Protected health information (PHI)
Under the U.S. HIPAA Privacy Rule, individually identifiable health information held or sent by a covered entity, such as a health care provider or health plan, or its business associate.
Protected health information is a legal term from the HIPAA Privacy Rule in the United States. It covers information that relates to a person's physical or mental health, the health care they receive, or payment for that care, and that identifies the person or could reasonably be used to identify them. It applies when the information is held or transmitted by a covered entity (such as a health care provider that bills insurance electronically) or a business associate, and it can be electronic, on paper or spoken.
For ABA services, PHI can include a client's name together with their diagnosis, treatment plan, session notes, data sheets, graphs, billing records, photos or videos, appointment times and address. Information that does not on its own seem medical becomes PHI when it is linked to the person's care, such as a home address in a session schedule.
RBTs handle PHI every day. Protecting it means following the employer's privacy policies: using approved, secure devices and systems, not texting or emailing client details through personal accounts, logging out of shared devices, keeping paper records secure, sharing only the minimum necessary information, and reporting a possible breach (such as a lost phone with client data) to the supervisor immediately.
Rules differ outside the United States, and other laws may apply, but the RBT Ethics Code (2.0) requires all RBTs to protect client confidentiality and follow applicable privacy laws and workplace requirements.
Example and non-example
| Example | An RBT's tablet contains the client's data sheets and name. The RBT uses the employer's secure app, locks the tablet when stepping away, and, after accidentally leaving the tablet in a café, reports it to the supervisor right away. |
|---|---|
| Non-example | General information that does not identify anyone, such as "many children practice requesting skills," is not PHI. |
Don't confuse it with
| Confidentiality | Confidentiality is the ethical duty to protect all client information, while PHI is a specific legal category of identifiable health information under HIPAA. |
|---|---|
| Session note | A session note is one type of record, which usually contains PHI; PHI is the category of protected information itself. |
Test yourself
-
Question 1A teacher asks the RBT whether the student's medication was recently changed. The RBT knows it was, from the caregiver. What should the RBT do?
Show answer
A: Not share it without the supervisor's direction. RBTs discuss confidential client information only under their supervisor's direction or when the law allows (Standard 2.10).
- B: Directing the teacher to the student is inappropriate.
- C: Being on the team does not make the teacher authorized to receive medical information.
- D: A promise of secrecy does not authorize disclosure.
Task E.3 · RBT Ethics Code 2.10
-
Question 2An RBT runs a social skills group with three clients. In one client's note, how should the RBT refer to the other clients?
Show answer
C: Without identifying details, such as "a peer". Each client's record should not contain other clients' identifying information. RBTs share only necessary client information in documentation (Standard 2.10).
- A: Initials with birth dates still identify other clients.
- B: Names and diagnoses are confidential information about other clients.
- D: Full names of other clients do not belong in this client's record.
Task E.4 · RBT Ethics Code 2.10 · RBT Ethics Code 2.08
-
Question 3Where should an RBT keep the session notes they write?
Show answer
D: In the organization's approved, secure system. RBTs protect client confidentiality by following the requirements of their employer and the law (Standard 2.08). Notes belong in approved, secure systems.
- A: Open folders allow unauthorized access.
- B: Personal phones are not approved, secure storage.
- C: Taking notes home risks loss and unauthorized access.
Task E.4 · RBT Ethics Code 2.08
Answer every question to see your score.
On the RBT exam
This term belongs to task F.5 Confidentiality in content area F, Ethics, which is 11 of the 75 scored questions.