An ABA practice incident classification and reporting matrix maps one event to every potentially applicable clinical, workplace, privacy, security, payer, insurer, licensing, protective, professional, contractual, and legal route. It records the source, scope, trigger, owner, clock, evidence, decision, status, and communication for each route. The matrix keeps an internal severity label from replacing a source-specific reporting analysis.

Define the source-specific route matrix

Bruno begins with facts, people, information, services, systems, locations, workforce exposure, and known consequences. Several rows can open for one incident. A client injury, for example, may require clinical review, family communication, workplace analysis, insurance notice, payer review, and a licensing decision owned by different qualified people. The incident-route matrix has a named owner, scope, current sources, qualified decision boundaries, version, role-limited access, evidence location, exception route, change triggers, and retention state.

Record triggers, scope, clocks, owners, decisions, and confirmation

The working record captures incident and route IDs, factual event, people and services, provisional severity, route category, governing source, entity and role scope, trigger question, discovery rule, clock start, deadline, qualified owner, consultation, evidence required, notification recipient, content requirement, confidentiality, external reference, decision, rationale, submitted time, confirmation, follow-up, correction, closure, and source recheck. Each field supports protection, a decision, communication, measurement, or later trace. Narrative is used for context and uncertainty; structured states support queues, clocks, ownership, and reconciliation.

Use internal severity without replacing external routes

He separates classification from reporting decisions. A matrix prompt can surface a possible route; the responsible role confirms whether the source applies. Every route retains its own clock and state. Internal closure waits for a recorded disposition of all opened rows, including routes found inapplicable with their rationale.

Protect people while classification continues

Bruno lets emergency, medical, crisis, protective, and immediate containment actions proceed under the applicable route. Routine approvals never delay urgent help. Temporary service or system controls stay scoped to the observed condition and retain access, communication, clinical, workforce, privacy, and continuity review.

Keep facts, hypotheses, decisions, and actions distinct

Bruno labels each entry as a reported fact, direct observation, system result, hypothesis, qualified decision, assigned action, or later correction. Authorship and time remain visible. This structure allows a fast response while showing what remains uncertain.

Validate each route against its current source

Bruno tests mixed events and checks whether the matrix opens parallel routes without resetting clocks at transfer. He samples inapplicable decisions, later reclassification, failed submissions, state-plan differences, vendor duties, and new facts that change a route.

Reconcile the incident across operating systems

Bruno compares the incident record with clinical documentation, schedules, staffing, access, communications, facilities, vendors, billing, payer evidence, HR systems, privacy and security cases, insurance files, and corrective actions as authorized. Differences receive owners, effects, and resolution states.

Protect direct communication, access, and dissent

Bruno gives affected people a direct, usable communication route whenever possible, keeps AAC and other supports available, allows time to respond, and records questions, corrections, refusal, pause, distress, or withdrawal. Confidentiality limits and required external routes are explained in accessible language.

Work through Bruno's fictional example

Bruno locks 28 incident-route rows. Twenty-one have source, scope, trigger, clock, owner, evidence, decision, communication, status, and confirmation. One workplace route is omitted, one privacy clock starts late, two rows lack qualified owners, one payer route uses a stale source, and three decisions lack rationale. Five rows are repaired. Two remain held. The scenario is synthetic. It tests scope, authority, access, evidence, clocks, response, and denominator logic without establishing clinical quality, legal compliance, reportability, coverage, causation, safety, satisfaction, or outcome.

Calculate the example measures

Initial route integrity is 21 of 28, or 75.0%. Twenty-six validate, or 92.9%. Incidents, routes, sources, clocks, decisions, notices, confirmations, and holds remain separate.

Avoid one severity scale for every reporting question

One severity scale cannot answer every reporting question. Bruno preserves the source-specific route even when the practice uses an internal severity label for coordination.

Test overlapping routes, stale sources, clocks, and rationale

Bruno tests client injury, worker injury, privacy event, cyber incident, restraint report, medication error, facility failure, insurer notice, payer notice, licensing route, protective report, and inapplicable route. Each case states the event or signal, affected people and services, immediate protection, source, owner, evidence, communication, open route, decision, correction, validation result, and next review.

Close review with unresolved work visible

Bruno confirms scope, sources, authority, access, evidence, safeguards, reporting routes, communications, decisions, recovery, corrections, and fresh validation. The incident classification and reporting matrix stays draft until every named reviewer finishes. Open work retains its owner, age, effect, and next action.

Place classification matrices within organizational guidance

Bruno uses the CASP Organizational Guidelines public overview for high-level business, clinical-operations, and risk-management context. CASP sells the detailed guidelines. The page presents an editorial incident classification and reporting matrix; the public overview does not prescribe this artifact, its fields, or its decision rights. The OIG General Compliance Program Guidance is voluntary and nonbinding. It supports reporting, investigation, correction, auditing, monitoring, and oversight concepts while actual duties come from the governing source.

Keep professional authority clear during response

The current BACB Ethics Code applies to BCBA and BCaBA certificants and people who completed an application for either credential. It addresses competence, client and stakeholder involvement, consent and assent when applicable, documentation, risk, delegation, evaluation, continuity, and reporting within scope. BACB has no separate jurisdiction over organizations or corporations. Bruno therefore maps covered professional duties separately from entity, owner, payer, regulator, and software roles.

Separate workplace recording and urgent reports

OSHA's recordkeeping page distinguishes recording, reporting, and electronic submission. Its fatality and severe-injury page describes federal reporting routes and clocks for covered work-related events. Bruno verifies event, employer, establishment, state-plan, and exception scope. Emergency response, clinical records, workers' compensation, insurance, licensing, and other reports keep their own routes.

Route privacy and security events through current sources

For HIPAA covered entities and business associates as applicable, current 45 CFR 164.308 includes security-incident procedures. HHS's Breach Notification Rule guidance explains the unsecured-PHI breach presumption, exceptions, low-probability assessment, and recipient-specific notice paths. Bruno keeps alerts, security incidents, impermissible uses or disclosures, breaches, business-associate notices, and non-HIPAA events distinct.

Use cybersecurity guidance within its scope

NIST SP 800-61 Revision 3, finalized in April 2025, integrates cybersecurity incident response across the six Cybersecurity Framework 2.0 functions. It is general guidance and does not replace HIPAA, state law, contracts, payer duties, clinical authority, or emergency action. Bruno adapts its preparation, detection, response, recovery, learning, and evidence concepts only where they fit the practice's systems and obligations.

Preserve usable communication throughout response

The DOJ effective-communication guidance addresses covered entities' communication with people who have communication disabilities, subject to the law's scope and standards. The ASHA AAC portal says AAC users should always have access to their communication tools or devices. Bruno provides accessible intake, updates, interviews, safeguards, emergency messages, corrections, and recovery communication while keeping needed AAC available.

Related resources

Sources