How an Adult Can Direct ABA Records to a Family Member

Use the right route for the requested result

HHS access guidance says an individual may direct a covered entity to transmit a PHI copy to another person. The request must be in writing, signed, and clearly identify the person or entity and where to send it. A third party may instead present an authorization or another valid disclosure basis. Record the route used.

Define the copy precisely

Name the designated record set or specific documents, service dates, clinicians, assessment or billing material, format, accessibility needs, and secure destination. Ask for an estimate of any permitted fee and the applicable deadline. Keep treatment records, internal operations documents, and separately protected material within their governing access rules.

Close the delivery loop

Confirm recipient identity and destination before sending. Preserve the request, exported file description, transmission time, sender, security method, delivery evidence, failure notices, and correction. If an address is wrong or delivery fails, stop reuse of that destination and reverify it. A family member who receives one copy gains no automatic portal, consent, or onward-disclosure power.

Build a source-controlled record

Create a restricted directed-record-copy log for requester authority, record set, date range, named recipient, destination, format, identity check, fee, deadline, transmission, and receipt. Record the request or event, the adult's own communication, controlling source, qualified reviewer, source version, effective date, expiration or review date, exact scope, restrictions, clinical owner, privacy owner, operations owner, payer contact when applicable, system changes, verification test, open question, due date, and final disposition. Preserve superseded evidence as history while removing obsolete operational access.

For this directed-record-copy log, label personal-representative authority, involved-person communication, written authorization, directed record access, financial authority, clinical recommendation, payer decision, daily support, and emergency action separately. One relationship label, signature, payment, or meeting invitation cannot safely stand in for all of them.

Protect the adult's communication and choices

Use the directed-record-copy log to keep the adult's voice visible. Offer plain-language explanations, ordinary AAC, interpreter access, enough response time, private communication, several real options, and a way to agree, question, pause, object, or change a supporter. ASHA says AAC users should always have access to their communication tools or devices.

Throughout review of the directed-record-copy log, preserve food, water, bathroom access, mobility, medication, prescribed care, ordinary relationships, rest, and emergency help. The BACB Ethics Code addresses understandable communication, client and stakeholder involvement, consent and assent when applicable, confidentiality, documentation, risk, and evaluation for covered professionals. It does not interpret state law or create organizational authority.

Ask the questions that release the next step

To send ABA records to a family member, keep the copy request separate from consent, family involvement, portal access, and legal decision authority.

• What exact action or disclosure is proposed?
• Which current source governs it, and who is qualified to interpret that source?
• Is the adult acting directly, receiving support, or represented under a verified legal route?
• Which information, decision, person, setting, and date are within scope?
• Which rights and choices remain with the adult?
• What accessible communication and private response opportunity were offered?
• Which clinical, payer, financial, privacy, and operations decisions remain separate?
• What changes in the portal, messages, meetings, records, signatures, or billing systems?
• What evidence proves implementation and removal of obsolete access?
• What event triggers recheck, expiration, restoration, escalation, or legal review?

Place only the affected action on hold when safe. Continue undisputed care and essential supports within verified authority. Emergency and mandatory-reporting routes follow their own current law and policy.

Apply a scoped release decision

Before the next assessment, treatment, meeting, disclosure, record transfer, billing action, or access change, the directed-record-copy log should answer five release questions. What action is proposed? Which source permits it? Has the qualified owner reviewed that source? Can the adult understand and respond through ordinary communication? Do system permissions match the decision?

In the directed-record-copy log, mark yes, no, pending, or inapplicable for each question. A pending legal or privacy gate pauses that path while unrelated supports continue when safe and authorized. Repeat the test when the action, person, information, setting, effective date, or controlling source changes.

A fictional family-involvement example

Marcus is a fictional adult involved in a transition to a family-supported housing program. The team locks 17 required request and delivery fields before review. It completes 13 of 17, or 76.5%, by the due date and leaves every missing field in the denominator. Each open item has an owner, source request, age, and next action.

Marcus's team does not call the percentage proof of valid authority or good care. It checks whether the correct person made each decision, the adult's accessible communication was available, the clinical recommendation remained with the qualified clinician, and system permissions matched the verified scope. It reports completed, pending, disputed, expired, and inapplicable states separately.

Before the provider sends the record copy, Marcus reviews a plain-language summary of the documents, date range, recipient, destination, format, and delivery method. Staff verify the export scope, file contents, recipient identity, secure destination, and delivery evidence. Any mismatch stays open and blocks only the affected transfer. The practice records Marcus's experience separately from administrative completion.

Measure verification and access

Measure the directed-record-copy log with locked units and dates: completed required fields divided by all fields due; permissions correctly configured divided by permissions tested; obsolete access removed divided by obsolete access identified; and open items resolved by due date divided by items due. For every duration, name the start and end event. For every percentage, publish counts and the eligible denominator.

Segment directed-record-copy log results by route, service, setting, and responsible owner. Report pending and excluded items with reasons. A high completion percentage cannot establish lawful authority, clinical quality, respect for the adult's choice, coverage, claim acceptance, or outcome. Review errors and client-reported access failures individually.

Review changes before access fails

Recheck the directed-record-copy log when the adult requests a change, a document activates or expires, capacity is formally reassessed, a supporter or family member changes, a portal or payer changes, a service moves settings, or staff identify conflicting evidence. Use the current state law, court or legal document, payer rule, and provider policy for the actual case.

For the directed-record-copy log, the CASP organizational overview supplies broad operations, clinical-operations, and risk framing. USAGov links to legal-help resources. These sources do not decide a particular person's authority. Keep this page in draft until the named clinical, adult or family, privacy, and legal reviewers complete their work.