO cannot be the custodian, because the recordkeeping duty is the licensee's under Rule 29.2 and the entity holding the records must be the professional entity. The management agreement therefore has to say who answers the OMIG request and who answers the Office of Professional Discipline, and it has to keep access to the record under the licensee's control. The New York ownership page covers the fee-splitting rules that constrain how the MSO is paid for hosting that system.

Reading the New York burden

Putting the pieces together, New York is a light-facility, heavy-Education-Law state. On the lighter side, there is no Article 28 certificate for outpatient ABA under either archetype and no facility survey. On the heavier side, behavior analysis is a licensed profession, so the retention rule binds the individual LBA as a matter of professional discipline and runs to age 22 for a child, the professional entity is mandatory and lay ownership is barred, the breach clock is a hard 30 days, and OMIG enforces a contemporaneous-records rule with extrapolation. The archetype decision that matters most is whether diagnostics come in through a psychologist or a physician, because a physician is the one variant that reopens the facility question.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid enrollment carries the six-year contemporaneous-records rule, OMIG audit and extrapolation, and the compliance program obligation above the revenue threshold. See the New York Medicaid page.
• Licensing and credentialing. The Article 167 license is the credential that carries the Regents recordkeeping duty, and the Education Law 8807 agency exemption now runs to July 1, 2030. See the New York licensing and credentialing page.
• Entity and ownership. The professional entity is mandatory in New York and its owners must be licensees, which fixes where records custody sits and who answers the Office of Professional Discipline. See the New York entity page and the New York ownership page.
• Practice sale and expansion. Records custody inside the professional entity, the OMIG six-year obligation, and the breach log since December 2024 are diligence items in any New York transaction. See practice expansion and sale.

Getting set up in New York: the sequence

1. Credential the analysts. Obtain and maintain Article 167 licenses and certifications, and confirm whether the practice relies on the Education Law 8807 agency exemption.
2. Decide the diagnostics model. Choose between a psychologist and a physician for in-house diagnostics; review any physician arrangement against 10 NYCRR 600.8 before the first patient.
3. Form the professional entity. Form the PLLC or PC with licensed owners and the Education Department certificate of authority, and confirm that no Article 28, 31, or 16 track is being triggered.
4. Enroll and contract. Complete Medicaid enrollment, managed care contracting, and commercial credentialing, and adopt the OMIG contemporaneous-records standard.
5. Build the privacy program. Implement HIPAA and the SHIELD Act safeguards, set incident response to the 30-day clock in General Business Law 899-aa, and adopt the ten-day section 18 access window if a psychologist is on staff.
6. Set retention and custody. Configure retention to six years and age 22 for minors under Rule 29.2, six years under 18 NYCRR 504.3 with plan extensions, and name the professional entity as custodian with MSO access under the licensee's control.

New York facility and records variables at a glance

Frequently asked questions