How HIPAA Shapes RBT Documentation

HIPAA doesn't just regulate WHAT information you can share — it specifies HOW you must collect, store, transmit, and retain documentation containing PHI. RBTs encounter HIPAA's documentation rules every time they touch a data sheet, session note, or progress report.

The Documentation Lifecycle

  1. Collection: Use agency-issued tools (data sheets, tablets, EHR apps). Never collect data on personal devices unless the agency has approved the platform.
  2. Storage during session: Keep documents secured — face-down on tables, in folders, locked screens on tablets when not in use.
  3. Transit: Use only encrypted agency channels to move documents between locations. Email attachments via Gmail/Yahoo are violations.
  4. Long-term storage: Records are retained per agency policy (usually 7 years minimum, longer for minors). Storage must be physically and electronically secure.
  5. Disposal: Shred paper. Use secure-delete tools for electronic copies. Never throw client records in regular trash.

Required Documentation Elements

  • Client identifier (typically a client ID number, not name)
  • Service date and time (start and end)
  • Provider identifier (your RBT certification number)
  • Service location (home, clinic, school, community)
  • Service code (procedure performed, for billing)
  • Objective behavior data (counts, durations, percentages)
  • Clinical observations (factual, not interpretive)
  • Plan deviations if any (and why)
  • Signature (electronic or wet)

The 24-Hour Rule

Most agencies require session notes to be completed within 24 hours of the session, ideally same-day. Notes written days later are clinically less accurate and legally vulnerable. Insurance audits scrutinize delayed documentation.

Common HIPAA Documentation Violations

  • Writing the client's full name on a data sheet visible from a coffee shop table
  • Saving client documents to a personal Dropbox or Google Drive
  • Auto-syncing photos from a personal phone to family cloud accounts
  • Discussing case details in a shared note-taking app (Notion, Evernote) used personally
  • Leaving printed session notes in a car overnight
  • Faxing to the wrong number

Audit Readiness

Assume any documentation you create could be reviewed by HIPAA auditors, BACB investigators, insurance auditors, or attorneys. Write every note as if someone with no context will read it in five years.