Confidentiality in Behavior Analysis
Confidentiality is a fundamental ethical obligation for behavior analysts. The 2022 BACB Ethics Code requires practitioners to protect the confidential information of clients, supervisees, and research participants. This obligation extends to all forms of information, including written records, electronic data, verbal communications, and visual recordings.
Maintaining confidentiality builds trust between the behavior analyst and the client, supports the therapeutic relationship, and protects the client from potential harm that could result from unauthorized disclosure of sensitive information.
Understanding HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes standards for the protection of individually identifiable health information, known as Protected Health Information (PHI). HIPAA applies to "covered entities," which include healthcare providers who transmit health information electronically in connection with certain transactions.
Many ABA providers are covered entities under HIPAA because they bill insurance electronically for their services. If your organization bills insurance, you are almost certainly subject to HIPAA requirements.
Key HIPAA Components
- Privacy Rule: Establishes standards for when and how PHI can be used and disclosed. Clients have the right to access their own records, request corrections, and receive an accounting of disclosures.
- Security Rule: Requires covered entities to implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI). This includes encryption, access controls, and audit trails.
- Breach Notification Rule: Requires covered entities to notify affected individuals, the Department of Health and Human Services, and in some cases the media when a breach of unsecured PHI occurs.
What Constitutes Protected Health Information?
PHI includes any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity. In the context of ABA services, PHI includes:
- Client names, dates of birth, addresses, and contact information
- Assessment reports and results
- Behavior intervention plans
- Session notes and data sheets
- Progress reports
- Insurance and billing information
- Photographs and video recordings of sessions
- Communications with other providers about the client
Practical Safeguards for ABA Practice
Physical Safeguards
- Store paper records in locked filing cabinets in secure areas
- Limit access to client files to authorized personnel only
- Shred documents containing PHI before disposal
- Ensure that computer screens displaying PHI are not visible to unauthorized individuals
- Secure data collection materials (such as paper data sheets) during transport between settings
Electronic Safeguards
- Use encrypted email and messaging platforms for communications containing PHI
- Protect electronic devices with strong passwords and automatic screen locks
- Enable encryption on all devices that store or access ePHI
- Use secure, HIPAA-compliant practice management software
- Implement role-based access controls so that staff can only access information relevant to their duties
- Back up electronic data regularly and store backups securely
Administrative Safeguards
- Develop and maintain written privacy and security policies
- Train all staff on HIPAA requirements and confidentiality obligations
- Designate a privacy officer responsible for overseeing compliance
- Conduct regular risk assessments to identify potential vulnerabilities
- Establish procedures for responding to breaches or suspected breaches
Common Confidentiality Challenges in ABA
In-Home Services
Providing services in a client's home presents unique confidentiality challenges. Other family members, neighbors, or visitors may be present during sessions. Behavior analysts should discuss confidentiality expectations with the family at the outset of services and take reasonable steps to protect the client's privacy during sessions.
School-Based Services
When providing services in schools, behavior analysts must navigate the intersection of HIPAA and the Family Educational Rights and Privacy Act (FERPA). Information shared with school personnel should be limited to what is necessary for the provision of services, and the appropriate consents must be in place.
Telehealth
The growth of telehealth services has introduced new confidentiality considerations. Behavior analysts providing services via telehealth must use HIPAA-compliant platforms, ensure that sessions take place in private settings on both ends, and address the unique risks of electronic communication.
Supervision and Training
Sharing client information during supervision or training requires appropriate de-identification or consent. When using client examples for training purposes, remove all identifying information or obtain explicit consent from the client or their representative.
When Disclosure Is Permitted or Required
While confidentiality is the default, there are circumstances under which disclosure of PHI is permitted or required:
- Client consent: Clients (or their representatives) may authorize the release of their information to specified parties
- Treatment, payment, and healthcare operations: HIPAA permits disclosure of PHI for these purposes without specific client authorization
- Mandatory reporting: When there is suspected abuse, neglect, or exploitation, disclosure to the appropriate authorities is required by law
- Court orders and legal proceedings: PHI may need to be disclosed in response to valid court orders or subpoenas
- Imminent danger: If there is an immediate threat to the safety of the client or others, disclosure may be necessary to prevent harm
HIPAA and Confidentiality on the BCBA Exam
Exam questions on this topic typically present scenarios where confidentiality might be breached and ask you to identify the appropriate course of action. Focus on understanding when disclosure is and is not permitted, the steps required to safeguard PHI, and the ethical obligations that supplement legal requirements.
Conclusion
Confidentiality and HIPAA compliance are essential components of ethical behavior analysis practice. By implementing robust physical, electronic, and administrative safeguards, training your team, and staying current with regulatory requirements, you can protect your clients' information and maintain the trust that is foundational to effective service delivery.