Does your ABA clinic need a facility license in Texas? And how must records be kept?

When an ABA practice needs a facility license in Texas

The common assumption is that an ABA practice with licensed providers can operate from any commercial space without additional licensing. In Texas, for a standard outpatient ABA practice, that assumption usually holds. Texas regulates ABA primarily at the practitioner level: behavior analysts and assistant behavior analysts are licensed by the Texas Department of Licensing and Regulation (TDLR) under Occupations Code Chapter 506 and 16 Texas Administrative Code Chapter 121, and registered behavior technicians work under their supervision (Tex. Occ. Code ch. 506; 16 TAC ch. 121). There is no separate Texas license for an ABA-only outpatient clinic as such. Whether you serve commercial payers, Medicaid, or both, the entry requirements are the licensed analyst, the corporate entity, and, for Medicaid, provider enrollment, not a facility survey.

What would trigger facility licensure

Texas uses a dual-structure model in which facility licensing is separate from service authorization and Medicaid participation, but the facility licenses HHSC issues attach to specific program types rather than to outpatient ABA (Texas HHSC behavioral-health facility licensing). A facility license becomes relevant when an ABA practice takes on one of those configurations:

• A distinct licensed program type. Residential treatment, day-treatment, partial-hospitalization or intensive-outpatient programs, and substance-use (chemical-dependency) programs map to HHSC facility-license categories. A purely outpatient ABA clinic does not.
• Multidisciplinary or mental-health-clinic scope. Adding psychotherapy, psychiatry, or a broader mental-health-clinic model alongside ABA can pull the practice toward a licensed facility category, where ABA-only generally would not.
• Medicaid, in most other states a trigger, generally is not one here. Texas Medicaid ABA is delivered through provider enrollment and the managed-care plans rather than through a facility-licensed behavioral-health agency, so Medicaid billing by itself does not usually require a facility license in Texas. This is a meaningful contrast with states where Medicaid behavioral-health services route through facility-licensed agencies.

The practical rule is that the trigger is the service type and setting, not the payor: an outpatient ABA clinic is light on facility licensure, while a residential or multidisciplinary program is not. Confirm your specific configuration with HHSC, because the same practice can license differently as it adds service lines.

HIPAA and the HB 300 privacy layer

HIPAA is the federal floor and applies uniformly: an ABA practice that bills electronically is a HIPAA covered entity, must meet the Privacy, Security, and Breach Notification Rules, must execute business-associate agreements with vendors that touch protected health information (PHI), and must retain its HIPAA administrative documents (policies, business-associate agreements, training records) for six years. Texas then builds a higher standard on top through the Texas Medical Records Privacy Act, as amended by HB 300 and codified at Health and Safety Code Chapter 181 (Tex. Health & Safety Code ch. 181; HB 300). The differences that matter for an ABA practice are:

• A broader covered-entity definition. HB 300 reaches any person or organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI, which sweeps in many entities HIPAA would treat only as business associates, and reaches out-of-state entities that handle a Texas resident's PHI (Tex. Health & Safety Code § 181.001).
• Mandatory, documented training. Employees who handle PHI must complete training on federal and state PHI law within 60 days of hire, again when a material change in law affects their duties, and at least every two years, with the training documented and signed (Tex. Health & Safety Code § 181.101).
• Faster electronic access. When a practice maintains records electronically, it must provide them within 15 business days of a written request, faster than HIPAA's 30-day standard, and the stricter Texas timeline governs (Tex. Health & Safety Code ch. 181).
• Tighter disclosure and authorization rules, including limits on electronic disclosure of PHI without authorization and a prohibition on reidentification, with state enforcement and penalties layered on top of HIPAA.

The operational takeaway is that a Texas ABA practice should build its privacy program to the stricter of HIPAA and HB 300 at each point, and should not assume a HIPAA-only program is sufficient. Note that student health data created by a public school is governed by FERPA rather than HIPAA or HB 300, which matters for school-based delivery.

Records retention: the minor rule governs

ABA practices generate substantial documentation: assessments, treatment plans, session notes, supervision logs, parent-training records, and progress data. Retention obligations come from several sources at once, and the longest applicable one governs.

For pediatric ABA, the minor rule almost always governs (Texas medical-records retention; 22 TAC § 165.1). A child who begins ABA at age three generates records that must be kept until that child turns 21, roughly eighteen years, and longer if the last service is recent. Build your retention schedule to the minor rule and the litigation-hold overlay, not to the shorter Medicaid or HIPAA-administrative periods, which can mislead a practice into purging too early.

Records ownership and custody on a change

Texas board and medical-records rules treat the licensed clinical entity (or the individual licensed provider) as the custodian of patient records, which has consequences when ownership changes (Texas medical-records custody rules). Records cannot simply be transferred to a non-licensed entity. In a change of ownership, and especially in an asset sale where the clinical entity is not itself part of the transaction, the custody of records must be specifically negotiated and documented, so that a licensed custodian remains responsible and patients retain access. Because a management services organization is typically not a licensed clinical entity, it cannot be the records custodian even if it hosts the systems, a point the next section develops. Plan custody arrangements before a sale or restructuring, not after.

The MSO question: covered entity, not just a business associate

Many ABA practices use a management services organization (MSO) to provide administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI on the practice's behalf is a business associate, governed by a business-associate agreement. Texas changes the analysis: because HB 300 defines a covered entity to include any organization that stores or transmits PHI, an MSO hosting a Texas practice's records is itself a covered entity under Texas law, not merely a business associate (Tex. Health & Safety Code § 181.001). The practical effects are that the MSO carries direct HB 300 obligations of its own (including training and access timelines), the business-associate agreement still must exist for HIPAA, and the MSO still cannot be the licensed records custodian. Structure the MSO relationship so that the clinical entity remains the custodian, the business-associate agreement is in place, and the MSO meets its own HB 300 duties.

Reading the Texas burden

Putting the pieces together, Texas is a light-facility, heavier-privacy state for outpatient ABA. On the lighter side, a standard outpatient ABA clinic generally needs no separate facility license, the regulation sits at the practitioner and enrollment level, and even Medicaid billing does not usually trigger a facility survey. On the heavier side, HB 300 raises the privacy bar above HIPAA with a broader covered-entity reach, training, and access timelines; the minor-records rule extends retention well past the Medicaid and HIPAA-administrative periods; and records must stay with a licensed custodian, which constrains how an MSO and a sale can be structured. The practical read is that the compliance work in Texas is concentrated in privacy and records rather than in facility licensure, and the facility question reopens only if you add a licensed program type. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit downstream of several other decisions in this guide:

• Medicaid and place of service. The place-of-service mix you bill drives the facility question: the clinic setting is where any facility and physical-plant questions arise, while home, school, and telehealth delivery generally avoid them. See the Texas Medicaid page, which treats place of service in detail.
• Licensing and credentialing. The TDLR analyst license is the foundation that makes the light facility posture possible. See the Texas licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the HB 300 covered-entity treatment of MSOs shape how the entity and any MSO are structured. See the Texas entity page and the Texas ownership page.
• Practice sale and expansion. Records custody on a change of ownership is a core diligence and structuring item in any sale. See practice expansion and sale.

Getting set up in Texas: the sequence

1. License the analysts. License behavior analysts and assistant behavior analysts through TDLR under Occupations Code Chapter 506.
2. Form the entity and confirm the facility question. Form the corporate entity and confirm with HHSC that your outpatient configuration does not require a facility license, or obtain the right license if you add a program type.
3. Enroll for Medicaid if applicable. Complete Texas Medicaid provider enrollment and managed-care contracting, which is the Medicaid pathway rather than a facility license.
4. Build the privacy program to HB 300. Implement HIPAA plus HB 300: broader covered-entity scope, training within 60 days and every two years, and 15-business-day electronic access.
5. Set the retention schedule. Configure retention to the minor rule (to age 21 or seven years after last service, whichever is longer) with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the records custodian, the business-associate agreement is in place, and any MSO meets its own HB 300 duties.

Texas facility and records variables at a glance

Frequently asked questions