Release of Information for ABA Care Collaboration: What to Share and What Not To

A Release of Information (ROI) is the signed paper that lets a BCBA share a kid's clinical info with another provider, informed consent is the real talk that happens before the parent signs it, and HIPAA's minimum necessary standard means you only share the smallest slice of info needed to help the kid. Those three things travel together. If one of them is missing, the whole collab is on shaky ground.

This page is the paperwork side of care collaboration. It pairs with the talk's full walkthrough on consent, sharing rules, and HIPAA. If you want the who-do-I-collab-with version, the sibling pages cover billing, scope, conflict, and prep. This one is about how to make any of that legal in the first place.

Why a release of information is the foundation of every collab#

If you call an SLP and start trading kid details without a signed ROI, you have a HIPAA problem and a trust problem at the same time. A signed ROI is what turns a "we should talk" idea into a real, documented, legal handoff between providers. It says the caregiver knows what is going to be shared, with whom, and why.

"Everything starts with a release of information and informed consent."

Matt frames it as the first step in the collab process, not the last. That order matters. When you treat the ROI as the foundation, every later step (the meeting, the data share, the IEP attendance) sits on real consent. When you treat it as a formality, every later step is built on a guess.

Intake-packet ROI vs. as-needed ROI: a both-and approach#

There are two camps in ABA on this. Camp one drops a stack of ROIs in the intake packet so the kid is "covered" for every provider on day one. Camp two does an ROI only when a new provider actually shows up, so each signature gets its own conversation.

Both camps have a point. The intake-packet method makes sure nothing falls through the cracks. The as-needed method makes sure each consent is a real choice, not a rubber stamp on page 17 of a sign-in flow.

The fix is a both-and system. Keep an intake checklist that flags every provider the family already sees. Then walk through each ROI as a separate conversation, on its own page or in its own meeting, not buried in a packet. When a new provider gets added mid-treatment, you do a fresh as-needed ROI for that one.

A common operations setup: the intake coordinator gathers the list of current providers and stages the ROIs. The BCBA owns the consent conversation and the signature. That split keeps paperwork from getting forgotten and keeps the consent talk in clinical hands.

How to have the conversation so consent is actually informed#

Informed consent is not a checkbox. It is a real-back-and-forth where the caregiver understands what you want to share, with whom, why it helps their kid, and what happens if they say no or change their mind later. The word "informed" is the whole point.

"Instead of hiding your ROI at the bottom of a 17 page DocuSign."

A clean version of the talk looks like this:

• Tell the caregiver you noticed their kid sees an SLP, an OT, and a pediatrician.
• Explain what you would share with each (broad goals, what is working, safety info).
• Explain what you would not share (gossip, opinions, raw assessment scores out of context).
• Tell them they have the first and final say, and that they can revoke any of this at any time.
• Get the signature, then document the conversation in the chart.

Doing it this way takes about 10 minutes per family. It also makes every later care collab call easier, because the caregiver already knows what you are doing and why.

What is fair game to share with another provider#

Once the ROI is signed, you still do not get to share everything. You share what is relevant to the joint goal for that kid.

"What is relevant... agreed upon outcomes and then how we're getting there."

Things that are fair game:

• The agreed-upon outcomes for the kid (e.g., functional communication, safer mealtimes, longer SLP sessions without interfering behavior).
• The path you are taking to get there (the broad strokes of the behavior plan, not the page numbers).
• What is working and what is not working, in plain language.
• Safety concerns and protocols, especially for severe behavior.
• Data the other provider can actually use, like sleep and behavior trends before a psychiatrist visit.

A simple rule: if the info would help the other provider make a better decision for this kid this week, it belongs in the share. If it would not, it does not.

What you should keep to yourself, even if the other provider asks#

The ROI is not a blank check. There are categories of info that stay with you even when another provider asks.

"Things that are not relevant to share... assessment scores, personal opinions, and of course gossip and speculation."

Keep out of the share:

• Raw assessment scores stripped of context. Send a summary of what the scores mean for treatment, not a number that the other provider will misread.
• Personal opinions about the family, the home, or the caregivers.
• Anything that sounds like gossip, even if it is true.
• Speculation about diagnoses outside your scope (e.g., a BCBA guessing at a psychiatric label).
• Info from one caregiver that the other caregiver has not consented to share.

If a provider pushes for any of this, the answer is, "That is outside what the family consented to share. If it is clinically important, I can go back to them and ask." That sentence protects the kid, the family, and your license at the same time.

The HIPAA minimum necessary standard for BCBAs#

HIPAA has a rule that does most of the work here. It is called the minimum necessary standard, and Matt calls it out by name as the line every BCBA should know when shaping a collab share.

In plain English, the rule means: when you share protected health info for treatment, share the smallest amount that gets the job done. Not the whole chart. Not every session note. Not the full assessment battery. Just the slice the other provider needs to do their part this week.

For a BCBA, that usually looks like:

• A one-page summary instead of the full behavior plan.
• A graph of the relevant trend instead of every data sheet.
• The two goals the SLP can support, not all 14 goals in the program.
• The medication-relevant data (sleep, affect, behavior counts) for the psychiatrist, not the whole IEP.
• A short safety note for the OT, not the full incident log.

Minimum necessary also applies to who hears it. A care collab call with the SLP does not need to include the front desk staff. A psychiatrist meeting does not need the school's whole team copied. A pediatrician update does not need the kid's RBT on the line. The fewer people on a share, the tighter the share has to be, and the safer the family's info stays.

A simple test before you hit send: if a reviewer pulled this share six months from now and asked, "What part of this did the other provider actually need to do their job?" you should be able to point to every line. If a line does not pass that test, cut it.

Secure channels for sharing data without breaking privacy#

You can have a perfect ROI and still blow it if you email the wrong file to the wrong inbox. Secure channels are the last piece.

Some patterns that work in practice:

• Encrypted email or a HIPAA-aligned messaging tool for written shares.
• A scheduled Google Meet or phone call for clinical conversations, with a documented note after.
• A shared, access-controlled folder for ongoing reports, not email attachments that live forever in someone's inbox.
• Phone calls for pediatricians and psychiatrists who prefer them. Video for SLPs, OTs, and mental health therapists who prefer those. Offer both.

The minimum necessary standard applies to channel choice too. Use the most secure channel that still actually gets used. The most secure tool in the world does not help if the SLP never logs in.

FAQ#

Do I need a separate release of information for every provider? Yes, in almost every case. One ROI per receiving provider keeps the consent specific and easy to revoke. A blanket "share with anyone" ROI is hard to defend and easy for a caregiver to misunderstand.

Can a parent revoke a release of information mid-treatment? Yes. The caregiver has the first and final say, and that includes pulling consent later. Document the revocation, stop sharing immediately, and tell the other provider that future shares are paused until the family reauthorizes.

What information should never go in a collab note? Personal opinions about the family, gossip, speculation about diagnoses outside your scope, and raw assessment scores without context. If you would not want it read aloud at an IEP meeting with the caregiver in the room, do not write it in a collab note.

Is email secure enough for sharing protected health information? Standard email is usually not enough on its own. Use an encrypted email service or a HIPAA-aligned messaging tool, or send a link to a secure folder instead of attaching the file. Document which channel you used in the chart.

Who on my team should own the ROI paperwork? Operations or intake usually owns the paperwork side (gathering the provider list, staging the forms, tracking signatures). The BCBA owns the consent conversation and the clinical decision about what to share. Split it so neither piece gets dropped.

Keep going#

Care collaboration only works if the paperwork and the consent talk are solid. From here, the next questions are usually about billing for it, staying inside scope, and handling the hard provider conversations. The sibling pages below pick up each of those threads.

Want to see Matt walk through the full ROI workflow, the HIPAA piece, and the live caregiver-conversation script? The recording has the whole thing. You can watch Stronger Together: Care Collab and grab the CEU on openceu.com.