Does your ABA clinic need a facility license in Pennsylvania? And how must records be kept?

When an ABA practice needs a license in Pennsylvania

Pennsylvania answers this spoke's central question differently from every other state. Most states license the individual ABA practitioner and leave the practice itself unlicensed for outpatient work. Pennsylvania, by contrast, requires that entities providing ABA be licensed as Intensive Behavioral Health Services (IBHS) agencies under 55 Pa. Code Chapter 5240, with ABA listed as a named service on the agency's certificate of compliance (55 Pa. Code ch. 5240; 5240.2). This grew out of the 2018 to 2020 transformation of the former Behavioral Health Rehabilitation Services (BHRS, or wraparound) into IBHS, and it means an entity, not just a clinician, holds the license. Pennsylvania also licenses behavior specialists through the State Board of Medicine, and the IBHS agency's clinical director must be a qualified licensed professional with a BCBA or graduate ABA credential (49 Pa. Code ch. 18, subch. I; 55 Pa. Code 5240.81). The practical headline is that opening an ABA practice in Pennsylvania is closer to standing up a licensed agency than to hanging out a practitioner shingle, which often surprises out-of-state entrants.

The IBHS agency license and its carve-outs

The IBHS agency license is the defining structural requirement, and it has a specific scope and a set of carve-outs worth understanding:

• The agency license itself. An entity providing IBHS, including ABA, must obtain an IBHS license under Chapter 5240, and to bill Medical Assistance must be licensed under Chapters 20 and 5240 and meet the Chapter 1155 payment conditions. OMHSAS licensing representatives review the service description and program information against the regulatory definition, and center-based one-to-one delivery requires the location to be identified on the license (55 Pa. Code ch. 5240; ch. 1155; ch. 20).
• Carve-outs for already-licensed program types. Entities that use ABA as a modality but are licensed in other categories, such as outpatient psychiatric clinics, partial-hospitalization programs, residential-treatment facilities, and family-based mental-health providers, do not need a separate IBHS license. Services licensed through another Commonwealth agency, such as the Department of Education for school services, also fall outside the IBHS license (55 Pa. Code 5240.1).
• Eligibility and delivery. IBHS, including ABA, serves children, youth, and young adults under 21 with a behavioral-health diagnosis, delivered in the home, school, and community, with a written order, assessment, and individual treatment plan reviewed by the county behavioral-health managed care organization (55 Pa. Code 1155; county BH-MCO HealthChoices).
• A more demanding compliance load. The IBHS agency standards, covering organizational structure, staff qualifications and training, criminal-history and child-abuse clearances, records, and quality improvement, are wider-ranging and more administratively burdensome than single-practitioner licensure.

The practical rule is that Pennsylvania places the heaviest true facility-and-agency entry hurdle in this guide on ABA: confirm early whether you need an IBHS license or fit a carve-out, because the answer reshapes your entire operating model.

HIPAA, IBHS records rules, and mental-health confidentiality

HIPAA is the federal floor and applies uniformly. Pennsylvania does not layer a single broad medical-records privacy statute on top in the way some states do, but an IBHS agency carries specific record and confidentiality obligations:

• IBHS records and confidentiality rules. An IBHS agency must ensure that records containing protected health information, written and electronic, are secured, maintained, and disposed of in accordance with applicable federal and state privacy and confidentiality statutes, and must keep detailed individual and agency records (55 Pa. Code 5240.41; 5240.42).
• Mental Health Procedures Act confidentiality. Where the Mental Health Procedures Act applies, Pennsylvania imposes confidentiality requirements on mental-health treatment records beyond the federal baseline, with disclosure generally requiring consent (50 P.S. 7111).
• Federal substance-use rules (42 CFR Part 2) apply to any co-occurring substance-use treatment records, though not to ABA itself.

The operational takeaway is that a Pennsylvania ABA practice builds its privacy program to HIPAA plus the IBHS records rules, and to the Mental Health Procedures Act where it applies, applying the stricter standard at each point. The privacy load here is moderate compared with the strictest states; the distinctive Pennsylvania weight is the agency license, not the privacy statute.

Records retention: IBHS rules and the minor rule

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the IBHS records rules and Medical Assistance audit requirements, means clinical records must be kept securely for many years after a child's last service (55 Pa. Code 5240; Pennsylvania records retention). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter agency-operational or HIPAA-administrative periods drive early destruction of clinical records.

Records ownership and custody on a change

In Pennsylvania the licensed IBHS agency is the custodian of client records, and the IBHS license attaches to the agency, so records and licensure obligations are tied to the licensed entity, which has consequences when ownership changes (55 Pa. Code 5240.41; ch. 20). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the licensed agency is not itself part of the transaction, custody must be specifically negotiated and the OMHSAS change-of-ownership and licensing process followed, so a licensed custodian remains responsible and clients retain access. Because the license itself is the asset that allows ABA delivery, transaction structuring in Pennsylvania centers on the IBHS license and its continuity. Plan custody and the licensing steps before a sale or restructuring.

The MSO question under an agency-license model

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement. Pennsylvania's agency-license model sharpens the analysis: the licensed IBHS agency, not the MSO, must be the records custodian and the holder of the license, and the IBHS records rules govern how records are secured, maintained, and disposed of regardless of who hosts the systems (55 Pa. Code 5240.41; 5240.42). The practical effects are that the MSO needs a HIPAA business-associate agreement, that the IBHS agency retains custody and licensure responsibility, and that the relationship must respect Pennsylvania's rules on who may own and control a licensed agency. Structure the MSO relationship so the licensed IBHS agency remains the custodian and licensee.

Reading the Pennsylvania burden

Putting the pieces together, Pennsylvania is heavy on the facility-and-agency axis and moderate on privacy. The defining feature is that ABA delivery generally requires an IBHS agency license, a wider-ranging and more administratively demanding entry than single-practitioner licensure, with carve-outs only for entities already licensed in other categories or operating under another Commonwealth agency. Medicaid runs through county behavioral-health managed care on top of the agency license. Privacy is the HIPAA floor plus the IBHS records rules and, where applicable, the Mental Health Procedures Act, which is moderate relative to the strictest states. Retention follows the minor rule and the IBHS and Medical Assistance requirements, and the license-attaches-to-the-agency structure makes the license itself the center of any transaction. The practical read is that Pennsylvania's weight is front-loaded into standing up and maintaining a licensed agency. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility and agency licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. ABA as IBHS is delivered in home, school, and community, and place of service is built into the service definition, so the Medicaid and facility questions are tightly linked here. See the Pennsylvania Medicaid page, which treats IBHS, place of service, and the county BH-MCO structure in detail.
• Licensing and credentialing. The behavior-specialist license and the IBHS clinical-director qualifications are the credentialing layer beneath the agency license. See the Pennsylvania licensing and credentialing page.
• Entity and ownership. Because the IBHS license attaches to the agency, the entity and its ownership are central, and ownership rules shape any MSO. See the Pennsylvania entity page and the Pennsylvania ownership page.
• Practice sale and expansion. The IBHS license and its continuity are the center of any Pennsylvania transaction. See practice expansion and sale.

Getting set up in Pennsylvania: the sequence

1. Plan the agency, not just the practitioner. Recognize that providing ABA generally requires an IBHS agency license, and confirm whether you need one or fit a carve-out.
2. License the clinical leadership. Secure the behavior-specialist license and the qualified clinical director (licensed professional plus BCBA or graduate ABA credential).
3. Obtain the IBHS agency license. Apply to OMHSAS under Chapters 20 and 5240, with a service description that lists ABA, and identify any center-based location on the license.
4. Enroll and contract for Medicaid. Meet the Chapter 1155 payment conditions and contract with the county behavioral-health managed care organization.
5. Build the privacy and records program. Implement HIPAA plus the IBHS records rules and the Mental Health Procedures Act where applicable.
6. Set retention and custody. Configure retention to the minor rule and the IBHS and Medical Assistance requirements, with the licensed agency as custodian and a plan for change-of-ownership licensing.

Pennsylvania facility and records variables at a glance

Frequently asked questions