Can Families Ask to Transfer ABA Records to a New Provider?

Verify the transfer route

For a HIPAA covered entity, HHS access guidance describes access to PHI in a designated record set, subject to the rule's scope and procedures. Provider-to-provider treatment disclosures may follow another permitted route. Ask the privacy contact which route applies and whether other law is more protective.

Preserve communication and essential supports

The ASHA AAC portal says AAC users should always have access to their communication tools or devices. Preserve communication, mobility, health, safety, and other essential supports through the transition.

Keep authority and source scope clear

The CASP public summary supports individualized assessment, planning, implementation, and evaluation within its autism-treatment scope.

The BACB Ethics Code addresses continuity, client involvement, consent and assent when applicable, documentation, transition, and discontinuation for covered behavior analysts.

A practical example

A family requests assessment, current plan, six months of notes, graphs, and a medication list sent to a named provider portal. The practice verifies the destination, sends the defined packet, logs receipt, and separately lists one missing outside record.

Questions families can use

Ask which pathway applies, who decided, what the client communicated, what continues, which records and referrals are ready, what payer or billing work remains, who owns each task, and when follow-up occurs.

Build the record-transfer tracker

Start by recording which records move, under which legal route, to which verified destination, and in what usable format. Use the request, identity and authority verification, date range, designated record categories, destination details, access or disclosure basis, transmission log, receipt, and any denial or missing-item response. Show the source and date for each fact. If two sources disagree, preserve both and assign the conflict instead of silently choosing one.

The record-transfer tracker should make incomplete work visible. Use states such as proposed, requested, verified, pending, held, completed, declined, or closed with reason. Include the next action, owner, and due date. A single discharge checkbox cannot show whether the clinical work, payer work, records, referrals, billing, property, and access have reached the same point.

Keep decision authority visible

The relevant participants may include the requester, records custodian, privacy contact, treating clinician for needed corrections or explanations, secure-transmission owner, and receiving provider. Record what each person can decide, what evidence that role supplies, and where another authority controls. Client choice, clinical judgment, payer coverage, legal authority, privacy decisions, scheduling, claim correction, and payment should not be blended into one approval.

For the record-transfer tracker, explain which records move, under which legal route, to which verified destination, and in what usable format. Give the client an accessible way to ask questions, correct an error, decline an option, or change a preference. Check the request, identity and authority verification, date range, designated record categories, destination details, access or disclosure basis, transmission log, receipt, and any denial or missing-item response. Keep communication, mobility, health, safety, and other essential supports available. Verify the source and scope whenever consent or representative authority matters.

Follow the work in a useful order

1. Define the exact packet and date range. Record the date, source, responsible role, and immediate consequence.
2. Verify the requester, authority, destination, and applicable route. Reconcile the relevant records before promising a result.
3. Prepare readable files while preserving authorship and correction history. Confirm availability in ordinary settings as well as the written checklist.
4. Transmit through the approved method and confirm receipt. Give every handoff a recipient, route, due date, and fallback.
5. Resolve every missing, denied, corrupted, or misdirected item. Keep pending work visible until the evidence supports closure.

Families can ask for one plain-language summary that mirrors these steps. The summary should distinguish confirmed facts from recommendations, estimates, and open questions. It should also identify the contact who can correct the record after services end.

Prepare for a realistic complication

An access request and a provider-to-provider treatment disclosure can use different HIPAA pathways. A family authorization is not universally required for every transfer, and a broad authorization does not cure an incorrect destination. Ask the privacy contact which route applies and whether state law is more protective.

If that complication occurs, return to the record-transfer tracker. Transmit through the approved method and confirm receipt. Record the failed step, its immediate effect, the family's update, the safe alternative, and the new due date. Keep the earlier attempt in the history so the receiving team can understand the delay.

Work through a concrete example

Sam's family requests the assessment, current plan, six months of notes, graphs, and medication list through a named provider portal. The practice verifies the destination and sends four categories. One outside specialist report is missing because the practice never received it. The completion notice identifies that gap, explains where the family may request it, and records receipt of the delivered packet.

Use the example to test whether the practice can define the exact packet and date range, verify the requester, authority, destination, and applicable route, and resolve every missing, denied, corrupted, or misdirected item. It does not set a required result. Report the person's actual dates and counts, then apply the controlling clinical, payer, privacy, and jurisdictional rules.

Questions to resolve for the record-transfer tracker

• Is this an individual access request, permitted treatment disclosure, authorization-based disclosure, or another route?
• Which records and dates are included?
• How were identity, authority, and destination verified?
• Can the receiving provider open and understand the files?
• What written response covers missing or denied material?

Ask for the answer in writing when it affects a date, service, disclosure, claim, balance, referral, support, or safety plan. If the answer remains unknown, request the responsible person and next update date.

Verify the result and close the loop

Keep the request, index, files sent, transmission evidence, receipt, corrections, and unresolved categories together. Transfer completion does not prove that the new provider accepted the client or adopted the prior plan.

Before closure, compare the written summary with the client's understanding and the actual operational state. Correct mismatched dates, names, destinations, files, balances, or goal statuses. Preserve the original record and document the correction instead of overwriting history.

Check the packet before relying on it

Open the delivered files and compare them with the request index. Confirm that dates, names, page counts, graphs, attachments, and readable formats match. A successful secure upload can still contain a corrupted file, an incomplete export, or material for the wrong person. Report an error promptly through the records or privacy contact and preserve evidence of the correction.

Families can keep a clean working copy and an untouched original. Record which version was sent to the new provider. If an amendment or late entry later changes the record, ask whether an updated copy should be transmitted under the applicable route. Do not silently replace the earlier packet in the family's history.