Does your ABA clinic need a facility license in North Dakota? And how must records be kept?

When an ABA practice needs a facility license in North Dakota

North Dakota's medical hospital license provision covers any entity that "maintains and operates organized facilities for the diagnosis, treatment, or care of two or more nonrelated persons suffering from illness, injury, or deformity or where obstetrical or other care is rendered over a period exceeding twenty-four hours" (NDCC 23-16-01). An outpatient ABA office with sessions of a few hours does not fit the twenty-four hour element, and the text read describes no outpatient clinic license.

That conclusion rests on one chapter. Other North Dakota facility chapters, including behavioral health and residential programs, were not read, so this guide does not say that no license is needed. The Medicaid ABA policy allows services "within the home, community, or a provider's facility" and lists individual credentialed provider types, with no separate center or day-treatment approval in the policy (ND Medicaid Autism ABA policy, revised February 2025).

The two archetypes: what changes between them

• The practice with in-house diagnostics. The same hospital definition applies. The only office provision is that no hospital license is required for emergency or transfer beds in a licensed medical doctor's office when they do not exceed four (NDCC 23-16-01). A physician on staff brings the Board of Medicine retention rule below.
• The ABA-only practice. Behavior analysts are licensed at the individual level by the Board of Integrative Health Care, and the practice of ABA excludes diagnosis and psychological testing: "the term does not include the diagnosis of disorders, psychological testing, psychotherapy" (NDCC ch. 43-64). The behavior analyst rule chapter has no client-record retention period, so the Medicaid seven years is the only client-record period found.

HIPAA and the North Dakota breach statute

HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.

North Dakota's breach statute sets no day count; disclosure is made "in the most expedient time possible and without unreasonable delay." The Attorney General is told by mail or electronic mail of a breach that exceeds 250 individuals. Personal information includes "medical information" and "health insurance information," and medical information means "any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional." A covered entity, business associate or subcontractor subject to the federal breach rule is considered to be in compliance (NDCC ch. 51-30).

No general North Dakota medical records confidentiality statute was found. NDCC 23-12-14 governs copies of medical records and fees, and defines "health care provider" as "a licensed individual or licensed facility providing health care services," which on its face includes licensed behavior analysts. It is a records-access statute, not a general confidentiality statute.

Records retention

North Dakota has a physician rule and a Medicaid rule, and none for behavior analysts.

Seven years from creation or last effect is the governing floor for a practice that bills Medicaid. The physician rule also runs seven years. A practice that treats children should consider a longer pediatric benchmark, since neither rule states a minor extension.

Records ownership and custody on a change

The only custody rule found binds Board of Medicine licensees. Upon "the sale of a medical practice, or a licensee's departure from the licensee's medical practice," the licensee or representative "shall ensure all medical records are transferred to another licensee or entity that is held to the same standards of confidentiality and agrees to act as custodian of the records" (N.D. Admin. Code 50-01-03-01). No custody rule for behavior analysts or for Medicaid was found. An asset sale should name a custodian and carry the seven-year schedule into the purchase agreement.

The MSO question

A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The North Dakota ownership page covers who may own the clinical entity.

Reading the North Dakota burden

North Dakota is light on records and moderate on breach regulation. The hospital definition read does not reach an outpatient office, but other facility chapters are unread. The breach statute's Attorney General threshold and medical information coverage matter more than the facility question for most practices.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the North Dakota Medicaid page.
• Licensing and credentialing. North Dakota licenses behavior analysts under chapter 43-64, which decides who may supervise and hold the clinical file. See the North Dakota licensing and credentialing page.
• Entity and ownership. The hospital definition turns on the site and the length of care, not the owner, so entity choice does not change the answer. See the North Dakota entity page and the North Dakota ownership page.
• Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any North Dakota transaction. See practice expansion and sale.

Getting set up in North Dakota: the sequence

1. Confirm the facility question. Have counsel check North Dakota's other facility chapters for any center-based site.
2. Decide the diagnostics model. If a physician is on staff, hold that file to the seven year rule. If a psychologist is, confirm the board rules.
3. Build the privacy program. Implement HIPAA and set incident response with Attorney General notice above 250 individuals.
4. Set the retention schedule. Configure retention to seven years from creation or last effect at minimum, plus a pediatric benchmark.
5. Settle custody. Name a custodian in any sale or closure agreement.

What this guide could not verify

Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:

• Other North Dakota facility chapters, including behavioral health and residential programs.
• Psychologist record retention; the psychologist board rules were not read.
• A general state medical records confidentiality statute.
• A records custody rule for behavior analysts or Medicaid.
• Amendments after the dates the chapter compilations were prepared; the PDFs show no history notes.
• The 2012 notice that a Medicaid rule would set a seven-year requirement; the rule text was not read.

North Dakota facility and records variables at a glance

Frequently asked questions