8.2 Mandated Reporting, Legal Obligations, and Documentation/Billing Integrity

Statutory Mandated Reporting Obligations for Behavior Analysts

Behavior analysts occupy a privileged position of trust within clinical, educational, and domestic environments. Because practitioners frequently work intimately with vulnerable populations—including young children, individuals with intellectual and developmental disabilities, and dependent elderly adults—society imposes solemn legal and ethical duties to ensure client protection. Central among these is the status of the behavior analyst as a statutory mandated reporter.

The Legal Status and Scope of Mandated Reporting

Mandated-reporting laws are written by each state (the federal Child Abuse Prevention and Treatment Act [CAPTA] ties funding to states having them). Many states name behavior analysts or the professional groups they belong to (health care, education, social services) as mandated reporters, and some require every adult to report. Standard 3.01 requires behavior analysts to know and comply with the reporting laws that apply to them. This designation extends across four primary domains of harm:

1. Child Physical Abuse: Non-accidental physical injury inflicted upon a child by a parent, caregiver, or custodian (e.g., unexplained burns, linear welts, fractures, internal injuries).
2. Child Sexual Abuse and Exploitation: Any sexual contact, exploitation, or exposure involving a minor.
3. Child Severe Neglect: The persistent failure of a caregiver to provide necessary food, shelter, clothing, medical care, or supervision required for the child's health, development, and well-being.
4. Elder and Vulnerable Adult Abuse or Exploitation: Physical abuse, emotional abuse, caregiver abandonment, fiduciary theft, or financial exploitation of dependent adults or elderly individuals who lack the physical or mental capacity to protect themselves.

The Standard of "Reasonable Suspicion"

A foundational concept tested rigorously on the BCaBA examination is the evidentiary threshold required to trigger a report. Mandated reporting laws do NOT require definitive physical proof, corroborating witnesses, confessions, or certainty.

The statutory threshold is reasonable suspicion (or "cause to suspect"). Reasonable suspicion exists when an objective professional, drawing upon their clinical training, observation, and experience, reasonably suspects that an injury or pattern of circumstances was caused by abuse or neglect rather than accidental trauma. Examples of reasonable suspicion include:

• Symmetrical, geometric, or patterned contusions (e.g., marks resembling electrical cords, belt buckles, handprints, or cigarette burns).
• Severe, unexplained trauma to soft-tissue areas that rarely sustain accidental childhood injuries (e.g., the buttocks, lower back, inner thighs, genitalia, or ears).
• A client's direct verbal, signed, or augmentative communicative disclosure of physical or sexual abuse.
• Extreme, untreated physical neglect, such as severe body wasting, chronic unmanaged dental decay causing open infections, or prolonged absence of essential seizure medications due to caregiver refusal.

The Immediate Reporting Mandate and Statutory Timeframes

Mandated reporting laws require immediate reporting. A clinician must contact the designated state child protective services (CPS), Department of Children and Families (DCF), Adult Protective Services (APS), or local law enforcement agency by telephone immediately upon forming the suspicion. Many states also require a written follow-up report within a set period (often 24 to 48 hours); check the applicable state law.

The Organizational Hierarchy Override: Primacy of Individual Duty

One of the most frequent ethical traps encountered in clinical practice and on certification exams involves agency organizational hierarchy. Often, agency policies state: "All suspected abuse must be reported internally to the Clinical Director, who will investigate and decide whether to contact the state authorities."

Such policies cannot override the law. In most states the duty to report belongs to the person who formed the suspicion, and following an employer policy that delays a report can violate the reporting statute and Standards 1.02 and 3.01.

• Non-Delegable Personal Responsibility: The statutory duty to report is personal to the practitioner who observed or suspected the abuse. It cannot be delegated, assigned, or surrendered to an employer, supervisor, clinic owner, school principal, or agency board.
• Absolute Prohibition on Delay or Suppression: A behavior analyst cannot be required to obtain administrative "permission" or "approval" prior to calling child protective services. A practitioner who obeys a supervisor's order not to call CPS may be personally liable for failure to report under state law.
• No Internal Clinical Investigations: Mandated reporters are strictly prohibited from conducting their own internal investigations. A behavior analyst must never interrogate the parents, confront suspected perpetrators, examine crime scenes, or delay a report to collect "more data." Conducting private inquiries alerts potential abusers, creates opportunities for evidence destruction or witness intimidation, increases the danger of retaliatory violence against the victim, and contaminates official forensic child interview procedures.

               [ SUSPECTED ABUSE / NEGLECT IDENTIFIED ]
                                  |
           +----------------------+----------------------+
           |                                             |
[ THE ILLEGAL / UNETHICAL PATH ]              [ THE MANDATED LEGAL PATH ]
  1. Report to supervisor only.                 1. Call State CPS / APS Hotline
  2. Await agency internal inquiry.                IMMEDIATELY without delay.
  3. Interrogate parents for proof.             2. File written report within 24-48h.
  4. Suppress report to protect agency.         3. Inform supervisor as courtesy ONLY;
  --> RESULT: Criminal liability,                 supervisor CANNOT alter or block.
      loss of BACB certification.               --> RESULT: Legal immunity, client safety.

Whistleblower Protections and Good-Faith Immunity

To ensure that professionals report suspicions without fear of personal or financial devastation, state and federal laws provide robust legal shields:

• Good-Faith Immunity: State laws generally make a mandated reporter who reports in good faith immune from civil liability (e.g., defamation or breach-of-confidentiality claims) and criminal liability, even if the investigation finds that no abuse occurred.
• Anti-Retaliation Protections: Many state reporting laws and whistleblower statutes prohibit employers from firing, demoting, or otherwise retaliating against an employee for making a required report; the remedies vary by state.

---

Record Keeping and Retention Standards (Standard 2.05)

Under Standard 2.05 (Documentation Protection and Retention), behavior analysts know and comply with all applicable requirements (BACB rules, laws, regulations, contracts, and funder and organization policies) for storing, transporting, retaining, and destroying documentation, and Standard 3.11 requires detailed, high-quality documentation of professional activity. Relevant laws include the Health Insurance Portability and Accountability Act (HIPAA) and the Family Educational Rights and Privacy Act (FERPA).

Contemporaneous, Objective, and Legible Documentation

Clinical documentation is the legal and scientific evidence of treatment delivery. Behavior analysts must author documentation that satisfies four operational criteria:

1. Contemporaneous Execution: Session notes, supervision documentation, and raw data sheets must be completed during or immediately following each clinical encounter. Delayed record writing—such as reconstructing notes days or weeks later from memory—undermines accuracy and often violates funder documentation requirements.
2. Objective Behavioral Descriptions: Notes must describe observable, measurable client actions and precise environmental events. Clinicians must avoid subjective, judgmental, or mentalistic language:
   • Unacceptable Subjective Entry: "Client had an awful attitude today, was manipulative, and threw a malicious tantrum because he wanted to punish his mother."
   • Acceptable Objective Entry: "Client engaged in 3 episodes of screaming (intensity > 70 dB) and 2 episodes of property destruction (knocking over a plastic chair), with a cumulative duration of 8 minutes following the presentation of academic flashcards. Therapist implemented the DRA protocol, providing a functional communication card for a break."
3. Administrative Completeness: Every record must clearly document the client's full legal name, date of service, exact start and end times (to the minute), location of service (e.g., clinic, home, community), specific behavioral goals addressed, prompt levels, interventions implemented, caregiver participation, and the legible printed name, credential, and signature of the rendering provider.

Physical and Electronic Data Security Protocols

Under HIPAA Security Rules, Protected Health Information (PHI) encompasses any individually identifiable health data, including client names, diagnoses, addresses, progress notes, and video recordings. Behavior analysts must implement multi-layered physical and digital safeguards:

• Physical Safeguards: The HIPAA Security Rule requires reasonable physical safeguards but does not prescribe a number of locks. Typical practice is to store paper charts and data sheets in locked cabinets in access-controlled areas and never leave records unattended on desks, in open therapy rooms, or in vehicles.
• Electronic Safeguards: Digital health records (electronic health record [EHR] platforms, electronic data collection tablets, cloud storage) must feature:
  • Encryption of data in transit and at rest (a HIPAA safeguard that is standard practice).
  • Unique user identification and complex passwords; sharing login credentials between RBTs or BCaBAs is strictly prohibited.
  • Automated session logouts following brief periods of inactivity.
  • Role-based access controls limiting staff access exclusively to clients assigned to their direct caseload.
  • Formal Business Associate Agreements (BAAs) executed with all cloud hosting, data collection, and communication software vendors.
• Mobile Device Security: Storing client video recordings, photos, or unencrypted data files on personal phones, tablets, or flash drives creates serious breach risk and usually violates organization policy and Standard 2.05. Clinical media belong on encrypted, organization-approved platforms.

Record Retention: Who Sets the Period?

How long must records be kept? The Ethics Code does not set one universal number for client records. Standard 2.05 requires behavior analysts to know and follow every applicable requirement (state record-retention laws, Medicaid and other funder contracts, HIPAA documentation rules, and organization policy), and it notes that when a behavior analyst leaves an organization, these responsibilities remain with the organization. Requirements differ by state and payer: many health-record laws set a period of years after the last service, and many extend the period for minors until a set number of years after they reach adulthood.

The Code does set two specific rules a BCaBA should know:

• Supervision documentation: Standard 4.05 requires keeping supervision documentation for at least 7 years (longer if law or other parties require) and instructing supervisees to do the same. The BCaBA Handbook likewise requires BCaBAs and their supervisors to keep supervision records for at least seven years.
• Destroying originals: Physical documentation may be destroyed after making electronic copies or summaries only when the applicable requirements allow it.

Clinical Illustration: An agency wants to purge every file closed more than seven years ago. Before anything is destroyed, the BCaBA should check the state's retention law, the payer contracts, and agency policy, paying special attention to clients who were minors.

Secure Disposal Protocols

Once the statutory retention timeline has expired, records must be disposed of using methods that ensure complete, unrecoverable destruction:

• Paper Records: Must undergo cross-cut shredding, incineration, or commercial pulverization by a certified document destruction contractor providing a formal Certificate of Destruction.
• Digital Media: Hard drives, server backups, and solid-state memory devices must undergo permanent cryptographic erasure or physical degaussing and shredding conforming to National Institute of Standards and Technology (NIST) Special Publication 800-88 guidelines. Discarding old clinic laptops or hard drives without wiping them can cause a reportable HIPAA breach.

---

Billing Integrity and Regulatory Compliance (Standard 2.06)

Under Standard 2.06 (Accuracy in Service Billing and Reporting), behavior analysts identify their services accurately on bills and reports, do not bill nonbehavioral services under behavioral authorizations, and inform relevant parties and correct billing inaccuracies when they discover them. Billing fraud in applied behavior analysis has become a major target of state Medicaid fraud control units and federal enforcement under the False Claims Act (31 U.S.C. § 3729).

The Standardized AMA CPT Coding Matrix for ABA Services

Applied behavior analysis services are billed under the American Medical Association (AMA) Current Procedural Terminology (CPT) adaptive behavior services codes. Each code is reported in 15-minute units:

• 97151 Behavior identification assessment: administered by a physician or other qualified health care professional (QHP), face-to-face with the patient and/or caregivers, plus non-face-to-face scoring, interpretation, and report/treatment-plan preparation.
• 97152 Behavior identification-supporting assessment: administered by one technician under the direction of a QHP, face-to-face with the patient.
• 97153 Adaptive behavior treatment by protocol: administered by a technician under the direction of a QHP, face-to-face with one patient.
• 97154 Group adaptive behavior treatment by protocol: administered by a technician under the direction of a QHP, face-to-face with two or more patients (no more than eight).
• 97155 Adaptive behavior treatment with protocol modification: administered by a QHP, which may include simultaneous direction of a technician, face-to-face with one patient.
• 97156 Family adaptive behavior treatment guidance: administered by a QHP, face-to-face with guardians or caregivers, with or without the patient present.
• 97157 and 97158: QHP-administered group codes (multiple-family caregiver guidance, and group treatment with protocol modification for no more than eight patients).

Where does a BCaBA fit? CPT does not name credentials; each payer decides who counts as a QHP. BCBAs and licensed behavior analysts usually do, RBTs bill as technicians, and payers treat BCaBAs differently (some allow assistant-level billing of certain codes under BCBA supervision; others allow only technician codes). Follow the payer's policy and the supervision requirements.

Prohibited Fraudulent Billing Practices

Submitting false, inflated, or unrendered claims violates both the BACB Ethics Code and state/federal criminal statutes. Behavior analysts must vigilantly avoid the following pervasive billing violations:

1. Upcoding: Billing for a service of higher complexity, longer duration, or requiring a higher professional credential than what was actually rendered:
   • Clinical Upcoding Trap: An assistant behavior analyst sits in an observation booth or does administrative paperwork on a laptop while an RBT implements discrete trials with a client. The agency bills the entire duration under CPT 97155. This is upcoding: 97155 requires the QHP to be face-to-face with the patient delivering treatment with protocol modification. Passive observation without modifying treatment must not be billed under 97155.
2. Ghost Billing (Billing for Services Not Rendered): Submitting billing claims for scheduled therapy sessions that were cancelled, missed due to client illness, or lost due to inclement weather. Billing for "prep time" when a client no-shows constitutes ghost billing.
3. Unbundling: Billing separately for individual component procedures that are already included within a single comprehensive CPT code package to artificially inflate reimbursement.
4. Billing Non-Clinical / Administrative Time: Submitting clinical CPT codes (such as 97153 or 97155) for time spent driving to a client's home, attending administrative agency meetings, scheduling staff, or cleaning clinic materials. Drive time and general administrative paperwork are non-billable overhead expenses.
5. Concurrent / Double Billing: Billing two different funding sources (e.g., commercial insurance and Medicaid) for the same clinician during the exact same 15-minute time increment, or billing for two different clients simultaneously when the code requires 1-on-1 care.

---

Documentation and Billing Compliance Pitfalls

The following table details pervasive documentation and billing compliance violations, classifying their legal status, the governing regulatory enforcement mechanism, and mandatory ethical remediation:

---

Common BCaBA Exam Traps: Legal, Mandated Reporting, & Billing

• Trap 1: The "Internal Agency Investigation" Trick: Questions will present a scenario where an agency director or principal demands that staff submit suspected abuse reports internally so the agency can investigate first. The exam wants to see if you will comply with your supervisor. You must never wait for an internal inquiry; your legal duty as a mandated reporter is individual, non-delegable, and immediate.
• Trap 2: Delaying Reports to Gather Definitive Evidence: A clinician who waits for a third or fourth bruise to "be sure" before calling CPS violates the law. Reasonable suspicion is the sole standard. Seeking proof is the job of sworn child protective investigators and police detectives, not behavior analysts.
• Trap 3: Billing Missed Appointments as Clinical Time: Questions may describe an impoverished family missing sessions, with the agency billing the session to pay the RBT's hourly wage. This is fraud. No client contact means no billable service under ABA CPT codes.
• Trap 4: Treating "7 Years" as a Universal Client-Record Rule: The Code's explicit 7-year rule is for supervision documentation (Standard 4.05). Client-record retention depends on state law, payer contracts, and policy, and is often longer for minors.