Does your ABA clinic need a facility license in Wisconsin? And how must records be kept?

When an ABA practice needs certification in Wisconsin

Wisconsin's facility question is best framed as a certification question, and the answer depends on how the practice is configured and bills. Outpatient autism ABA generally runs through Wisconsin's ForwardHealth behavioral-treatment benefit, with provider enrollment and rendering-provider rules, and professional credentialing runs through the Department of Safety and Professional Services (Wis. ForwardHealth behavioral-treatment benefit; DSPS credentialing). Separately, Wisconsin certifies outpatient mental-health clinics under DHS 35, a real clinic-certification framework that the next section explains, so the key task is to confirm which path applies to your practice.

The behavioral-treatment benefit and DHS 35 certification

Two paths can apply in Wisconsin, and they should not be conflated:

• The behavioral-treatment benefit. Outpatient autism ABA is generally delivered through Wisconsin's ForwardHealth behavioral-treatment benefit, with provider and rendering-provider enrollment rules. A 2025 federal audit found improper payments in this benefit, so payment-integrity scrutiny and rendering-provider documentation are heightened (Wis. ForwardHealth behavioral-treatment benefit; 2025 federal audit).
• DHS 35 certification of outpatient mental-health clinics. Under DHS 35, an outpatient mental-health clinic is not eligible to receive Medicaid, BadgerCare Plus, federal block-grant, or state community-aids funding, or to be a certified clinic for the private-insurance mandate, unless it is certified, and certification involves an application, fees, insurance proof, and program standards, with a survey (Wis. Admin. Code ch. DHS 35; DHS 35.06; DHS 35.08). Whether a given ABA practice is configured as an outpatient mental-health clinic, and therefore needs DHS 35 certification, rather than enrolling through the behavioral-treatment benefit, depends on the specifics.
• Confirm the path. Because the two frameworks coexist, an ABA provider should confirm with DHS whether its configuration enrolls through the behavioral-treatment benefit, requires DHS 35 certification, or both. This is the variable that distinguishes Wisconsin from the cleanly light states.

The practical rule is that Wisconsin is light-to-moderate on this axis: most outpatient autism ABA runs through the behavioral-treatment benefit, but the DHS 35 clinic-certification framework is a genuine adjacent requirement that may apply depending on configuration, so confirm the path before you build or bill.

HIPAA and the Wisconsin treatment-records statute

HIPAA is the federal floor and applies uniformly. Wisconsin then has one of the country's strongest treatment-records privacy regimes, and it is the distinctive element of Wisconsin compliance:

• The treatment-records confidentiality statute. Wisconsin's treatment-records statute makes records created in the course of providing services for mental illness, developmental disability, and substance use confidential, with consent-based disclosure and strong protections, a regime stricter and more consent-driven than the HIPAA baseline (Wis. Stat. Section 51.30).
• Administrative-code confidentiality. The administrative-code confidentiality rules reinforce the statute and apply to certified clinics, and the clinic rules require treatment records to be kept confidential to the extent the statute requires, alongside HIPAA and 42 CFR Part 2 (Wis. Admin. Code chs. DHS 92 and DHS 35).

The operational takeaway is that a Wisconsin ABA practice should treat the treatment-records statute as a real, consent-driven layer on top of HIPAA, and build consent, disclosure, and redisclosure procedures to the stricter standard. To the extent autism ABA records fall within the statute's coverage of developmental-disability service records, this is the privacy framework that governs.

Records retention: at least seven years and the minor rule

ABA practices generate substantial documentation, and retention obligations come from several sources at once, with the longest applicable one governing.

For pediatric ABA, the minor rule governs and, layered with the seven-year health-care-records baseline and heightened Medicaid scrutiny, means records must be kept securely for many years after a child's last service (Wis. Stat. Section 146.819). Build your retention schedule to the minor rule and the litigation-hold overlay, confirm the exact periods with counsel, and do not let the shorter HIPAA-administrative period drive early destruction of pediatric records.

Records ownership and custody on a change

Wisconsin treats the licensed clinic or provider as the custodian of patient records, and the treatment-records statute governs disclosure. The clinic rules are unusually explicit on changes: a certified clinic must notify the department of any change in administration, ownership, or control, office location, name, or program by no later than the effective date, and on a client's written request the clinic must transfer the treatment records and file to another licensed professional, clinic, or facility for continued treatment (Wis. Admin. Code Sections DHS 35.09 and 35.23; Wis. Stat. Section 51.30). Records cannot be transferred to a non-licensed entity, and in a change of ownership, particularly an asset sale, custody and the certification status must be specifically addressed so a licensed custodian remains responsible and patients retain access. Plan custody and the change notifications before a sale or restructuring.

The MSO question under a strong privacy statute

Many ABA practices use a management services organization (MSO) for administrative infrastructure, including the systems that hold records. Under HIPAA, an MSO that handles PHI is a business associate governed by a business-associate agreement. Wisconsin adds that, where the treatment-records statute applies, the MSO's access to and handling of treatment records must satisfy the statute's consent and disclosure rules, not merely a business-associate agreement, and that the MSO cannot be the licensed records custodian or, where DHS 35 applies, the certification holder (Wis. Stat. Section 51.30; Wis. Admin. Code ch. DHS 35). The practical effects are that the MSO needs a HIPAA business-associate agreement, that access must fit the treatment-records statute, and that the licensed clinic remains the custodian. Structure the MSO relationship accordingly.

Reading the Wisconsin burden

Putting the pieces together, Wisconsin is a light-to-moderate state with the weight in certification configuration and privacy. On the lighter side, most outpatient autism ABA runs through the ForwardHealth behavioral-treatment benefit rather than a building-based facility license. On the heavier or more uncertain side, the DHS 35 clinic-certification framework is a genuine adjacent requirement that may apply depending on configuration, the 2025 federal audit has raised payment-integrity scrutiny on the ABA benefit, the treatment-records statute is one of the strongest privacy regimes in the country, retention runs at least seven years with a long minor rule, and the clinic rules impose explicit change-of-ownership and records-transfer obligations. The practical read is that Wisconsin's key decisions are confirming the certification path and building to a strong treatment-records privacy statute. None of this is legal advice; it is the structure you would design your compliance program around with counsel.

How this connects to the rest of your compliance stack

Facility and clinic certification and records sit alongside several other decisions in this guide:

• Medicaid and place of service. Wisconsin delivers ABA through ForwardHealth with a rendering-provider specialty rule for direct therapy and heightened payment-integrity scrutiny after the 2025 federal audit, and the clinic setting is where any facility question would arise. See the Wisconsin Medicaid page, which treats the rendering-provider rule and place of service in detail.
• Licensing and credentialing. The DSPS credentialing and the rendering-provider rules are the credentialing story. See the Wisconsin licensing and credentialing page.
• Entity and ownership. The certification path, the records-custodian rule, and the treatment-records statute shape how the entity and any MSO are structured. See the Wisconsin entity page and the Wisconsin ownership page.
• Practice sale and expansion. The certification status, the explicit change-of-ownership notification, and records custody are diligence items in any Wisconsin transaction. See practice expansion and sale.

Getting set up in Wisconsin: the sequence

1. Credential the team. Maintain BACB certification and DSPS credentialing as applicable, and meet the ForwardHealth rendering-provider rules for direct therapy.
2. Confirm the certification path. Confirm with DHS whether your configuration enrolls through the behavioral-treatment benefit, requires DHS 35 clinic certification, or both.
3. Enroll for Medicaid. Enroll with ForwardHealth, build rendering-provider documentation for payment integrity, and complete DHS 35 certification if it applies.
4. Build the privacy program to the statute. Implement HIPAA plus the treatment-records statute and the administrative-code confidentiality rules, with a 42 CFR Part 2 overlay for any substance-use information.
5. Set the retention schedule. Configure retention to at least seven years and the minor rule, with a litigation-hold overlay.
6. Fix custody and change rules. Ensure the licensed clinic is the custodian, the business-associate agreement is in place, and you can meet the explicit change-of-ownership notification and records-transfer rules.

Wisconsin facility and records variables at a glance

Frequently asked questions