Families let you into their homes, their routines, and their hardest moments. Supervisees and research participants trust you with information too. Confidentiality is how you keep that trust. It touches almost every workday decision.
Why it matters
Confidential information leaks in ordinary ways: a session video left on a shared laptop, a client's name in a group text, a hallway conversation a parent overhears, a "success story" posted with a blurred face. None of these require bad intent. The Ethics Code for Behavior Analysts asks you to prevent accidental sharing, not just avoid deliberate gossip.
Breaches harm clients (stigma, lost services, damaged relationships), erode trust, and can violate laws such as HIPAA (health information) or FERPA (education records), depending on your setting.
Key ideas
- Protect it everywhere. The code's confidentiality standard protects clients, stakeholders, supervisees, trainees, and research participants. It applies to services (in person, telehealth, recorded sessions), to documentation and data, and to anything you say, write, or send electronically.
- Prevent accidents, not just disclosures. Lock screens, use approved secure platforms, and choose where you discuss cases.
- Follow every layer of rules. Comply with laws, regulations, funder contracts, and your organization's policies. Meeting one set of requirements does not excuse ignoring another.
- Know the narrow exceptions. The code's disclosure standard lets you share confidential information only in five situations: you have informed consent; you are trying to protect the client or someone else from harm; you are working out a contract issue (such as a billing dispute); you are trying to prevent a crime likely to cause someone physical, mental, or financial harm; or a law or court order requires it.
- Share the minimum. Even when sharing is allowed, share only what the purpose of that particular communication requires. A signed release for a pediatrician is not a license to send the entire file.
- Handle records with care. Follow every requirement (BACB rules, laws, contracts, funder and agency policies) for storing, moving, keeping, and destroying records. Shred paper data after scanning it only when those requirements allow. If you leave an organization, the records stay its responsibility. When rules set different retention periods, follow the longest one.
- Explain the limits at the start. The code expects you to tell clients and stakeholders, at the outset of services, where confidentiality ends: who on the team will see information, what funders or insurers receive, and when you may have to share it.
Tip
Before you share anything, ask three questions: Do I have consent or a recognized exception? Who exactly needs this? What is the least I can share to meet that need?
Definitions
- Confidential information: any information about a client, stakeholder, supervisee, trainee, or research participant that you learn through your professional role, including identity, data, records, and recordings.
- Informed consent: permission from a person with the legal authority to give it (an adult client who can consent, or a legal guardian or other authorized representative) after they understand what will be shared, with whom, and why. It can be withdrawn.
- Minimum necessary: sharing only the information that the purpose of an allowed disclosure actually requires. The phrase comes from HIPAA, and it matches the ethics code's limit on authorized sharing.
- De-identification: removing or changing every detail that could identify a person on its own or in combination, not just the name.
Examples from a session
Everyday moments
- The school call. A second-grade teacher asks Priya, a BCBA, for a child's functional assessment results. Priya wants to collaborate but first checks for a signed release from the parent that covers the school. Until then, she shares nothing, not even whether the child is on her caseload.
- The teleservice session. Diego, a BCBA, runs parent training by video from home. He uses the agency's secure platform, wears headphones, and closes the door so his housemate cannot hear.
- The conference poster. Mei wants to present a case about a teenager in a small rural district. The school, town, and a rare diagnosis would identify him even without his name. She removes the name and those details and gets the parents' consent and the teen's assent for the presentation.
- The release with limits. An adult client, Tomas, signs a release so his BCBA can update his job coach. The BCBA shares the workplace goals and strategies, not Tomas's family history.
- Non-example: the lobby update. A BCBA tells a waiting grandmother, who drives the child but is not the guardian, how his session went. It feels kind, but there is no consent and no exception, so it is a disclosure, not collaboration.
Common mistakes / exam traps
- "They're on the team, so I can share." Teachers, therapists, and relatives are not automatically entitled to information. You need consent from the person with legal authority, unless an exception applies.
- "Initials in a group chat are fine." Non-secure personal channels are the problem, not just the name. Use approved, secure systems.
- "The records are mine, so I'll take them when I leave." Records belong under the organization's care, and its rules govern storage and destruction.
- "Confidentiality is absolute." It has limits. Protecting someone from harm and complying with law or a court order are recognized exceptions.
Exam trap
Removing the name vs. de-identifying. A blurred face, initials, or a made-up name removes one identifier. De-identification removes every detail that could point to the person alone or in combination: voice, clothing, setting, caption, a rare diagnosis in a small town. If anything identifying remains, public use needs informed consent first.
Exam trap
Permission to share vs. how much to share. Consent or a recognized exception decides whether you may share. The purpose of that communication decides how much. A release naming the behavior plan and recent data does not cover the full file, and a safety risk does not justify sending everything.
Quick check
During a session, Marcus, a 34-year-old client, tells his BCBA that he plans to seriously injure his roommate tonight and describes how. Marcus refuses to let her tell anyone. What should the BCBA do?
Related topics
- Core principles of the ethics code for behavior analysts (E.1)
- What unethical conduct risks for you, others, and the profession (E.2)
- Public statements, social media, and honest representation (E.5)
- Multiple relationships: types, risks, and mitigation (E.7)
- Legal, regulatory, and practice requirements: licensure, funding, and certification (E.12)