Keeping client information private
What you may collect, store, share — and what you may not say
- RBT
- BCaBA
- BCBA
What the obligation is
Confidentiality covers more than files. It covers the fact that someone is a client at all, what you say in a waiting room or a car park, what is visible on a screen or a clipboard, what you put in a group chat, and what you carry between sites. Both codes require you to follow the rules for collecting, using, storing, protecting and disclosing client information, and those rules come from several directions at once: the codes, your employer's policy, funder requirements, and law — in the United States usually the federal health-privacy rule for clinical providers and a different federal statute for school records. Disclosure happens with consent or where the law requires it, and a suspected-abuse report is the clearest example of the latter.
In plain language
Keep client information private everywhere: in files, on your phone, and in conversation. Do not even confirm that someone is a client. Share only with consent or where the law requires it.
What this looks like
- Declining to confirm or deny that a family is a client when someone asks in public.
- Data sheets transported in a closed folder and handed in the same day.
- Using the client code your organisation assigns rather than a name in messages.
- Checking before sharing anything with a school or another provider, even a helpful detail.
Where people get caught
- Sharing something positive, as though only bad news is confidential.
- Photographing data sheets on a personal phone "just as a backup".
- Discussing a session in a car park, corridor or lift where families can hear.
- Assuming a first name or initials is anonymous in a small community.
If you are not sure
Do not disclose, and ask your supervisor. An unnecessary delay is recoverable; a disclosure is not. If someone raises a safety concern about a child, direct them to protective services rather than handling it informally yourself.
In the codes
- RBT Ethics Code (2.0) Section 2 — How you deliver services
- 2.08 Protect confidentiality and privacy
- 2.09 Never put identifying client information online
- 2.10 Discuss client information only where you are directed to
- Ethics Code for Behavior Analysts Section 2 — Your conduct in practice
- 2.03 Protect confidential information
- 2.04 Disclose confidential information only on specific grounds
- 2.05 Store, retain and destroy records properly
- Ethics Code for Behavior Analysts Section 3 — What you owe clients and stakeholders
- 3.10 Explain the limits of confidentiality early
- 3.11 Document your professional activity properly
On the exam
Terms used here
Situations where this comes up
Related topics
Written from
- bacb-rbt-ethics-code-2 — Confidentiality
- bacb-ethics-code-2022 — Confidentiality standards
- hipaa-privacy-rule
Written from both codes' confidentiality standards and the federal privacy rule, in our own words. No code or regulatory text reproduced.
This entry has not yet been through independent review. Treat it as a draft, and read the official code for anything that matters.