The living room is your facility

The Security Rule’s physical safeguards were written by people imagining a building. Facility access controls. Locked doors. Maintenance records for hardware, walls, and locks. An ABA clinic owner reads that section and reasonably concludes it has nothing to do with an RBT sitting on a carpet in a family’s front room.

But the rule does not follow buildings. It follows ePHI, and yours travels. The workstation definition is device-based, not location-based (a laptop, or any other device that performs similar functions, plus the media in its immediate environment), so the tablet in the bag carries the workstation standards into the house with it (45 CFR 164.310(b) and (c)). You are a guest with a workstation, and the rule expects you to have thought about that in advance rather than improvising in someone’s kitchen.

Here is what thinking about it in advance actually looks like.

“You are a guest with a workstation, and the rule expects you to have thought about that in advance rather than improvising in someone's kitchen.”

The screen, and what a sibling seeing it means

An older brother walks behind the RBT and glances at the tablet: the client’s name, the program, today’s data. Is that a violation?

Usually not, and the reason is worth understanding rather than memorizing. The Privacy Rule permits incidental uses and disclosures: those that occur as a by-product of a permitted use, provided that you applied the minimum necessary standard and reasonable safeguards (45 CFR 164.502(a)(1)(iii); 45 CFR 164.530(c)). The permission is real. It is also conditional, and the condition is where clinics live or die.

The safeguard is not preventing every glimpse, which is impossible in a home. The safeguard is the ordinary care you took beforehand: the screen angled away from the room, the device locked when you step away, the app closed rather than left open on the coffee table during a break, the auto-logoff set short (45 CFR 164.312(a)(2)(iii)). Do those, and a passing glance is exactly what the rule contemplates. Do none of them, and the same glance is evidence you never applied a safeguard at all.

The single highest-leverage rule here: never carry another family’s information into a home. The RBT whose tablet holds the entire caseload has, in that living room, exposure with no clinical purpose. Scope the app to today’s client where the platform allows it; if it does not, that is a finding for your risk analysis, and a real one.

The conversation

A parent asks how it went, and the answer belongs to them; they are the personal representative and this is their child. But other people are often in the room: a grandparent, a neighbor, a family friend, a sibling old enough to understand every word.

The rule’s answer is 45 CFR 164.510(b): you may share PHI relevant to a person’s involvement in the individual’s care with family and others the individual (or here, the parent) has brought into that circle, with an opportunity to object. Practically, in a living room with three adults in it, that means one habit: ask the parent, not the room. “Do you want to talk here, or somewhere quieter?” A three-second question, and it converts an ambiguous disclosure into a documented, agreed one. It also protects families in conflict, where the person on the couch may be exactly the person the parent does not want informed.

The car is the most dangerous room in your clinic

Between sessions, the RBT is a mobile office, and the vehicle is where the physical safeguards fail most often:

• Devices left in cars. Between sessions, at lunch, overnight. This is the loss event most likely to actually happen to you, which is why encryption is the decision that defines the day.
• Notes written in the driver’s seat, on paper, that then live in a bag or a glovebox for a week. Paper PHI is still PHI; it has no encryption safe harbor and no remote wipe.
• Calls taken in parking lots, on speaker, with windows down. A conversation naming a client, audible to a stranger, is a disclosure and not an incidental one.
• The bag itself. Unattended in a hallway, on a porch, in a school lobby.

The countermeasures are unglamorous and cheap: devices never left in vehicles, no paper where a system will do, calls made with the windows up and no speaker, and a bag that stays on the person. Write them down; they are the workstation-use policy for a workforce whose workstation is mobile (45 CFR 164.310(b)).

What you owe the family

An in-home clinician sees things no clinic-based one does: the state of the house, other children, an argument in the next room, sometimes a situation that raises a mandated-reporting question. Two clarifications, because clinics tangle these.

Observing a home is not a HIPAA event. What you see in a family’s house is not automatically PHI, and HIPAA is not the law that governs what you may say about a messy kitchen. Where an observation is clinically relevant it goes in the record like any clinical observation, and the record is protected.

Mandated reporting is a separate legal duty that HIPAA does not block. Where state law requires you to report suspected abuse or neglect, the Privacy Rule permits the disclosure (this is the required-by-law and abuse-reporting machinery at 45 CFR 164.512). No clinician should ever hesitate over a report because of a privacy rule; the rule anticipated exactly this and made room for it. Say that plainly in training, because hesitation here is the most dangerous confusion HIPAA causes in this field.

The six-line in-home policy

Everything above compresses into a policy short enough that an RBT will actually read it:

1. Screens: angled away, locked when unattended, auto-logoff on, only today’s client loaded.
2. Devices: encrypted, never left in a vehicle, never out of your possession, reported the moment they might be missing.
3. Conversations: ask the parent whether to speak in front of others, before speaking.
4. Paper: avoid it; where unavoidable, it comes straight back and never sits in a car.
5. Photos and video: only inside approved apps, never the personal camera roll.
6. Incidents: if something is seen, lost, or overheard, tell the officer today, not Friday.

That is the whole thing. It is short because in-home compliance is not complicated; it is just relentlessly situational, and the only defense against situational risk is habit. The clinic that has trained those six lines into its field staff has done more real compliance work than the clinic with a two-hundred-page manual in a binder nobody has opened since the day it was purchased.