How to Review ABA Photo, Audio, and Video Recording Requests

Identify the exact recording purpose

Ask whether the request covers a photograph, audio clip, video, screen recording, telehealth session, device data, or another format. Name the specific visit, people, date range, and purpose. A recording used for case supervision raises different questions from a testimonial, staff training library, research project, or social-media post.

Request a separate answer for every proposed use. “For quality” leaves the audience, retention period, and reuse boundary unclear. The CASP public summary concerns ABA treatment for people diagnosed with autism; it does not create a universal recording process.

Separate permissions and decision-makers

Determine who has legal authority for the requested permission and what other rules apply. Clinical service consent, HIPAA authorization, state recording consent, research consent, media release, and client assent address different questions. A signature on one form should carry only the scope stated on that form.

For covered entities, 45 CFR 164.508 specifies when a HIPAA authorization is required and the elements of a valid authorization. State recording and privacy law can add requirements. Ask the provider to name the governing source rather than treating HIPAA as the complete answer.

Protect assent, dissent, and communication

Tell the person what the device will capture in a form they can understand. Provide an accessible way to accept, decline, pause, or ask who will watch. The BACB Ethics Code addresses informed consent, assent when applicable, confidentiality, documentation, and professional boundaries for covered people.

Keep augmentative and alternative communication available throughout the decision and recording. ASHA guidance says AAC users should always have access to their tools or devices. A representative's signature and the person's current willingness remain separate evidence.

Review storage, access, and deletion

Ask for the device and application, storage location, access roles, encryption or approved-system status, backup copies, vendor involvement, retention period, reuse rules, and deletion method. Confirm whether the file enters the clinical record and whether copies may exist in messages, downloads, training platforms, or vendor backups.

If the provider says withdrawal is available, ask when it takes effect and what happens to copies already used or disclosed. Get the answer in writing. A promise to delete “the video” needs a defined list of every controlled copy.

Use a decision ledger

Marta receives one request with three proposed uses: case supervision, internal staff training, and a public testimonial. She approves supervision, declines the testimonial, and holds training until the provider states the audience and deletion date. Report one approved, one declined, and one pending use out of three. A single yes-or-no label would erase the scope of her decision.

Build the recording-purpose decision register

Use the recording-purpose decision register to separate every proposed photo, audio, video, screen, or device-data use so a family can make a scoped decision and later verify what happened. Lock the person, request or event, document version, and review period before calculating any rate. Give each row a source, current state, owner, next action, due date, and closure artifact. Keep a family-facing summary linked to the restricted operational record without copying sensitive narrative into broadly visible queues.

Collect only the evidence needed for this decision: format; person recorded; people incidentally captured; service and setting; exact purpose; recorder; audience; storage; vendor; clinical-record status; reuse; sharing; retention; deletion; legal and organizational authority; consent and assent process; accessible explanation; decision; effective date; and withdrawal route. Label who created or issued each item, when it took effect, what it covers, and where the authoritative copy lives. A portal flag, call note, signed document, clinical record, legal instrument, vendor report, and audit log answer different questions. Preserve conflicts until the responsible role resolves them.

Follow a sequence that can be explained later. Split supervision, care documentation, training, research, marketing, testimonial, security, and family use into separate rows. Ask which source governs each. Review the actual capture, access, storage, reuse, retention, and withdrawal terms. Record approval, decline, or hold for each use, then compare the delivered practice with the approved scope. Keep the original record when a correction occurs and add the new state with its author, date, reason, and scope. Use approved systems and role-based access for health, identity, authority, and incident information.

Keep privacy, clinical, and family decisions distinct

Write the decision owner beside every open field. Applicable law and the person's legal authority determine who may provide any required permission. The person still needs an accessible way to express willingness, discomfort, or withdrawal when assent applies. A qualified clinician decides whether clinical recording is appropriate. Privacy, security, research, marketing, employment, and organizational owners act within their domains. Administrative staff and software may collect evidence, calculate dates, flag conflicts, and route work. They should not invent authorization, personal-representative authority, clinical judgment, legal conclusions, breach status, or the person's preference.

Turn the record into a real choice. A family can approve one purpose and decline another, limit a date range or audience, request live observation instead, ask for recording on an approved device, or require a shorter retention period when the controlling source permits. Ask whether declining changes care and which lawful exception the provider believes applies. Explain confirmed facts, provisional facts, consequences, alternatives, and the next review in accessible language. Keep AAC, interpretation, disability access, and a private question route available. Record the person's own message separately from family, staff, and clinician interpretations.

Ask focused questions: What exactly is captured and why? Who can see it? Is it part of the record? Which device and vendor hold it? May it be reused or shared? When is it deleted? Who may decide? How can the person pause or withdraw, and what happens to prior lawful use? Read back the answers, source, owner, and date. When the contact cannot answer, route the question to the privacy, security, legal, clinical, payer, vendor, or records role that actually controls it.

Use a release gate and an incident plan

The recording-purpose decision register needs a release gate. Before capture, verify the exact purpose, authority, participants, format, setting, device, accessible explanation, required consent and assent, audience, storage, access, vendor, sharing, retention, deletion, withdrawal, and incident route. Hold any proposed use whose scope or owner is unclear. A cleared gate applies only to the named person, requester, recipient, information, purpose, system, and time period. Recheck fields that can change before recording, disclosure, portal access, communication, signature, service, or delivery occurs.

Prepare for realistic failure. Risk rises when a form says quality without a purpose, captures other clients, allows staff downloads, mixes treatment and marketing, lacks deletion terms, records after withdrawal, removes AAC, assumes a minor cannot dissent, or treats a signed media release as permission for every future use. Record the observed condition instead of guessing intent. Protect immediate health and safety, preserve evidence, contain the affected action, maintain applicable deadlines, and tell the family what remains available while review continues.

Give each high-impact recording-purpose decision register failure a written fallback with the trigger, authorized decision-maker, immediate action, information needed, safe family contact, alternate route, and update time. Privacy or security review should continue alongside urgent clinical, medical, emergency, mandated-reporting, or protective action when those duties apply.

Work through a realistic complication

Marta reviews five uses. She approves one case-supervision clip for named staff, approves a still image of materials with no person visible, declines a public testimonial, and holds research and training-library uses. Report two approved, one declined, and two pending, with each audience and retention rule preserved. State the numerator, denominator, unit, eligibility rule, time window, and status of every open or excluded item. A completion rate does not establish legal compliance, clinical quality, confidentiality, or lack of harm.

Add a later complication to the recording-purpose decision register. New authority evidence, a corrected document, a changed recipient, a returned message, a vendor finding, a portal log, or the person's new preference may invalidate the earlier state. Link the new evidence to every downstream action that relied on the old record. Keep history visible so reviewers can see what was known at each point.

Verify implementation and close the loop

Audit actual recordings against the register. Reconcile files, clinical-record links, training copies, vendor storage, exports, access logs, retention events, deletion evidence, and withdrawals. Ask the person and family whether the process matched the explanation and route every unexpected capture or disclosure through the privacy and security process. A sent form, portal status, password reset, staff promise, or signed document can be an intermediate artifact. Close the recording-purpose decision register only when the expected real-world result, system state, and family-facing record agree.

Define recording-purpose decision register measures before reporting them. Name start and end events for durations and every eligible item in a denominator. Report pending items by count and oldest age. Keep people, documents, authorizations, recipients, systems, messages, sessions, files, and incidents as separate units. Pair percentages with raw counts and material exceptions.

Finish the recording-purpose decision register workflow with a narrow retrospective. Ask which fact was hardest to verify, which handoff or access control failed, whether the person and family could communicate and participate, and which control should change. Test the correction in the workflow where the miss occurred. The examples on this page support planning and questions; they do not determine another person's rights, clinical need, breach status, or legal outcome.