Does your ABA clinic need a facility license in Oregon? And how must records be kept?

When an ABA practice needs a facility license in Oregon

For a standard outpatient ABA practice, Oregon does not require a facility license. What distinguishes Oregon is how thoroughly it licenses the people who deliver ABA. The Behavior Analysis Regulatory Board, housed within the Oregon Health Authority's Health Licensing Office, licenses behavior analysts and assistant behavior analysts and registers behavior analysis interventionists, so even the technician tier is recognized by the state rather than left to national certification alone (Or. Behavior Analysis Regulatory Board). Since January 2015, a practitioner billing insurance for ABA must hold a license to be reimbursed (Or. ABA insurance-billing licensure, since 2015). The regulation sits at the practitioner level, and the program-license framework that does exist, covered next, is a separate lane.

The three-tier practitioner system and the OHA program license

The Oregon facility question turns on telling practitioner licensure apart from program licensure:

• A complete practitioner tier. Oregon recognizes three levels: Licensed Behavior Analyst, Licensed Assistant Behavior Analyst, and registered Behavior Analysis Interventionist, with ABA recommended by a licensed physician or psychologist experienced in autism and delivered by these providers (OAR 824-030-0010). This practitioner system, not a facility license, is the gating structure for ABA.
• Program licensure is for other services. The Oregon Health Authority's Behavioral Health Division licenses and certifies residential and outpatient mental-health, substance-use, withdrawal-management, and gambling programs, with facility standards and inspections, but outpatient autism ABA is not one of those program types (OHA Behavioral Health licensing and certification).
• The Medicaid route for ABA. ABA is delivered through the Oregon Health Plan and its coordinated care organizations by the licensed and registered providers, with payment structures that Oregon is restructuring in 2026. Participation is through licensure and coordinated-care-organization contracting, not a facility license.

The practical rule is that Oregon is light on facility licensure for outpatient ABA, with the regulatory weight placed on a complete practitioner-licensure system and Oregon Health Plan participation rather than a building survey.

HIPAA and Oregon's confidentiality statutes

HIPAA is the federal floor and applies uniformly. Oregon then layers state confidentiality on top:

• Mental-health and developmental-disability records. Oregon protects the confidentiality of written accounts and records of individuals receiving mental-health and developmental-disability services, a state layer relevant to the records an ABA practice keeps (ORS 179.505).
• Health-information privacy. Oregon's health-information privacy statutes govern the use and disclosure of protected health information on top of HIPAA (ORS 192.553 et seq.).

The operational takeaway is that an Oregon ABA practice builds its privacy program to HIPAA, the mental-health records confidentiality rules, and the health-information privacy statutes, applying the stricter standard at each point. Oregon's privacy regime is a real named-statute layer in the moderate range.

Records retention: the minor rule governs

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with Medicaid audit requirements, means records must be kept securely for many years after a child's last service (Oregon records retention; Oregon Health Plan). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

Oregon treats the licensed practitioner or entity as the custodian of patient records, and the mental-health records confidentiality and health-information statutes govern how that information may be disclosed (ORS 179.505; ORS 192.553 et seq.). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. Plan custody arrangements before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Oregon does not redefine that relationship the way some broad state statutes do. What Oregon adds is that any access to records must satisfy the mental-health records confidentiality and health-information statutes, and that the MSO cannot be the licensed records custodian (ORS 179.505; ORS 192.553 et seq.). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Oregon's confidentiality statutes, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the Oregon burden

Putting the pieces together, Oregon is a light-facility state with an unusually complete practitioner layer. On the lighter side, a standard outpatient ABA clinic needs no facility license, the program-license framework is a separate lane for mental-health, substance-use, and gambling programs, and Medicaid billing does not trigger a facility survey. On the heavier side, Oregon licenses or registers all three practitioner tiers and requires a license to bill insurance, the mental-health records and health-information statutes add state privacy obligations on top of HIPAA, the minor-records rule extends retention for many years, and the 2026 payment restructuring is a moving piece. The practical read is that Oregon places its regulatory weight on credentialing the delivery team and on Oregon Health Plan participation rather than on a facility survey. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Oregon delivers ABA through coordinated care organizations, is restructuring qualified directed payments in 2026, and applies member-choice telehealth parity; the clinic setting is where any facility question would arise. See the Oregon Medicaid page, which treats the payment restructuring and place of service in detail.
• Licensing and credentialing. The three-tier practitioner system and the bill-to-be-licensed rule are the credentialing story. See the Oregon licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the confidentiality statutes shape how the entity and any MSO are structured. See the Oregon entity page and the Oregon ownership page.
• Practice sale and expansion. Records custody and the practitioner credentials are diligence items in any Oregon transaction. See practice expansion and sale.

Getting set up in Oregon: the sequence

1. License the team. Obtain Behavior Analysis Regulatory Board licensure for analysts and assistant analysts and register interventionists, ensuring a license for anyone billing insurance.
2. Confirm the facility question. Confirm that your outpatient configuration does not require an OHA Behavioral Health Division program license, which applies to mental-health, substance-use, and gambling programs.
3. Enroll for Medicaid. Contract with the coordinated care organizations under the Oregon Health Plan, noting the 2026 payment restructuring.
4. Build the privacy program. Implement HIPAA plus the mental-health records confidentiality and health-information statutes.
5. Set the retention schedule. Configure retention to the minor rule and Medicaid requirements, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and access fits Oregon's confidentiality statutes.

Oregon facility and records variables at a glance

Frequently asked questions