ABA Records Request and Delivery Tracker for Families

Use a new ABA records request tracker for each recipient or process. Record the requester, stated authority, entity, scope, form, format, channel, source dates, response, delivered items, and unresolved questions.

Update the tracker when the responsible entity acknowledges, clarifies, fulfills, limits, denies, redirects, or closes the request.

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

The HHS Your Medical Records page explains that the HIPAA Privacy Rule gives individuals, with limited exceptions, rights to inspect, review, and receive copies of medical and billing records held by health plans and health-care providers covered by the rule. It also distinguishes access by the individual or personal representative from other disclosures. This tracker does not decide whether HIPAA covers a particular ABA entity, record, requester, or transaction.

Important boundary: This is a family-owned request and delivery log, not an access determination or authorization form. It cannot determine HIPAA or state-law coverage, requester or representative authority, the designated record set, an applicable exception, a fee, deadline, required format, secure method, denial, review right, or legal remedy. It cannot require creation of a new record, certify a transmission as secure, or prove the delivered set is complete. Use the responsible entity's current instructions and qualified privacy, records, payer, school, state, or legal guidance.

Classify the request before tracking it

The same words, “send the ABA records,” can refer to different processes. Ask the recipient what process applies and record the answer's source.

Classification fieldFamily entryPerson whose records are involvedYour entry: __________.Requester and relationshipYour entry: __________.Entity asked to respondYour entry: __________.Intended recipient of the copyYour entry: __________.Purpose stated by requester, if anyYour entry: __________.Process named by the responsible entityYour entry: __________.HIPAA access, disclosure, payer, school, ordinary copy, or otherYour entry: __________.Current instructions or form source and dateYour entry: __________.

• Name the responding entity.
• Identify the intended recipient.
• Record the process stated.
• Save the instruction date.
• Keep different requests separate.

Do not reuse one form merely because it worked elsewhere. A request for the individual to receive records can differ from a request to direct records to another person, a provider's treatment disclosure, an authorization, a payer's documentation request, or a school process.

The HHS right-of-access guidance describes access to protected health information in designated record sets maintained by or for a covered entity. The guidance includes important qualifications and notes the effect of a federal court order on parts of earlier guidance. Record the current instruction; do not turn a summary into a universal deadline or fee rule.

Record identity and authority as stated, not assumed

Identity and authority fieldFamily entryRequester's full nameYour entry: __________.Person's name and identifiers requested by the entityYour entry: __________.Authority or relationship statedYour entry: __________.Verification method requestedYour entry: __________.Representative documentation requested, if anyYour entry: __________.Entity response to verificationYour entry: __________.Limitation or unresolved authority questionYour entry: __________.Qualified source asked for clarificationYour entry: __________.

• State the relationship accurately.
• Minimize copied identifiers.
• Follow the current verification step.
• Preserve any stated limitation.
• Route authority questions carefully.

A family relationship alone does not establish every access right. Minor, adult, personal-representative, custody, guardianship, supported-decision, school, and payer questions can require different facts and law. Record the entity's current request without placing unnecessary identifiers in this tracker.

Define the record scope and date range precisely

The HHS FAQ on what information individuals may access explains that designated record sets can include medical, billing, payment, claims, enrollment, case-management, and other information used to make decisions about individuals. It also explains that covered entities are not required through the access right to create new explanatory materials or analyses that do not already exist.

Requested itemDate range or versionEntity or departmentExisting record requested, not a new analysisRequested form and formatIncluded, missing, limited, or unknownAssessment or reassessmentTreatment plan or updateProgress or session recordAuthorization or consent recordBilling, payment, claim, or EOB-related recordCommunication or correspondence kept in the recordOther item named precisely

• Name an existing record.
• Bound the date range.
• Select the requested format.
• Separate each record source.
• Mark unknown scope openly.

Ask for the actual existing record by name and date range. “Complete file” may be interpreted differently. Keep a missing record distinct from an excluded record, a record held by another entity, or a new explanation the family hoped the recipient would create.

The HHS FAQ about information in the medical record describes broad access to PHI in a designated record set, subject to limited grounds and exclusions. That federal FAQ does not determine the result for an entity or record outside its scope.

Log submission, acknowledgment, and clarification

EventDate and timeChannelSender or recipientExact request, confirmation, or responseEvidence locationNext stepInstructions obtainedRequest submittedDelivery or portal confirmationIdentity or authority verificationAcknowledgment receivedClarification requestedFee or timing information statedResponse or status update

• Preserve the submission proof.
• Distinguish sent from received.
• Date every clarification.
• Quote fees as stated.
• Attribute each timing statement.

Keep the date the family sent the request distinct from the date the entity says it received a valid or complete request. Save the confirmation. Record fees and timing only as stated by the responsible source, with the source date and any conditions.

Preserve accessible communication and format questions

The ADA effective-communication resource explains general effective-communication obligations for covered entities and discusses aids and services based on context. It does not decide which law, entity, aid, format, exception, or outcome applies to this records request.

Access and format fieldFamily entryRequested paper, electronic, portal, inspection, or other formYour entry: __________.Requested file formatYour entry: __________.Accessibility need or communication preference sharedYour entry: __________.Secure delivery preference discussedYour entry: __________.Entity's response or alternativeYour entry: __________.Person's feedback after attempting accessYour entry: __________.Remaining access questionYour entry: __________.

• Request the usable form.
• Specify the file format.
• Protect passwords and identifiers.
• Test access after delivery.
• Record the person's feedback.

Do not place passwords, full identifiers, or sensitive record contents in an unsecured tracker. Ask how the entity handles secure delivery. A successful download does not prove accessibility; an accessible file does not prove completeness or legal compliance.

Reconcile the delivered set without interpreting the clinical record

Received item or fileDelivery dateFile name or document titleDate range or versionOpens and is readable?Matches requested item?Missing pages, duplicate, unexpected content, or uncertaintyFollow-up needed

• Open every delivered file.
• Compare titles and dates.
• Count pages when useful.
• Flag duplicates without deleting them.
• List missing items precisely.

Use filenames, titles, versions, page counts, and dates. Do not decide that a clinical record is accurate, sufficient, lawful, or clinically appropriate merely because it arrived. A separate amendment, explanation, appeal, complaint, or clinical-review process may apply.

The BACB Ethics Code for Behavior Analysts applies to certificants and applicants and addresses professional documentation and confidentiality responsibilities. It does not turn a family reconciliation list into an official record, audit, ethics finding, or proof of a provider's complete file.

Track a limitation, denial, redirection, or missing item

Follow-up fieldFamily entryItem affectedYour entry: __________.Response classification used by the entityYour entry: __________.Exact explanation providedYour entry: __________.Rule, policy, exception, or source citedYour entry: __________.Written notice received and dateYour entry: __________.Review, correction, appeal, complaint, or other route statedYour entry: __________.Deadline stated by authoritative sourceYour entry: __________.Qualified help requestedYour entry: __________.Current status and next review dateYour entry: __________.

• Copy the response classification.
• Save the written notice.
• Capture the cited source.
• Avoid inventing a deadline.
• Track the stated next route.

Do not label a delayed response a denial unless the responsible source does. Do not calculate a legal deadline from this article. Preserve the exact notice, ask which process applies, and use current instructions for any review or complaint.

Close the request without losing version history

Closeout fieldFamily entryDate family considers this tracker completeYour entry: __________.Items receivedYour entry: __________.Items intentionally withdrawn from requestYour entry: __________.Items still missing, limited, denied, or held elsewhereYour entry: __________.Separate follow-up process openedYour entry: __________.Secure storage locationYour entry: __________.Who can access the family copyYour entry: __________.Destruction, retention, or sharing question routed elsewhereYour entry: __________.

• Keep the original request.
• Version every revision.
• List unresolved items.
• Protect the storage location.
• Close only this tracker.

Do not overwrite the original request when a revised request is sent. Preserve both versions and the reason for the change. Add received records to the family binder or index only with the correct source, version, and secure location.

Fictional example: a treatment-plan and billing-record request

This example is fictional and demonstrates tracking language only.

FieldFictional entryRequester and entityTaylor Morgan requested records about Taylor's own care from Harbor ABA ServicesProcess statedProvider directed Taylor to its current individual-access request form; family recorded the form version and retrieval dateScopeSigned treatment plans and billing records dated January 1 through June 30; no new summary requestedFormatSearchable electronic PDF through the provider's secure delivery routeAcknowledgmentPortal confirmation received September 12; provider requested one identity-verification stepDelivery reviewTreatment-plan PDF opened; billing file contained January through May onlyOpen follow-upTaylor asked whether June billing records are held by the provider, another entity, or not yet availableStatusPartially received; no legal conclusion or deadline entered in the tracker

The example cannot establish that HIPAA applies, Taylor has authority in another case, the requested records fall within a designated record set, the format must be provided, a fee or deadline applies, or the response is complete or lawful.