Does your ABA clinic need a facility license in Virginia? And how must records be kept?

When an ABA practice needs a facility license in Virginia

For a standard outpatient ABA practice, Virginia does not require a facility license, and its history explains why this is worth stating clearly. Before 2012, Virginia issued an outpatient ABA license through DBHDS, but it was built for clinics, asking about matters like water temperature and the number of fire extinguishers, and it fit poorly with in-home delivery. In 2012, the Department of Health Professions, through the Board of Medicine, began licensing behavior analysts, and the DBHDS outpatient-ABA license became unnecessary (Va. Board of Medicine, behavior-analyst licensure since 2012). Today, ABA is delivered under the analyst's professional license, registered behavior technicians work under supervision, and, for Medicaid, providers enroll with DMAS rather than obtaining a facility license. Virginia is the clearest case in this guide of a state that deliberately shifted ABA from facility regulation to practitioner regulation.

What would trigger a DBHDS license

DBHDS still licenses behavioral-health services, and it uses a subjectivity review to decide whether a particular service is subject to licensure under Virginia Code Section 37.2-405 (Va. Code Section 37.2-405; 12 VAC 35-105). For an ABA practice, the analysis is:

• Ordinary outpatient ABA is not subject to a DBHDS license. Delivered under the Board of Medicine analyst license and billed through DMAS, standard outpatient ABA falls outside DBHDS facility licensure.
• Broader behavioral-health configurations can be. If a practice provides services that meet the DBHDS definition of a licensable service, such as community mental-health rehabilitation services, intensive in-home, crisis services, or residential models, DBHDS licensure applies, and that process is detailed and can take six to twelve months. Practitioners have noted that the DBHDS licensing route is arduous and not well suited to behavior analysts, which is precisely why the practitioner-license pathway is the norm for ABA.
• Medicaid does not itself trigger a facility license. Medicaid ABA runs through DMAS enrollment and the Cardinal Care managed-care organizations, with a per-code service-authorization change effective October 15, 2025; it does not require a DBHDS facility license for ordinary ABA.

The practical rule is that Virginia is light on facility licensure for outpatient ABA, and the DBHDS framework becomes relevant only if you add broader behavioral-health service lines that fall within its subjectivity review.

HIPAA and the Virginia Health Records Privacy Act

HIPAA is the federal floor and applies uniformly. Virginia then adds a named state statute, the Health Records Privacy Act, codified at Virginia Code Section 32.1-127.1:03, which layers state requirements on top of HIPAA (Va. Code Section 32.1-127.1:03). The features that matter for an ABA practice are:

• Confidentiality and a defined patient interest in records. The Act establishes the confidentiality of health records and the patient's rights in them, and sets Virginia-specific rules for disclosure and for patient access to records.
• Access and disclosure procedures. The Act governs how and when records may be disclosed and how patient requests for copies are handled, on top of the HIPAA right of access, so a Virginia practice should align its access and disclosure procedures with both.

The operational takeaway is that a Virginia ABA practice should build its privacy program to the stricter of HIPAA and the Health Records Privacy Act at each point. Virginia's regime is a named state statute but is more procedural and HIPAA-aligned than the absolute consent regimes of the strictest states, which places Virginia in the moderate range on privacy.

Records retention: the Board of Medicine minor rule

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and extends retention well beyond the six-year adult baseline (18 VAC 85-20-26). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact minor period with counsel, and do not let the shorter HIPAA-administrative period drive early destruction.

Records ownership and custody on a change

Virginia treats the licensed practitioner or entity as the custodian of patient records, and the Board of Medicine has specific rules for what must happen to records when a practice closes, relocates, or changes hands, including patient notification and arrangements for continued access (Va. Board of Medicine records rules; Va. Code Section 54.1-2403.3). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale where the clinical entity is not part of the transaction, custody must be specifically negotiated so a licensed custodian remains responsible and patients retain access under the Health Records Privacy Act. Plan custody arrangements and any required patient notifications before a sale or restructuring.

The MSO question

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement, and Virginia does not redefine that relationship the way some broad state statutes do. What Virginia adds is that any disclosure of records, including to or through an MSO, must satisfy the Health Records Privacy Act, and that the MSO cannot be the licensed records custodian (Va. Code Section 32.1-127.1:03). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must remain within the Act's disclosure rules, and that the licensed clinical entity remains the custodian. Structure the MSO relationship accordingly.

Reading the Virginia burden

Putting the pieces together, Virginia is a light-facility, moderate-privacy state. On the lighter side, a standard outpatient ABA clinic needs no facility license, the regulation sits at the practitioner and enrollment level, the historical DBHDS facility license was retired in 2012, and Medicaid billing does not trigger a facility survey. On the heavier side, the DBHDS framework still applies to broader behavioral-health configurations through its subjectivity review, the Health Records Privacy Act adds named state privacy obligations on top of HIPAA, and the minor-records rule extends retention well past the six-year adult baseline. The practical read is that Virginia keeps the entry light for outpatient ABA while maintaining a real program-licensure framework for anything broader, and a named but moderate privacy regime. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility licensure and records sit downstream of several other decisions in this guide:

• Medicaid and place of service. Place of service drives the facility question: the clinic setting is where any facility and physical-plant questions arise, while home, school, and telehealth delivery generally avoid them, and Virginia requires the initial assessment in person. See the Virginia Medicaid page, which treats place of service and the service-authorization change in detail.
• Licensing and credentialing. The Board of Medicine analyst license is the foundation that makes the light facility posture possible. See the Virginia licensing and credentialing page.
• Entity and ownership. The records-custodian rule and the Health Records Privacy Act shape how the entity and any MSO are structured. See the Virginia entity page and the Virginia ownership page.
• Practice sale and expansion. Records custody and the practice-closure notification rules are diligence items in any Virginia transaction. See practice expansion and sale.

Getting set up in Virginia: the sequence

1. License the analysts. Obtain Board of Medicine behavior-analyst licensure through the Department of Health Professions.
2. Form the entity and confirm the facility question. Form the corporate entity and, if you plan broader behavioral-health services, request a DBHDS subjectivity determination.
3. Enroll for Medicaid if applicable. Complete DMAS PRSS enrollment and contract with the Cardinal Care managed-care organizations, noting the per-code service-authorization rules.
4. Build the privacy program. Implement HIPAA plus the Virginia Health Records Privacy Act for disclosure and access.
5. Set the retention schedule. Configure retention to the Board of Medicine adult and minor rules, with a litigation-hold overlay.
6. Fix custody and MSO terms. Ensure the licensed entity is the custodian, the business-associate agreement is in place, and you can meet the practice-closure notification rules on any change.

Virginia facility and records variables at a glance

Frequently asked questions