Does your ABA clinic need a facility license in Utah? And how must records be kept?

When an ABA practice needs a facility license in Utah

For a standard outpatient ABA practice, Utah does not require a facility license. Utah regulates ABA at the practitioner level: behavior analysts are licensed under the Behavior Analyst Licensing Act through the Division of Occupational and Professional Licensing, with Licensed Behavior Analyst and Licensed Assistant Behavior Analyst roles and additional technician and coach roles added by a 2024 amendment and still being defined, and only a psychologist or behavior analyst may design and supervise an ABA program (Utah Code Title 58; Behavior Analyst Licensing Act). ABA is available only under the EPSDT benefit, delivered by enrolled providers through Utah Medicaid's accountable care organizations. The clinic or center setting raises no facility-license requirement by default; the one lane that adds a layer is the waiver lane, which the next section addresses.

The EPSDT lane, the waiver lane, and Utah's distinctive rules

The Utah facility question turns on which delivery lane you use, and Utah adds two rules worth knowing:

• The EPSDT clinic lane is light. Standard outpatient and center-based ABA under EPSDT is delivered by DOPL-licensed psychologists and analysts and their supervised staff, enrolled through Utah Medicaid's accountable care organizations, with no DHHS Office of Licensing facility license required by default.
• The waiver lane adds a certification. Home and community-based services waiver providers, such as the Autism Waiver and the disability-services waivers, obtain an Office of Licensing certification, which involves a safety inspection, so the waiver lane carries a real, though light, facility layer (Utah DHHS Office of Licensing).
• Multiple settings on the same day are allowed. Utah expressly permits ABA in multiple settings on the same day, in the home, community, clinic, or center, which keeps place-of-service flexible (Utah Medicaid ASD manual).
• The non-supplanting rule. Under Utah Code Section 63J-1-212, autism services provided in any setting already funded by other state or federal money for treating autism-associated behaviors must be reimbursed through that designated appropriation, not Medicaid, which is a distinctive funding boundary to track across settings such as schools and specialized programs (Utah Code Section 63J-1-212).

The practical rule is that Utah is light on facility licensure for outpatient EPSDT ABA, with the regulatory weight on DOPL practitioner licensure and Medicaid enrollment, while the waiver lane adds an Office of Licensing certification and the non-supplanting rule sets a funding boundary you must respect across settings.

HIPAA, Utah confidentiality, and the Consumer Privacy Act

HIPAA is the federal floor and applies uniformly. Utah then layers state obligations on top:

• Medical-records confidentiality. Utah's medical-records and patient-confidentiality rules govern the clinical record and its disclosure on top of HIPAA, and Utah Medicaid imposes its own recordkeeping requirements.
• The Utah Consumer Privacy Act. For personal data that falls outside HIPAA-regulated PHI, the Utah Consumer Privacy Act imposes consumer-data obligations; HIPAA-covered data is largely carved out, but a practice's non-PHI consumer data can be in scope (Utah Consumer Privacy Act).

The operational takeaway is that a Utah ABA practice builds its privacy program to HIPAA, the Utah medical-records confidentiality rules, and the Utah Consumer Privacy Act for any non-PHI consumer data, applying the stricter standard at each point. Utah has no single broad medical-records privacy statute on the model of some states, so the privacy load is in the moderate range.

Records retention: the minor rule governs

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with Utah Medicaid recordkeeping requirements, means records must be kept securely for many years after a child's last service (Utah records retention; Utah Medicaid recordkeeping). The supervising psychologist or analyst is responsible for retaining compliance records for supervised staff. Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

Utah treats the licensed practitioner or entity as the custodian of patient records, with the supervising psychologist or analyst responsible for retaining compliance records, and the medical-records confidentiality rules govern disclosure (Utah Medicaid ASD manual; Utah custody rules). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access. If you operate in the waiver lane, the Office of Licensing certification and any change to it must also be addressed. Plan custody and any licensing steps before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Utah does not redefine that relationship the way some broad state statutes do. What Utah adds is that any access to records must satisfy the medical-records confidentiality rules and, for non-PHI consumer data, the Utah Consumer Privacy Act, and that the MSO cannot be the licensed records custodian (Utah Consumer Privacy Act; Utah custody rules). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within Utah's confidentiality rules, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the Utah burden

Putting the pieces together, Utah is a light-facility state with a couple of distinctive Medicaid features. On the lighter side, a standard outpatient EPSDT ABA clinic needs no facility license, the regulation sits at DOPL practitioner licensure and Medicaid enrollment, and same-day multiple settings are allowed. On the heavier or more particular side, the waiver lane adds an Office of Licensing certification with a safety inspection, the non-supplanting rule sets a funding boundary you must respect across settings, the medical-records rules and the Utah Consumer Privacy Act add state privacy obligations on top of HIPAA, and the minor-records rule extends retention for many years. The practical read is that Utah keeps the facility entry light for outpatient ABA while asking you to track which delivery lane you are in and to respect the non-supplanting funding rule. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Utah's same-day-multiple-settings allowance and the non-supplanting rule are core place-of-service features, and the clinic setting is where any facility question would arise. See the Utah Medicaid page, which treats EPSDT, the accountable care organizations, and place of service in detail.
• Licensing and credentialing. The DOPL analyst licensure and the design-and-supervise rule are the credentialing story. See the Utah licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the privacy regime shape how the entity and any MSO are structured. See the Utah entity page and the Utah ownership page.
• Practice sale and expansion. Records custody, any waiver-lane certification, and the non-supplanting boundary are diligence items in any Utah transaction. See practice expansion and sale.

Getting set up in Utah: the sequence

1. License the analysts. Obtain DOPL behavior-analyst licensure, with psychologists or analysts designated to design and supervise programs.
2. Confirm your lane. Confirm whether you deliver under the EPSDT clinic lane, which needs no facility license, or the waiver lane, which requires an Office of Licensing certification with a safety inspection.
3. Enroll for Medicaid. Enroll with Utah Medicaid and the accountable care organizations, and build the non-supplanting funding boundary into your place-of-service practices.
4. Build the privacy program. Implement HIPAA plus Utah medical-records confidentiality and the Utah Consumer Privacy Act for non-PHI data.
5. Set the retention schedule. Configure retention to the minor rule and Utah Medicaid recordkeeping, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and any waiver-lane certification is addressed on changes.

Utah facility and records variables at a glance

Frequently asked questions