Does your ABA clinic need a facility license in Tennessee? And how must records be kept?

When an ABA practice needs a facility license in Tennessee

Tennessee regulates ABA primarily through practitioner licensure and TennCare, but the facility question is worth resolving rather than assuming. Behavior analysts are licensed through a Tennessee Department of Health board, and ABA is delivered under that license and billed through TennCare's three managed-care organizations in a model integrated under the medical contracts since 2007 (Tenn. Dept. of Health licensure; TennCare MCOs). The reason the facility question needs care is that the Department of Mental Health and Substance Abuse Services licenses behavioral-health facilities, including non-residential facilities, which the next section addresses.

The TDMHSAS facility framework and the TennCare route

The Tennessee facility question turns on how broadly the TDMHSAS framework reaches:

• TDMHSAS licenses mental-health and substance-use facilities. The Department of Mental Health and Substance Abuse Services, through its Office of Licensure, licenses mental-health and substance-use facilities and services under its rules, and it requires a fire-marshal inspection for any facility where clients come to the place of business, not only residential facilities (TDMHSAS Office of Licensure; Tenn. Comp. R. & Regs. ch. 0940).
• Autism ABA is generally a medical benefit. Autism ABA is treated as a medical and developmental benefit delivered by licensed analysts through TennCare's managed-care organizations, rather than as a TDMHSAS mental-health facility service, so it is generally regulated at the practitioner and TennCare level (TennCare MCOs).
• Confirm the configuration. Because the TDMHSAS framework reaches non-residential facilities, an outpatient ABA clinic should confirm with TDMHSAS whether its specific configuration falls within facility licensure or is regulated through practitioner licensure and TennCare credentialing. This is the one variable that distinguishes Tennessee from the cleanly light states.

The practical rule is that Tennessee is light-to-moderate on facility licensure for outpatient ABA: the operative requirements are analyst licensure and TennCare MCO credentialing, but because the TDMHSAS framework reaches non-residential facilities, you should confirm the facility question for your specific setup rather than assume it does not apply.

HIPAA and Tennessee's confidentiality statutes

HIPAA is the federal floor and applies uniformly. Tennessee then layers named state confidentiality on top:

• Mental-health and developmental-disability records. Tennessee protects the confidentiality of service-recipient records in the mental-health and developmental-disability system, a state layer relevant to the records an ABA practice keeps (TCA Title 33).
• Medical-records confidentiality. Tennessee's medical-records statute makes medical records confidential and governs their disclosure on top of HIPAA (TCA Section 63-2-101).
• Substance-use overlay. Where any substance-use information is involved, the federal 42 CFR Part 2 confidentiality rules add a stricter consent-and-redisclosure regime, which Tennessee providers must follow alongside state law.

The operational takeaway is that a Tennessee ABA practice builds its privacy program to HIPAA, the Title 33 mental-health and developmental-disability confidentiality rules, and the medical-records statute, applying the stricter standard at each point. Tennessee's privacy regime is a real named-statute layer in the moderate range.

Records retention: the minor rule governs

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the medical-records statute and Medicaid audit requirements, means records must be kept securely for many years after a child's last service (TCA Section 63-2-101; TennCare). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter Medicaid or HIPAA-administrative periods drive early destruction of pediatric records.

Records ownership and custody on a change

Tennessee treats the licensed practitioner or entity as the custodian of patient records, and the mental-health and medical-records confidentiality statutes govern how that information may be disclosed (TCA Title 33; TCA Section 63-2-101). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. If any TDMHSAS facility license applies, its transfer must also be addressed. Plan custody arrangements and any licensing steps before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Tennessee does not redefine that relationship the way some broad state statutes do. What Tennessee adds is that any access to records must satisfy the Title 33 and medical-records confidentiality statutes, and that the MSO cannot be the licensed records custodian or, where a facility license applies, the license holder (TCA Title 33; TCA Section 63-2-101). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Tennessee's confidentiality statutes, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the Tennessee burden

Putting the pieces together, Tennessee is a light-to-moderate state on this spoke. On the lighter side, ABA is regulated at the practitioner and TennCare level, autism ABA is generally a medical benefit rather than a TDMHSAS mental-health facility service, and the program runs through a fully integrated managed-care model. On the heavier and more uncertain side, the TDMHSAS facility framework reaches non-residential facilities where clients come to the place of business and triggers a fire-marshal inspection, so the facility question must be confirmed rather than assumed, the Title 33 and medical-records statutes add state privacy obligations on top of HIPAA, and the minor-records rule extends retention for many years. The practical read is that Tennessee keeps the entry light for outpatient ABA but leaves a genuine facility question to resolve up front. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Tennessee was the fiftieth and final state to require commercial ABA coverage, imposes no annual cap, runs a Katie Beckett pathway, and limits telehealth for ongoing counseling to half of visits; the clinic setting is where any facility question would arise. See the Tennessee Medicaid page, which treats the coverage mandate and place of service in detail.
• Licensing and credentialing. The behavior-analyst license and TennCare MCO credentialing are the credentialing story. See the Tennessee licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the confidentiality statutes shape how the entity and any MSO are structured. See the Tennessee entity page and the Tennessee ownership page.
• Practice sale and expansion. Any facility license, records custody, and TennCare credentialing are diligence items in any Tennessee transaction. See practice expansion and sale.

Getting set up in Tennessee: the sequence

1. License the analysts. Obtain behavior-analyst licensure through the Tennessee Department of Health board.
2. Confirm the facility question. Confirm with TDMHSAS whether your outpatient configuration falls within facility licensure or is regulated at the practitioner and TennCare level, and obtain any license required.
3. Credential with TennCare. Contract and credential with the three TennCare managed-care organizations, BlueCare, Amerigroup, and UnitedHealthcare Community Plan.
4. Build the privacy program. Implement HIPAA plus the Title 33 and medical-records confidentiality statutes, with a 42 CFR Part 2 overlay if any substance-use information is involved.
5. Set the retention schedule. Configure retention to the minor rule and Medicaid requirements, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian and any facility-license holder, the business-associate agreement is in place, and access fits Tennessee's confidentiality statutes.

Tennessee facility and records variables at a glance

Frequently asked questions