Families let you into their homes, routines, and hardest moments. Keeping what you learn private is one of the clearest ways you earn that trust. This lesson walks through the life of client information, from the moment you collect it to the rare times you must disclose it, and shows what an RBT does at each stage.
Why it matters
A careless comment in a waiting room or a data sheet left on a car seat can expose a client's diagnosis, behavior, or family situation to people who have no right to it. That can embarrass the family, damage their trust in services, and break the law. Laws such as HIPAA, your employer's policies, and the ethics code for RBTs all expect you to protect client information.
On the exam, confidentiality questions are usually short scenarios: someone asks about a client, a record needs to be stored or sent, or an RBT learns something that may have to be reported. The best answer protects the client's privacy, follows agency policy, and brings anything unclear to your supervisor.
Key ideas
Think of client information as moving through four stages.
- Collecting. Gather only what you need to deliver services, such as the data your plan asks for. Don't ask about family finances, relationships, or history out of curiosity.
- Storing. Keep records where only authorized people can reach them: the agency's secure electronic system, a locked cabinet, or a closed folder that stays with you. Follow your agency's rules on devices. Never save client information on a personal phone, laptop, or email account unless policy specifically allows it.
- Sharing. Share information only with people who have a legitimate need to know, such as your supervisor and other members of the treatment team, and only as much as they need. Use approved, secure channels. Talk about clients in private spaces, not in hallways, cafés, or the break room.
- Disclosing. Releasing information to someone outside the team, such as a teacher, a physician, or a relative, usually requires the written consent of the client or their legal guardian. A small number of exceptions exist where the law requires or permits disclosure, such as reporting suspected abuse or neglect. When you are unsure whether disclosure is allowed, ask your supervisor before you share anything.
Two more points round this out:
- Even confirming that someone is a client is a disclosure. "I can't discuss who I work with" is a complete answer.
- Confidentiality continues after services end and after you leave a job. Records belong to the agency and stay under its policies.
Tip
A quick test before you share: Does this person need this information to help the client, do I have permission, and am I using a secure channel? If any answer is "no" or "I'm not sure," pause and check with your supervisor.
Definitions
- Confidentiality: your professional duty to protect information learned through your work with a client and to share it only as allowed by consent, law, and policy.
- Identifying information: any detail that could reveal who a client is, such as a name, photo, voice recording, address, school, birth date, or a unique combination of details.
- Need to know: the principle that people get only the information their role in the client's care requires.
- Release of information: a signed consent form that lets the agency share specific information with a specific person or organization for a stated purpose.
- Mandated reporting: a legal duty, set by state law, to report suspected abuse or neglect to the proper authorities. Your agency's policy explains the steps to follow. Confidentiality does not override this duty.
Examples from a session
Confidentiality in four settings
- Clinic: In the waiting room, a parent asks Dani, an RBT, why another child screams during sessions. Dani says kindly, "I'm not able to talk about other families, but I'm happy to answer questions about your son's program."
- Home: After a session with Aiyana, age 9, her father asks for today's data. Dani gives a brief verbal summary and explains that the written data come through the agency's secure parent portal.
- School: A teacher asks Marcus, an RBT, for a copy of Owen's behavior plan. Marcus isn't sure a release is on file, so he tells the teacher he will check with his supervisor before sharing anything.
- Adult day program: Marcus needs to tell his supervisor that Ruth, age 42, has a new behavior. He uses the agency's secure messaging app and describes what happened objectively, without extra personal details.
Common mistakes / exam traps
- "I only used her first name." A first name plus a location, school, or diagnosis can still identify someone. Avoid identifying details in any public or unsecured setting.
- Treating everyone close to the client as part of the team. Grandparents, babysitters, and teachers are not automatically entitled to information. Check for consent first.
- Using personal devices or accounts for convenience. Texting a photo of a data sheet or emailing notes to your personal email puts records outside the agency's protections.
- Thinking confidentiality means staying silent about harm. If you suspect abuse or neglect, follow your agency's reporting procedure and the law. Tell your supervisor right away, and make any report the law requires of you.
- Taking records with you when you leave a job. Return them to the agency so they can be kept or destroyed under its records policy.
Exam trap
Watch for answer choices that sound helpful but skip consent, such as sharing "just a little" with a caring relative or an eager teacher. The best answer protects the information and routes the request through your supervisor.
Exam trap
The opposite trap is refusing to tell the legal guardian. For a minor client, the parent or guardian generally has a right to information about services. Confidentiality protects the family from outsiders, not from itself.
Quick check
Jade, an RBT, finishes her session notes and has 20 minutes before her next client. Which choice best protects the client's information?