Does your ABA clinic need a facility license in North Carolina? And how must records be kept?

When an ABA practice needs a facility license in North Carolina

North Carolina is the state in this guide where you cannot assume a facility license away. Two things sit at the entry. First, behavior analysts are now licensed under General Statutes Chapter 90, Article 43, through the North Carolina Behavior Analysis Board, and a licensed analyst is the qualified autism service provider for Medicaid purposes (N.C.G.S. ch. 90, art. 43). Second, and unusually, Chapter 122C defines a facility broadly: it means any person at one location whose primary purpose is to provide services for the care, treatment, habilitation, or rehabilitation of individuals with mental illness, developmental disabilities, or substance use, and the State's own guidance notes that a bricks-and-mortar practice area is not required and that even a sole practitioner who makes home visits can be a facility (N.C.G.S. 122C-3(14)). Whether a given ABA practice actually needs a 122C license then depends on the exclusions and the specific service definitions, which the next section covers, but the breadth of the definition is why the question must be checked rather than presumed.

What triggers a 122C license and the LME/MCO route

The practical analysis in North Carolina runs along two tracks that interact:

• The 122C licensure track. Services subject to licensure under Chapter 122C are set out in the facility rules (10A NCAC 27G), and exclusions and deemed-status provisions remove some configurations from licensure (N.C.G.S. 122C-22; 10A NCAC 27G). Residential programs and day programs clearly require a 122C license, with day programs for children subject to building-code occupancy rules, while a purely outpatient, periodic ABA service must be checked against the service definitions to determine whether a license is required.
• The Medicaid and LME/MCO track. To be paid through Medicaid or state or county funds, a provider enrolls in NCTracks and participates in the LME/MCO or Tailored Plan network; the LME/MCOs no longer perform credentialing, but they contract the network, and residential providers must obtain an LME/MCO letter of support to apply for licensure (NCTracks; N.C.G.S. 122C-23.1). A private-pay practice that takes no public dollars does not need an LME/MCO contract.

The practical rule is that North Carolina leans toward the facility end of this spoke: the 122C framework is broad and real, residential and day configurations are squarely licensable, Medicaid participation runs through NCTracks and the LME/MCO Tailored Plans, and an outpatient ABA practice should confirm its licensure status with DHSR rather than assume it is exempt. Layer on the recent rate environment, including a paused Medicaid rate reduction, and the structural questions deserve early attention.

HIPAA and the Chapter 122C confidentiality rules

HIPAA is the federal floor and applies uniformly. North Carolina then applies the Chapter 122C confidentiality regime to client information held by facilities, and because the facility definition is broad, ABA practices generally fall within it (N.C.G.S. 122C-52 to 122C-56). Two features matter:

• Confidentiality by default, with consent-based disclosure. Client information is confidential and may be disclosed only as Chapter 122C allows, which generally requires written consent or a specific statutory exception, alongside a set of care-coordination and payment exceptions (N.C.G.S. 122C-52; 122C-53; 122C-55).
• No automatic redisclosure. Unlike HIPAA, Chapter 122C does not automatically allow a person who legitimately receives confidential information to redisclose it, so each onward disclosure must independently satisfy the statute. This is stricter than the federal baseline and is a frequent compliance trap for practices that assume HIPAA-style redisclosure latitude (N.C.G.S. 122C-52 et seq.).

The operational takeaway is that a North Carolina ABA practice must build consent and disclosure procedures to Chapter 122C, treating each disclosure and any redisclosure as separately governed, and applying the stricter of HIPAA and 122C at every point.

Records retention: the minor rule and 122C

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the 122C facility rules and Medicaid audit requirements, means records must be kept securely for many years after a child's last service (North Carolina medical-records retention; 10A NCAC 27G). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter Medicaid or HIPAA-administrative periods drive early destruction.

Records ownership and custody on a change

In North Carolina, a 122C facility license attaches to the licensee and owner, so records and licensure obligations are tied to the licensed entity, which has consequences when ownership changes (N.C.G.S. 122C, art. 2; DHSR change-of-ownership process). The DHSR change-of-ownership process requires reporting the legal identity of the new owner and any controlling affiliates, and there are statutory bars that can prevent enrollment or licensure for owners or affiliates connected to a revoked facility. Records cannot be transferred to a non-licensed entity, and in an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and clients retain access and confidentiality protections under 122C. Plan custody and the change-of-ownership filing before a sale or restructuring, not after.

The MSO question under a no-redisclosure rule

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement. North Carolina adds two constraints. First, because Chapter 122C does not automatically permit redisclosure, an MSO's access to and any handling of client information must independently satisfy the statute, not merely a business-associate agreement (N.C.G.S. 122C-52 et seq.). Second, the MSO cannot be the licensed records custodian, which must be the licensed clinical entity, and the owner-and-affiliate enrollment rules mean the ownership chain behind an MSO is relevant to the practice's licensure. Structure the MSO relationship so the clinical entity remains custodian, the business-associate agreement is in place, and access fits 122C.

Reading the North Carolina burden

Putting the pieces together, North Carolina is a moderate-to-heavy state on this spoke, and the weight sits on the facility axis more than in any other state in this guide. The 122C facility framework is broad and real, residential and day configurations are clearly licensable, and even outpatient practices should confirm their status rather than assume exemption. Medicaid participation runs through NCTracks and the LME/MCO Tailored Plans, with residential providers needing an LME/MCO letter of support. On privacy, the 122C confidentiality regime is stricter than HIPAA on redisclosure. Retention is long under the minor rule and the facility rules, and the license-follows-the-licensee structure makes change-of-ownership mechanics a formal step. The practical read is that North Carolina requires careful structural and licensure analysis up front, more than a light-touch state, and that the facility question genuinely deserves professional review. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Place of service interacts directly with the 122C question, since residential and day settings are licensable while periodic outpatient delivery may not be, and the broad natural-settings definition shapes where services occur. See the North Carolina Medicaid page, which treats place of service and the rate environment in detail.
• Licensing and credentialing. The new Behavior Analysis Board license and NCTracks enrollment are the gating steps. See the North Carolina licensing and credentialing page.
• Entity and ownership. The license-follows-the-licensee structure and the owner-and-affiliate rules tie ownership tightly to licensure. See the North Carolina entity page and the North Carolina ownership page.
• Practice sale and expansion. The change-of-ownership filing and records custody are core diligence items in any North Carolina transaction. See practice expansion and sale.

Getting set up in North Carolina: the sequence

1. License the analysts. Obtain North Carolina Behavior Analysis Board licensure under Chapter 90, Article 43, in addition to BACB certification.
2. Determine the 122C status. Confirm with DHSR whether your configuration requires a 122C facility license, and obtain it for residential or day programs.
3. Enroll and contract for Medicaid if applicable. Enroll in NCTracks and contract with the LME/MCO or Tailored Plan network, securing a letter of support where required.
4. Build the privacy program to 122C. Implement HIPAA plus Chapter 122C, treating each disclosure and any redisclosure as separately governed.
5. Set the retention schedule. Configure retention to the minor rule, the facility rules, and Medicaid requirements, with a litigation-hold overlay.
6. Fix custody and the change-of-ownership plan. Ensure the licensed entity is the custodian, plan the DHSR change-of-ownership filing, and align any MSO with 122C.

North Carolina facility and records variables at a glance

Frequently asked questions