ABA Privacy Authorization and Information-Sharing Questions Worksheet for Families

Use one copy for one proposed sharing arrangement. Before signing, declining or revoking anything, ask which process the responsible organization says applies. Keep the official form and provider response outside this worksheet.

This ABA release of information questions worksheet is a family-owned preparation tool. It is not a HIPAA authorization, release of information, consent, privacy notice, access request, legal objection, school form or permission to disclose.

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

What this worksheet can and cannot establish

The worksheet can preserve the proposed information, sender or holder, recipient, purpose, channel, duration, person whose permission is requested, explanation received, revocation instructions, copy location and unanswered questions. It can help a family compare the proposal with the official form.

Important boundary: This worksheet cannot authorize, revoke or block a disclosure. It cannot determine who may legally act; whether HIPAA or another law applies; whether authorization is required, optional or valid; whether information is protected; whether a channel is secure; whether a disclosure occurred or was lawful; consent, assent, decision capacity, minimum necessary, emergency authority or legal compliance. It cannot replace the responsible provider, plan, school, privacy, records or legal process.

The BACB Ethics Code for Behavior Analysts addresses confidentiality, disclosure, documentation, communication and informed consent within its professional scope. The code does not determine the legal privacy rule or authorization route for a particular organization or record.

Define the proposed information-sharing situation

Situation fieldEntryInformation holder or proposed senderProposed recipientInformation or record describedStated purposeProposed channelStart date, expiration or eventPerson asked to agree, object, consent or authorizeOfficial form or policy to review

Write the proposal as it was explained. Do not infer a purpose from the recipient's job title. Record the source and date for each detail.

Leave uncertain fields open. A vague proposal is a reason to ask a question. It is not permission to fill in the missing terms.

Separate the possible privacy and records routes

Route or conceptWhat it may involveResponsible source to confirmFamily questionTreatment consentAgreement to a service or interventionHIPAA authorization, if applicableSpecified use or disclosure of protected informationRelease of informationOrganization-specific sharing document or processOpportunity to agree or objectParticular permitted communication contextIndividual access requestA person seeking a copy of their own informationProvider-permitted disclosureDisclosure the responsible entity says is permitted without authorizationSchool record processSchool-held information and applicable school routePayer or authorization processPlan-held information or benefit administrationActual disclosure recordWhat was sent, when and by whom

These routes are not interchangeable. A signature for treatment does not automatically answer every information-sharing question. An access request is not necessarily an authorization.

Have the responsible privacy or records contact identify the process. Preserve the answer with its source. Do not convert a family preference into a legal conclusion.

Ask who may send, receive and act

Authority questionAttributed answerWho holds the information?Who is proposed to send it?Who is proposed to receive it?Who is being asked to sign or decide?How is that person's authority verified?Is learner agreement, objection or assent being sought separately?Which office answers privacy questions?What remains unresolved?

Do not use this worksheet to decide guardianship, custody, personal-representative status or decision capacity. Those determinations belong with the responsible organization and applicable law. A family relationship alone does not let the worksheet establish authority.

Preserve the learner's communication separately. An expression of preference, agreement or objection may be important without becoming the legal authorization itself. Ask how the organization records it.

Review the information and purpose in specific terms

Scope questionEntryWhat exact records or data are described?What dates or service periods are included?What is excluded?What purpose is stated?May the recipient use the information for another purpose?What expiration date or event appears?What happens after expiration?What question must be answered before a decision?

Avoid labels such as “all records” unless that is the exact language under review. Ask for a plain-language explanation of categories that are unclear. Do not narrow or expand an official form by writing different terms here.

The family can record a preferred scope. The responsible organization must explain whether and how that preference fits the applicable process. The worksheet itself cannot make the preference effective.

Understand consent and authorization as different concepts

The HHS consent-versus-authorization FAQ distinguishes voluntary consent for certain treatment, payment and operations uses from a detailed HIPAA authorization for uses or disclosures not otherwise allowed by the Privacy Rule. It also describes required authorization elements at a high level. The FAQ does not establish which route applies to every ABA provider or sharing proposal.

The current 45 CFR 164.508 eCFR text sets requirements for authorizations when that HIPAA section applies. It includes core elements, required statements, revocation, plain language and a copy to the individual. The responsible covered entity must determine whether a proposed use or disclosure requires and satisfies that rule.

This worksheet is not the official document. A family should review the actual language. Questions that remain open should stay visible.

Check explanation, readability and access support

Understanding and access fieldEntryPlain-language explanation requestedPreferred languageInterpreter or communication supportAccessible formatTime to reviewPerson or office available for questionsLearner communication supportUnclear term or clause

Record the explanation without certifying comprehension. A completed row does not prove informed consent, valid authorization or assent. Ask for clarification when the official form and spoken explanation differ.

Keep access support separate from the decision. Needing an interpreter or alternate format does not imply agreement or refusal. The family can request time to review without this worksheet deciding what time must be allowed.

Map channels and privacy questions without declaring security

Routing fieldEntryProposed transmission channelChannel approved by the holder, if statedRecipient contact confirmed bySensitive categories identified by the sourceCopy or receipt availablePrivacy concern or questionBackup routeActual disclosure confirmation, if later supplied

Do not put sensitive information into this worksheet merely to test a channel. The responsible organization can explain where protected details belong. A convenient channel is not automatically an approved one.

The worksheet cannot determine encryption, security adequacy or privacy compliance. It also cannot prove that information was transmitted. Preserve an official receipt or disclosure record if one is provided.

Record the decision and official document separately

Decision fieldEntryOfficial form or process usedDecision made byDateSigned, declined, limited, withdrawn or still under reviewCopy received and stored atRevocation instructions suppliedProvider acknowledgementRemaining question

The decision belongs in the official process. This worksheet can reference that record but should not substitute for it. Do not copy a signature into the worksheet as if it creates a second authorization.

A refusal or open question is not automatically a complaint. A signed form does not prove that every later disclosure matched its terms. Keep later events attributed and dated.

Track changes, revocation questions and later disclosures

Follow-up eventDateSource and exact entryStatus or next stepProposed scope changedRecipient changedExpiration reachedRevocation question submittedRevocation response receivedDisclosure confirmation receivedCorrection or disagreement recordedNext privacy review

The eCFR text describes revocation rules for a HIPAA authorization when applicable, including limits after reliance. This worksheet cannot execute a revocation. Follow the instructions supplied by the responsible entity.

Do not assume a revocation removes information already received by another party. Ask what action was taken and preserve the attributed answer. Keep the family's own records current.

Preserve family involvement without assuming disclosure authority

The HHS family-and-friends communication FAQ describes circumstances in which HIPAA permits certain communications with people involved in care or payment. It includes patient agreement, an opportunity to object and professional judgment in specified circumstances. The responsible provider must apply the rule to the actual situation.

Family involvement can be valuable without making every family member an authorized recipient. Learner preferences and objections should be preserved through the appropriate supported process. The worksheet does not decide the legal result.

Fictional example: questions before sharing a progress summary

This fictional example describes no real learner, family, provider, school or record.

Proposal. Fictional Cedar Lane ABA asks Jordan's mother, Malikah, to review a form about sharing a quarterly progress summary with Jordan's school coordinator. The form names the provider and coordinator but uses the phrase “relevant records.”

Questions. Malikah records questions about which dates and documents “relevant records” includes, the purpose, expiration and how Jordan's communication about the proposal will be supported. She asks the provider's privacy contact for a plain-language explanation. The worksheet does not narrow the form itself.

Response and decision. The privacy contact supplies a revised form that identifies the quarterly summary, a six-month expiration and the named coordinator. Malikah stores the official form separately. She records that she signed that form after review; her signature is not placed in this worksheet.

Follow-up. The provider later supplies a portal receipt showing the summary was sent. Malikah records the receipt date. She does not infer whether the school used or redisclosed the information.

The example does not establish HIPAA applicability, authority, valid authorization, consent, assent, secure transmission, minimum necessary, lawful disclosure or school-record compliance.