HIPAA is a federal law that protects health information, and it applies to many, but not all, ABA settings, depending on how services are billed and structured. Even where HIPAA doesn’t technically apply, RBTs are still bound by confidentiality requirements in the RBT Ethics Code and often by state privacy laws or FERPA in school settings.
Example
An RBT working in a private clinic that bills insurance is very likely covered by HIPAA. An RBT working in a public school may fall under FERPA instead, which has similar confidentiality goals but different rules.
Key points
- Protected health information: covers anything that could identify a client along with their health or treatment details.
- Minimum necessary: share only the information needed for the task at hand, even with coworkers.
- Secure storage: physical and electronic records should be stored and disposed of according to employer policy.
- Ask your employer: which law applies (HIPAA, FERPA, or state rules) depends on the setting, so confirm with a supervisor rather than assuming.
Common mistake
Assuming HIPAA rules are identical everywhere. The specific law that applies depends on the setting and how services are funded.
Quick check
An RBT wants to text a coworker a photo of a client’s data sheet for a quick question. Is this appropriate? No, this risks exposing protected information outside approved channels.
Keep studying
Client dignity and confidentiality · Session notes for RBTs · RBT glossary
Independent study resource, not affiliated with the BACB or Pearson VUE.