A composed clearance policy plus per-member tracking: every active member has a clearance record, is fully cleared with a reference check and confidentiality acknowledgment, and rechecks are current.
Clearance answers a different question from authorization. Authorization asks what a person may reach. Clearance asks whether this person should be near PHI at all, and it is supposed to be settled before the first login exists.
Your clearance policy defines the components: exclusion list verification, credential verification against the BACB and RBT registries, reference checks, and a signed confidentiality acknowledgment. Your background check scope, your exclusion check cadence, and your determination authority are rendered from your own recorded settings.
It covers exclusion re-screening with same-day escalation and access suspension on a match, credential re-verification before expiry with the role suspended on lapse, two-stage clearance for trainees, a recorded determination of cleared, cleared with conditions, or denied, and six-year immutable retention. Clinics doing field or in-home work get a clause treating those roles as access-bearing for every component.
Six requirements, working per member:
The full-clearance check reads the reference check and the confidentiality acknowledgment. It does not read the exclusion list check or the credential verification, even though your policy describes both and the recheck schedule tracks their cadence. Those are real obligations the policy sets and the schedule watches, but they are not what determines this control’s status.
The system also does not run any screening. It does not query an exclusion list or a credential registry. It records what you determined and when it is due to be looked at again.
A per-member clearance record with a determination on it. Reference checks and confidentiality acknowledgments recorded per person. A recheck schedule with due dates, and a visible flag when one is past due. The answer to “how did you decide this person could work with PHI,” per person.
The regulation: read the rule behind this control.
No pressure, no pitch. Book a 20-minute call, or just email a question and we'll point you the right way.