RBT session-note privacy, sharing, storage, and corrections

Confidentiality Session Notes RBT: Protect, Share, and Store Records

Write useful notes without exposing information that the record does not need.

Confidentiality session notes RBT practices connect two responsibilities: create an accurate record of services and protect the information inside that record. A note should help an authorized supervisor or organization reviewer understand what occurred, what data were collected, what procedure was implemented, and what follow-up is needed. It should not become a public story, a personal archive, or a place to include every detail an RBT happened to hear.

The RBT Ethics Code (2.0), the employer’s policies, the approved record system, the written program, payer requirements, privacy laws, and supervisor direction all matter. This guide explains a practical way to think through session notes. It is not a universal form, legal advice, or permission to bypass the process used by your organization.

Confidentiality session notes RBT: the short answer

Protect a session note by using an approved system, recording the minimum necessary job-related information, limiting access to authorized recipients, and correcting mistakes through the system’s documented process. Before you share a note or screenshot, ask four questions:

1. System: Am I writing, storing, or sending this through the approved channel?
2. Purpose: Is the information needed for a job-related service, supervision, safety response, or authorized administrative task?
3. Recipient: Is the person or organization authorized to receive it?
4. Amount: Am I sharing only the details needed for that purpose?

If any answer is unclear, pause and ask the supervisor or designated privacy contact before sending. A fast message through a personal account may feel convenient, but convenience does not make an unapproved route appropriate.

Write only what the service record needs

Confidentiality begins before a note is saved. An RBT can protect privacy by making the record accurate, relevant, and restrained. Include the date or service period, setting, assigned services, observable events, required measures, procedures implemented, barriers that affected service delivery, relevant communication, and follow-up. Use the fields required by the organization rather than copying a generic template into every note.

Separate observable information from assumptions. “After the instruction, the learner pushed the worksheet away and left the table for 30 seconds” is more useful than “the learner was being difficult.” The objective sentence gives an authorized reviewer a service-relevant event without adding a diagnosis, motive, or judgment that the record cannot support.

Do not add identifying details merely because they make a story feel complete. A full name, address, school name, photograph, medical detail, or family conversation may be unnecessary for the specific field. Use the approved identifier or record structure, and ask what level of detail the system requires when you are unsure.

Share through the right job-related route

Sharing can be part of ethical service delivery. An RBT may need to communicate relevant observations to a supervisor, follow an approved handoff, report a safety concern, or complete an authorized administrative task. The important question is not simply whether the information is true. The question is whether the recipient, purpose, route, and amount of information are appropriate.

Use the organization’s approved electronic record, secure message system, or other designated route. Address the message to the intended recipient, check attachments before sending, and avoid forwarding a whole chart when one field or summary is enough. If a supervisor requests information through a route that seems outside policy, do not improvise a workaround. Verify the approved route first.

Public sharing is a different category. Do not post a client photograph, video, written story, screenshot, or recognizable session detail on a website or social media account. Removing a name does not automatically remove identifying information. A combination of dates, locations, diagnoses, school details, unusual events, or images can still reveal who the person is.

Store and access notes securely

Storage includes more than the final note. Drafts, downloaded PDFs, screenshots, email attachments, handwritten pages, text messages, camera-roll images, and browser downloads can all contain protected information. Keep records in the approved system, follow the organization’s access controls, and do not create a second personal archive “just in case.”

Use the access method required by your organization. Lock the device when stepping away, keep credentials private, and check that a shared computer or personal cloud account is not synchronizing work files. Do not assume that a password alone makes a personal device acceptable for client records. The organization’s policy determines what equipment and software may be used.

Retention and disposal are also part of confidentiality. Keep the record for the period and in the location required by the organization and applicable rules. Do not delete a note because it contains an error, and do not throw away a paper record until the designated retention and disposal process allows it. If a device, file, or message may have been exposed, report it through the organization’s incident route promptly.

Correct an error without hiding the history

Errors happen: a time may be entered incorrectly, a measure may be attached to the wrong field, or an event may be described unclearly. The safe response is to use the approved correction process. Depending on the system, that may mean an amendment, addendum, correction field, supervisor review, or other auditable action. Follow the instructions you were trained to use.

Do not backdate a note, silently overwrite a signed record, ask another person to change your entry, or delete an original simply to make the record look clean. A correction should make the accurate information clear while preserving the history required by the system. If the error affects billing, safety, supervision, or a required measure, notify the appropriate person rather than waiting for someone to discover it.

A useful correction is factual and limited: identify the field or date, state what was entered, state the accurate information, and note who was notified if the process requires it. Avoid turning an amendment into a long explanation about blame or private family details.

Apply the rule to common situations

“Can I text a screenshot to my supervisor?”

Only if the organization has explicitly approved that route and the supervisor is an authorized recipient. Otherwise, use the designated secure system. A screenshot can include more information than the question requires, including names, dates, browser tabs, or unrelated notes.

“Can I use a real note as an example in class?”

Do not use a real client note, even if you plan to remove the name, unless your organization has a specific authorized process and the use is permitted. Create an original fictional example with no copied identifying details. Label it as fictional and avoid combining facts that could point to a real person.

“What if a family member asks what the note says?”

Do not decide access rights from the request alone. Follow the organization’s communication policy and direct the question to the supervisor or authorized contact. Share only through the approved process and only after the requester’s authorization and the applicable requirements are confirmed.

“What if I sent the note to the wrong address?”

Report the event immediately through the organization’s privacy or incident route. Do not attempt to hide it by deleting your sent copy or asking the recipient to ignore it without guidance. Preserve the relevant facts and follow the instructions for containment, documentation, and notification.

Final confidentiality checklist

• The note uses the approved system and required identifier.
• The content is relevant to services, supervision, safety, or an authorized administrative purpose.
• Observations and required measures are accurate and separate from guesses or judgments.
• Unnecessary names, photographs, locations, and private conversations are excluded.
• The recipient, route, and amount of information have been checked before sharing.
• Drafts, screenshots, downloads, and paper copies are stored or disposed of through the approved process.
• Errors are corrected through an auditable process rather than hidden or overwritten.
• Unclear requests, suspected exposure, and safety concerns are escalated promptly.

Frequently asked questions

Are session notes confidential?

Session notes can contain confidential client and service information. Handle them according to the RBT Ethics Code (2.0), organization policy, applicable law, payer requirements, and the approved record system. The exact access and release process depends on the situation.

Can an RBT share a session note with anyone who asks?

No. The request alone does not establish authorization. Confirm the job-related purpose, authorized recipient, approved route, and minimum necessary information with the supervisor or designated contact.

Can an RBT delete an incorrect session note?

Do not delete or overwrite a record unless the approved system and policy specifically direct that action. Use the documented correction or amendment process and notify the appropriate person when required.

Role reminder: This article is educational information, not an official BACB form, legal advice, or individualized supervision direction. Follow the current written program, supervisor, employer, payer, privacy policy, and applicable law.

Official starting points: RBT Ethics Code (2.0), RBT Handbook, and the BACB ethics codes page.