Your clinic, translated into HIPAA's vocabulary
Every role, tool, and room in an ABA clinic mapped to the word HIPAA uses for it, and what changes the moment you know which word applies.
Last verified: 2026-07-12
HIPAA and ABA use different words for the same things, and most of the confusion in this field is a translation failure rather than a legal one. A clinic owner reads a regulation about workstations and facilities and workforce members and concludes it was written for a hospital. It was. And it still governs the RBT sitting on a carpet with an iPad.
So here is the dictionary. Left column, what you call it. Right column, what the regulation calls it, and what changes the moment you know.
Your people
| In your clinic | In HIPAA | What that means |
|---|---|---|
| RBTs, BCBAs, BCaBAs | Workforce | Employees, volunteers, and trainees under your direct control (45 CFR 160.103). They need training, unique logins, and access that ends when employment does. |
| The practicum student, the unpaid intern | Workforce | Same word, same obligations. Whether they are paid is irrelevant to the definition. |
| The clinic owner or practice manager who "handles HIPAA" | Security official, privacy official | One named human, required (45 CFR 164.308(a)(2); 45 CFR 164.530(a)). Not a committee, not the IT vendor. |
| The parent | Personal representative | Generally treated as the individual for privacy purposes (45 CFR 164.502(g)), with exceptions state law and custody can change. |
| The child | Individual | The person the PHI is about, and the holder of the rights the parent exercises. |
| Your billing company, your EHR vendor, your AI scribe | Business associates | Anyone outside your workforce handling PHI for you (45 CFR 160.103). Each needs a signed agreement before the first record moves. |
Your things
| In your clinic | In HIPAA | What that means |
|---|---|---|
| The field tablet, the RBT's phone, the front desk computer | Workstations | Any device that performs computing functions, plus its immediate media (45 CFR 164.304). Ownership is irrelevant; the personal phone counts. |
| Your clinic space | Facility | The physical premises (45 CFR 164.304). Facility access controls apply, at your scale: keys, codes, screens, and a written answer to who gets in. |
| The family's living room, the classroom | Nothing. And everything. | Not your facility, so the facility standards do not reach it. But the workstation went with you, so the workstation standards did too. |
| The old iPad in the drawer, the copier, the laptop you are donating | Electronic media subject to disposal and re-use | Both required, no judgment call (45 CFR 164.310(d)(2)(i) and (ii)). Data must be destroyed or sanitized before the hardware moves on. |
Your records
| In your clinic | In HIPAA | What that means |
|---|---|---|
| Session data, assessments, treatment plans, progress notes, billing records | The designated record set | Records used to make decisions about the individual (45 CFR 164.501). This is what a parent can demand a copy of, within 30 days. |
| Your SOAP notes and session notes | NOT psychotherapy notes | The definition excludes session times, modalities, test results, and summaries of plan, symptoms, and progress (45 CFR 164.501). Nearly everything you write is excluded, so the special protections do not apply, and withholding notes from a parent on that basis is a violation. |
| Session video | PHI that cannot be de-identified | A face and a voice are both listed identifiers. It stays PHI in the most identifiable form you hold. |
| A text to a parent | A transmission of ePHI | Transmission security applies (45 CFR 164.312(e)), and the message rests afterward on two phones and a carrier. |
| The schedule with client names on it | PHI | Names plus the fact of treatment is individually identifiable health information. The whiteboard in the break room counts. |
Your workflows
| In your clinic | In HIPAA | What that means |
|---|---|---|
| Delivering therapy, supervising, coordinating with another provider | Treatment | PHI moves without an authorization (45 CFR 164.506), and minimum necessary does not apply to treatment disclosures. |
| Billing, checking eligibility, requesting authorization | Payment, and covered transactions | Doing any of these electronically is what made you a covered entity in the first place. |
| Credentialing, quality review, staff training, business admin | Health care operations | Also permitted without authorization; the O in TPO (45 CFR 164.501). |
| Sending a clip to the district, posting a success story, using a session in a conference talk | Uses requiring an authorization | None of these are treatment, payment, or operations. Each needs written permission with the required elements (45 CFR 164.508). |
| Onboarding an RBT | Workforce security and training | Authorization, clearance, training, unique credentials, and a record that all of it happened (45 CFR 164.308(a)(3) and (a)(5)). |
| An RBT resigning | Termination procedures | Access ends when employment ends (45 CFR 164.308(a)(3)(ii)(C)). In a high-turnover field this is your most frequently exercised security process. |
| "We should probably look at our security sometime" | Risk analysis and risk management | Both required (45 CFR 164.308(a)(1)(ii)(A) and (B)), and the most cited failures in enforcement. |
What the dictionary is actually for
Notice what happened as you read down those columns. Nothing in your clinic fell outside the vocabulary. Every person, device, room, record, and habit had a word waiting for it, and each word carried an obligation that was already attached whether or not anyone in the building knew the word.
That is the real finding, and it is more useful than any single rule on this site. You do not have a HIPAA problem separate from your operation. You have an operation, and HIPAA has a word for every part of it, which means compliance is not a project bolted onto the clinic. It is a description of the clinic, written accurately.
Which is why the honest question is never “are we HIPAA compliant.” It is: for each thing on this page, do we know what we actually do, and could we show it? The clinics that can answer that are compliant almost as a side effect. The ones that cannot have a binder.
“You do not have a HIPAA problem separate from your operation. You have an operation, and HIPAA has a word for every part of it”
Once you know the word, you know where to look. Every term above links into the glossary, and every rule behind it is written out in plain English on this site, with the citation attached, so you never have to take our word for any of it.
The short version
- Your RBTs are workforce, your tablets are workstations, your vendors are business associates, and your session notes are the designated record set. The words are not decoration; each one attaches a specific obligation.
- Nothing in your clinic is outside the vocabulary: if it touches a client's information, HIPAA has a name for it and a rule that follows.
- The most consequential mismatch is psychotherapy notes: an ABA session note is almost never one, and treating it as one causes real violations.
- Once you know the word, you know where to look, because the rules are organized by the vocabulary rather than by your workflow.
This article is educational information about the HIPAA regulations, not legal advice. It describes what the rules say; it does not tell you what to do about your specific situation, and reading it does not create an attorney-client or consultant-client relationship. Regulations change, and enforcement positions change with them. For advice on your clinic, talk to a qualified professional.
Sources
- Definitions, general45 CFR 160.103https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
- Definitions, Security Rule45 CFR 164.304https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.304
- Definitions, Privacy Rule45 CFR 164.501https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501
- Uses and disclosures: general rules, including personal representatives45 CFR 164.502https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
- Administrative safeguards45 CFR 164.308https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- Physical safeguards45 CFR 164.310https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310
- Technical safeguards45 CFR 164.312https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
Your operation, mapped.
WiseUpHIPAA works from your actual clinic: your people, your devices, your vendors, your records. It applies the rules to what is really there and shows you honestly where you stand.