Does your ABA clinic need a facility license in Ohio? And how must records be kept?

When an ABA practice needs a license or certification in Ohio

Ohio's entry point is a practitioner credential, not a building-based facility license. To practice ABA in Ohio, a behavior analyst must hold the Certified Ohio Behavior Analyst (COBA) certificate, administered by the Ohio Board of Psychology under Ohio Revised Code Chapter 4783, with reciprocity available for analysts certified elsewhere (ORC ch. 4783; OAC ch. 4783). Beyond the practitioner credential, Ohio's distinctive feature is a Medicaid community-behavioral-health certification layer, which can but does not always reach an ABA practice. The next section explains the wrinkle.

The Medicaid certification layer and the licensed-professional exemption

The Ohio facility question is really a certification question tied to how you bill Medicaid:

• Community-behavioral-health certification. To participate as a behavioral-health provider in Ohio Medicaid, including contracting with the managed-care entities, an organization must be certified by the state behavioral-health department (formerly OhioMHAS, renamed in 2024) under Ohio Administrative Code rule 5160-27-01 and enroll through the Provider Network Management module (OAC rule 5160-27-01; ODM BH manual).
• The licensed-professional exemption. Certification is not required for Ohio-licensed health-care professionals whose scope of practice includes a certified service. This is the key: a COBA-credentialed analyst delivering outpatient ABA may avoid agency certification, while a community-behavioral-health organization (Medicaid provider type 84) that bills as such generally must certify (OhioMHAS certification exemption).
• A tightened framework. House Bill 33 tightened certification and residential licensure beginning October 3, 2023, with an October 1, 2025 compliance deadline for existing providers, and added local behavioral-health-board coordination, so the certification environment has become more demanding (HB 33).
• Coding nuance. Community behavioral health centers may bill an ABA-adjacent code, but Medicaid encourages the use of the dedicated ABA CPT codes, and dedicated medical ABA is generally not delivered in classrooms (ODM BH manual; Ohio Medicaid ABA policy).

The practical rule is that Ohio keeps the physical-plant burden light for outpatient ABA, but you must place yourself correctly: a COBA analyst's outpatient practice may rely on the licensed-professional exemption, while billing as a community-behavioral-health organization pulls in state certification. Confirm which applies to your exact configuration with counsel and the agencies.

HIPAA and Ohio mental-health confidentiality

HIPAA is the federal floor and applies uniformly. Ohio then layers state mental-health confidentiality and the behavioral-health administrative code on top, governing the confidentiality and disclosure of behavioral-health records (Ohio mental-health confidentiality; OAC ch. 5122). A few practice points follow:

• Behavioral records carry a state layer. The kind of records an ABA practice keeps are subject to Ohio's mental-health confidentiality rules on top of HIPAA, so disclosures must satisfy both.
• Minor-consent nuance. Ohio allows a minor age fourteen or older to receive a limited number of outpatient mental-health sessions without parental consent, which can affect consent and recordkeeping in edge cases, though it is narrow in the ABA context.

The operational takeaway is that an Ohio ABA practice builds its privacy program to HIPAA and Ohio's mental-health confidentiality rules, applying the stricter standard at each point. Ohio's privacy load is in the moderate range, anchored in mental-health confidentiality rather than a single broad medical-records privacy statute.

Records retention: the verified minor rule

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing. Ohio's pediatric rule is unusually explicit.

For pediatric ABA, the minor rule governs and is explicit: at least two years past the age of majority or seven years after the last service, whichever is longer, which for a young child can mean well over a decade (Ohio records retention; Ohio Medicaid ABA policy). Build your retention schedule to the minor rule and the litigation-hold overlay, and do not let the shorter HIPAA-administrative period drive early destruction of pediatric records.

Records ownership and custody on a change

Ohio treats the licensed practitioner or certified entity as the custodian of patient records, and the mental-health confidentiality rules govern how that information may be disclosed (Ohio mental-health confidentiality; Ohio custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. Medicaid changes must also be reported through the Provider Network Management module. Plan custody and the enrollment updates before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Ohio does not redefine that relationship the way some broad state statutes do. What Ohio adds is that any access to records must satisfy the state mental-health confidentiality rules, and that the MSO cannot be the licensed records custodian, nor can it substitute for the practitioner credential or, where it applies, the agency certification (Ohio mental-health confidentiality; OAC rule 5160-27-01). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Ohio's confidentiality rules, and that the licensed clinical entity remains the custodian and the credential or certification holder. Structure the MSO relationship accordingly.

Reading the Ohio burden

Putting the pieces together, Ohio is a light-to-moderate state on this spoke, with the weight in certification rather than physical plant. On the lighter side, there is no building-based facility license for outpatient ABA, and a COBA-credentialed analyst's outpatient practice may rely on the licensed-professional exemption from agency certification. On the heavier side, the practitioner credential is mandatory, billing as a community-behavioral-health organization pulls in state certification under a framework that House Bill 33 has tightened, the mental-health confidentiality rules add a state privacy layer, and the minor-records rule is explicit and long. The practical read is that Ohio's key decision is structural, whether you operate as a licensed-professional outpatient practice or as a certified community-behavioral-health organization, because that choice determines whether the certification layer applies. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility and provider certification and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Ohio pays a fee-for-service ABA baseline that managed-care entities negotiate, treats Medicaid as the payer of last resort, keeps a separate non-Medicaid Autism Scholarship lane, and defines behavioral-health telehealth by rule; the clinic setting is where any facility question would arise. See the Ohio Medicaid page, which treats the rate baseline and place of service in detail.
• Licensing and credentialing. The COBA credential and the licensed-professional exemption are the credentialing story. See the Ohio licensing and credentialing page.
• Entity and ownership. The licensed-professional-versus-certified-organization choice and the records-custodian rule shape how the entity and any MSO are structured. See the Ohio entity page and the Ohio ownership page.
• Practice sale and expansion. The certification status, records custody, and PNM updates are diligence items in any Ohio transaction. See practice expansion and sale.

Getting set up in Ohio: the sequence

1. Credential the analysts. Obtain the Certified Ohio Behavior Analyst certificate through the Ohio Board of Psychology under ORC Chapter 4783.
2. Choose your structure and confirm certification. Determine whether you will operate under the licensed-professional exemption or as a certified community-behavioral-health organization, and obtain state certification if the latter.
3. Enroll for Medicaid. Enroll through the Provider Network Management module and contract with the managed-care entities, using the dedicated ABA codes.
4. Build the privacy program. Implement HIPAA plus Ohio's mental-health confidentiality rules, noting the minor-consent nuance.
5. Set the retention schedule. Configure retention to the explicit minor rule, at least two years past majority or seven years after last service, whichever is longer, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian and credential or certification holder, the business-associate agreement is in place, and PNM updates are handled on changes.

Ohio facility and records variables at a glance

Frequently asked questions