ABA Personal Representative, Caregiver and Supporter Role Map for Families

Use one copy for one person receiving services and one review period. Keep court papers, custody orders, powers of attorney, identification, clinical records and other sensitive documents in the organization's approved secure route. This working map should hold references and attributed answers, not copies of private evidence.

Use this ABA personal representative caregiver supporter role map for families only as a preparation and follow-up tool. It is not itself a consent form, authorization, guardianship document, capacity finding, custody interpretation, portal credential, access decision, or legal opinion.

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

What this role map can and cannot establish

The map can preserve the individual's name and communication needs, each person's stated role, the source presented, the activity requested, the organization that reviewed it, the response, any limits, the effective period and the next review trigger. It can also show when one person has several different roles or when separate organizations have reached different conclusions.

Important boundary: This map cannot decide whether HIPAA or another law applies. It cannot determine identity, personal-representative status, decision-making capacity, guardianship, custody, emancipation, consent authority, disclosure permission, record access, best interests, abuse, neglect, endangerment, validity, priority among documents, legal sufficiency or remedy. The responsible provider, plan, court, agency, privacy office or qualified attorney must apply the governing source. The client's own communication, preferences, assent and dissent remain important even when another person has legal authority.

The BACB Ethics Code for Behavior Analysts addresses confidentiality, informed consent, understandable communication, client and stakeholder involvement, documentation and compliance with applicable requirements. A family worksheet cannot decide whether a certificant or organization satisfied the code.

Separate roles before recording names

Role or relationshipWhat it may describeWhat it does not establish by label aloneClient or person receiving ABA servicesThe individual whose services and information are involvedCapacity, consent outcome or agreement with a proposed planPersonal representativeA person the responsible entity recognizes as able to act for the individual within an identified scopeUnlimited authority for every service, record, organization or time periodParent or guardianA family or legal relationship described by applicable documents and lawAutomatic access to every record or authority over every decisionCaregiverA person helping with daily care, routines or implementationLegal decision authority or broad permission to receive informationSupport personA person invited to help the individual understand, communicate or participatePermission to speak over the individual, sign, decide or receive recordsEmergency contactA person to contact under an approved emergency processOrdinary clinical, billing, portal or records accessInterpreter or communication supporterA person or service supporting communication accessDecision authority or permission beyond the interpreted interactionPortal delegate or proxyA person with organization-approved electronic accessAuthority outside the portal permissions or after access endsRecords recipientA person designated through a valid route to receive identified informationAuthority to make treatment decisions or receive later information

One person can appear in more than one row, but each role needs its own scope and source. A caregiver may also be an emergency contact. A legally authorized representative may also attend as a support person. Record both roles with separate activities instead of collapsing them into one label.

Start with the individual's authorship

Individual-centered fieldEntryPerson receiving servicesPreferred name and pronounsBest way to communicateAAC, interpreter or accessibility supportDecisions the individual makes directlyTopics the individual wants help understandingPeople the individual wants involvedPeople or topics the individual wants excluded or limitedHow assent, dissent or a request for private time will be communicated

Do not treat a diagnosis, disability, age, communication method or need for support as a capacity decision. Do not ask a supporter to answer first when the individual can communicate directly with appropriate access. The clinical team should explain how it will seek and honor participation within the applicable consent and safety boundaries.

If the person is a minor, an adult with a representative, or an adult who invites help, keep those situations distinct. The map should record what the responsible organization actually verifies rather than applying a family assumption.

Use the current HIPAA sources as questions, not conclusions

Current 45 CFR 164.502 describes personal representatives when the HIPAA Privacy Rule applies. The regulation addresses adults, emancipated minors, unemancipated minors, deceased people and an exception involving abuse, neglect or endangerment. It connects the recognized role and the information involved to authority under applicable law.

The HHS personal-representatives guidance explains that the scope of authority generally comes from state or other applicable law. Broad authority and limited authority are not interchangeable. The guidance also distinguishes a personal representative from a family member or other person involved in care or payment.

Current 45 CFR 164.514 includes verification requirements for identity and authority when they are not known to the covered entity. Families can ask which identity or authority evidence the entity requests, where to send it securely, and how the decision will be documented. The worksheet cannot tell an entity which evidence is sufficient.

The HHS Family Members and Friends page explains that involvement in care and personal-representative status are different routes. An involved family member or friend is not automatically entitled to all information. Record which route the organization says applies to each requested activity.

Build one row for each person and activity

PersonStated roleRequested activitySource presentedOrganization reviewingStatus or limitsEffective datesAttend care meetingGive consent or approvalReceive clinical updatesRequest or receive recordsUse the portalDiscuss billing or benefitsReceive emergency contact

Write activities precisely. “Can help with scheduling” is narrower than “can make all decisions.” “May receive the June progress report” is narrower than “can access records.” If the organization recognizes only part of a request, record the accepted and excluded activities separately.

The source column should identify a document, instruction from the individual, organization form, or other basis without storing its sensitive contents here. Use wording such as “court order dated [date], secure copy sent to privacy office” or “adult client's written invitation for the October meeting.” Do not summarize a legal document beyond what the responsible reviewer confirms.

Ask the responsible organization to verify the scope

Verification questionAttributed answerSource or reviewerOpen itemWhich legal entity or practice is making this determination?Which role is recognized?Which services, decisions or records are within scope?Which actions remain with the individual?What identity or authority evidence is required?When does the role begin, end or require rechecking?Does the portal use a separate proxy process?Do billing, payer and clinical systems need separate updates?How can the individual ask for privacy or private time?Which contact handles disagreement or changed circumstances?

Copy the organization's answer and identify who gave it. “Parent verified” is incomplete if the unresolved question concerns a limited custody order, a service-specific minor rule or an adult's records. “Supporter approved” does not explain whether approval covers meeting attendance, communications, portal access or signatures.

Different organizations may use different forms or reach different results because they control different systems and may apply different sources. A provider's role decision does not automatically update a health plan, school, hospital or another provider.

Protect private evidence and account access

Never place login credentials, full identification numbers, medical details or complete legal documents in this sheet. Record where the authoritative item is stored and who may access it. Submit evidence only through the route the responsible organization approves.

Never ask several people to share one portal username. Ask whether the organization offers separate delegate or proxy credentials, what each credential permits, how access is logged, and how it is removed. A portal permission is an operational control, not proof of broader legal authority.

If the wrong person appears to have access, use the organization's security or privacy route promptly. Preserve facts such as date, screen, account and contact response without circulating screenshots that expose more information.

Track conflicts without choosing a winner

Conflict or mismatchSource ASource BPerson responsible for reviewInterim boundaryResolution statusName or relationship differsScope differs between systemsIndividual preference differs from supporter requestDocument dates or terms conflictProvider and payer responses differ

Preserve both sources. Do not mark one invalid solely because it is older, informal, or inconvenient. Ask the authority responsible for the particular decision to explain what controls and what the interim privacy and care boundary will be.

An immediate safety concern belongs with the approved clinical or emergency route. A concern about abuse, neglect or endangerment requires qualified handling and should not be investigated in a family worksheet. Do not alert a person in a way that could increase risk; follow the responsible safety and legal process.

Recheck after a change

Review the map when the individual reaches adulthood, a court order changes, custody or guardianship changes, a power of attorney begins or ends, a representative is added or removed, the client changes a support preference, a portal changes, the provider or plan changes, or a record-access question arises.

Change eventDate learnedSystems or organizations affectedNew verification ownerEffective resultNext check

Do not overwrite the old row. Preserve the earlier scope and effective period, then add the new result. This makes it possible to understand which instruction applied at a past meeting or disclosure without treating a later change as retroactive.

Close the map without certifying authority

Before closing, record every active role, scope, source reference, reviewing organization, effective period, access accommodation, unresolved conflict, and next review trigger. Mark an activity confirmed only when the responsible organization has provided a dated, attributable answer.

“Closed” means the family finished this mapping cycle. It does not certify identity, capacity, guardianship, custody, consent, privacy access, legal authority, best interests or compliance. Leave disputed or organization-specific items visibly open.

Fictional example: one adult, three helpers and two systems

This example describes no real person, family, provider, plan or legal document.

Fictional adult client Devon uses text-based AAC. Devon asks sibling Maren to attend a November ABA plan meeting as a support person and asks housemate Luis to receive scheduling calls. A court-appointed representative, Priya, submits a document to fictional Cedar Path ABA for review of a limited health-care role.

The family map uses three rows. Maren's row covers meeting support only and records Devon's request for private time before decisions. Luis's row covers scheduling calls and no clinical records. Priya's row references the secure document and leaves consent, records and portal activities open until Cedar Path's privacy and clinical contacts confirm the scope.

Cedar Path recognizes Priya for one set of decisions, gives her separate portal-proxy instructions and says its billing system needs another update. Devon's health plan requests its own verification. The family records the different responses rather than treating the provider's result as binding on the plan.

At the meeting, staff communicate with Devon first, Maren supports AAC use, and Priya acts only within the verified role. The example does not establish capacity, representative authority, document validity, portal access, consent, disclosure permission or legal compliance.