How Can Families Authorize ABA and School Record Sharing?

Start with who holds each record

The location of a service does not, by itself, determine the privacy rule. The relationship between the person creating the record and the school also matters. The federal joint FERPA and HIPAA guidance explains how the two frameworks apply to student health information.

For example, health records maintained by a school or by someone acting on behalf of a FERPA-covered school are generally education records under FERPA. HHS explains that records created by an outside healthcare provider serving the student independently may fall outside FERPA. HIPAA applies to that outside provider only if the provider is a HIPAA covered entity, such as a provider that conducts covered transactions electronically. The HHS school-record FAQ describes this distinction.

Families can begin with a simple map:

Treat each direction as its own decision. A school form may authorize the school to release an IEP to the clinic while giving the clinic no authority to send its assessment to the school.

Build the school-to-provider consent carefully

When FERPA prior consent is the route, current 34 CFR 99.30 requires signed and dated written consent that:

1. specifies the records that may be disclosed
2. states the purpose of the disclosure
3. identifies the party or class of parties that may receive the records

Electronic consent can qualify when it identifies and authenticates the person giving consent and indicates that person’s approval. The U.S. Department of Education’s family-facing consent FAQ confirms that oral permission alone does not satisfy these FERPA consent requirements.

A useful form can be more precise than the federal minimum. Instead of “all school records,” a family might specify “the current IEP, most recent eligibility evaluation, behavior intervention plan dated May 3, 2026, and progress reports from January through June 2026.” The form can name the clinic’s privacy contact, secure portal, or records department rather than every employee at the practice.

Families may also ask for:

• the date or event that ends permission, such as the close of the school year
• whether the consent covers one transfer or recurring transfers
• the contact for revocation or correction
• a copy of exactly what the school disclosed
• confirmation that the intended recipient received the records

Section 99.30 says that when disclosure occurs under this consent route, a parent or eligible student who requests a copy of the disclosed records must receive one. That copy helps the family confirm that the packet matches the permission they signed.

Identify the provider-to-school HIPAA route

HIPAA authorization is one possible route for an independent covered provider, rather than a universal requirement for every school communication. HHS treatment-disclosure guidance explains that covered entities may disclose protected health information for treatment in circumstances allowed by the Privacy Rule. HHS also states that a covered healthcare provider may share relevant student information with a school nurse, physician, or other healthcare provider for treatment purposes without an authorization. The agency’s school-nurse FAQ gives a medication-management example.

That treatment pathway should be applied to the actual recipient and purpose. A disclosure to a teacher, special-education administrator, outside consultant, or general IEP distribution list may present a different analysis. The clinic’s privacy role should identify and document the applicable route before sending the record.

When HIPAA requires an authorization, 45 CFR 164.508 calls for specific elements. These include a meaningful description of the information, the person authorized to disclose it, the person who may receive it, the purpose, an expiration date or event, and the required signature. HHS’s consent-versus-authorization FAQ explains that informal consent cannot replace a valid authorization when authorization is the required route.

Families can ask the clinic one direct question: “Are you relying on my HIPAA authorization, a treatment disclosure, or another rule for this exact recipient and purpose?” The answer should identify a route, not merely state that coordination is common.

Confirm who has authority to sign

Authority should be verified for each system. Under FERPA, rights generally belong to the parent until they transfer to an “eligible student.” The Department of Education explains that a student becomes eligible upon reaching age 18 or attending a postsecondary institution at any age. At that point, FERPA rights transfer to the student, although specific exceptions can still permit parental access. See the Department’s eligible-student guidance.

HIPAA personal-representative authority follows a different analysis. HHS personal-representative guidance explains that authority comes from state or other applicable law and may be broad or limited. Parents commonly act for unemancipated minors, while exceptions can apply when a minor consents to particular care under law, another person or a court has authority, a parent agrees to a confidential provider relationship, or an abuse, neglect, or endangerment concern is present.

A family relationship, emergency-contact label, or invitation to attend a meeting does not establish authority to sign every record form. Shared custody, guardianship orders, foster-care arrangements, emancipation, and age-of-majority transitions deserve an authority check before either organization releases records.

Choose records that serve a defined purpose

More pages can create more confusion. Start with the decision the school and clinical team are trying to support, then choose the smallest useful packet for that purpose.

The table is a planning aid. The person with authority chooses what to authorize, the school decides what education records it creates and how the IEP process proceeds, and qualified clinicians decide what clinical content they recommend within scope.

Preserve the student’s voice and communication access

Record sharing should help adults understand the student rather than replace the student’s participation. Ask what the student wants each team to know, which subjects feel private, and how the student wants to participate in meetings or follow-up conversations.

The ASHA AAC portal says AAC users should always have access to their communication tools or devices. Give the student access to speech, AAC, sign, gesture, writing, interpreters, communication partners, wait time, and another reliable method throughout consent discussions and meetings. Record how the student expresses agreement, questions, discomfort, or withdrawal when assent applies.

For covered behavior analysts, the BACB Ethics Code addresses understandable communication, client and stakeholder involvement, informed consent and assent when applicable, confidentiality, collaboration, documentation, and evaluation. The Code applies to covered individuals and does not assign authority to a school, clinic, or family member.

Keep school and clinical decisions separately attributable

Shared information can improve coordination while preserving each team’s role. The IDEA IEP-team rule defines required participants and allows other people with knowledge or special expertise to participate at the discretion of the parent or agency. The IEP review rule assigns IEP development, review, and revision to the IEP team.

An ABA clinician can contribute observations, explain a clinical recommendation, or answer questions. The IEP team makes education decisions under the applicable process. Likewise, a school record can inform clinical assessment without directing the clinician’s diagnosis, dosage, goals, or treatment recommendation. Record who authored each statement and which role made each decision.

Plan for expiration, revocation, and redisclosure

Permission can change. Families should know what a revocation will stop and what has already happened.

Under the HIPAA authorization rule, an individual can generally revoke an authorization in writing, subject to action already taken in reliance on it and other specified limits. A passed expiration date, known revocation, incomplete required element, or materially false information can make an authorization defective. Ask the clinic where to send a revocation and when its systems will reflect the change.

FERPA redisclosure has its own rules. Current 34 CFR 99.33 generally conditions a disclosure of personally identifiable information from education records on the recipient refraining from further disclosure without prior consent, subject to listed exceptions. The recipient’s personnel may use the information for the purpose for which disclosure was made. Families can ask the school what redisclosure notice accompanies the records and ask the clinic how received education records will be stored, accessed, and used.

Revocation usually affects future sharing. It does not retrieve copies that an authorized recipient already received. A family may request correction of inaccurate source records through the applicable process, then send the corrected version to the other organization with a clear replacement notice.

Use a transfer log from request through receipt

A signed form is only one part of the workflow. A well-run ABA school record sharing process also tracks what moved, where it went, and what remains unresolved. Keep a simple transfer log with:

• the sender and record holder
• the legal or policy route named by the sender
• the signer and source of authority
• the purpose, records, and date range
• the exact recipient, address, portal, or secure destination
• the authorization or consent date and expiration event
• the date sent and the person who sent it
• delivery confirmation and recipient acknowledgment
• missing, unreadable, duplicate, or incorrect items
• correction, replacement, revocation, and closure dates

Before transmission, confirm the recipient through a known phone number or official directory. Use the school or clinic’s approved secure method. Avoid placing clinical or education records in a general inbox when a records office, secure portal, or named privacy contact is available. If information reaches the wrong recipient, contact the sender’s privacy or records office promptly and follow its incident process.

Personal delivery can be practical when a family wants to review the packet first or the two organizations cannot agree on a direct route. Ask for the records in an accessible format, preserve the source and date, and obtain confirmation when the other party receives them. A family-carried copy may have a different delivery trail from a direct institutional transfer, so document both the handoff and receipt.

A practical two-direction example

Dev is a fictional 14-year-old who uses speech and AAC. Dev and a parent want the school and ABA clinic to compare how each setting responds to an accessible break request before an IEP meeting.

For the school-to-clinic direction, the parent signs a FERPA consent naming the current IEP communication pages, school break-request definition, and four weeks of relevant progress summaries. The purpose is preparation for the scheduled IEP meeting. The consent names the clinic’s records contact and ends after that meeting. The parent asks for a copy of the disclosed packet.

For the clinic-to-school direction, the clinic determines that its disclosure to the special-education coordinator will use a HIPAA authorization. The authorization names a short assessment summary, the clinic’s break-request definition, relevant limitations, and the receiving coordinator. It expires after the meeting. Dev reviews the summary with AAC available and asks the clinician to add that device charging problems affected two observations.

The school sends five documents, and the clinic confirms receipt of four. The transfer log shows that one progress summary was missing. The school sends the missing file through the secure route. The clinic sends its final summary, and the coordinator confirms receipt. At the meeting, the school and clinic definitions remain separately labeled; the IEP team decides whether the school plan should change.

This example measures transfer completeness rather than the success of a service. School-to-clinic receipt is 5 of 5 documents after correction. Clinic-to-school receipt is 1 of 1 summary. Those counts say nothing about whether either recommendation is clinically or educationally appropriate.

Family checklist before signing

Use this checklist for each direction of sharing:

1. Who currently holds the record?
2. Which rule or policy supports this disclosure?
3. Who has authority to sign for this record system?
4. What exact decision or coordination purpose will the information support?
5. Which named records and dates are included?
6. Who is authorized to send the records?
7. Who is authorized to receive them?
8. Is this one transfer or recurring sharing?
9. When does permission expire?
10. How can permission be revoked or corrected?
11. What redisclosure rule or notice applies?
12. Which secure route will be used?
13. Who will confirm a complete, readable receipt?
14. How will the student participate and communicate preferences?
15. Who will resolve a missing file, wrong recipient, or conflicting form?

When an organization asks for a broad release, request a narrower version tied to the current purpose. When the school and clinic forms conflict, ask each sender to identify the elements required for its own route. Two clear forms can be easier to administer than one document that tries to govern both record systems.