An ABA practice contact, relationship, and decision-authority matrix separates who may be contacted, who is related to the client, who is involved in care or payment, who has legal authority for a specific decision, and which disclosure path applies. It records the source, scope, restrictions, dates, verification, ambiguity, privacy review, and escalation instead of treating caregiver, guardian, parent, emergency contact, portal user, or payer contact as interchangeable labels.

Define the contact, relationship, and decision-authority matrix

Your practice builds person-by-purpose rows. One person may schedule appointments, receive directly relevant care information under an applicable route, lack treatment-consent authority, and have no right to a complete record. Another may hold limited authority that applies only to a named decision or period. The relationship, authority, and disclosure-path record has a named owner, scope, current sources, role-limited users, qualified decision boundaries, version, evidence location, exception route, change triggers, and retirement state.

Build the required fields

The working record captures client and person, relationship label, contact role, care or payment involvement, legal-authority source, decision scope, PHI scope, minor-specific condition, restriction, court or custody condition, effective and expiry dates, identity verification, document location, professional or privacy review, disclosure route, consent role, portal and record access, emergency contact status, communication preference, conflict, hold, escalation, and review. Each field supports a decision, handoff, measurement, access need, or later trace. Sensitive detail stays in the restricted source record while operational queues carry only purpose-needed instructions.

Use the artifact for bounded decisions

He requires a source for each authority claim and avoids copying a broad guardian flag into every workflow. Operations can record evidence and route questions. Privacy or legal owners resolve ambiguous disclosure or representative status. Qualified clinicians confirm who may consent to clinical work under the governing sources.

Keep authorship, authority, and delivery distinct

The authority matrix identifies who supplied relationship evidence, who may decide each matter, who entered and approved the determination, who relied on it, and what evidence supports it. One person can fill several roles, yet the evidence remains attributable. Software may route and flag; qualified people make clinical, privacy, payer, legal, access, and financial decisions.

Handle changes and exceptions without losing history

A relationship or authority change records the prior state, new instruction or determination, source, affected purposes and recipients, owner, effective time, expiry when applicable, system updates, communication, monitoring, and validation. Your practice preserves the history needed to understand messages already sent and decisions already made.

Validate the workflow with real communication tasks

Your practice samples scheduling, consent, record access, portal access, billing discussions, and urgent communication against the matrix. It checks expired, limited, disputed, and changed relationships. A correction updates every dependent permission and leaves a trace of the prior state.

Reconcile communication with operational state

Reconcile the contact and authority matrix with identity evidence, legal records, client instructions, service decisions, portal access, communications, deliveries, and disputes. Differences receive owners and resolution states. This trace prevents a correct message from announcing an incorrect operational state or a correct operational change from reaching the wrong person.

Protect direct client communication and dissent

The authority-matrix workflow gives the client an accessible route to describe relationships and preferences, use AAC or other supports, take time to respond, and challenge an incorrect determination. Family involvement can support communication while preserving the client's voice, privacy, and applicable decision rights.

Work through a fictional example

Graham locks 26 person-purpose rows. Nineteen have relationship, authority, scope, dates, identity, disclosure route, preference, conflict, and review evidence. One order is expired, one emergency contact has portal access, two authority scopes are vague, one family involvement route is undocumented, and two rows lack review. Five repair. Two remain held. The scenario is synthetic. It tests source, authority, access, privacy, delivery, evidence, and denominator logic without establishing clinical quality, legal compliance, payer approval, informed consent, satisfaction, or outcome.

Calculate the measures honestly

Initial person-purpose integrity is 19 of 26, or 73.1%. Twenty-four validate, or 92.3%. People, relationships, authorities, decisions, disclosure paths, access grants, conflicts, and holds retain separate counts.

Address the main contact, relationship, and decision-authority matrix risk

A correct family label can still produce an unauthorized decision or disclosure. Your practice asks what this person may do for this purpose under this source.

Test the artifact against hard cases

Your practice tests minor, adult client, limited representative, emergency contact, involved family member, custody restriction, expired document, portal user, record request, treatment consent, billing call, and urgent safety contact. Each case states purpose, person, authority, channel, access need, privacy route, source, owner, evidence, correction, validation, and next review.

Close review with unresolved communication visible

Your practice confirms scope, sources, people, authority, privacy, access, channels, systems, vendors, messages, failed delivery, incidents, corrections, and fresh validation. The contact, relationship, and decision-authority matrix stays draft until every named reviewer finishes. Open work retains its owner, age, effect, and next action.

Place the relationship, authority, and disclosure-path record within professional and organizational scope

Your practice uses the CASP Organizational Guidelines public overview for high-level business, clinical-operations, and risk context. The current BACB Ethics Code applies to BCBA and BCaBA certificants and people with a completed application; it addresses understandable communication, involvement, consent and assent when applicable, confidentiality, documentation, and risk. BACB has no separate organization or corporation jurisdiction, so the practice assigns policy and workforce roles under all applicable sources. For the contact relationship and decision-authority matrix, this boundary separates organizational accountability from the clinical and legal authority assigned to qualified people.

Apply minimum-necessary rules precisely

For a HIPAA covered entity or business associate, HHS minimum-necessary guidance says the standard generally applies to uses, disclosures, and requests for PHI and calls for role-based policies. The guidance lists exceptions, including disclosures to or requests by a provider for treatment. Your practice confirms entity, purpose, route, exception, and any more protective law or contract before using this federal standard. Role-based review of the contact relationship and decision-authority matrix should record the communication purpose and access decision that supports each use, request, or disclosure.

Recognize confidential communication requests

Current 45 CFR 164.522 includes rights to request restrictions and confidential communications. Its exact duties differ for covered health plans and covered providers and include rule-specific conditions. Your practice routes applicability, acceptance conditions, denials, implementation, and exceptions to a qualified privacy or legal owner instead of treating a preference flag as the complete legal analysis. When the contact relationship and decision-authority matrix involves a restriction or confidential route, staff preserve the request, governing condition, decision, implementation evidence, and exception.

Separate representative authority from family involvement

HHS personal-representative guidance explains that applicable law determines who is a representative and the scope. HHS family-involvement guidance describes specified circumstances for sharing directly relevant PHI with people involved in care or payment. Receiving information from a family member does not itself authorize disclosure back or transfer decision authority. Your practice records the actual path and purpose. Decision-authority review for the contact relationship and decision-authority matrix should name who may receive information, who may decide, the source, scope, and expiration or review trigger.

Keep HIPAA permission distinct from the operating decision

HHS treatment, payment, and health-care-operations guidance explains specified HIPAA uses and disclosures that may occur without individual authorization, subject to the rule and other requirements. A HIPAA permission does not establish clinical authorship, legal representation, payer approval, or the best communication route. Your practice verifies each decision separately. Within the contact relationship and decision-authority matrix, teams document the HIPAA pathway separately from the operational approval, clinical authorship, and delivery choice.

Protect electronic communication systems

The HHS Security Rule page describes safeguards for ePHI held by covered entities and business associates and says risk analysis is foundational. Your practice maps electronic channels, devices, users, vendors, exports, access, delivery evidence, retention, and incident routes into the regulated entity's current security program. Non-HIPAA data still receives analysis under other applicable sources. Security review of the contact relationship and decision-authority matrix follows the message from creation through recipient verification, delivery, storage, correction, export, and incident handling.

Make communication usable

The DOJ Title III overview and effective-communication guidance address covered public accommodations and communication with people with disabilities, subject to rule-specific standards and defenses. ASHA's AAC portal says AAC users should always have access to their tools or devices. Your practice treats accessibility and communication support as operational requirements, keeps AAC available, and validates the person's completed communication task. Accessibility testing for the contact relationship and decision-authority matrix should confirm that the intended person can receive, understand, answer, and correct the communication using their chosen supports.

Related resources

Sources