Notice "shall be made without unreasonable delay," and an entity that complies with the rules of "the entity's primary or functional regulator shall be in compliance with this article" (2008 enrolled S.B. 340, W. Va. Code 46A-2A-101 to 105). Treatment and evaluation information about "any client or patient" is confidential (2018 enrolled S.B. 543, W. Va. Code 27-3-1). Later amendments to both were not checked.
The codified West Virginia Code site returned an access error, so no row quotes codified text. The breach statute was read from the 2008 enrolled bill and the mental health confidentiality section from the 2018 enrolled bill, and later amendments were not checked. The psychologist rule is effective April 18, 2023, and the Medicaid ABA policy April 1, 2020. Items this guide could not verify are listed in the section titled “What this guide could not verify,” below. Treat this as a point-in-time overview, not a determination for your practice. Confirm the current requirements with the agencies named on this page and qualified West Virginia counsel before you build, bill, or sell.
The nine facility-and-records criteria at a glance
- When an ABA practice needs a facility license in West Virginia
- The two archetypes: what changes between them
- HIPAA and the West Virginia breach statute
- Records retention
- Records ownership and custody on a change
- The MSO question
- Reading the West Virginia burden
- How this connects to the rest of your compliance stack
- Getting set up in West Virginia: the sequence
- West Virginia facility and records variables at a glance
- Frequently asked questions
- Where professional advice is essential
When an ABA practice needs a facility license in West Virginia
No West Virginia facility licensing definition or exemption was retrieved. The state licenses "behavioral health centers" through its Office of Health Facility Licensure and Certification. The rule that governs them, 64CSR11, is marked historical on the Secretary of State site, a 2026 bill refers to a successor rule, and the rule text did not load. Search summaries of an agency presentation and a 2024 bill, whose enactment was not confirmed, described the term as a provider that provides behavioral health services, supports, or both, which could reach an ABA clinic. Because no quoted definition was retrieved, this guide does not say whether an ABA-only or diagnostics practice needs the license.
West Virginia does not license behavior analysts, per the state's licensing research; the Medicaid program and the insurance mandate require BACB certification instead. The Medicaid ABA policy conditions ABA on BACB credentials and provider enrollment, and no center-based or day-treatment approval was found in it, which does not by itself verify that none exists (BMS Policy 519.23, effective April 1, 2020).
The two archetypes: what changes between them
- The practice with in-house diagnostics. A psychologist on staff brings the psychologist records rule below. Whether the behavioral health center license reaches a psychologist's office was not retrieved.
- The ABA-only practice. There is no behavior analyst license and no board retention rule. The open question is the behavioral health center license, and the Medicaid ABA policy defers record maintenance to provider manual chapters that were not retrieved.
HIPAA and the West Virginia breach statute
HIPAA is the federal floor and applies uniformly to covered entities in every state. Its breach rule sets a 60-day outer limit for notice to individuals (45 C.F.R. § 164.404), and its documentation rule requires six years for required administrative documents such as policies, business associate agreements, training records and risk analyses.
The West Virginia breach statute, as enrolled in 2008, requires notice that "shall be made without unreasonable delay," with no fixed day count. It contains no Attorney General or regulator notice requirement; the Attorney General enforces, and nationwide consumer reporting agencies are notified when more than 1,000 persons are. Personal information is limited to Social Security number, driver's license or state identification number, and financial account numbers; medical and health insurance information are not listed in that text. An entity complying with its primary or functional regulator's notification rules is in compliance, and no HIPAA-specific clause appears (2008 enrolled S.B. 340). The codified statute and any amendment after 2008 were not checked.
West Virginia's mental health confidentiality section provides that "communications and information obtained in the course of treatment or evaluation of" ... "any client or patient are confidential information," and permits disclosure as provided under the federal HIPAA privacy rule (2018 enrolled S.B. 543, W. Va. Code 27-3-1). The text read does not name covered professions, so it is not limited to listed licensees on its face. Who is bound depends on chapter 27 definitions, which were not read.
Records retention
West Virginia has one verified profession rule, for psychologists.
| Source | Requirement |
|---|---|
| Physician records (diagnostics variant) | Not found |
| Psychologist records (diagnostics variant) | "not less than five years after the last date that service was rendered or for a longer period if required by law" (17CSR6, effective April 18, 2023). No minor-patient extension appears in the subsection quoted. |
| Behavior analyst records | No state license, so no board rule |
| Medicaid provider records | Not retrieved; the ABA policy defers to provider manual chapters 100 and 300, and the chapter 300 text read contains no retention period |
| HIPAA administrative documents | 6 years |
| Litigation or audit hold | Preserve regardless of schedule while pending or threatened |
For a practice with no psychologist, HIPAA's six years is the floor that is certain. The Medicaid term must be confirmed before a schedule is set.
Records ownership and custody on a change
No West Virginia rule on records custody at closure, sale or change of ownership was found. The Medicaid change-of-ownership provisions in the manual concern enrollment, not records. An asset sale should name a custodian in the purchase agreement and settle which party keeps the Medicaid enrollment file.
The MSO question
A management services organization that hosts the record system is a HIPAA business associate and needs a business associate agreement in either archetype. The management agreement should keep the record, and the clinical decisions it documents, under the control of the licensed clinical entity, and should say who runs breach response and who gives any regulator notice.
West Virginia's facility answer depends on a behavioral health center definition this guide could not retrieve.
Reading the West Virginia burden
West Virginia is an open state. The breach and confidentiality text is from enrolled bills, the facility license definition was not retrieved, and the Medicaid retention term is missing. The first thing to do before opening is to ask the Office of Health Facility Licensure and Certification whether an ABA practice is a behavioral health center.
How this connects to the rest of your compliance stack
Facility licensure and records sit alongside several other decisions in this guide:
- Medicaid and place of service. Medicaid enrollment decides who may bill and sets a records floor. See the West Virginia Medicaid page.
- Licensing and credentialing. West Virginia has no state license for behavior analysts, so BACB certification and Medicaid enrollment are the credential events. See the West Virginia licensing and credentialing page.
- Entity and ownership. The behavioral health center license turns on the services the site provides, so entity choice does not change the answer. See the West Virginia entity page.
- Practice sale and expansion. Records custody, the Medicaid change-of-ownership notice, and the breach statute are diligence items in any West Virginia transaction. See practice expansion and sale.
Getting set up in West Virginia: the sequence
- Ask the Office. Before opening, ask the Office of Health Facility Licensure and Certification whether an ABA practice is a behavioral health center.
- Decide the diagnostics model. If a psychologist is on staff, hold the file to the five year rule.
- Build the privacy program. Implement HIPAA and have counsel check the codified breach and confidentiality sections, since only enrolled bills were read.
- Set the retention schedule. Configure retention to HIPAA's six years at minimum and confirm the Medicaid term in the provider manual.
- Settle custody. Name a custodian in any sale or closure agreement.
What this guide could not verify
Where a source was blocked or the law could not be found, this page says so instead of guessing. These items remain open:
- The behavioral health center definition and any office exemption; the rule is marked historical and the text did not load.
- The codified breach statute and any amendment after the 2008 enrolled bill.
- Who is bound by the mental health confidentiality section; chapter 27 definitions were not read, and only the 2018 bill was.
- A physician records rule.
- The Medicaid record retention term and any custody rule; provider manual chapters 100 and 300.
- A center-based or day-treatment ABA approval.
West Virginia facility and records variables at a glance
| Variable | West Virginia value |
|---|---|
| Separate facility license for commercial-only outpatient ABA? | Unresolved: behavioral health center license may reach ABA |
| Does Medicaid billing trigger facility licensure? | Not verified |
| Licensing / oversight agencies | Office of Health Facility Licensure and Certification; Bureau for Medical Services; Attorney General (enforcement) |
| What would trigger a facility license | Operating a behavioral health center; definition not retrieved |
| Physical-plant / survey layer | Not verified |
| State privacy law beyond HIPAA | Breach: no day count (2008 text); 27-3-1: treatment information confidential (2018 text) |
| Records retention (pediatric) | Psychologist 5 years; no BA license; Medicaid not retrieved |
| Records custodian | Not found; contract |
| MSO treatment | Business associate agreement; keep clinical control with the licensed entity |
| Key authorities | W. Va. Code 46A-2A-101 to 105; 27-3-1; 17CSR6 |
Frequently asked questions
Does an outpatient ABA clinic need a facility license in West Virginia?
How long must records be kept in West Virginia?
What is West Virginia's breach deadline?
Does West Virginia license behavior analysts?
Where professional advice is essential, not optional
West Virginia needs the most follow-up of any page in this batch. Have qualified West Virginia counsel obtain the facility answer from the Office of Health Facility Licensure and Certification and read the codified breach and confidentiality sections. Treat this page as an orientation, not a determination, and not legal advice.
The governing authorities to know are W. Va. Code 46A-2A-101 to 105, W. Va. Code 27-3-1, 17CSR6, and BMS Policy 519.23, read together with federal HIPAA.
This page describes licensure, privacy, and retention rules that change and that depend on your configuration. The West Virginia Office of Health Facility Licensure and Certification, the Bureau for Medical Services, the Board of Examiners of Psychologists, the Attorney General, and qualified West Virginia counsel are the authoritative sources. Neither this page nor any secondary source should be relied on in place of direct verification and legal advice.