How to sell an ABA practice

Is your practice sellable

A buyer, whether a strategic acquirer, a private equity platform, or an individual BCBA looking to expand, is underwriting a small set of things before anything else. None of these require a specific statute to understand, but each one determines whether a deal closes on the terms a seller wants, or at all.

Payer mix and contract assignability. A buyer wants to know what share of revenue comes from which payers, how concentrated that is, and whether the underlying payer contracts can actually move to the buyer. Commercial contracts and Medicaid enrollment are not automatically portable: commercial contracts often require the payer's consent to assign, and Medicaid enrollment may be tied to the enrolled provider and entity rather than freely transferable; check each contract and the state Medicaid agency's own procedure before assuming either one moves with the deal. A practice overly concentrated in a single payer is harder to underwrite than one with diversified, clearly assignable relationships.

Clinical staffing and BCBA supervision capacity. A buyer is not just buying client relationships, it is buying the clinical capacity that sustains them: enough BCBAs to supervise the RBT caseload the practice already carries, and a supervision structure that will actually survive a change of ownership. A practice where one or two BCBAs personally hold every supervisory relationship is more fragile, and therefore harder to value, than one with supervision capacity distributed across several credentialed clinicians.

Referral sources. Where clients come from, and how dependent that pipeline is on a single referring clinician, school district, or diagnostic practice, shapes how durable the buyer believes the revenue is after the seller is no longer the one maintaining those relationships.

Licensure status. Whether every clinician providing services holds the state license or registration the state actually requires, and whether the practice itself holds any entity-level license or registration its state requires, is a basic diligence item. A gap here is not just a valuation issue, it is a closing condition risk.

Compliance history. Open or resolved payer audits, state licensing board complaints, and HIPAA incidents are all part of the record a buyer's counsel will ask to see. A clean history is not itself a value driver the way revenue growth is, but a troubled one is a value destroyer, because it is exactly the kind of risk a buyer's diligence team is paid to find.

This guide does not state valuation multiples or market growth statistics. Those figures move quickly and vary by buyer and market; ask a transaction adviser who tracks live deal activity for current numbers.

Asset sale, equity sale, or merger

The three common structures differ mainly in what actually transfers and who remains liable for what came before: an asset sale lets the buyer pick specific assets and liabilities while the seller keeps the rest, an equity sale carries the entity's contracts, licenses, and enrollments forward unchanged but also carries its liabilities, and a merger moves everything to the surviving entity by operation of law. None of this is tax or legal advice. The deal structures and economics guide works through each structure in full, including what happens to payer contracts, Medicaid enrollment, licenses, and employment agreements under each one, and how tax basis and liability exposure track the choice.

The regulatory layer unique to ABA

A generic business sale does not have to account for who may hold a professional license, whether the buyer may own equity in the practice at all, or whether the clinicians' supervisory relationships with the national certifying board survive the closing. An ABA transaction does.

State licensure and entity rules. Whether ABA is a licensed profession in your state, and whether your state's professional-entity statute reaches behavior analysis, determines who may hold equity in the practice at all, a question that becomes concrete the moment a buyer is not itself a licensed clinician. This varies by state; see the licensing and credentialing hub for whether and how your state licenses the profession, and the entity decision hub for whether your state's ownership rules reach a buyer who is not a licensed behavior analyst.

Professional-entity ownership limits. Where a state requires every owner of a professional entity to hold the relevant license, a buyer who is not a licensed behavior analyst cannot hold direct equity, which is exactly why management services organization structures exist in this market. Whether that applies to your state, and what it means for how a deal can be structured, is state-specific; see the entity decision hub above for your state's answer.

MSO structures. A management services organization structure separates a management or administrative company, which may be owned by non-clinicians, from the clinical practice entity, which remains owned by licensed clinicians where state law requires it. Where this structure is available, and how much control it may actually exercise over clinical decisions without crossing into the practice of medicine or behavior analysis itself, is governed state by state; see the MSO and ownership hub for how that boundary is drawn where you operate.

Medicaid provider enrollment and change-of-ownership timing. At the federal level, a state Medicaid agency must obtain ownership-and-control-interest disclosures from Medicaid providers, and a provider or disclosing entity must provide that disclosure within 35 days after any change in ownership (42 CFR § 455.104(a), (b), (c)(1)(iv)). That federal disclosure clock is a floor, not the full picture: whether the Medicaid enrollment itself transfers, requires a new application, or triggers a re-validation is a matter of each state Medicaid agency's own procedure, and varies by state; see the Medicaid and insurance hub for your state's enrollment and credentialing process.

BACB supervision continuity. A sale can change who employs the clinicians providing supervision, and the BACB's own rules do not treat that as a formality. The RBT Handbook states that an RBT may only practice once a qualified RBT Supervisor or RBT Requirements Coordinator has added the RBT as a supervisee and is on record with the BACB (RBT Handbook, updated 06/2026, printed pp. 14 to 15, 21). The Handbook does not speak directly to a sale or a change of employer; this guide's interpretation, not a quoted rule, is that a change in supervisor, including because the supervising BCBA leaves or the employing entity changes, requires a new qualified supervisor to add the RBT as a supervisee and go on record before the RBT continues providing services, on the same on-record logic the Handbook states for the first assignment. A transaction that changes who supervises whom, without re-establishing that record promptly, risks creating a gap where services are being delivered without a supervisor of record, which would itself be a BACB compliance problem independent of anything in the deal documents. See how to become an RBT and how to become a BCBA for the full supervision structure both credentials require.

HIPAA in a transaction

A sale process puts protected health information in front of people who are not treating the patient: buyers, their counsel, their accountants, and sometimes a data room administrator. HIPAA has specific, favorable answers for most of this, and specific obligations that follow from them.

Diligence disclosures can be a permitted use, depending on the buyer. The HIPAA Privacy Rule's definition of health care operations expressly names the sale, transfer, merger, or consolidation of a covered entity with another covered entity, or with an entity that will become a covered entity as a result of the transaction, and the due diligence related to that activity, as one of the covered activities (45 CFR § 164.501, definition of health care operations). Whether a given prospective buyer fits that wording, a covered entity itself, an entity that will become one through the deal, or neither, depends on how the buyer is structured, so confirm with HIPAA counsel before sharing PHI with a prospective buyer's diligence team, rather than assuming the permitted-use language reaches every buyer; where it does apply, the Privacy Rule's general minimum-necessary and safeguarding obligations still govern how that access is structured.

Business associate agreements. If anyone outside the practice's own workforce, an outside counsel's e-discovery vendor, a virtual data room provider, or a consultant assembling the diligence file, will create, receive, maintain, or transmit PHI on the practice's behalf, the practice may disclose PHI to that party only if it first obtains satisfactory assurance that the party will appropriately safeguard the information (45 CFR § 164.502(e)(1)(i)), and that assurance has to take the form of a contract meeting the Privacy Rule's business associate contract requirements (45 CFR § 164.504(e)(1)(i)). A data room vendor or diligence consultant handling PHI is a business associate under this framework, not a bystander, and needs a signed business associate agreement before it touches PHI, not after.

What happens to the records. HIPAA's own permission for sale-related due diligence does not answer how long records must be kept or who has to keep them after closing; that is set by each state's own medical-records retention law, not by HIPAA itself, and varies by state. In an asset sale the records typically transfer to the buyer as part of the purchased assets; in an equity sale or merger they simply stay with the entity, which does not change. See the facility licensure and HIPAA hub for your state's specific retention period.

Security risk analysis as a diligence item. The HIPAA Security Rule requires every covered entity and business associate to conduct an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic PHI it holds (45 CFR § 164.308(a)(1)(ii)(A)). A buyer's counsel may ask to see this current risk analysis directly as part of diligence. Producing a current, documented risk analysis before diligence starts, rather than scrambling to produce one once it is requested, is one of the few HIPAA-related diligence items a seller can fully control on its own timeline. WiseUpHIPAA's risk analysis service is one resource built specifically around this requirement.

Diligence checklist and sequence

A sale runs, in general order, through preparation, engaging advisers, buyer outreach, a letter of intent, diligence, definitive agreement negotiation, closing conditions, and post-closing integration, with no fixed timeline, since that depends on deal size and buyer type. The due diligence playbook walks through the workstreams a buyer's team actually reviews, revenue, compliance, people, and clinical model among them, and how each one shapes price and deal protections.

Mistakes sellers make

• Assuming a payer contract or Medicaid enrollment transfers automatically. Commercial contracts often require the payer's consent to assign, and Medicaid enrollment may be tied to the state agency's own process rather than carried over by a bill of sale; check each contract and the state Medicaid agency's procedure before assuming otherwise.
• Treating an equity sale as a clean exit from liability. Because the entity itself does not change, an equity sale generally carries the entity's existing liabilities forward to the new owner, a very different risk profile from an asset sale.
• Overlooking the professional-entity ownership question until a buyer is already at the table. If your state limits who may hold equity in the practice, discovering that after a letter of intent is signed, rather than before marketing the deal, can force a structure change late in the process.
• Letting the BACB supervision record lapse at closing. If supervising clinicians change employer as part of the deal, the RBT Handbook's requirement that a qualified supervisor be on record with the BACB does not pause for a transaction; a gap here is a compliance problem on day one of new ownership.
• Waiting for diligence to produce a HIPAA security risk analysis. Assembling one under time pressure, after a buyer's counsel has already asked for it, is a worse position than having a current one ready before diligence starts.
• Letting a data room vendor or consultant handle PHI without a business associate agreement. The Privacy Rule's satisfactory-assurance and contract requirements apply to diligence-support vendors just as they do to any other business associate.

Next steps

This guide covers mechanics that apply across states; specifics that gate your deal, who may own equity, how your state's Medicaid program handles ownership changes, and your records-retention requirement, are state-specific. Start with the licensing and credentialing hub and the entity decision hub to confirm your state's ownership and licensure rules, the MSO and ownership hub if a management services structure is on the table, the Medicaid and insurance hub for your state's enrollment and change-of-ownership process, and the facility licensure and HIPAA hub for records retention and facility-level rules. For the deal mechanics themselves, the deal structures and economics guide and the due diligence playbook go deeper than this page does, and the structural exposure guide covers how a poorly structured practice destroys value before a buyer ever appears.