Notice "shall be made not later than sixty days from the discovery or notification of the breach of system security," and the Attorney General is told of "any breach of system security that exceeds two hundred fifty residents of this state" (SDCL 22-40-20, SL 2018 ch 135). Personal information includes health information as defined in 45 C.F.R. 160.103 (SDCL 22-40-19).
The breach statutes were read in codified form with a 2018 source note and no later amendment. The facility definition was read from 2022 session law, and a reported 2024 amendment was not read. The HIPAA deemed-compliance clause was read from the 2018 act, not its codified section. The Medicaid provider agreement is version 3.1 (May 2023). Items this guide could not verify are listed in the section titled “What this guide could not verify,” below. Treat this as a point-in-time overview, not a determination for your practice. Confirm the current requirements with the agencies named on this page and qualified South Dakota counsel before you build, bill, or sell.
The nine facility-and-records criteria at a glance
- When an ABA practice needs a facility license in South Dakota
- The two archetypes: what changes between them
- HIPAA and the South Dakota breach statute
- Records retention
- Records ownership and custody on a change
- The MSO question
- Reading the South Dakota burden
- How this connects to the rest of your compliance stack
- Getting set up in South Dakota: the sequence
- South Dakota facility and records variables at a glance
- Frequently asked questions
- Where professional advice is essential
When an ABA practice needs a facility license in South Dakota
South Dakota licenses "health care facilities" under SDCL chapter 34-12. As amended by 2022 session law, the definition lists "any institution, birth center, ambulatory surgery center, chemical dependency treatment facility, hospital, nursing facility, assisted living center, rural primary care hospital, adult foster care home, inpatient hospice, residential hospice, freestanding emergency care facility, community living home," and reaches any "place, building, or agency in which any accommodation is maintained, furnished, or offered for the hospitalization, nursing care, or supervised care of the sick or injured" (SDCL 34-12-1.1, as amended by 2022 SL ch 103). No outpatient clinic or office type is listed, so an outpatient ABA practice does not appear to fall within it.
Two limits. The current codified section was not read, and a 2024 amendment (SB 147) was reported. And the Department of Social Services behavioral health accreditation rules were not checked for any reach to ABA providers. A center-based or day-treatment ABA approval was not found; the Medicaid ABA billing manual lists enrolled behavior analysts as billing providers and contains no center-based license.
The two archetypes: what changes between them
- The practice with in-house diagnostics. The same definition applies. A hospital is an "establishment with an organized medical staff with permanent facilities that include inpatient beds," and the only office carve-out in the definitions is a dentist's office, from the ambulatory surgery center type (SDCL 34-12-1.1, as amended by 2022 SL ch 103). No explicit physician or psychologist office exemption was found, but an outpatient diagnostic office is not a listed facility type.
- The ABA-only practice. Behavior analysts are licensed by the Board of Social Work Examiners under chapter 36-38, and the sections read contain no entity or records rule. No profession-specific retention rule was found.
HIPAA and the South Dakota breach statute
HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.
South Dakota's breach statute sets a fixed outer limit: disclosure is made not later than 60 days from discovery or notification of the breach. The Attorney General is told by mail or electronic mail of any breach that exceeds 250 South Dakota residents. Personal information includes "health information as defined in 45 CFR 160.103" (SDCL 22-40-19, 22-40-20). An information holder regulated by federal law, including HIPAA, is deemed compliant if it notifies affected residents under the applicable federal law. That clause was read from the 2018 act, not its codified section (2018 SB 62, section 8). A South Dakota health information confidentiality statute was not found.
Records retention
South Dakota's verified retention period is the Medicaid term. Profession-specific rules were not found.
| Source | Requirement |
|---|---|
| Physician records (diagnostics variant) | Not found |
| Psychologist records (diagnostics variant) | Not found |
| Behavior analyst records | Licensed under chapter 36-38, but no retention rule found in the sections read |
| Medicaid provider records | "for a period of at least six years after" ... "the last claim is adjudicated or while an audit or investigation is pending" (SD Medicaid Provider Agreement 3.1 (May 2023)) |
| HIPAA administrative documents | 6 years |
| Litigation or audit hold | Preserve regardless of schedule while pending or threatened |
The Medicaid six years from the last adjudicated claim is also HIPAA's six years in practice. A rule for licensed facilities sets ten years (ARSD 44:76:08:06), but it applies to facilities under chapter 34-12, not to professions, and this guide does not apply it to an outpatient practice.
Records ownership and custody on a change
The Medicaid provider agreement requires "at least thirty (30) days advance written notice" of a change of ownership and treats a sale or transfer of ownership or control as a ground for termination (SD Medicaid Provider Agreement 3.1). No rule on who holds records when a practice closes or is sold was found. In an asset sale, the purchase agreement should name a custodian, carry the six-year Medicaid term, and plan for the buyer's own enrollment.
The MSO question
A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice. The South Dakota ownership page covers who may own the clinical entity.
South Dakota's facility definition lists institutions and has no outpatient clinic category, but the text read is from 2022.
Reading the South Dakota burden
South Dakota is light on facility licensure and moderate on breach regulation. The 60 day limit and Attorney General notice above 250 residents are the practical obligations. Profession record rules are unverified, so the Medicaid term and HIPAA set the floor.
How this connects to the rest of your compliance stack
Facility licensure and records sit alongside several other decisions in this guide:
- Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the South Dakota Medicaid page.
- Licensing and credentialing. South Dakota licenses behavior analysts through the Board of Social Work Examiners, which decides who may supervise and hold the clinical file. See the South Dakota licensing and credentialing page.
- Entity and ownership. The facility definition turns on the kind of institution, not the owner, so entity choice does not change the answer. See the South Dakota entity page and the South Dakota ownership page.
- Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any South Dakota transaction. See practice expansion and sale.
Getting set up in South Dakota: the sequence
- Confirm the facility question. Have counsel read the current codified 34-12-1.1 and any 2024 amendment before a center-based site opens.
- Decide the diagnostics model. If a physician or psychologist is on staff, confirm their board's records rules.
- Build the privacy program. Implement HIPAA and write incident response to the 60 day limit with Attorney General notice above 250 residents.
- Set the retention schedule. Configure retention to the longest of HIPAA's six years and the Medicaid six years, with a pediatric benchmark.
- Plan the Medicaid notice. Give 30 days' advance written notice of any ownership change.
What this guide could not verify
Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:
- The current codified text of SDCL 34-12-1.1 and the reported 2024 amendment.
- Behavioral health accreditation rules at the Department of Social Services.
- A center-based or day-treatment ABA approval.
- Physician, psychologist and behavior analyst retention rules.
- A South Dakota health information confidentiality statute.
- A rule on records custody at closure or sale, and the codified section of the HIPAA deemed-compliance clause.
South Dakota facility and records variables at a glance
| Variable | South Dakota value |
|---|---|
| Separate facility license for commercial-only outpatient ABA? | Not indicated: 34-12-1.1 lists institutions with no outpatient clinic category (2022 text) |
| Does Medicaid billing trigger facility licensure? | Not verified |
| Licensing / oversight agencies | Department of Health; Board of Social Work Examiners; Department of Social Services; Attorney General |
| What would trigger a facility license | Operating a listed institution or an accommodation for hospitalization, nursing or supervised care |
| Physical-plant / survey layer | Not indicated for outpatient |
| State privacy law beyond HIPAA | 22-40-20: 60 days; AG above 250 residents; health information covered; HIPAA deemed compliant |
| Records retention (pediatric) | Not found for professions; Medicaid 6 years after last claim |
| Records custodian | Contract; Medicaid 30 day ownership change notice |
| MSO treatment | Business associate agreement; keep clinical control with the licensed entity |
| Key authorities | SDCL 34-12-1.1, 22-40-19, 22-40-20, ch. 36-38 |
Frequently asked questions
Does an outpatient ABA clinic need a facility license in South Dakota?
What is South Dakota's breach deadline?
How long must records be kept?
How much notice does Medicaid need of an ownership change?
Where professional advice is essential, not optional
South Dakota's facility answer looks light, and the text should be confirmed against the current code. Have qualified South Dakota counsel confirm the 2024 amendment and the Department of Social Services accreditation rules. Treat this page as an orientation, not a determination, and not legal advice.
The governing authorities to know are SDCL 34-12-1.1, SDCL 22-40-19 and 22-40-20, and the Medicaid provider agreement, read together with federal HIPAA.
This page describes licensure, privacy, and retention rules that change and that depend on your configuration. The South Dakota Department of Health, the Department of Social Services, the Board of Social Work Examiners, the Attorney General, and qualified South Dakota counsel are the authoritative sources. Neither this page nor any secondary source should be relied on in place of direct verification and legal advice.