ABA Health Record Access Denial and Review Follow-Up Tracker for Families

Use this ABA health record access denial tracker for families to preserve what the organization actually said and what happened next, without deciding whether the denial was correct.

Start a separate tracker for each organization and written decision. Store the request, denial, records, and identity documents in the organization's approved secure location. Use short reference labels here instead of copying protected health information into a shared worksheet.

This is not a new records request, appeal, complaint, amendment request, or legal filing. The tool does not tell an organization to disclose a record or tell a licensed professional how to decide a review.

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

What this tracker can and cannot establish

The tracker can preserve the request reference, exact material affected, denial notice, stated basis, reviewability statement, instructions, responsible office, alternative or partial access, review request, designated reviewer, written determination, delivery, and unresolved questions.

Important boundary: This tracker cannot decide whether HIPAA or another law applies. It cannot determine covered-entity or designated-record-set status, requester or personal-representative authority, or access entitlement. It also cannot classify a denial ground as reviewable, evaluate professional judgment, danger or substantial harm, or decide notice sufficiency, timeliness, complaint eligibility, violation, or remedy. It cannot calculate a legal deadline or replace privacy, records, clinical, payer, regulator, safety, state-law, or legal review.

The BACB Ethics Code for Behavior Analysts addresses confidentiality, documentation, accurate information, understandable communication, and compliance with applicable requirements within its scope. This worksheet does not determine whether a certificant, provider, or health plan complied with that code.

Confirm that the response is an access denial

Response receivedWhat to recordKeep separate fromRequest still being processedThe status and attributed completion dateA written denialClarification or identity requestThe exact information requested and response routeA conclusion about authorityRecord not maintained hereThe organization’s statement and any redirectA denial based on record contentPartial accessWhat was provided and what was withheldA complete denialWritten access denialThe denied material, basis, and instructionsAn amendment denial or payer appealClinical disagreementThe clinical issue and responsible clinicianA health-information access decision

Use the ABA Records Request and Delivery Tracker for Families for the original request and ordinary delivery cycle. Open this page only when the responsible organization labels its written response as a whole or partial access denial. A delay, inaccessible file, missing item, claim denial, treatment authorization decision, or refusal to amend a record may use a different process.

Read the current sources without deciding the outcome

Current 45 CFR 164.524 describes an individual's HIPAA right of access and limited denial grounds when the rule applies. It separates grounds that do not carry a review opportunity from specified grounds that do. The section also addresses written notice, partial access, redirection, review by a designated licensed health care professional who did not participate in the original decision, and a written determination.

The HHS right-of-access guidance explains those elements for covered entities and individuals. HHS's public Your Medical Records page describes access rights in medical and billing records held by health plans and health-care providers covered by the rule, with exceptions and qualifications. The HHS FAQ on electronic judgments about denial of access distinguishes individual professional judgment from automated application of an established policy.

These sources do not decide whether a particular ABA entity, record, requester, denial, or review falls within the rule. Record what the responsible organization says, then ask a qualified reviewer when the answer matters.

Create one denial identity block

Denial fieldFamily entryPerson whose information is involvedRequester and authority presentedOrganization and legal entityOriginal request date and referenceExact records, date range, or portion affectedDate the organization says it received the requestDate of written responseWhole or partial denialOrganization’s classification of the decisionPrivacy or records contactSecure location of the notice

Identify one person, one organization, and one bounded request without copying sensitive contents. For example, write “session records, January 1 through March 31, request R-104” instead of pasting every note. If a plan and provider each issue a response, create two trackers because their records, duties, instructions, and reviewers may differ.

Use attributed language. “Records office states that access to pages 8 through 10 is denied” preserves the response. That wording does not prove the pages fall inside or outside an access right.

Map the written notice before taking a next step

Notice element to locateWhere it appearsExact wording or short referenceMissing or unclear questionMaterial deniedBasis stated for denialReview right stated, if anyHow to request reviewInternal complaint routeExternal complaint route describedContact name or title and telephone numberPartial or alternative access offeredRedirect to another record holder

The regulation identifies content for a written denial when its process applies. Copy the notice's own labels and references into the table. This helps a family find and ask about the content without labeling the notice defective, deciding that a review right exists, or extending a filing period.

If the notice is not readable or understandable, request accessible communication. The DOJ ADA effective-communication resource explains general principles and aids or services for entities covered by the ADA. The resource does not decide which entity, law, aid, or outcome applies. Record the accessibility request and the organization's answer separately from the access decision.

Keep partial access and denied material separate

Requested itemProvided, denied, redirected, or unknownDelivery or denial referenceOpens and is readable?Next question

When some material is provided, reconcile that delivery without treating it as resolution of the denied portion. Preserve the exact date range and version. Do not infer that an omitted page was intentionally withheld, that a delivered page is clinically accurate, or that the response is complete.

If the organization says it does not maintain the information and identifies another holder, record the redirect. A redirect is not proof that the other organization has the record or must release it. Start a new request using that organization's current instructions if the family chooses.

Ask whether a review route was identified

Review questionAttributed answer and sourceDoes the notice state that this denial may be reviewed?Which portion of a partial denial is covered by that statement?Who receives a review request?What form or information does the organization request?What submission route is approved?What date or timing instruction is stated?What accessibility support is available?Who can answer privacy or legal questions?

Do not infer reviewability from the stated basis or classify the denial yourself. Under the federal regulation, only specified denial grounds carry the review described there. Other laws, contracts, or internal processes may be different. Ask the responsible privacy or records office to explain the route that applies to this written decision.

Avoid asking a treating clinician to promise a result. A reviewable HIPAA denial is reviewed by the designated licensed health care professional under the regulation's conditions. This family tracker preserves the route and outcome; it does not select the reviewer or substitute its judgment.

Log a review request and determination

EventDate and timeSender or recipientExact submission, response, or statusEvidence locationNext actionInstructions confirmedReview requestedReceipt acknowledgedDesignated reviewing official identifiedAccessibility support suppliedWritten determination receivedAccess provided or denial reaffirmedFamily received and tested files

Save the family's actual submission and proof of receipt. Record the reviewer's name or title only as the organization provides it. Ask the organization to confirm the reviewer's role and nonparticipation in the original decision. Do not investigate private personnel information or make an independent qualification or conflict finding.

When a determination arrives, quote its disposition accurately. “Reviewing official reversed the denial for two pages” is an attributed result. It does not show that all requested material was delivered or that every related issue is resolved. Track delivery and usability as separate events.

Separate other routes instead of blending them

ConcernPossible owner to confirmSeparate record to keepIncorrect information in a recordPrivacy, records, or clinical officeAmendment or correction requestABA service authorization denialHealth plan or utilization reviewerPayer appeal or grievanceImmediate clinical or safety concernResponsible clinician or urgent routeClinical or safety recordPrivacy-process concernPrivacy office or qualified regulator contactComplaint recordBilling or claim errorProvider billing office or payerBilling follow-upLegal rights or remedyQualified legal professionalPrivate legal notes

A review request under the access process is not a statement of disagreement about record accuracy. It is not an appeal of denied ABA hours. A complaint may run on a separate track, but this worksheet does not determine eligibility, deadline, forum, or outcome.

Route urgent care, medication, safety, authorization, or billing risk without waiting for a record-access review. State the observable issue and ask the responsible role for an interim plan. Do not tell a family to ignore current clinical guidance because a records question remains open.

Close the follow-up cycle carefully

Before closing, confirm that the original request and denial are preserved, partial access has been reconciled, the family's selected action is recorded, submission evidence is stored, and the written determination is linked. Test delivered files for ordinary opening and accessibility. Give each unanswered question an owner and review date.

Mark the family status “closed” only after recording the endpoint and any intentionally deferred question. That status does not certify access entitlement, denial validity, professional judgment, file completeness, accessibility compliance, legal compliance, harm, or remedy.

Fictional example: a partial denial and review request

This example describes no real learner, family, provider, plan, record, or decision.

Alex requests a copy of child Sam's fictional Harbor Birch Health Plan case-management and claim records for January through March. The plan delivers the claim records and sends a written partial denial covering two case-management entries. The notice describes one part as reviewable and gives a secure review-request route.

Alex opens one denial tracker. The identity block references request R-104 and the two entries without copying their contents. The notice map records the plan's stated basis, review instructions, complaint contacts, and partial-access explanation. Alex asks the privacy office to confirm which portion the review statement covers and requests an accessible version of the notice.

After receiving that answer, Alex submits a review request through the listed route and saves the receipt. The plan identifies a reviewing official who was not involved in the original decision. Later, the plan sends a written determination reversing the denial for one entry and reaffirming it for the other. Alex records that attributed result, receives the released entry, and confirms that the file opens with the family's assistive technology.

The tracker remains open for one question about the second entry, with the privacy office named as owner. The example does not establish coverage, authority, reviewability, or reviewer sufficiency. It also does not decide that either determination was correct or that a violation or remedy exists.