F.5 Confidentiality

What the outline says

Task F.5 in content area F, Ethics (11 of the 75 scored questions): "Identify and comply with requirements for collecting, using, storing, protecting, and disclosing confidential information."

The standards

Three standards in the RBT Ethics Code cover confidentiality:

• 2.08: protect the confidentiality and privacy of clients, stakeholders and others in the workplace by following all related requirements from the BACB, employers and the law (for example, privacy laws and licensure requirements), and maintain confidentiality when handling client information and records.

• 2.09: do not share identifying information about clients, such as photos, videos or written information, on social media or websites.

• 2.10: discuss confidential client information only under your supervisor's direction, unless the law allows it for a valid reason, such as protecting the client or others from harm, and share only necessary client information in job-related communications such as emails and documentation.

Failing to protect the privacy and confidentiality of clients or stakeholders is listed in the RBT Handbook as an ethics violation that must be self-reported to the BACB.

What is confidential

Confidential information includes anything you learn about a client through your work: their name, the fact that they receive services, diagnoses, behavior, data, session notes, family circumstances and schedules. In the US, health information that can identify a person (protected health information, or PHI) is also governed by privacy laws such as HIPAA; your employer's policies tell you how they apply to your work.

A client can be identified without a name. Age, school, town, a distinctive photo or a description of a memorable event can be enough, so leaving out the name does not make a post or conversation safe. Confidentiality also covers stakeholders, such as caregivers, and coworkers: a colleague's private health information is not yours to share.

Collecting, using and storing

• Collect only what the job needs. Personal questions out of curiosity, such as a family's immigration status, have no place in your work.

• Use information only for the client's services. Do not take client records with you when you change jobs, even with names blacked out.

• Store records securely, following agency policy: paper data sheets out of sight and secured during transport, never left on a car seat; screens locked and accounts logged out when you step away; client records only in the agency's approved systems, never in personal cloud storage, personal email or a personal phone.

Disclosing: who, what and how

Before sharing anything, ask three questions:

• Who: is this person authorized to receive it, and am I sharing it under my supervisor's direction? Relatives who are not authorized, neighbors, other families and callers whose identity and authorization you cannot confirm do not get information. Politely say you cannot discuss it and refer them to the caregiver or supervisor. Records requests, even from another health care provider, go through the supervisor and the agency's process.

• What: is this the minimum needed? A scheduling email needs the time and place, not a description of the client's behavior. A summary the caregiver authorized for a teacher does not mean sending the entire file.

• How and where: use approved methods, and talk about clients only in private places. Waiting rooms, hallways, stores and social media are not places for client details. If you meet a family in public, let them decide whether to say hello, and do not mention services.

Discussing a client with your supervisor, or in group supervision under the supervisor's direction, is appropriate. Share what is needed for the discussion.

Limits of confidentiality and mistakes

Confidentiality has limits. If a client says they plan to seriously harm themselves or someone else, or you suspect abuse, you cannot promise secrecy. Act right away: contact your supervisor, follow the law and organization policy, and contact authorities when required (Standards 2.07 and 2.10).

If you make a mistake, such as emailing a note to the wrong family, tell your supervisor right away and follow the agency's breach process. Do not try to handle it quietly by asking the recipient to delete it; the agency may have legal duties it can meet only if it knows.

Common mistakes

• Thinking a post is fine without the client's name. Other details can identify a client, and Standard 2.09 prohibits sharing identifying information online.
• Sharing with relatives or other professionals just because they seem trustworthy. Share only with authorized people, under the supervisor's direction.
• Using personal phones, email or cloud storage for client information because it is convenient. Use the agency's approved systems.
• Promising a client secrecy about a threat of harm. Safety overrides confidentiality, and you must act right away.
• Handling a privacy mistake quietly. Report it to the supervisor at once so the agency can follow its breach process.

How it's tested

Scenarios dominate: a neighbor, relative, caller or another family asks about a client; data sheets or a laptop need protecting; a social media post is being considered; a mistake has been made. The right answer protects information, shares only what is necessary with authorized people under the supervisor's direction, and involves the supervisor quickly. Watch for distractors that seem harmless ("only good news", "first name only", "private account").

Related ethics code standards

• 2.08 Confidentiality and privacy: RBTs protect the confidentiality and privacy of clients, stakeholders and others in the workplace by following the requirements of the BACB, their employer and the law. They keep client information and records confidential whenever they handle them.
• 2.09 Client information on social media and websites: RBTs don't share identifying information about clients, such as photos, videos or written details, on social media or websites. This applies to personal and professional accounts, public and private groups, and posts where the client's face is hidden but other details could identify them.
• 2.10 Discussing and sharing client information: RBTs discuss confidential client information only as their supervisor directs, unless the law allows it for a valid reason such as protecting the client or others from harm. In job-related communications such as emails and documentation, they share only the client information that is needed.