Collecting, using, storing, protecting, and disclosing client information in RBT work

RBT Confidentiality: How to Protect Client Information

RBT confidentiality is a daily practice, not just a rule about where a session note is stored. An RBT may handle data, messages, video, schedules, records, and conversations across home, clinic, school, and community settings. This guide explains how to decide what information is needed, use approved channels, limit disclosure, respond to mistakes, and ask for direction when authorization is unclear.

RBT confidentiality: quick answer

Protect client, stakeholder, and workplace information by collecting only what is needed for the assigned service, using it only for an approved job-related purpose, storing it in the organization’s approved system, and disclosing only the necessary information to an authorized recipient through an approved channel. Follow the RBT Ethics Code, employer policy, applicable privacy laws, payer or school rules, and supervisor direction.

The RBT Ethics Code (2.0) requires RBTs to protect confidentiality and privacy, maintain confidentiality when interacting with client information and records, avoid posting identifying information on social media or websites, and discuss confidential client information under supervisor direction unless a lawful reason applies. “I know the family” or “the other person works in the building” is not enough authorization by itself.

What confidentiality means

Confidentiality is the professional duty to protect information entrusted to the service relationship. Privacy concerns the person’s control and reasonable expectation around personal information. Security concerns the safeguards used to prevent unauthorized access, loss, alteration, or disclosure. In practice, an RBT usually has to manage all three.

Identifying information can be obvious, such as a name, face, address, or medical record number. It can also be indirect: a school, unusual schedule, distinctive behavior, a voice, a photograph of a room, or a combination of details that lets someone identify the client. Removing the name does not automatically make a post, screenshot, or message safe.

Confidentiality does not mean hiding a safety concern or refusing every request for information. The Code allows disclosure when permitted by law for a valid reason, such as protecting a client or another person from harm. It also requires the RBT to follow the approved reporting route and supervisor direction. When the reason or authorization is uncertain, ask before sharing unless an immediate emergency procedure requires action.

The information lifecycle

Think of every piece of information as moving through four decisions:

A decision that was acceptable at one stage may be wrong at the next. For example, collecting a data point in an approved session app does not authorize copying it into a personal spreadsheet. A supervisor’s request to review a note does not authorize forwarding the entire client file to a friend who is helping you proofread.

Collect only what the role needs

Before recording a detail, identify the service purpose. The current plan or form may require target data, session variables, a safety event, a caregiver report, or a communication note. It may not require unrelated family history, a personal opinion, a full screenshot of a schedule, or a photograph of the client’s home.

Use the organization’s definitions and forms. If a field asks for a session variable, record the relevant variable and its source rather than copying a long private conversation. If you need to contact a supervisor, describe the observable event and the decision needed. Avoid collecting “just in case” information that increases exposure without helping the service.

Photos and video require special care. Do not photograph a client, a data sheet, a classroom, or a home scene for convenience unless the approved policy, consent process, and service purpose clearly authorize it. A personal phone gallery is not automatically a secure clinical record. Ask the supervisor or privacy contact before creating a new copy.

Use information for an approved purpose

Use client information to implement the assigned service, document it, receive supervision, communicate through the approved team route, support billing or quality processes when authorized, or protect health and safety under the applicable procedure. Do not use the information to satisfy curiosity, build a personal portfolio, win an argument, entertain coworkers, or create social media content.

Keep communication factual and limited. An RBT can say, “The approved data form shows four independent responses across six opportunities,” without adding unrelated details about the family. A message to a supervisor can include the context needed for a decision, but it should not become a running personal diary about the client.

Check whether a recipient is authorized for the specific purpose. A teacher, caregiver, payer, vendor, trainee, or another provider may have a legitimate role, but the scope of access can differ. If the request involves a new person, new service, or new type of record, verify the route instead of relying on a verbal assumption.

Store and protect records

Store notes, data, messages, and attachments in the system named by the employer or service organization. Use strong device security, lock screens when stepping away, protect paper records from casual viewing, and follow the required retention and destruction process. Do not move records to personal cloud storage, a personal email account, or a removable drive unless the policy specifically authorizes it.

Be careful with ordinary workspaces. A printed note left in a car, an unlocked tablet in a waiting room, a screen shared with the wrong participant, or a voicemail that names a client can disclose information without anyone intending harm. Build a pause into transitions: close the record, check the recipient, and secure the device before changing locations.

Backups and exports are records too. If the system creates an automatic copy, follow the organization’s controls. Do not make your own duplicate so that you can work faster later. When you are unsure about retention, deletion, or access permissions, ask the person responsible for the system.

Disclose through the right channel

Before sharing information, check four things: need to know, approved channel, minimum necessary, and documentation. The recipient should have a legitimate role; the channel should be one the organization permits; the content should answer the work question without unrelated details; and the disclosure should be recorded when the policy requires it.

Personal text messages and social media are common risk points. Do not post identifying photos, videos, written information, or “anonymous” stories that could reveal a client. Do not use a personal messaging app because the work platform is inconvenient. If an urgent safety concern requires a different route, follow the emergency or mandated-reporting procedure and notify the supervisor as soon as possible.

When a family member, teacher, or coworker asks for information, respond within your role. You can acknowledge the request and say that you will confirm the approved process. You do not need to argue or disclose more than necessary. If a person insists, record the request and ask the supervisor for direction.

If information is sent or exposed by mistake

Act promptly. Do not delete evidence, quietly pretend it did not happen, or send more copies while trying to fix the first one. Follow the organization’s incident or privacy procedure, tell the supervisor or designated privacy contact, identify what information was involved, who may have received it, when it happened, and what immediate containment step was taken.

Use factual language: “At 3:05 p.m., I sent the session summary to the wrong saved contact. I recalled the message when the system permitted it and did not send any further copies. I notified my supervisor at 3:12 p.m. and am waiting for the incident-reporting instruction.” This is more useful than “I messed up the client’s privacy.” The responsible organization decides notification, remediation, and reporting requirements.

If a record is inaccurate, correct it through the approved audit trail. Do not create a clean replacement that hides the original. Preserve the documents and communications requested by the responsible person, and complete any required training or follow-up.

Workplace scenarios

• A teacher asks in the hallway: move the conversation to an approved private channel and share only the information the teacher is authorized to receive for the educational role.
• A caregiver texts your personal phone: follow the employer’s communication policy, avoid substantive disclosure in the personal thread, and redirect to the approved route.
• A coworker wants a “funny story”: do not share it, even if the name is omitted. Indirect details and disrespectful framing can still expose or harm the client.
• A supervisor needs data for review: provide the requested record through the approved system and check whether identifiers or attachments beyond the question are necessary.
• An emergency creates immediate risk: follow the emergency and mandated-reporting procedure first, then communicate and document through the required route.

A daily confidentiality checklist

1. I know which system and channel are approved for today’s records and communication.
2. I am collecting facts required for the assigned service, not unrelated personal details.
3. I can identify who needs the information and what minimum content answers the question.
4. My device, paper notes, screen, and attachments are protected during transitions.
5. I have not placed identifying information in a personal app, public document, social post, or unapproved tool.
6. I know whom to contact if a request, disclosure, or safety concern is unclear.
7. I will report and document a mistake instead of hiding, deleting, or rewriting it.

A checklist is a prompt, not a substitute for the current privacy policy or law. The organization may require additional consent, authorization, retention, encryption, incident response, or release procedures.

Frequently asked questions

Can an RBT tell a family member what happened in a session?

Use the approved caregiver communication route and share only what the role and policy authorize. If the request involves clinical interpretation, a new concern, or information outside your role, ask the supervisor to direct the response.

Is a message safe if I remove the client’s name?

Not necessarily. A combination of setting, schedule, image, voice, behavior, or other details may identify the client. Use approved systems and minimum necessary information.

Can I keep a copy of session data on my personal laptop?

Only if the organization’s policy explicitly authorizes that system and its security controls. Otherwise use the approved record system and ask before creating an export or duplicate.

What should I do if I am not sure whether I may disclose something?

Pause the nonurgent disclosure, identify the purpose and recipient, and ask the supervisor or designated privacy contact. If there is immediate risk, follow the emergency or mandated-reporting route first.

Official source note

This educational guide was checked against the BACB RBT Ethics Code (2.0), especially standards 2.08–2.10, and the BACB RBT Handbook, retrieved September 28, 2026. Employer, payer, school, legal, state, and privacy requirements may add requirements or differ in implementation.

Role boundary: This article is general education, not individualized legal, privacy, clinical, or compliance advice. Follow the current Code, applicable law, employer policy, approved systems, supervisor direction, and incident-reporting procedure.