Confidentiality and Professional Boundaries

As a Registered Behavior Technician (RBT), you see private parts of families' lives. Two habits protect those families. First, share client information only when the job needs it and your supervisor has directed it, or the law allows it. Second, keep your work role from mixing with personal roles, like friendships, side jobs and gifts, in ways that could bend your judgment.

These rules come from the BACB's RBT Ethics Code. Your employer and the law where you work can add stricter requirements, and you follow those too.

What you'll be able to do

• Handle client information correctly at each step: collecting it, using it, storing it, protecting it and sharing it.
• Recognize when the law may allow or require disclosure, and why a legal duty to report can't wait for approval.
• Explain why identifying client content stays off social media.
• Describe your credentials and services accurately, without promising results.
• Spot a multiple-relationship or gift problem, including one involving your supervisor, and know whom to tell.

No prior credential is needed. A few terms:

• Client: the person receiving services.
• Stakeholder: someone else affected by and invested in the services, such as a parent, caregiver or funder.
• Supervisor: your RBT Supervisor or RBT Requirements Coordinator, who directs your work and is responsible for it.

Share what the job needs, through the job's channels

Confidential client information is information about clients, and the records about them, that you must keep private. The BACB, your employer and the law (such as privacy laws) set the requirements for protecting it. The duty also covers stakeholders and others in your workplace. A useful working habit is to treat what you learn about a client through your work as private unless your supervisor or employer tells you otherwise.

The Code says you discuss confidential client information only under your supervisor's direction, unless the law allows sharing for a valid reason. In job communications, such as emails and session notes, you include only the information the task needs.

Example: you email your supervisor that a session ended early. The time and what happened during the session belong in that email. A comment you overheard about the family's money troubles does not, because the email's purpose doesn't need it.

Now change one fact. At dinner you tell a friend, "A kid I work with had a really rough day," and you don't use a name. It is tempting to think that leaving out the name makes this fine. It doesn't, for two reasons:

• Your friend has no work reason to know, and your supervisor didn't direct the conversation.
• Small details like the school, the street or the age can identify a child without a name.

Good intentions don't change this. Perhaps your friend is a teacher and you want advice. Questions about your services go to your supervisor. That isn't just paperwork. The purpose of ongoing supervision is to build your professional and ethical skills, so this is exactly the kind of help it exists to give. Wanting to help is not the same as being competent to handle something alone.

Collect, use, store and protect information the required way

Sharing is only one step. Confidentiality also applies to how information comes to you, what you do with it, where it lives and who can reach it. There is no single universal method for each step. Your employer's policies and the law where you work set the details. Your job is to know those requirements and follow them every time you handle client information or records.

• Collect: gather the information your supervisor directs you to gather, such as session data or session notes, and record it accurately.
• Use: use client information for the work it was collected for, not for personal reasons.
• Store: keep records in the systems your employer has approved. Your personal texts or notes app are not a substitute.
• Protect: follow your workplace's safeguards so that people without a work reason can't see or reach the information.
• Keep or dispose: follow your employer's rules and the law on how long records are kept, who may access them and how they are destroyed.

Example: you finish a home session and want to complete your notes later. Taking a photo of the data sheet on your personal phone feels efficient. But it moves a client record outside your employer's approved system, where your workplace's protections no longer apply. The right move is to use the approved system or the method your employer specifies.

Now change one fact: you are in the clinic, and you step away from an open data binder in a waiting area where other families sit. You haven't told anyone anything. You still haven't protected the record, because people with no work reason could read it. Protecting information means preventing access, not just avoiding conversation.

If you aren't sure what your employer requires for any of these steps, ask your supervisor.

When the law allows or requires disclosure

Sometimes sharing is permitted or required without your supervisor's direction. One example is protecting a client or others from harm. RBTs must also know and follow mandated-reporting requirements. Mandated reporting means a legal duty to report certain concerns, such as suspected abuse, to authorities.

There is no single universal rule here. Who must report, what triggers a report, whom you report to, how quickly and how to file it all depend on the laws where you work. Learn your jurisdiction's requirements and your employer's procedures before you need them.

The law comes first. If the law requires you to make a report yourself, directly to an authority or within a set time, you make that report. You do not wait for your supervisor's approval. Talking with your supervisor or following employer steps must not delay a report the law requires. Don't assume that telling your supervisor satisfies a duty the law places on you; check what your local law says.

The Code also gives steps for any situation where a client's legal rights are being violated or a client is at risk of harm:

1. Report to your supervisor.
2. Follow your organization's policies.
3. Document what you did.

Follow these steps in a way that fits your legal duty, not in place of it.

Example: during a session you see something that, under your jurisdiction's law, you are required to report directly to an authority. Your supervisor is away until Monday. If the law requires a report before then, waiting is not an option. Make the report as the law requires. Then tell your supervisor, follow your organization's policies and document what you did.

Social media: no identifying client content

RBTs do not share identifying information about clients on social media or websites. That includes photos, videos and written information. "Identifying" means more than a face or a name. A combination of details can point to one child.

Suppose a parent says, "I'd love for you to post that video!" The parent's wish tells you what they want. It does not tell you what you are allowed to do. The Code's standard does not list a caregiver-approval exception. Thank the parent and don't post.

Checkpoint 1: You post a photo of handprint art with no face or name visible. The caption reads: "So proud of my 6-year-old client at the Elm Street clinic!" Is this acceptable?

Answer: No

The post is about a client and combines an age, a location and the client's artwork. People who know the family could recognize the child. Removing the face doesn't make content non-identifying when other details narrow it to one person, so this post breaks the Code's rule.

The Code's minimum standard is no identifying client information. Because it is easy to misjudge what could identify someone, a sensible practice that goes beyond that minimum is to avoid posting client content at all. Your employer may also have a stricter social media policy, and you follow it.

Be accurate about your credentials and services

RBTs don't make false, misleading or exaggerated statements about their qualifications or services. They also give employers and supervisors a current, accurate set of credentials when asked.

Example: introducing yourself to a family as "the behavior analyst who designs the plan" is misleading. You carry out services under your supervisor's direction. The same applies to public claims. A profile that says "ABA specialist, 5 years" when you have one year as an RBT is an exaggeration.

Accuracy also covers what services can achieve. Telling a worried parent, "ABA will have your son speaking in full sentences within three months," promises a result no one can guarantee. It misleads the parent about the services and about behavior analysis. If a family asks what to expect, direct the question to your supervisor.

Now change one fact: your certification status changes, for example to inactive. Within 24 hours of finding out, tell your supervisor. Then follow the BACB's requirements about practicing, billing and using the RBT title.

Multiple relationships

A multiple relationship is a mixing of two or more of your roles, such as professional and personal. It can involve a client, stakeholder, supervisor, coworker or someone close to the client. The risk is a conflict of interest: your personal interests start to influence your professional judgment, which can harm the client.

Example: a client's parent offers to pay you to babysit the client's siblings on weekends. You would become both the family's employee and the client's RBT. Suppose the family is unhappy with your babysitting. Could you still report session data honestly and follow the plan without worrying about the side income? That doubt is the problem.

RBTs avoid these relationships. If you find one has developed:

1. Tell your supervisor immediately.
2. Work to resolve it.
3. Document what you did.

Now change one fact: the mixed relationship is with your supervisor. For example, your supervisor asks you to tutor their own child for pay. You can't resolve a conflict by reporting it only to the person who is part of it. Report it to your supervisor's manager or another appropriate entity, such as human resources or the BACB, and document that communication.

Gifts

Gifts can create conflicts of interest and multiple relationships. So RBTs don't give gifts to, or accept gifts from, clients, stakeholders or supervisors worth more than $10 US, or the equivalent purchasing power in another currency.

Staying under $10 does not make a gift automatically fine. A gift is acceptable only when it is an occasional expression of thanks and gives the recipient no financial benefit.

Example: at the end of the year, a family gives you a handwritten card and a $5 coffee. That is occasional thanks with a small value, so the Code allows it if your employer does. Now change one fact at a time:

• The family brings a $5 coffee to every session. Each gift is small, but repeated or cumulative gifts can violate the standard once they become a regularly expected source of value.
• The family offers a $25 gift card. This is over the limit, so decline it.

If your employer is stricter, for example banning all gifts, you follow the employer's policy.

Checkpoint 2: Your employer prohibits all gift exchange with families. On the last day of services, a client hands you a $3 keychain they picked out. It is a one-time gift. What do you do?

Answer: Decline kindly and follow the employer's policy

The Code's $10 limit is a ceiling, not a permission. A stricter employer rule takes priority. A one-time, under-$10 gift would otherwise fit the Code, but that doesn't override your employer. Thank the client warmly, explain that you're not allowed to accept gifts, and ask your supervisor if you're unsure how to handle it.

Practice on your own: a relationship you didn't choose

You are assigned a new client. At the first home session, you realize the client's father is your landlord. You rent your apartment from him, and your lease comes up for renewal next month.

Answer before opening the feedback:

1. What is the conflict-of-interest risk?
2. What do you do, and when?
3. Change one fact: your supervisor, not the client's father, is your landlord. What changes?

Answer: Report it now, work on a resolution, document

1. You would be both the family's tenant and the client's RBT. If the renewal is uncertain or a rent dispute comes up, you might hesitate to report a hard session honestly or to pass on a concern about the family. Your housing could start to influence your professional judgment, and that puts the client at risk.

2. Tell your supervisor immediately, before more sessions happen under the conflict. Work with them to resolve it, and document what you reported, when, and what was decided.

Keeping it private is tempting because nothing has gone wrong yet. But the risk exists now. The Code asks you to report a multiple relationship as soon as you find it has developed, not after it causes a problem. Quitting the case on your own is also not the answer. It disrupts the client's services and skips the resolution you are supposed to work out with your supervisor. Your supervisor directs how services continue.

• 3. You can't resolve a conflict by reporting it only to someone who is part of it. Report it to your supervisor's manager or another appropriate entity, such as human resources or the BACB, and document that communication.

Recap

• Share client information only when the job needs it, under your supervisor's direction or when the law allows it, and only through employer-approved channels.
• Confidentiality covers every step: collect what you're directed to, use it only for the work, store it in approved systems, protect it from people without a work reason, and follow employer and legal rules on keeping and disposing of records.
• "No names" doesn't make casual sharing acceptable, and good intentions don't replace following the rules.
• Laws on disclosure and mandated reporting vary. If the law requires you to report, report as the law requires without waiting for approval. Alongside that, tell your supervisor, follow organizational policy and document.
• Never post identifying client information, even if a family would like you to. Avoiding client content entirely is the safer practice.
• Describe your role, credentials and services accurately, and don't promise outcomes. Report a status change to your supervisor within 24 hours.
• Report multiple relationships to your supervisor. If your supervisor is part of one, report to their manager, HR or the BACB, and document either way.
• Gifts over $10 are prohibited. Smaller gifts must be occasional and non-financial, and a stricter employer rule always wins.

Sources

• Behavior Analyst Certification Board. (2021, updated 08/2024). RBT Ethics Code (2.0). https://www.bacb.com/wp-content/rbt-ethics-code
• Behavior Analyst Certification Board. (Updated 10/2026). RBT Handbook, supervision section. https://www.bacb.com/rbt-handbook

Independent study resource

This study resource is not affiliated with, sponsored by, or endorsed by the Behavior Analyst Certification Board (BACB). BACB, Registered Behavior Technician and RBT are registered trademarks of the Behavior Analyst Certification Board. Source citations do not imply endorsement by their authors or publishers.