How to Start an ABA Agency: A Step-by-Step Guide for BCBAs and Clinician-Entrepreneurs

What you need before you start: the BCBA as clinical anchor

An insurance-funded ABA agency is built around at least one Board Certified Behavior Analyst (BCBA). The BCBA credential is a national certification issued by the Behavior Analyst Certification Board (BACB), a nonprofit credentialing organization. Earning it requires a qualifying graduate degree, behavior-analytic coursework, supervised fieldwork, and a passing score on the BCBA examination; the exact requirements are published in the BACB's BCBA Handbook and requirements documents.

BACB certification is not the same thing as a state license. Certification is national and issued by a private board; licensure is a state legal permission to practice, issued by a state agency or licensing board. In states that license behavior analysts, holding BCBA certification is typically a core eligibility requirement for the license, but the license itself is a separate application with its own fees and renewal cycle.

The founder does not always have to be the BCBA. In many arrangements a clinician-entrepreneur partners with, employs, or contracts a BCBA to serve as clinical director. However, payer rules frequently require a qualified, licensed, or certified behavior analyst in a defined oversight role. For example, Texas Medicaid enrolls only Licensed Behavior Analysts (LBAs) as providers of its ABA benefit; licensed assistant behavior analysts and behavior technicians may render services only under the direct supervision of an enrolled LBA, who is responsible for all ABA services provided. Whoever fills that role, the agency cannot deliver or bill ABA services without it.

State behavior-analyst licensure: check your state first

Most US states now license or otherwise regulate behavior analysts, and the list continues to grow. The BACB maintains the authoritative, continuously updated list of US licensure laws, the year each law was enacted, and links to each state's licensing board. Because roughly ten states, including some large ABA markets, still have no standalone behavior-analyst license, and because newly enacted laws sometimes take time to implement, the correct first step is always to check the BACB's licensure page and your state board directly rather than assuming a national rule.

Requirements, fees, renewal periods, and exemptions vary by state. As examples of how varied the landscape is: Nevada enacted behavior-analyst licensure in 2009 and today regulates behavior analysts through a dedicated Applied Behavior Analysis Board; Arizona enacted licensure in 2010 and regulates behavior analysts through its Board of Psychologist Examiners; and Texas enacted licensure in 2017, administered by the Texas Department of Licensing and Regulation (TDLR). Three states, three different years, three different kinds of regulatory bodies.

Licensure also matters commercially, not just legally. State Medicaid programs commonly tie provider enrollment to the state license. Texas Medicaid, for instance, requires ABA billing providers to be licensed as an LBA by TDLR. If you plan to serve clients in more than one state, expect to hold a license in each state that requires one.

Business formation: entity, EIN, and bank account

Choose a legal structure before anything else that carries your business name. The two structures most commonly considered by small healthcare practices are the limited liability company (LLC) and the corporation, sometimes with an S-corporation tax election. According to the US Small Business Administration, an LLC protects the owner's personal assets from most business liabilities and passes profits through to personal income without corporate tax, while corporations offer strong liability protection but cost more to form, require more record-keeping, and can face taxation at both the corporate and shareholder level. Which structure fits depends on your ownership plans, tax situation, and state; this is a decision to make with an accountant or attorney, not from a checklist.

Some states apply professional-entity rules to licensed healthcare professions, which can affect what entity type a licensed behavior analyst may form and who may own it. This varies by state, so verify with your state's business filing office and licensing board before filing.

Once the entity exists, obtain an Employer Identification Number (EIN) from the IRS. The EIN application is free, and the online tool issues the number immediately upon approval. The IRS explicitly warns against websites that charge for an EIN; you never have to pay for one. With formation documents and the EIN in hand, open a dedicated business bank account so clinical revenue and business expenses are separated from personal finances from day one.

NPIs: you need both Type 1 and Type 2

The National Provider Identifier (NPI) is the 10-digit identifier used on healthcare claims. There are two types, and an ABA agency typically needs both. A Type 1 NPI identifies an individual practitioner, so your BCBA (and each subsequently enrolled rendering clinician, where the payer enrolls individuals) needs one. A Type 2 NPI identifies the organization itself and is typically what your agency uses as the billing provider on claims — though some programs differ (Texas Medicaid's ABA benefit, for example, requires the enrolled LBA's individual NPI as both rendering and billing provider).

Both are obtained through the National Plan and Provider Enumeration System (NPPES), operated by CMS, and there is no charge to apply. The Type 2 application asks for the organization's legal name, EIN, mailing address, taxonomy code, and an authorized official. Behavior analysts generally use the behavior-analyst taxonomy code for the individual NPI; confirm the taxonomy your payers expect, because a mismatched taxonomy can stall enrollment.

Get the NPIs early. Nearly everything downstream, including Medicaid enrollment, CAQH profiles, commercial credentialing, and claim submission, asks for one or both numbers. Texas Medicaid, as one example, lists an NPI as a precondition for LBA enrollment.

Liability insurance: what payers expect

Two coverage types form the baseline: professional liability insurance (also called malpractice insurance), which covers claims arising from clinical services, and general liability insurance, which covers non-clinical risks such as injuries on your premises. Once you hire employees, state law typically also requires workers' compensation coverage; requirements and thresholds vary by state.

Proof of professional liability coverage is a standard element of payer credentialing. The CAQH provider data profile that most commercial plans pull from includes malpractice insurance details as a required data section, and payers commonly require that coverage be active and meet their minimum limits before completing credentialing. Specific limit requirements vary by payer and are stated in each payer's participation criteria, so read them rather than guessing; many agencies obtain coverage quotes as soon as the entity is formed so a certificate of insurance is ready when credentialing begins.

Payer credentialing and contracting: the long pole

Credentialing and contracting are two different things, and confusing them is one of the most expensive mistakes a new agency can make. Credentialing is the payer's verification of qualifications: license, certification, NPI, insurance, work history, and background. Contracting is the executed participation agreement that sets your rates and makes you in-network. You can be fully credentialed and still unable to bill in-network because no contract is in effect. Always confirm, in writing, your contract effective date before scheduling billable services.

For commercial plans, the process usually starts with the CAQH provider data portal (formerly CAQH ProView), where individual clinicians enter their professional information once and authorize plans to access it. The portal is free for providers. Profiles must be re-attested on a recurring cycle (CAQH materials describe a 120-day re-attestation rhythm), and an expired attestation silently stalls credentialing, so calendar the re-attestation date.

Medicaid enrollment is state-specific, and states differ in both structure and requirements. In Texas, ABA became a Medicaid benefit effective February 1, 2022, and billing providers enroll as Licensed Behavior Analysts through the state's Provider Enrollment and Management System (PEMS), with a TDLR license and NPI required; behavior technicians and licensed assistant behavior analysts work under LBA supervision and do not enroll or bill independently. In Indiana, ABA providers enroll with the Indiana Health Coverage Programs as behavioral health providers (provider type 11), with a specialty for board-certified behavior analysts, and the state expanded enrollment to additional ABA specialties, including bachelor-level therapists and RBTs, in December 2024. Your state's Medicaid provider-enrollment page is the only reliable source for its process.

Timelines are the hard truth of this stage. Credentialing and enrollment durations are not standardized: they vary by payer, by state, and by how complete your application is. Plan in months, not weeks, for each payer relationship, start applications as soon as licensure, NPIs, and insurance are in place, and pursue multiple payers in parallel rather than sequentially. Incomplete applications and stale CAQH attestations are the most common self-inflicted delays.

Policies and compliance before the first client

An ABA agency that bills insurance electronically is a HIPAA covered entity. That brings two rule sets: the Privacy Rule, governing how protected health information (PHI) may be used and disclosed, and the Security Rule, requiring administrative, physical, and technical safeguards for electronic PHI, including a documented risk analysis.

Every vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and HHS requires a written business associate agreement (BAA) with each one before PHI flows. For a new ABA agency that typically means the practice-management or EHR platform, the billing clearinghouse, any telehealth platform, cloud storage, and email if PHI touches it. A vendor that will not sign a BAA cannot handle your PHI.

Retention has two distinct layers. HIPAA itself requires that compliance documentation, including policies, procedures, risk assessments, and required records of actions and assessments, be retained for six years from creation or from when the document was last in effect (45 CFR 164.316). Clinical record retention is different: HIPAA does not set a federal medical-record retention period; state law and payer contracts set those timelines, and periods for minors are often longer. Check your state's rule and your payer contracts, and adopt the longest applicable period.

Beyond HIPAA, HHS Office of Inspector General guidance describes the seven elements of an effective compliance program, including written policies and a code of conduct, a designated compliance lead, training, open lines of communication, monitoring and auditing, enforcement, and corrective action. OIG also expects healthcare entities to screen staff against the List of Excluded Individuals/Entities (LEIE) at hire and monthly thereafter, because the list is updated monthly and employing an excluded person in federally funded care carries civil monetary penalty exposure. Finally, document incident and breach-response procedures before you need them: who investigates, who notifies, and on what clock.

The ABA CPT codes you will bill: 97151-97158

ABA services are billed under the adaptive behavior services family of CPT codes, 97151 through 97158, maintained by the American Medical Association. All codes in the family are reported in 15-minute units. At a high level, the family splits into assessment codes (97151, 97152), technician-delivered treatment (97153, 97154), and services delivered by the qualified health care professional, typically the behavior analyst (97155, 97156, 97157, 97158). Payer-specific billing rules, authorization requirements, and rates vary; what follows is the code-level structure only.

Which credential may render which code is governed by payer policy and state rules, not just the CPT descriptor, so build your scheduling and billing workflows around a credential-to-code matrix from the start.

Hiring and supervision: the RBT pipeline

Most direct therapy hours in an insurance-funded agency are delivered by Registered Behavior Technicians (RBTs), so building a compliant RBT pipeline is an operational core competency. The BACB's RBT requirements define the path: candidates complete a 40-hour training covering the BACB's curriculum outline, delivered over no fewer than 5 days and no more than 180 days; then pass an initial competency assessment administered by a qualified assessor, completed no more than 90 days before the certification application; then apply to the BACB and pass the RBT examination.

Certified RBTs carry an ongoing supervision obligation that your staffing model must absorb. Per the BACB's ongoing supervision requirements, an RBT must receive supervision for at least 5 percent of the hours they spend providing behavior-analytic services each calendar month, across at least two face-to-face, real-time contacts per month, at least one of which includes the supervisor observing the RBT delivering services to a client. Supervisors must be qualified BACB certificants acting within the BACB's supervision rules. Note that payers and state Medicaid programs may impose their own supervision and oversight requirements on top of the BACB's, and those are defined in each payer's policy.

Above the technician tier, BCaBAs (Board Certified Assistant Behavior Analysts) practice under BCBA oversight, and BCBAs carry assessment, treatment planning, protocol modification, and caregiver guidance. Caseload sizing is a clinical and business judgment: it depends on client acuity, authorized hours, travel geography, and the supervision load each BCBA carries. There is no single national ratio; treat any fixed number you encounter as a payer-specific or state-specific rule to verify, not a universal standard.

Electronic Visit Verification for home-based services

If you will deliver Medicaid-funded services in clients' homes, check whether your state's Electronic Visit Verification (EVV) program covers your services. Section 12006 of the 21st Century Cures Act required states to implement EVV for Medicaid personal care services by January 1, 2020, and for home health care services by January 1, 2023, with federal funding reductions for non-compliant states. EVV systems must electronically verify six data elements: the type of service, the individual receiving it, the individual providing it, the date, the location, and the start and end times.

Whether ABA falls under a state's EVV mandate depends on how the state classifies the service and structures its program, and states also differ on the systems and aggregators providers must use. Do not assume ABA is exempt or included nationally; confirm with your state Medicaid agency's EVV page before launching home-based services. A dedicated guide to EVV for ABA agencies covers this topic in depth.

A realistic startup timeline

Durations below are typical planning ranges, not guarantees. Items marked as sourced come from the issuing agency; items marked as typical range vary with state workload, application completeness, and payer queues. The overall sequence usually lands between six months and a year from entity formation to first reimbursed session, driven almost entirely by licensure and payer timelines.

Startup cost categories

Startup costs vary enormously with state, service model (home-based versus clinic-based), and how much you outsource, so this table lists the categories every founder should budget rather than dollar figures. Two line items are reliably free: the EIN (IRS) and both NPI types (CMS/NPPES). Everything else should be priced against your own state and vendors.

Common early mistakes

The failure patterns in new ABA agencies are remarkably consistent, and almost all of them are administrative rather than clinical.

• Billing before credentialing and contracting are actually effective. Services rendered before a payer's enrollment or contract effective date are commonly not reimbursable in-network. Verify effective dates in writing before scheduling billable sessions.
• Documentation debt. Session notes written days late, unsigned, or missing required elements accumulate silently and surface during payer audits, when the money can be recouped. Set a same-day or next-day documentation standard from client one.
• Authorization tracking by memory or spreadsheet. Authorizations cap units per CPT code per period; delivering sessions past the cap or past the end date produces unpaid work. Track unit burn against every authorization continuously and start reauthorization well before expiry.
• Supervision ratio drift. The BACB's 5 percent monthly supervision minimum for each RBT is easy to satisfy in month one and easy to miss in month six as caseloads grow. Track the percentage per technician per month, not on average.
• Skipping exclusion screening. OIG expects LEIE screening at hire and monthly; employing an excluded individual in federally funded care creates penalty exposure regardless of intent.
• Vendors without BAAs. Any tool that touches PHI, including messaging and file storage, needs a signed business associate agreement before PHI flows through it.
• Confusing BACB certification with state licensure, and assuming one state's rules apply in another. Both the licensure landscape and Medicaid enrollment are state-by-state.

Frequently asked questions