ABA Confidential Communication Method and Location Request Tracker for Families

Use one copy for one organization. Separate appointment, clinical, records, billing and payer communications because an organization may use different systems or owners for each. Keep the actual request form, decision and private contact details in the approved restricted location rather than copying sensitive information into a shared planning sheet.

This ABA confidential communication request tracker for families is a preparation and follow-up tool. It is not a legal request, safety plan, contact-information form, portal setting, accessibility accommodation, authorization, disclosure restriction or finding that a channel is secure.

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

What this tracker can and cannot establish

The tracker can preserve the organization, requester, communication categories, current route, requested alternative, safe fallback, submission route, acknowledgement, decision, implementation checks and later changes. It can also reveal when a billing office and clinical team need separate instructions.

Important boundary: This tracker cannot decide whether HIPAA or another law applies. It also cannot determine whether an organization is a covered provider or health plan, who may act for another person, or whether a request is reasonable. Questions about endangerment, required request contents, payment responsibility, security, feasibility, implementation, exceptions, legal sufficiency, violation and remedy belong with the responsible reviewer. Do not use the tracker to reveal why a provider request is needed when an explanation is not required.

The BACB Ethics Code for Behavior Analysts addresses confidentiality, documentation, understandable communication and applicable requirements within its professional scope. A family tracker cannot decide whether a certificant or organization complied with the code.

Decide which request this really is

Possible needWhat the family is asking to changeSeparate route to confirmOrdinary contact updateA phone number, email or mailing addressRegistration or contact-update processCommunication preferenceRoutine preference for calls, texts, mail or portal messagesCommunication plan or settingsAccessibility supportInterpreter, translated material, relay or accessible formatAccessibility or language-access processConfidential communicationAlternative means or location for specified health informationPrivacy contact's request processPortal proxy changeWho can enter or view an accountIdentity and access processAuthorization or disclosure choiceWhether information may go to another person or organizationAuthorization or privacy processMarketing opt-outWhether promotional messages continueMarketing-preference process

More than one route may be needed. Use one row for each route the organization says it controls. Updating a phone number does not necessarily change a billing vendor's address, an automated reminder system or a health plan's communication route. A confidential-communications decision also does not automatically remove a portal proxy or revoke an authorization.

Write down the family's actual goal before sending a form: “Send billing mail to the designated post-office box” is more testable than “keep everything private.”

Map the communications before choosing an alternative

Communication categoryCurrent method or locationRequested method or locationBackup if unavailableSensitive details kept outside this trackerAppointment and schedulingClinical messagesRecords noticesBills and payment messagesPayer or authorization messagesGeneral administrative notices

Name a method and location precisely enough to implement. “Call the mobile ending in 42 and do not leave a detailed voicemail” is different from “phone only.” For mail, record the complete approved destination on the organization's restricted form, not in a broadly shared worksheet.

Keep urgent safety and care instructions separate. A privacy preference should not make it impossible to reach the person through the agreed urgent route. The clinical or safety owner determines what urgent communication is needed; the privacy contact explains how the confidential request interacts with it.

Use the current HIPAA source without applying it yourself

The current 45 CFR 164.522 distinguishes covered health care providers from health plans. When the rule applies, paragraph (b) addresses requests for alternative means or locations. Its conditions differ for provider and health-plan requests.

The family should ask the responsible organization which part, if any, applies to its role and the particular communication. Do not assume that an ABA brand, billing company, employer or app has the same legal status or duties as the provider or plan.

The regulation says a covered provider may not require an explanation of the basis for the provider request as a condition of confidential communications. A health plan request has a different provision involving a clear statement about possible endangerment. This tracker deliberately provides no space for a narrative about danger. Use the plan's approved private route and qualified advice when that issue is relevant.

Prepare a bounded request record

Request fieldFamily entryOrganization and role to confirmPerson whose communications are involvedRequester and authority presentedCommunication categories coveredAlternative method or locationSafe fallback methodEffective date requestedPayment-handling information requested by organizationOfficial form or routePrivate copy location

Use the organization's current form when one exists. Ask whether that form updates every relevant department. Clinical, scheduling, records, billing and plan systems may need separate instructions.

The HHS Privacy Rule summary explains, at a high level, that covered providers and health plans must permit confidential-communications requests under the rule's conditions. The summary also describes alternative addresses or contact methods and, when appropriate, information about payment handling. Record what the organization asks and who supplied the instruction. The tracker does not decide whether a condition is appropriate.

Ask about channel risk and accessibility separately

The HHS email FAQ describes electronic communication, reasonable safeguards and alternative means when the Privacy Rule applies. It does not make every email secure or require every provider to use the same platform.

Ask the organization to explain its available routes and material risks in understandable language. Record the family's selected alternative only after the responsible contact confirms it can be used. Do not test a private address by sending protected information from an unapproved account.

Accessibility is a separate question. Record whether the person needs an interpreter, translated text, captions, relay, AAC-compatible messaging, large print, plain language or another support. A route can be private yet unusable; it can also be accessible but directed to the wrong person.

Track the response without upgrading its meaning

Follow-up eventDateOffice or personExact response or statusNext actionRequest deliveredReceipt acknowledgedClarification requestedApproved, partly approved or declinedEffective date suppliedSystems or departments namedWritten terms received

Copy the organization's wording. “Scheduling updated” does not mean billing, records or the plan updated. “Preference saved” may not be the same as a formal confidential-communications accommodation. If a request is partly accepted, preserve the exact accepted method, covered categories and effective date.

Ask where an urgent message goes and which exceptions the organization says remain. Do not infer an exception from a missed call or promise that no communication can ever use another route.

Test implementation with low-risk events

Implementation checkExpected routeActual resultDateCorrection ownerScheduling reminderGeneric callback requestBilling noticeRecords-status messagePlan message, if separately requested

Use ordinary events that would have happened anyway. Do not trigger a claim, send sensitive content or create a false appointment merely to test a route. Confirm only what the family directly observed.

If a message uses the old route, preserve the date and the available envelope, caller information or notification without circulating its contents. Ask whether the request was effective for that category. A separate system may need correction, but a failed check does not by itself prove a privacy violation or establish harm.

Handle changes, termination and duplicate systems

A family may later change an address, replace a phone, revise the safe fallback or ask to end an arrangement. Record the new request and effective date rather than overwriting the earlier terms. Ask which systems will retain the historical instruction and which will receive the new one.

Change-control fieldEntryEarlier request or decisionRequested changeReason shared, if the family chose to share oneEffective dateSystems to updateOld-route removal testNew-route confirmationWritten closure

Changing the provider request does not necessarily change the health plan, outside laboratory, clearinghouse, school or another clinician. Route each organization separately. If a safety concern affects how contact occurs, use a qualified safety or legal route instead of putting the concern in a shared log.

Close the tracker without certifying privacy or security

Before closing, record the written response, accepted method or location, effective date, systems named, implementation checks, unresolved exceptions, accessible format, family copy location and next review trigger. Leave any untested category visibly open.

“Closed” means this family tracking cycle is complete. It does not certify that HIPAA applied, the request was legally sufficient, every system changed, a channel is secure, no disclosure occurred or a remedy is available.

Fictional example: two communication categories, two tests

This example describes no real learner, family, provider, address or safety concern.

Elena asks fictional Clearbrook ABA for its confidential-communications process for her daughter Marisol. She requests that billing mail use a designated post-office box and that appointment reminders go to a specified mobile number without detailed voicemail. Elena does not write the private reason in her general family tracker.

The privacy contact supplies a form and says the billing office and scheduling system are separate. Elena submits the form through the approved route. The provider's written response accepts both methods beginning October 6 and identifies a generic urgent callback route. Elena records the wording without declaring that every message is covered.

The next ordinary appointment reminder reaches the selected mobile. A later billing notice goes to the old address. Elena saves the envelope, contacts the privacy office and learns that the billing vendor update was delayed. The office gives a corrected effective date, and the next ordinary statement reaches the post-office box.

Elena closes the tracker after both categories have one observed successful event. The example does not establish HIPAA applicability, authority, reasonableness, endangerment, security, fault, violation or remedy.