Does your ABA clinic need a facility license in Washington? And how must records be kept?

When an ABA practice needs a facility license in Washington

Washington's facility license for outpatient behavioral care is the behavioral health agency license issued by the Department of Health under RCW 71.24.037 and chapter 246-341 WAC. The chapter's scope is stated in its first section, and applied behavior analysis is not in it.

Applied behavior analysis appears in the chapter once, in the list of certifications a licensed agency may add, as a recovery support mental health service. That is an elective certification for an organization that has chosen to be a behavioral health agency and wants to deliver ABA under a mental health benefit; it is not a requirement for an ABA practice. A practice of licensed behavior analysts under chapter 18.380 RCW operates on its professional licenses, and the Department's professional rules at chapter 246-805 WAC, which the Washington licensing page covers, contain no facility component. The physical plant layer is absent for an outpatient practice, and the only configuration that carries a facility element is the Apple Health facility-based day program described below (WAC 246-341-0110(1); RCW 18.380; WAC 246-805).

The real hurdle: the center of excellence is a person, and one archetype employs it

Washington's Medicaid ABA benefit is built in three stages, and the first stage is the archetype fork. The Apple Health ABA chapter, WAC 182-531A, requires a center of excellence to evaluate the client, confirm the qualifying diagnosis, and prescribe ABA before any assessment or treatment can be authorized. The chapter is explicit about what a center of excellence is.

• The practice with an in-house psychologist. A licensed psychologist experienced in autism diagnosis is a center of excellence by status under subsection (3)(a)(vi); the attestation form HCA 13-0009 and the agency training requirement apply to the ARNP, physician, physician assistant, and naturopath group in subsection (4), not to the listed specialists. The psychologist must be enrolled with the Health Care Authority and, for managed care clients, contracted with the plan. The practice then performs Stage One under WAC 182-531A-0500, its lead behavior analysis therapist performs Stage Two under 0600, and its technicians deliver Stage Three under 0700, with prior authorization requested within 60 days of the assessment and recertification in three-month increments. When the agency routes a recertification back to the center of excellence under 1100(4)(c), the reviewer is on staff.
• The ABA-only practice. It depends on an outside center of excellence for every new client and for every recertification the agency refers back. Its lead behavior analysis therapist must be a DOH-licensed behavior analyst or assistant enrolled as a servicing provider, and its technicians must be DOH-certified and enrolled, supervised for at least five percent of direct care each week. The documentation chain from the outside prescriber's evaluation to the treatment plan is the audit trail, and a missing or stale center of excellence evaluation is a denial.
• The facility-based day program. Either archetype that offers the day services program under WAC 182-531A-0600(3)(a) must employ or contract a multidisciplinary team, hold a signed ABA Day Program Capacity Attestation, form HCA 13-0007, and, if the program is hospital-based, meet the outpatient hospital licensure requirements in chapter 246-320 WAC. The agency covers one lifetime authorization of day treatment services. This is the only facility-flavored layer in Washington ABA, and it is elective.

The practical rule is that Washington replaces the facility license with a provider-qualification chain, and the in-house diagnostics archetype owns the top of that chain (WAC 182-531A-0500 to 0800, 0900(1)(e), 1100).

HIPAA, the Uniform Health Care Information Act, and the 30-day breach clock

HIPAA is the federal floor and applies uniformly. Washington layers two statutes on it, and both reach behavior analysts because Washington licenses them.

• The Uniform Health Care Information Act. Chapter 70.02 RCW governs disclosure of health care information by health care providers, patient access and amendment, and disclosure charting. Its coverage turns on one definition.

Licensed behavior analysts, licensed assistant behavior analysts, and certified behavior technicians under chapter 18.380 RCW are inside that definition, as are psychologists under chapter 18.83 RCW. Both archetypes are therefore bound by the Act's authorization rules, its access timelines, and its requirement that disclosures other than to third-party payors be charted. The Legislature's site shows an amended version of RCW 70.02.010 scheduled to take effect June 30, 2027; the definition quoted above is the current one, and subsection numbers should be rechecked before they are cited in a policy.

• The breach statute. RCW 19.255.010 requires notice to affected residents no more than 30 days after discovery of a breach, and notice to the Attorney General within the same 30 days when more than 500 Washington residents must be notified. A HIPAA covered entity that complies with the HITECH breach rule is deemed to have complied with the consumer-notice requirements for protected health information, but must still notify the Attorney General. The statute is enforceable under the Consumer Protection Act, which gives consumers a private right of action. Because the state clock is 30 days and HIPAA's is 60, a Washington practice runs incident response to the state deadline and files the Attorney General notice on the same schedule (RCW 19.255.010; RCW 19.255.040; RCW 19.86).
• Professional disclosure rules. The licensing chapter requires an assistant behavior analyst and a certified behavior technician to disclose the supervisor's name and contact information in writing before providing services, to keep that disclosure in the client file, and to review it annually with the review documented in the file. Those are records requirements enforced by the Department against the licensee (WAC 246-805-250, 246-805-340).

The My Health My Data Act, chapter 19.373 RCW, regulates consumer health data outside HIPAA; its application to a covered entity's non-PHI data should be confirmed by counsel for the practice's configuration, and this page does not state its scope.

Records retention: eight years for the psychologist, none by rule for the behavior analyst

Washington's behavior analyst licensing chapter contains no client-record retention rule. It requires supervision plans to be kept for seven years and continuing education and technician training documentation for four, and it requires supervision disclosures to sit in the client file, but it never says how long the client file itself must be kept. The psychology board's rule is specific, and the Apple Health rule binds every enrolled provider.

The Apple Health rule also prescribes minimum chart contents, including the name and title of the person performing the service, a detailed description of treatment, the plan of treatment and outcome, the claims and payments received, and informed consent documentation, and it requires that entries be authenticated by the person who provided the care. For the ABA-only archetype that list is the retention standard, because the licensing chapter gives it nothing else. For the diagnostics archetype the psychologist's eight-year and age-22 rule is longer than anything on the ABA side, and the psychology rule also requires a written policy for the records on retirement, discontinuation of practice, or death that the Board can demand within sixty days. Build the schedule to age 22 and eight years for the psychologist's file, six years for Apple Health claim support, and a litigation-hold overlay (WAC 246-924-354(2), (3); WAC 182-502-0020(1), (4), (5)).

Records ownership and custody on a change

Washington puts custody on the licensee and the enrolled provider. The psychologist's records are the psychologist's responsibility under WAC 246-924-354, which requires a written custody and transition policy and permits disposal only after the minimum period and only by secure means. The behavior analyst's records carry no custody rule in chapter 246-805 WAC beyond the supervision disclosures that must remain in the file, so custody sits with the enrolled provider entity that signed the Apple Health core provider agreement. In a change of ownership, particularly an asset sale where the enrolled entity is not itself transferred, custody must be negotiated so that a licensed custodian remains, patients retain their chapter 70.02 access rights, and the six-year Apple Health obligation survives. Apple Health enrollment and the center of excellence status of an individual psychologist do not transfer with the assets, which is a records question and a Stage One question at once. The elective professional entity rules the Washington entity page covers decide which entity that custodian is (WAC 246-924-354(3), (5); WAC 182-502-0018).

The MSO question

A management services organization that hosts the record system is a HIPAA business associate under a business-associate agreement in either archetype. Washington adds that disclosures to the MSO are disclosures by a health care provider under chapter 70.02 RCW, that the supervision disclosures and reviews must remain in the licensee's client file, and that the psychologist's custody policy has to name a licensed custodian rather than the MSO. The MSO therefore cannot be the custodian. Because Washington's corporate-practice doctrine is untested for behavior analysis, the Washington ownership page treats the MSO structure as a doctrine question first and a records question second; this page adds only that the management agreement has to keep access under the licensee's control and allocate who answers a Health Care Authority audit and a Department of Health complaint.

Reading the Washington burden

Putting the pieces together, Washington is a light-facility, structured-Medicaid state. On the lighter side, there is no behavioral health agency license for outpatient ABA, no facility survey unless a day program is offered, and the behavior analyst licensing chapter is silent on retention. On the heavier side, every Apple Health case runs through a three-stage chain with a named individual center of excellence at the top, prior authorization inside 60 days, three-month recertifications, and a six-year documentation rule with prescribed contents; the Uniform Health Care Information Act reaches every licensee; and the breach clock is a hard 30 days with a private right of action. The archetype decision is a Medicaid throughput decision: the practice that employs its own center of excellence controls Stage One.

How this connects to the rest of your compliance stack

Facility licensure and records sit alongside several other decisions in this guide:

• Medicaid and place of service. The Apple Health ABA chapter's three stages, the individual center of excellence, the 60-day authorization window, and the six-year records rule are the operating structure of Medicaid ABA in Washington. See the Washington Medicaid page.
• Licensing and credentialing. The chapter 18.380 license and the chapter 246-805 rules carry supervision, disclosure, and training-record duties but no facility component and no client-record retention rule. See the Washington licensing and credentialing page.
• Entity and ownership. Washington's corporate-practice doctrine reaches licensed professions absent legislative authorization and is untested for behavior analysis, which shapes which entity holds the records and the Apple Health enrollment. See the Washington entity page and the Washington ownership page.
• Practice sale and expansion. Non-transferable Apple Health enrollment, the individual center of excellence status of a psychologist, and the psychology board's custody policy are diligence items in any Washington transaction. See practice expansion and sale.

Getting set up in Washington: the sequence

1. Credential the team. Obtain and maintain DOH licenses for behavior analysts and assistants and DOH certification for technicians under chapter 18.380 RCW, and enroll each as an Apple Health servicing provider.
2. Decide the diagnostics model. If the practice will employ a licensed psychologist, enroll the psychologist with the Health Care Authority as a center of excellence and contract with the managed care plans; if not, establish referral relationships with outside centers of excellence.
3. Confirm the facility question. Confirm that the outpatient configuration is not a behavioral health agency service under WAC 246-341-0100, and if a day services program is offered, file the HCA 13-0007 attestation and meet any chapter 246-320 requirements.
4. Build the privacy program. Implement HIPAA and chapter 70.02 RCW, keep supervision disclosures and annual reviews in each client file, and set incident response to the 30-day clock in RCW 19.255.010 with the Attorney General notice above 500 residents.
5. Set the retention schedule. Configure retention to eight years and age 22 for the psychologist's file under WAC 246-924-354, six years for Apple Health under WAC 182-502-0020 with the prescribed chart contents, and a litigation-hold overlay.
6. Fix custody and MSO terms. Adopt the psychologist's written custody policy, name the enrolled provider as custodian for the ABA file, sign the business-associate agreement, and keep access under licensee control.

Washington facility and records variables at a glance

Frequently asked questions