How to Request Confidential ABA Communications

Describe the alternative you need

State the exact communication method or location: portal only, a different mailing address, a specific phone, no voicemail, a neutral callback message, a safe time window, or another usable method. Name whether the request covers all PHI communications or selected topics such as scheduling, billing, or clinical updates.

The CASP public summary concerns ABA treatment scope. Confidential-communication rights and operational duties come from privacy law, policy, and the provider's systems.

Know the HIPAA provider rule

Under 45 CFR 164.522, a covered health-care provider must permit and accommodate reasonable requests to receive PHI communications by alternative means or at alternative locations. The provider may require a written request, an alternative address or contact method, and appropriate payment-handling information. It may not require an explanation of the basis as a condition.

Health plans follow a related rule with an endangerment statement condition. State law can provide additional protection. Ask which entity and rule govern the request.

Choose a workable electronic route

HHS email guidance says covered providers may use email with reasonable safeguards and should accommodate a reasonable confidential-communications request for another method. Discuss secure portal, encrypted email, mail, telephone, or another route that both sides can use.

Include communication access. An alternative method still needs language, AAC, captioning, screen-reader, or interpreter support where applicable.

Make the scope visible to staff

Ask how the request appears to scheduling, billing, clinicians, call centers, vendors, and mailed-statement processes. A note hidden in one chart tab may fail when another system sends reminders. Request a named owner and escalation route for any conflicting workflow.

The BACB Ethics Code addresses confidentiality, understandable communication, documentation, and professional responsibilities for covered people.

Verify implementation

Andre requests three changes: portal-only clinical messages, a new billing address, and no voicemail. Two are verified after one week; a reminder still leaves a detailed voicemail. Completion is 2 of 3 communication controls. He reports the failed control through the privacy route and keeps the request open until retested.

Build the confidential-communications instruction

Use the confidential-communications instruction to request that a covered ABA provider send PHI by a reasonable alternative means or to an alternative location and verify that every relevant workflow follows it. Lock the person, request or event, document version, and review period before calculating any rate. Give each row a source, current state, owner, next action, due date, and closure artifact. Keep a family-facing summary linked to the restricted operational record without copying sensitive narrative into broadly visible queues.

Collect only the evidence needed for this decision: individual; covered provider or health plan; requested alternative address, phone, email, portal, or method; communications covered; unsafe or prohibited routes; written request; payment handling when appropriate; health-plan endangerment statement when required; effective date; systems; vendors; exceptions; confirmation; and test. Label who created or issued each item, when it took effect, what it covers, and where the authoritative copy lives. A portal flag, call note, signed document, clinical record, legal instrument, vendor report, and audit log answer different questions. Preserve conflicts until the responsible role resolves them.

Follow a sequence that can be explained later. Identify the covered entity and communication risk, choose an alternative method or location, and submit the request through its stated process. Specify enough detail to implement it without disclosing more rationale than required. Ask which appointment, billing, clinical, records, and vendor workflows are affected, then test with a low-sensitivity confirmation. Keep the original record when a correction occurs and add the new state with its author, date, reason, and scope. Use approved systems and role-based access for health, identity, authority, and incident information.

Keep privacy, clinical, and family decisions distinct

Write the decision owner beside every open field. Under the HIPAA rule, a covered health care provider must accommodate reasonable requests for alternative means or locations and may not require an explanation as a condition. A health plan has a different endangerment condition. Other organizations and laws may follow different rules. Privacy staff should distinguish this right from a general restriction request. Administrative staff and software may collect evidence, calculate dates, flag conflicts, and route work. They should not invent authorization, personal-representative authority, clinical judgment, legal conclusions, breach status, or the person's preference.

Turn the record into a real choice. A person may request mail to another address, a particular phone, no voicemail, a secure portal, or another reasonable route. Ask how payment communications work and whether emergencies or legally required notices use another process. Choose a method the person can access consistently. Explain confirmed facts, provisional facts, consequences, alternatives, and the next review in accessible language. Keep AAC, interpretation, disability access, and a private question route available. Record the person's own message separately from family, staff, and clinician interpretations.

Ask focused questions: Which covered entity holds the request? Which means or location is safe and usable? Which communications are included? Is writing required? How is payment handled? Which vendors need the instruction? What exceptions apply, and what test proves the old route stopped? Read back the answers, source, owner, and date. When the contact cannot answer, route the question to the privacy, security, legal, clinical, payer, vendor, or records role that actually controls it.

Use a release gate and an incident plan

The confidential-communications instruction needs a release gate. Implementation requires the correct entity, written request when required, specific alternative means or location, covered communication types, applicable payment detail, effective date, every affected system and vendor, unsafe-route suppression, exceptions, family confirmation, and a successful test. A cleared gate applies only to the named person, requester, recipient, information, purpose, system, and time period. Recheck fields that can change before recording, disclosure, portal access, communication, signature, service, or delivery occurs.

Prepare for realistic failure. A request can fail when stored as a note but ignored by billing, a vendor uses old data, voicemail reveals the provider name, paper mail goes to a shared home, staff demand a diagnosis or personal explanation, an inaccessible portal becomes the only option, or an ordinary contact update overwrites the confidential route. Record the observed condition instead of guessing intent. Protect immediate health and safety, preserve evidence, contain the affected action, maintain applicable deadlines, and tell the family what remains available while review continues.

Give each high-impact confidential-communications instruction failure a written fallback with the trigger, authorized decision-maker, immediate action, information needed, safe family contact, alternate route, and update time. Privacy or security review should continue alongside urgent clinical, medical, emergency, mandated-reporting, or protective action when those duties apply.

Work through a realistic complication

Ari requests that six communication streams use a secure portal instead of home mail or voicemail. Five update; the billing vendor still mails statements. Implementation is five of six streams. The provider keeps the request open and uses an interim safe method until the vendor correction is verified. State the numerator, denominator, unit, eligibility rule, time window, and status of every open or excluded item. A completion rate does not establish legal compliance, clinical quality, confidentiality, or lack of harm.

Add a later complication to the confidential-communications instruction. New authority evidence, a corrected document, a changed recipient, a returned message, a vendor finding, a portal log, or the person's new preference may invalidate the earlier state. Link the new evidence to every downstream action that relied on the old record. Keep history visible so reviewers can see what was known at each point.

Verify implementation and close the loop

Review the next reminder, clinical message, statement, records response, and vendor notice. Investigate any old-route contact as a privacy event rather than merely editing the profile again. Reconfirm the instruction after system migrations while avoiding unnecessary repeated disclosure of the person's reason. Give frontline staff an implementation cue that identifies the approved route without exposing why the request exists. Test both routine and time-sensitive communications before closing the request. Preserve the test result with the instruction's effective date and owner. A sent form, portal status, password reset, staff promise, or signed document can be an intermediate artifact. Close the confidential-communications instruction only when the expected real-world result, system state, and family-facing record agree.

Define confidential-communications instruction measures before reporting them. Name start and end events for durations and every eligible item in a denominator. Report pending items by count and oldest age. Keep people, documents, authorizations, recipients, systems, messages, sessions, files, and incidents as separate units. Pair percentages with raw counts and material exceptions.

Finish the confidential-communications instruction workflow with a narrow retrospective. Ask which fact was hardest to verify, which handoff or access control failed, whether the person and family could communicate and participate, and which control should change. Test the correction in the workflow where the miss occurred. The examples on this page support planning and questions; they do not determine another person's rights, clinical need, breach status, or legal outcome.