Standard 2.08: Confidentiality and privacy
RBTs protect the confidentiality and privacy of clients, stakeholders and others in the workplace by following the requirements of the BACB, their employer and the law. They keep client information and records confidential whenever they handle them.
What it means in practice
Confidentiality covers anything that could identify a client or reveal their services: names, diagnoses, data, notes, photos, schedules, even the fact that a family receives services. It also covers stakeholders and coworkers, such as a colleague's health or a caregiver's personal situation.
The rules come from three places: the BACB, your employer and the law. In the US, privacy laws such as HIPAA apply to many providers, and state laws and licensure requirements may add more. Your employer's policies tell you how these apply day to day, so learn them.
In practice: collect only what is needed, use approved systems for records and messages, keep paper data sheets secured and out of view, lock screens and devices, don't keep client information on personal devices unless your employer allows it, and don't talk about clients where others can overhear.
Scenarios
| Situation | What to do |
|---|---|
| A neighbor asks whether you are working with the family down the street, since they see you there twice a week. | Don't confirm or deny. Say you can't discuss your work and change the subject. |
| You finish your last home session and plan to leave the client's data binder on your car seat while you go out to dinner. | Don't leave records where others can see or take them. Follow your employer's policy for transporting and storing records, such as returning them to the clinic or keeping them locked and out of sight. |
| Your supervisor is out of the office, and you want to text them a photo of a client's data sheet from your personal phone. | Use only the communication systems your employer approves for client information. If none is available, wait or ask your supervisor how they want the information sent. |
| A coworker tells you privately about a health condition, and later others at the clinic ask why they have been absent. | Don't share it. The standard protects the privacy of others in the workplace too. |
Practice questions
-
Question 1A supervisor wants to score a client's conversation with peers later, but conversation leaves no physical product. Which approach creates a lasting record that can be scored after the session?
Show answer
B: Video recording with the required consent. Video or audio recordings create a lasting record of behavior that leaves no product, which can then be scored later with any measurement procedure. Recording clients requires consent and must follow the organization's privacy rules.
- A: A summary from memory is not a record of the behavior and is prone to error.
- C: Peer reports are secondhand and not a record of the behavior itself.
- D: The number of peers present says nothing about the client's conversation.
Task A.3 · 40-hour curriculum section C · RBT Ethics Code 2.08
-
Question 2After scoring a client's worksheets, an RBT is left with papers that show the client's name and work. What should the RBT do with them?
Show answer
C: Store or dispose of them per confidentiality rules. Permanent products with client information are confidential records. The RBT Ethics Code requires RBTs to protect client confidentiality and follow employer and legal requirements for records.
- A: Leaving identifiable client work in a shared space risks a breach of confidentiality.
- B: RBTs must not share identifying client information, including photos, on social media or websites.
- D: Client information is shared only as needed and as directed by the supervisor.
Task A.3 · 40-hour curriculum section C · RBT Ethics Code 2.08 · RBT Ethics Code 2.09
-
Question 3A client builds a block model at the end of a session, and it must be taken apart right away for the next client, so there is no time to score it on the spot. The plan scores the number of correctly placed blocks, and the supervisor has said that photos of client work that do not show the client may be used for scoring, as organization policy allows. What can the RBT do?
Show answer
C: Photograph the model before it is taken apart and score the photo. When a product cannot stay in place, a photo taken within the organization's privacy rules preserves it so it can be scored and checked later.
- A: Scoring from memory is not scoring the product and is prone to error.
- B: Leaving the model disrupts the next session and is not needed to keep a record.
- D: A photo allowed by policy can preserve the product, so the data need not be lost.
Task A.3 · 40-hour curriculum section C · RBT Ethics Code 2.08
-
Question 4An RBT has finished a home session and needs to enter data into the clinic's electronic data system. Which practice protects the client's confidentiality?
Show answer
A: Using an approved device where no one else can see the screen. Client data are confidential records. RBTs follow employer and legal requirements, which includes using approved systems and keeping others from viewing client information.
- B: Personal accounts are outside the organization's protected systems and put client records at risk.
- C: Data entry is the RBT's job duty, and the record should stay within the organization's procedures.
- D: Sharing client information on social media is prohibited, even with staff.
Task A.4 · 40-hour curriculum section C · RBT Ethics Code 2.08 · RBT Ethics Code 2.09
Answer every question to see your score.
Where it sits in the code
Standard 2.08 is in section 2, Responsibilities in Providing Behavior-Technician Services, of the RBT Ethics Code (2.0). On the exam it relates to task F.5 Confidentiality. Read the official text for the exact wording.
Related standards: 2.09 Client information on social media and websites, 2.10 Discussing and sharing client information, 2.07 Protecting clients' rights and safety.