7.2 Responsibility to Clients: Confidentiality, Informed Consent, and Client Dignity

Defining the "Client" and the Hierarchy of Ethical Responsibility (Code Glossary and Section 3)

In applied behavior analysis, establishing who holds the status of "client" is foundational to resolving complex clinical and ethical conflicts. In organizational, school, and community environments, multiple parties interact simultaneously: the individual receiving treatment, parents or legal guardians, classroom teachers, school principals, group home directors, private insurance companies, and state medicaid agencies.

The Code defines the client as the direct recipient of the behavior analyst's services and a stakeholder as anyone else impacted by and invested in those services (parents, teachers, funders, and others). Its core principles direct behavior analysts to protect the welfare and rights of clients above all others, and Standard 3.08 requires placing the client's care and welfare above all others when a third party contracts for services. In practice, this produces a working hierarchy of ethical responsibility:

• The Primary Client: The primary beneficiary of behavior-analytic services is the individual whose behavior is being assessed or modified (the direct recipient of services). Regardless of who signs the initial service agreement or who remits payment, the practitioner's ultimate ethical allegiance is to this individual.
• Secondary Stakeholders: Parents, legal guardians, and family members who care for the primary client and have legal authority to make healthcare and educational decisions.
• Tertiary Entities and Third-Party Payers: Public school districts, private insurance companies, regional healthcare authorities, or residential facility administrators who contract or pay for behavior-analytic services.

Resolving Conflicting Interests and Advocacy Mandates

Ethical dilemmas frequently arise when the goals or demands of tertiary entities directly conflict with the welfare and rights of the primary client. For example:

• A school administrator demands that an assistant behavior analyst immediately implement mechanical restraint or exclusionary isolation to suppress a child's vocal stereotypy because it distracts other students.
• A third-party insurance payer demands the immediate termination of behavioral funding because a client has not achieved arbitrary normative benchmarks, despite documented, steady-state behavioral progress.
• A parent requests the use of aversive electric shock or corporal punishment to address non-injurious property destruction.

Under Standards 2.01 and 3.08 and the position paper by Van Houten et al. (1988), The Right to Effective Behavioral Treatment, the behavior analyst has an affirmative ethical duty to advocate for the primary client's welfare above institutional or financial convenience. The client possesses an inalienable right to:

1. A therapeutic physical and social environment;
2. Services directed toward personal welfare, autonomy, and habilitation;
3. Treatment delivered by a competent behavior analyst;
4. Curricula that teach functional, liberating behavioral repertoires;
5. Ongoing behavioral assessment and dynamic visual data analysis;
6. The most effective treatment procedures available.

When third parties demand procedures that are restrictive, punitive, ineffective, or harmful, the behavior analyst must refuse to implement them, document the conflict objectively, educate stakeholders on evidence-based alternatives, and, if the conflict cannot be resolved, initiate formal transition or termination of services.

---

Confidentiality, Privacy Protections, and Statutory Compliance (Standards 2.03 and 2.04)

Confidentiality is an ethical cornerstone and a legally enforceable right. Standards 2.03 and 2.04 mandate that behavior analysts take all necessary precautions to protect the confidential information of clients, supervisees, and research participants.

Scope of Confidential Protected Information

Confidential information includes all Personally Identifiable Information (PII) and Protected Health Information (PHI):

• Full legal names, nicknames, and aliases;
• Dates of birth, age, gender, and social security numbers;
• Home addresses, telephone numbers, and email addresses;
• Diagnostic evaluations, psychiatric classifications, and medical records;
• Raw behavioral data sheets, observation notes, and clinical session graphs;
• Video recordings, audio files, and photographs captured during therapy.

Multi-Contextual Protection Modalities

Behavior analysts must maintain active privacy protections across all operational modalities:

• Verbal Confidentiality: Case details must only be discussed with authorized individuals in private, soundproof clinical spaces. Practitioners must never discuss client information in public school hallways, clinic waiting rooms, elevators, cafeterias, or during social gatherings with friends or colleagues.
• Physical Security: Hard-copy client files, paper data sheets, and clinical binders must be stored securely (for example, in locked cabinets in access-controlled areas) according to law and organization policy when not in active use.
• Digital and Electronic Security: All electronic devices utilized for data collection (laptops, tablets, mobile smartphones) should be password-protected and, where possible, encrypted, with access limited to authorized staff. When a HIPAA-covered organization stores data with a cloud vendor, that vendor signs a Business Associate Agreement (BAA).
• Social Media Restrictions (Standard 5.10): Behavior analysts never publish client information or digital content on their personal social media accounts or websites. On professional accounts, they may publish client content only after obtaining informed consent for each publication, adding a disclaimer that consent was obtained and the content should not be reused, posting in a way that limits sharing, and working to prevent and correct misuse. Even when client names are omitted, "jigsaw identification"—the synthesis of unique behavioral topographies, geographic details, age, and clinical settings—frequently allows the public to identify the client, constituting an egregious breach of confidentiality.

Statutory Frameworks: HIPAA and FERPA

Behavior analysts must navigate two overarching federal statutory frameworks governing privacy:

• Health Insurance Portability and Accountability Act (HIPAA): Governs healthcare clearinghouses, providers, and clinical agencies. HIPAA enforces the Privacy Rule (safeguarding PHI) and the Security Rule (mandating technical, physical, and administrative safeguards for electronic data). HIPAA enforces the "minimum necessary" rule: practitioners must access, discuss, and disclose only the absolute minimum amount of confidential data necessary to accomplish the intended clinical purpose.
• Family Educational Rights and Privacy Act (FERPA): Governs educational agencies and public school districts receiving federal funding. FERPA protects the privacy of student educational records, granting parents and eligible adult students the right to inspect, review, and request amendments to behavioral intervention plans, IEP goals, and school-based data records.

---

Exceptions to Confidentiality (Standards 2.04 and 3.10)

Confidentiality is not absolute. Standard 2.04 allows behavior analysts to share confidential information only (1) when informed consent is obtained, (2) to protect the client or others from harm, (3) to resolve contractual issues, (4) to prevent a crime reasonably likely to cause physical, mental, or financial harm to another, or (5) when compelled by law or court order; even then, they share only the information critical to the purpose. Standard 3.10 requires informing clients and stakeholders of these limits at the outset of services. The most frequently tested situations are:

1. Mandated Reporting of Abuse, Neglect, or Exploitation

Behavior analysts are designated mandated reporters under state and federal statutes. A practitioner who observes, suspects, or receives disclosure of abuse, neglect, or exploitation involving a child, an elderly individual, or a vulnerable adult with disabilities must immediately file a report with the appropriate statutory agency (e.g., Child Protective Services [CPS], Adult Protective Services [APS], or law enforcement).

• Threshold for Reporting: Mandated reporting requires only reasonable suspicion; it does not require definitive physical proof, medical validation, or conclusive investigation. Attempting to conduct an independent clinical investigation before reporting is illegal and unethical.
• Supremacy Over Employer Gag Orders: The duty to report is an individual legal obligation. An employer, clinic director, or school principal cannot overrule, delay, or prohibit an analyst from filing a mandated report.

2. Imminent, Credible Harm to Self or Others (Tarasoff Doctrine)

The landmark case Tarasoff v. Regents of the University of California (1976) recognized a duty to protect identifiable third parties, and state laws now differ on how that duty to warn or protect applies. Standard 2.04 permits disclosure to protect the client or others from harm when an individual poses a direct, imminent, and credible physical threat to themselves or an identifiable third party. If a client communicates a specific, credible intent and lethal plan to commit suicide or inflict severe physical violence on another person, the analyst should act immediately to protect the people at risk (for example, contacting emergency services and following the supervisor's and organization's crisis procedures), consistent with state law.

3. Lawful Court Orders and Judicial Mandates

Behavior analysts must release confidential records when commanded by a valid court order signed by a judge.

• Critical Exam Distinction: A court order signed by a judge carries the force of law and mandates compliance. In contrast, an administrative discovery subpoena issued by an opposing attorney is not a court order; receiving an attorney subpoena requires consulting legal counsel and the client's legal representative to file appropriate protective motions before releasing confidential files.

4. Written, Signed Authorization for Release of Information (ROI)

Confidentiality may be breached when the client or their legal guardian executes an explicit, written, and time-limited Authorization for Release of Information. The ROI must explicitly identify who is authorized to disclose information, the specific recipient, the exact records to be shared, the clinical purpose of disclosure, and the expiration date.

---

The Three Legal Pillars of Informed Consent (Standard 2.11)

Standard 2.11 dictates that behavior analysts must obtain valid informed consent prior to conducting assessments, implementing behavioral interventions, modifying treatment procedures, or sharing confidential data. Informed consent is an ongoing operational process, not merely the administrative signing of a boilerplate document.

For informed consent to be legally and ethically valid, all three essential pillars must be completely satisfied:

                    [ THE THREE PILLARS OF INFORMED CONSENT ]
                                        |
       +--------------------------------+--------------------------------+
       |                                |                                |
  [ CAPACITY ]                   [ VOLUNTARINESS ]                [ INFORMATION ]
Legal competence &             Absence of coercion,             Full disclosure in
cognitive ability              duress, penalties, or            understandable language;
to weigh risks                 undue financial pressure         unconditional right to revoke

1. Capacity

Capacity refers to the legal and cognitive competence of an individual to understand the nature of the proposed clinical procedures, appreciate the consequences, evaluate risks and benefits, and make a reasoned, voluntary choice.

• Adults (aged 18 and older) are legally presumed competent unless a court of law has formally adjudicated them incapacitated and appointed a legal guardian or conservator.
• Minors under age 18 legally lack capacity (except for legally emancipated minors); therefore, legal consent must be granted by their parent or legal guardian.
• When working with adults with intellectual disabilities who maintain their legal rights, the analyst must ensure information is presented in adapted, accessible formats matching their cognitive repertoire.

2. Voluntariness

Consent must be provided entirely freely, without coercion, duress, manipulation, intimidation, or undue incentive.

• Coercive Threats Void Consent: If a group home manager tells a resident, "Sign this behavior plan or you will be evicted," or if a school tells a parent, "Consent to this timeout protocol or your child is expelled," the resulting consent is legally and ethically void because it was obtained under duress.
• Undue Incentives: Offering excessive, disproportionate financial or material rewards that overwhelm an individual's judgment constitutes undue incentive, destroying voluntariness.

3. Information

The clinician must provide comprehensive, fully transparent disclosure of all relevant clinical facts in clear, non-technical language that the consumer can thoroughly understand. Full information requires:

• The exact nature, procedures, and behavioral techniques to be implemented;
• Anticipated clinical benefits and realistic timelines for progress;
• Potential risks, discomforts, or unwanted side effects (e.g., extinction bursts, emotional responding);
• Evidence-based alternative interventions and the projected risks of non-treatment;
• Precise data collection protocols, video recording practices, and confidentiality safeguards;
• An explicit, written statement affirming that consent may be withdrawn at any time without penalty or forfeiture of standard services.

---

Client Assent vs. Legal Consent: Honoring Dignity and Autonomy

While legal informed consent can only be granted by an individual possessing legal capacity (or an authorized surrogate), behavior analysis recognizes that every human being retains an inherent right to bodily autonomy and personal agency. This is operationalized through client assent.

Defining Client Assent

Assent is the affirmative, ongoing agreement to participate in behavioral services provided by an individual who legally lacks the capacity to grant informed consent (such as young children or conserved adults with significant developmental disabilities). Standard 2.11 and contemporary trauma-informed behavioral literature mandate that behavior analysts solicit and maintain client assent throughout all clinical interactions.

Distinguishing Assent from Passive Compliance

Practitioners frequently commit a grave clinical error by equating passive compliance with assent. Sitting quietly because resistance has been extinguished through coercive physical prompts or learned helplessness is not assent. Genuine assent involves active, willing participation, characterized by:

• Voluntary approach toward the practitioner and instructional stimuli;
• Smiling, positive vocalizations, and engagement with materials;
• Receptive following of instructions without physical guidance or intimidation.

Behavioral Indicators of Dissent

Dissent is the behavioral communication of refusal, protest, or desire to terminate an activity. In non-speaking or developmentally delayed individuals, dissent is expressed topographically through:

• Vocal Dissent: Crying, screaming, whining, saying "no," "stop," or "all done."
• Motor Dissent: Pushing materials away, swiping instructional stimuli, turning the body away, hiding face, dropping to the floor, pulling away from physical guidance, or eloping toward an exit.
• Physiological Dissent: Rapid shallow respiration, trembling, muscle rigidity, facial flushing, or clenching fists.

Ethical Mandate When Dissent Occurs

When a client emits behavioral dissent, the behavior analyst must never dismiss the behavior as mere "maladaptive noncompliance" to be crushed via escape extinction. The ethical practitioner must:

1. Pause Immediately: Cease instructional demands or intervention procedures.
2. Analyze Environmental Context: Investigate establishing operations—is the task excessively difficult, pacing too rapid, reinforcement density too low, or is the client experiencing pain, illness, or fatigue?
3. Honor Communicative Agency: Provide a functional communication mechanism (e.g., teaching and honoring a break mand), offer meaningful choices between activities, adjust instructional parameters, and renegotiate participation.

---

Comparative Matrix: Informed Consent vs. Client Assent

The following matrix contrasts legal informed consent with client assent across operational, legal, and behavioral dimensions:

---

Common BCaBA Exam Traps: Client Responsibilities, Rights, and Consent

• Trap 1: Prioritizing the Funder over the Primary Client: Questions often describe a school district, insurance company, or group home demanding quick punishment or cessation of services to save money. The correct ethical response always prioritizes the direct recipient's welfare and habilitation over institutional or financial convenience.
• Trap 2: Confusing Attorney Subpoenas with Judicial Court Orders: An attorney discovery subpoena is not a court order. A court order signed by a judge must be obeyed; an attorney subpoena requires legal consultation and protective motions before releasing confidential PHI.
• Trap 3: Conducting an Internal Investigation Before Mandated Reporting: When suspected child or elder abuse is observed, the analyst must report immediately based on reasonable suspicion. Delaying a report to gather proof, confront the abuser, or conduct an internal investigation is illegal and violates the Ethics Code.
• Trap 4: Overriding Client Dissent with Escape Extinction: When a child cries, pulls away, and pushes materials, forcing them through trials under the label of "escape extinction" violates client dignity and assent. Ethical practice demands pausing, honoring the communicative protest, and redesigning the motivating operations and demand parameters.