ABA Accounting of Disclosures Request and Review Tracker for Families

Use one copy for one organization and one person whose information is involved. Keep the organization's official accounting, request form and correspondence as separate source records. A family-created list of people who may have received information is useful context, but it is not the organization's accounting.

This ABA accounting of disclosures tracker for families is a family-owned preparation and review tool. It is not a HIPAA request, disclosure accounting, authorization, access log, security audit, payer claim history, complaint or legal opinion.

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

What this tracker can and cannot establish

The tracker can preserve the organization contacted, requested period, delivery route, acknowledgement, attributed explanation of scope, response date, entries supplied, questions and closure. It can also make visible when a family question concerns a different record, such as an authorization, portal access log or claim history.

Important boundary: This tracker cannot decide whether HIPAA or another law applies, whether an organization is a covered entity or business associate, or who may act as a personal representative. It cannot determine which disclosures must appear, the available lookback period, a deadline, an extension, a fee, or whether a response is complete, accurate, lawful or compliant. It also cannot decide authorization, minimum necessary, a privacy violation or a remedy, and it cannot replace a privacy, records, payer, school, regulator or legal process.

The BACB Ethics Code for Behavior Analysts addresses confidentiality, documentation, disclosures and communication within its professional scope. A family worksheet cannot determine whether a certificant, organization or disclosure complied with that code.

Start with the family’s actual question

Request-planning fieldFamily entryOrganization believed to hold the informationPerson whose information is involvedFamily's relationship to that personWhat the family wants to understandRequested date rangePrivacy or records contact to confirmOfficial request route or formInformation still unknown

Write the question in ordinary language before choosing a route. “Who received information outside the care team?” is different from “Who opened the portal record?” or “Which claims did the plan process?”

The responsible organization can explain whether an accounting of disclosures, access history, authorization copy, claim history or another record addresses the question.

Do not assume that the ABA provider holds every relevant record. A school, health plan, clearinghouse, outside clinician or technology vendor may have a separate process and a different responsible contact.

Keep nearby records and requests distinct

Record or routeWhat it may showWhat it does not automatically showFamily-created sharing logWhat the family remembers approving or receivingThe organization's complete disclosure recordAuthorization or release historyForms and scopes recorded by the holderEvery disclosure that occurredHIPAA accounting, if applicableDisclosures the responsible entity includes under its processEvery access, use or disclosurePortal or security access logSystem activity the organization chooses or is required to provideThe legal purpose or recipient of every disclosureIndividual access requestCopies of the person's own recordsA disclosure accountingPayer claim historyClaims, adjustments and plan processingAll clinical-record disclosuresSchool record-disclosure recordSchool-held record sharing under the school's processProvider-held health-record sharingComplaint or investigation fileA concern and the reviewing body's responseProof that a disclosure was unlawful

Ask the holder to name the record it will provide. Do not label a portal report an “accounting” unless the responsible source uses that term. A short response is not necessarily incomplete, because some categories may not be included in a particular accounting.

Understand the federal accounting boundary without applying it yourself

The current 45 CFR 164.528 eCFR text is the federal provision used here. It describes an individual's right to an accounting of certain disclosures by a HIPAA covered entity. The rule identifies exclusions, content elements, a six-year maximum period with the option to request a shorter period, response timing, a possible extension, fees for some repeat requests and documentation duties.

The same section excludes several categories from the accounting requirement, including specified disclosures for treatment, payment and health care operations, disclosures to the individual, disclosures pursuant to authorization and other listed categories. That means an accounting is not necessarily a list of everyone who viewed or received information.

The responsible covered entity must decide how the rule applies. This tracker should record the entity's explanation rather than treating the regulation as a calculator for a deadline, fee or required entry.

Prepare and preserve the request

Submission fieldEntryOfficial form or instructions usedRequested period as writtenPerson submitting the requestAuthority documentation requested by holderRecipient office or roleSubmission date and channelDelivery confirmationCopy stored at

Use the organization's official route after confirming it. Avoid adding unrelated clinical or identifying details. If authority is questioned, preserve the request for documentation and the family's response without deciding the legal result in this tracker.

Retain the exact submitted copy. A phone conversation can be logged, but it may not substitute for a required written request. Record only a deadline or fee stated by the responsible organization or authoritative source for the actual situation.

Track acknowledgement and scope explanations

Follow-up eventDateSource and exact responseOwnerNext question or statusDelivery confirmedRequest acknowledgedIdentity or authority information requestedRequested period clarifiedScope or exclusions explainedFee discussedDelay or extension notice suppliedAccounting delivered

Attribute each statement to its source. “Privacy office stated that authorized disclosures are not included” is more useful than “authorized disclosures do not count.” Keep a copy of any written explanation.

An acknowledgement is not the accounting. An estimated delivery date is not proof of a legal deadline. If the family changes the requested period, preserve both versions.

Review the response entry by entry

Entry numberDisclosure date or periodRecipient namedInformation describedPurpose or basis statedFamily question1234

The eCFR text identifies date, recipient, a brief description of the information and a brief statement of purpose or another specified basis as ordinary content elements, subject to special provisions. Copy the organization's entry faithfully. Do not infer information that the response does not state.

For multiple disclosures, research disclosures or another special format, preserve the response as supplied. The tracker can flag a question, but it cannot decide that the format is legally insufficient.

Compare the response with family records carefully

For each comparison, write the family record, the accounting or holder response and the question to route. Review known authorizations, portal messages about sharing, payer information requests, school coordination events, outside-provider requests and unfamiliar recipients. Leave any unsupported conclusion blank.

A difference is a question, not proof of omission or wrongdoing. A known authorized disclosure may fall into an excluded category. A payer interaction may be treatment, payment or operations. A family-created date may be approximate.

Ask the responsible privacy contact to explain unfamiliar entries or apparent differences. Do not contact an unfamiliar recipient using personal information unless the responsible organization or qualified adviser instructs the family to do so.

Know why a business associate may appear indirectly

The HHS business-associate FAQ explains covered-entity responsibility for individual rights such as access, amendment and accounting. It also explains how contracts with business associates support those duties. A family may be directed back to the covered entity even when another company stores or processes information.

Record that routing explanation. Do not infer whether a company is legally a business associate or whether its activity belongs in the accounting. Those determinations require the responsible entity and applicable facts.

Route questions, corrections and concerns separately

Follow-up typeQuestion or requestResponsible routeDate sentResponse or statusClarify an entryAsk about an apparent omissionCorrect family contact informationRequest another record typeRaise a privacy concernAsk about complaint options

The HHS Privacy Rule summary provides an overview of individual rights and disclosure-accounting exclusions. Use it to frame questions, not to decide the outcome of a particular ABA record request.

Keep a correction to the family's tracker distinct from a request to the organization. If the family believes the response raises a privacy concern, open the responsible concern or complaint route separately and preserve its reference number.

Close the tracker without certifying completeness

Before closing, note whether the accounting or response arrived and which date range it covers. Record clarifications, separate records requested, any concern or complaint route, the family copy location, open questions and a next review date if useful.

“Closed” means the family has finished this tracking cycle. It does not certify that every disclosure was listed, every disclosure was lawful or every question was resolved. Preserve unresolved questions with their responsible route.

Fictional example: reviewing an unfamiliar recipient

This fictional example describes no real learner, family, provider, payer or disclosure.

Request. Priya asks fictional North Harbor ABA's privacy office which request would help her understand certain non-routine disclosures of her son Arun's information during the prior year. The office provides an accounting-of-disclosures form. Priya records the requested period and keeps the signed form outside the tracker.

Response. The office acknowledges the request and later supplies a written accounting with two entries. One entry names a county health office. Priya copies the date, recipient, information description and stated public-health purpose exactly as written.

Question. Priya does not label the disclosure unauthorized. She asks the privacy office for a plain-language explanation of the entry and whether a copy of the underlying request is available through another process. The office explains its route and provides a reference number.

Closure. Priya stores the response and explanation together. She notes that the accounting did not list a school disclosure she remembers authorizing, and records the privacy office's explanation that the authorization category was not included in this accounting. The tracker does not determine whether either response was complete or legally correct.

The example does not establish HIPAA applicability, personal-representative authority, accounting scope, a required entry, a deadline, minimum necessary, authorization, lawful disclosure, violation or remedy.