AI Tool Checklist for ABA Providers: HIPAA and the BACB Ethics Code
What it is and what it is for
A checklist to run before you or your team use an AI tool with client information. It follows the HIPAA rules in 45 CFR (business associate agreements, minimum necessary, de-identification and breach notice), the BACB Ethics Code, the BACB's July 2024 note on AI and CASP's 2025 practice parameters. It names no products: vendors change their terms, so you confirm each item in writing.
Key facts
Before any client data goes in
Consent and transparency
You stay the author
Supervisees and records
If something goes wrong
What is current
The HIPAA rules are quoted from the current eCFR, the Ethics Code is the version updated in August 2024, and the Florida statute is the 2026 text, all read on October 15, 2026.158 AI vendors change their plans and agreements often: confirm each item with your vendor in writing before you start, and again when your plan changes.
Frequently asked questions
Can I use an AI tool with client data under HIPAA?
Only with a vendor that signs a business associate agreement covering the product and plan you use, sharing only the minimum necessary, and reviewing everything yourself. Without a BAA, enter no client health information. De-identifying under one of HIPAA's two methods is the alternative, and free-text notes often keep identifiers of relatives or schools.
Does the BACB ban AI?
No. The BACB's July 2024 note describes the risks, says certificants must follow their ethics code whatever AI tool they use, and encourages legal and technical guidance to set clear policies.
Do I have to tell families and payers that I use AI?
CASP's 2025 practice parameters say clinicians are expected to disclose AI use in any work product it contributed to, that informed consent can give clients the chance to decline it, and that you should not assume payers permit or pay for every use of AI.
Who is responsible if the AI gets something wrong?
You are. CASP says the practitioner is responsible for clinical documentation, and the Ethics Code asks you to keep reports accurate and to correct inaccurate submissions as soon as you find them.
Sources
- 45 CFR 164.502: Uses and disclosures of protected health information. eCFR, Office of the Federal Register, current.
- 45 CFR 164.514: Other requirements relating to uses and disclosures (de-identification). eCFR, Office of the Federal Register, current.
- 45 CFR 164.404: Notification to individuals. eCFR, Office of the Federal Register, current.
- 45 CFR 164.410: Notification by a business associate. eCFR, Office of the Federal Register, current.
- Ethics Code for Behavior Analysts. Behavior Analyst Certification Board (BACB), Updated 08/2024.
- BACB Newsletter: Considerations for Using Artificial Intelligence in ABA Practice. Behavior Analyst Certification Board (BACB), July 2024.
- Practice Parameters for Artificial Intelligence Use in Applied Behavior Analysis. Council of Autism Service Providers (CASP), July 2025.
- Florida Statutes section 501.171: Security of confidential personal information. The Florida Legislature, 2026.
Educational tool. It does not replace clinical judgment, legal advice or your payer’s rules. Always check the current version of each source.