How to Start an ABA Clinic: Licensure, Credentialing and the Timeline

Here is the sequencing problem that costs new ABA clinic owners the most money: you generally cannot be paid by Medicaid until you are enrolled, enrollment verifies your licensure and certification, and commercial credentialing runs on a clock the payer controls. Each step depends on the one before it, and only the first one — forming the company — is under your control.

This page covers the regulatory and payer path. It does not cover software; the tooling decisions are in the stack guide. Nothing here is legal advice, and entity formation and licensure applications are the two places where a professional is worth what they cost.

The order things actually happen

Step	Who decides	What it gates
Form the business entity, get an EIN	Your state’s business filing office; IRS	Everything downstream needs a legal entity and a tax ID
Individual NPI (Entity Type 1)	CMS, through NPPES	Identifying the rendering clinician on a claim
State behavior analyst license	The state licensing board, where one exists	Independent practice and, commonly, enrollment
Organization NPI (Entity Type 2)	CMS, through NPPES	Billing as the organization
Medicaid screening and enrollment	The state Medicaid agency	Being paid by Medicaid at all
Managed care credentialing and contracting	Each managed care plan	Being in-network for that plan’s members
Commercial payer credentialing and contracting	Each carrier	Being in-network for that carrier’s members

Step one: the entity, and why it matters later

Form the company, get an EIN from the IRS, and open the bank account in the entity’s name. The reason to do this first is not tax planning. It is that Medicaid enrollment requires ownership disclosures, and the CMS Applied Behavior Analysis Toolkit lists them among the minimum elements of ABA provider enrollment: “verification of identity, National Provider Identifier (NPI), licensure and certification status, education and training, ownership disclosures, and checks against federal and state exclusion lists.” The ownership structure you file in month one is the structure you disclose in month four.

Step two: state licensure, which is not one national rule

The BACB maintains a U.S. licensure table that opens with the plain statement: “Since 2009, the applied behavior analysis profession has rapidly become regulated.” Read the count off that table directly. We could not settle on one: the BACB page returned different totals depending on how it was retrieved, and the CMS toolkit states “39 states plus Washington, D.C.” Rather than pick a number we cannot stand behind, we report only what every source we opened agreed on — the District of Columbia is included, and California, Florida and Pennsylvania are not. If you are opening in a state whose status decides your timeline, the board’s own page is the only citation worth relying on.

The boards are not consistent in where they sit inside state government, which affects who you are actually dealing with:

State	Year enacted	Licensure board named by the BACB
Nevada	2009	NV Applied Behavior Analysis Board
Virginia	2012	VA Board of Medicine
Texas	2017	TX Department of Licensing and Regulation
New York	2014	NY State Education Department, Office of the Professions
Illinois	2022	IL Dept. of Financial and Professional Regulation
North Carolina	2021	NC Behavior Analyst Licensure Board
Colorado	2026	CO HB26-1425

Source: BACB, U.S. Licensure of Behavior Analysts, retrieved 6 August 2026. The BACB notes that “Some states with newly enacted laws may not have implemented an application system.”

Two consequences worth internalizing. First, certification is not licensure. The CMS toolkit states that “Because licensure frameworks vary across states, a BCBA is not automatically an LBA.” New York’s Office of the Professions says the same thing in enforcement language: “While BACB certification may be included in advertising in New York State, it may not be used as a license to practice in New York State.”

Second, the toolkit’s stated best practice for states is sequencing, not paperwork: “Providers should meet licensure requirements before being able to bill for ABA.” Where a state has adopted that, licensure is a gate on revenue, not a formality you catch up on.

Step three: NPIs, and why you need two of them

The NPI application form (CMS-10114) defines the two entity types:

• Entity Type 1: “Individuals who render health care or furnish health care to patients; e.g., physicians, dentists, nurses, chiropractors, pharmacists, physical therapists.” The form states that “A sole proprietorship is an Entity Type 1 (Individual).”
• Entity Type 2: “Organizations that render health care or furnish health care supplies to patients.”

The form also states that incorporated individuals “may obtain NPIs for themselves (Entity Type 1 Individual) if they are health care providers and may obtain NPIs for their corporations (Entity Type 2 Organization).” If your clinic is an LLC or a corporation, that is two applications: one for you, one for the company. The Entity Type 2 record is also where subparts get declared.

The CMS toolkit is explicit that this extends down the staffing tier: “All ABA providers should have their own NPI, even those billing under a supervisor.”

Step four: Medicaid screening and enrollment

Federal rules set the floor and the states run the process. Under 42 CFR part 455 subpart E:

• Screening risk levels. § 455.450 sorts providers into limited, moderate and high risk. Limited risk means license verification and database checks. Moderate adds on-site visits (§ 455.432). High adds a criminal background check and fingerprints, which § 455.434 requires be submitted “within 30 days upon request from CMS or the State Medicaid agency.” The CMS toolkit states that “Each state has the discretion to classify ABA provider types as either limited, moderate, or high-risk for screening and enrollment in accordance with 42 C.F.R. § 455.450.” Your risk level is a state decision, and it determines whether a site visit is in your timeline.
• Application fee. § 455.460 requires states to collect it from institutional providers, with exceptions for individual physicians and nonphysician practitioners and for providers who already paid Medicare or another state. CMS set the calendar year 2026 amount at $750, effective 1 January 2026, in a Federal Register notice published 3 December 2025.
• Revalidation. § 455.414: “The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years.” Enrollment is not a one-time event.

How long the state takes is a state fact, and states publish it unevenly. Colorado’s Department of Health Care Policy & Financing states on its enrollment page, under “What Happens Next?”: “The application is reviewed by the Department of Health Care Policy & Financing’s (the Department’s) fiscal agent. The average processing time is eight (8) business days. Some applications may require a site visit or Department approval.” That last sentence is the one to plan around.

Enrollment rules can also close doors you assumed were open. North Carolina’s Session Law 2026-1 (House Bill 696, ratified 28 April 2026 and signed 30 April 2026) added: “Board Certified Behavior Analysts and Qualified Autism Services Practitioner Supervisors shall not be permitted to enroll in the North Carolina Medicaid program as out-of-state providers.”

Step five: managed care credentialing, which is a separate process

Enrolling with the state is not the same as being in a plan’s network. The CMS toolkit’s comparison of fee-for-service and managed care puts it plainly: in managed care, “Providers generally must first be screened and enrolled by the state, and then complete managed care plan credentialing, contracting, and periodic recredentialing.” The toolkit adds that plans “often layer their own credentialing criteria on top of state minimums, such as requiring participation in organizational accreditation programs, additional background checks, or more frequent recredentialing cycles.”

That is two sequential queues, not one, and only the first is governed by the state’s published processing time.

Step six: commercial credentialing and the clock you do not control

Commercial credentialing timelines are set by carrier policy and, in some states, by statute. Maryland is a useful example because the Maryland Insurance Administration publishes the rule: under § 15-112 of the Insurance Article, “Within 30 days of receiving an application, a carrier must send notice of the carrier’s intent to continue to process the application or a rejection,” and then “the carrier has 120 days after the date of the notice to accept or reject the provider for participation and send notice of the decision.” Incomplete applications must be returned within 10 days.

Read that as a ceiling in one state, not a national average. But it establishes the shape of the problem: a carrier acting entirely lawfully in Maryland can take five months, and that is before contract negotiation and fee schedule loading. Multiply by the number of carriers you intend to bill.

What gates what

• Licensure gates independent practice in licensure states, and the CMS toolkit’s best practice is that it gates billing.
• An Entity Type 2 NPI gates billing as an organization.
• State Medicaid enrollment gates Medicaid payment, and generally precedes managed care credentialing.
• Managed care and commercial credentialing gate in-network payment, plan by plan.
• Nothing gates the landlord. The lease starts on the lease date.

That last one is the sequencing error to avoid. Start licensure and enrollment before the build-out, not after, because the only step with a schedule you can compress is the one you can do from a laptop.

What we could not verify

We did not find a published, official figure for how long commercial ABA credentialing takes on average, in any state, from any regulator or carrier. Numbers in that range circulate widely and we could not source one, so this page cites the Maryland statutory limit instead. We also did not attempt to summarize each state’s licensure requirements; those are set by the boards listed in the BACB table, and the board’s own page is the only source we would rely on.

Related: Medicaid ABA reimbursement rates by state, ABA CPT codes, and what the CMS ABA toolkit says.