AI Use Policy Template for ABA Agencies and Practices (Word and Excel)
What it is for
An editable AI use policy for an ABA agency or practice, in 9 sections: scope, approved tools, what may go into a tool, consent and transparency, review and signature, supervisees, records, incidents and breaches, and approval. Each rule cites where it comes from: the HIPAA rules in 45 CFR, the BACB Ethics Code, CASP's 2025 practice parameters or Florida's breach law. It comes with an Excel register to list each approved tool and what its vendor confirmed in writing. It names no products.
What it includes
- 9-section policy in Word, with the source of each rule
- Excel register of approved tools: BAA, plan, retention and training use
- Table of acceptable and unacceptable uses to fill in
- Breach steps under HIPAA and Florida law
- Approval and signature block
- Printable PDF of the policy
How to use it
- Download the Word policy and the Excel register.
- Replace every bracketed prompt and delete what does not apply to your organization.
- List each tool in the register: vendor, plan, whether a signed BAA covers that exact plan, how long inputs are kept and whether they train the vendor’s models.
- Have your attorney and your IT or security adviser review it. The BACB encourages legal and technical guidance to set clear AI policies.2
- Train your team on it and set the date of the next review.
The rules it is built on
- A business associate may handle protected health information for you only with satisfactory assurances, documented in a written contract or agreement.1
- Use only the minimum necessary information for the purpose.1
- What you type into a generative AI application may be used as learning material and exported to other users.2
- Families can learn how AI is used, its risks and benefits, and decline it; AI use is disclosed in any work product it contributed to.3
- HIPAA breach notice to the people affected: no later than 60 calendar days after discovery.4 In Florida, a breach affecting 500 or more people in the state is reported to the Department of Legal Affairs no later than 30 days after it is determined or there is reason to believe it occurred.5
What it does not do
Before you adopt it
Questions about the tool
Is this policy legal advice?
No. It is a starting draft that cites the federal rules, the BACB Ethics Code and CASP's practice parameters. Have your attorney and your IT or security adviser review it before you adopt it.
Does it recommend AI tools?
No. It names no products. The register is where you list the tools your organization approves and what each vendor confirmed in writing.
Why a separate Excel register?
A vendor's plans, agreements and data practices change. The register keeps each tool's BAA, retention and training use in one place, with a date for the next review.
Sources
- 45 CFR 164.502, Uses and disclosures of protected health information. eCFR, current.
- BACB Newsletter, July 2024. Behavior Analyst Certification Board (BACB), July 2024.
- Practice Parameters for Artificial Intelligence Use in Applied Behavior Analysis. Council of Autism Service Providers (CASP), July 2025.
- 45 CFR 164.404, Notification to individuals. eCFR, current.
- Florida Statutes 501.171, Security of confidential personal information. Florida Legislature, 2026.
- Ethics Code for Behavior Analysts. Behavior Analyst Certification Board (BACB), Updated 08/2024.
Educational tool. It does not replace clinical judgment, legal advice or your payer’s rules. Always check the current version of each source.