How can a family ask whether an ABA safety event was reported externally? Track any ABA safety event reported externally by route, recipient, date, and confirmation. Request a record showing which licensing, protective-services, privacy, payer, insurer, law-enforcement, facility, employment, or other duty was evaluated. Ask who classified the event, which source and deadline applied, and whether a report was required. Keep each authority separate.

Build a reportability map instead of asking one yes-or-no question

For an ABA safety event reported externally, the recipient and governing route matter. The same event can trigger different reviews for a client, employee, facility, payer, insurer, privacy program, licensing board, protective agency, police, or emergency service. Each route has its own covered person, event definition, evidence, decision-maker, clock, recipient, format, confidentiality, and follow-up.

Ask the provider to list considered routes and the disposition for each: reported, outside scope, below threshold, referred to another role, pending, or disputed. A submitted form to one recipient does not establish that all applicable duties were met.

Ask for the source and classification date

For each possible route, request the statute, regulation, contract, manual, policy, insurer instruction, or official agency guidance used. Record the source version, event facts applied, discovery or notice date, classification date, person who decided, deadline, submission date, confirmation number, and any supplemental-report duty.

The AHRQ event-response primer describes reporting, investigation, communication, and improvement as separate safety functions. It does not define ABA-specific external reporting duties. State, setting, payer, and event-specific authorities control.

Keep privacy-breach analysis precise

For HIPAA-regulated information, the HHS breach guidance says an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless an exception applies or a documented assessment of at least four factors shows a low probability of compromise. A regulated entity may elect to notify without completing the assessment. Individual, HHS, media, and business-associate notice paths have different conditions and timing.

A safety injury is not automatically a HIPAA breach, and a privacy event can exist without a physical injury. Ask which facts and rule were applied rather than requesting a generic “HIPAA report.”

Understand what confirmation can and cannot show

A receipt, portal screenshot, case number, letter, email, or agency acknowledgment can show delivery or case creation. It does not prove the agency accepted the provider's classification, completed an investigation, found a violation, or required a remedy. Track requests for more information, closure reason, appeal or review rights, and any provider action.

Ask which information the family can receive and who has authority. The HHS personal-representative guidance explains that applicable law defines representative authority and scope. For case-specific legal help, the USAGov legal-aid directory offers a starting route.

Use one decision register

Create a role-limited external-reporting decision register. Include event, potentially applicable route, covered person or entity, governing source and version, triggering facts, discovery date, classifier and authority, disposition, deadline, submission and supplemental dates, recipient, confirmation, requested follow-up, family access, appeal or review path, provider response, and closure evidence. Preserve every original record and add later information as a dated, attributed entry.

Use the external-reporting decision register to distinguish direct observation, client communication, family report, staff report, clinical judgment, medical direction, device or system evidence, authority response, and interpretation. Give the person and authorized family member an accessible summary. ASHA says AAC users should always have access to their communication tools or devices.

The external-reporting decision register uses the CASP organizational overview only for broad business, clinical-operations, and risk framing. For covered professionals, the BACB Ethics Code addresses competence, understandable communication, consent and assent when applicable, documentation, risk, and evaluation. Neither source assigns medical, legal, payer, insurer, facility, protective-services, or family authority.

Answer the questions that control the next step

  • Which external routes were considered?
  • What source and event definition applied?
  • Who had authority to classify the event?
  • Which clock and deadline governed?
  • What receipt or case evidence exists?
  • What follow-up did the authority request?
  • Which actions remain after the report decision?

For every answer in the external-reporting decision register, record the source, version, date, responsible role, decision, rationale, next action, due date, interim safeguard, and acceptance evidence. Mark the item confirmed, open, disputed, inapplicable with a source, or decided by the authority. Preserve competing accounts rather than merging them into artificial certainty.

When case-specific legal advice is needed, the USAGov legal-aid directory can help locate affordable assistance. A provider policy, meeting note, software status, or family agreement cannot replace an authority's required decision.

Prepare for a second failure

Plan now for what happens if new facts change a classification, a clock starts earlier than assumed, one report is treated as universal, the provider cannot name the source, a confirmation is missing, an agency requests more information, or the family is told that an acknowledgment proves the outcome. Name who protects health and safety, who communicates with the person, which record is preserved, which accessible backup is available, which service pauses, and which medical, clinical, privacy, payer, insurer, facility, licensing, protective, legal, or emergency role must act.

While the external-reporting decision register remains open, keep AAC, interpreters, mobility, bathroom use, food, water, prescribed care, rest, and emergency help available. Record the actual response, failed control, new evidence, notification, temporary safeguard, and condition for safe continuation. Avoid asking the person to reenact an event or enter an unverified condition to prove a correction.

One named owner remains accountable for each open external-reporting decision register item, including work delegated elsewhere. The client and family should know whom to contact, what is happening next, and when another update is due.

A fictional family tracking example

Sofia's family and provider lock 18 route and evidence rows. Fourteen have a documented disposition. Licensing, insurer, privacy, and one supplemental-report decision remain open. Decision completeness is 14 of 18, or 77.8%.

The ratio reports documented route decisions only. It cannot prove that every duty was identified, a report was accurate, an agency agreed, or a legal violation occurred.

Measure the named process

Lock the external-reporting decision register cohort and checkpoint before counting. Report verified or accepted items divided by every item due at that checkpoint. Keep missing, late, failed, disputed, and untested items in the denominator with their age and owner. Mark inapplicable only when the governing source and event facts support it.

Focus on Sofia's event facts, each report route, governing source, classification authority, clock, confirmation, follow-up, family access, and resulting safeguards. Pair process counts with the person's direct report, health, safety, communication access, missed care, privacy, financial effects, travel, work or school disruption, and household effort. If direct report is unavailable, identify whose observation is used and preserve accessible opportunities for the person to participate.

An external-reporting decision register percentage describes the named cohort and time window. It cannot prove causation, fault, compliance, medical recovery, clinical appropriateness, client agreement, or future safety. Show raw counts beside percentages and explain every exclusion.

Set the next review date

Review the external-reporting decision register when the event is discovered, when material facts change, before each applicable deadline, after submission, after an authority responds, and when the provider completes resulting actions. At each checkpoint, verify current health and safety, the person's priorities, new facts, applicable sources, responsible roles, deadlines, interim safeguards, service effects, and unresolved consequences.

Close each external-reporting decision register row with a concrete disposition such as received, corrected, amended, disagreement linked, medically reviewed, clinically decided, reported, declined by the authority, implemented, tested, failed and reopened, transferred, appealed, or completed with evidence. A meeting, apology, assigned task, sent form, or “closed” label alone does not show the issue was resolved.

Provide a plain-language summary of what happened, what was decided, what changed, what remains uncertain, who owns the next step, and when review continues.

Related resources

Sources

Finni resources

Ready for the next step?

Find ABA care near you