Applied Behavior Analysis Provider Security Risk Assessment: A Practical Guide

An effective security risk assessment helps an applied behavior analysis (ABA) provider understand where electronic protected health information (ePHI) is handled, what could put it at risk, and which safeguards need attention. Use the steps below to make your assessment specific to your services, systems, workforce, and locations.

What does the HIPAA Security Rule require of ABA providers?

HIPAA applies to ABA providers when they qualify as a covered entity or business associate. A health care provider generally qualifies as a covered entity when it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. A provider’s specific status depends on its activities and relationships; HHS’s overview of covered entities and business associates explains the categories.

For covered entities and business associates, the Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. It also requires security measures that reduce risks and vulnerabilities to a reasonable and appropriate level. These obligations are part of an ongoing security management process, not a one-time checklist. See 45 CFR § 164.308.

The rule does not prescribe one assessment template or a single technology solution. Providers determine appropriate measures in light of factors such as their size, infrastructure, costs, and the probability and criticality of risks. HHS’s risk analysis guidance explains that the analysis should reflect the organization’s actual environment.

HHS has also described proposed cybersecurity revisions to the Security Rule. Its proposed-rule page states that the current Security Rule remains in effect while that rulemaking is underway; do not treat proposals as existing requirements.

Which systems and locations should an ABA security risk assessment cover?

Start by tracing where ePHI is created, received, maintained, or transmitted. In ABA services, this may include client records, assessments, behavior plans, session notes, billing information, scheduling details linked to a client, caregiver communications, and session images or video if they contain identifiable health information. HHS guidance says the Security Rule applies to ePHI across these activities, not just information stored in an electronic health record.

Make an inventory of systems, devices, and people that may access or handle this information. Consider practice-management and clinical-record platforms, billing systems, email and messaging tools, video services, cloud computing and storage, staff phones and tablets, laptops, printers, removable media, and vendor or contractor systems. Include backups and test environments where ePHI may be stored.

Map the places where staff use those systems: the clinic, employees’ homes, clients’ homes, schools, vehicles, and community settings. For each, note what information is accessed, which devices are used, whether data is stored locally, and how information is transmitted. HHS recommends identifying ePHI throughout the organization and documenting the data gathered during the analysis in its risk analysis guidance.

Review service-provider relationships, too. If a vendor creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, assess the relevant risks and applicable business associate arrangements. HHS’s cloud computing guidance explains that cloud service providers handling ePHI on behalf of a regulated entity can be business associates, including when they store encrypted information.

How should providers evaluate threats, vulnerabilities, and risk levels?

For each system, location, and information flow, identify reasonably anticipated threats and weaknesses that could expose, alter, destroy, or make ePHI unavailable. ABA-relevant examples may include a lost tablet, a stolen laptop, an account shared by multiple staff, a misdirected caregiver message, a compromised vendor account, malware, or a service outage that prevents clinicians from accessing essential records.

Assess existing safeguards alongside the threats. A written policy may not reduce risk if staff do not follow it, access settings are too broad, or backups cannot be restored. HHS recommends documenting current security measures and checking whether they are properly configured and used; its guidance on risk analysis also describes identifying threats, vulnerabilities, and likelihood.

Use a consistent method to estimate the likelihood and potential impact of each threat-vulnerability combination. You can use qualitative ratings such as low, moderate, and high, or a numerical scale, provided the method is understandable and applied consistently. Consider effects on confidentiality, integrity, and availability—for example, whether an incident could expose a client’s records, corrupt data used in care, or interrupt access to critical information.

HIPAA does not require a particular scoring formula. The purpose is to support reasoned decisions about which risks to address, how urgently to act, and whether existing safeguards are adequate. HHS describes risk analysis as evaluating risks and vulnerabilities, including likelihood, while risk management is the implementation of measures to reduce risk. See HHS’s explanation of risk analysis and risk management.

Which administrative, physical, and technical safeguards should be reviewed?

Review administrative, physical, and technical safeguards as connected parts of your HIPAA security risk management program. The required safeguards depend on the Security Rule standards and your environment. For provisions marked “addressable,” the rule requires you to assess whether the measure is reasonable and appropriate; if it is not, document why and implement an equivalent alternative measure if reasonable and appropriate. See 45 CFR § 164.306.

• Administrative safeguards: Review security responsibility, workforce access and termination procedures, security awareness and training, incident response, sanctions, periodic reviews of system activity, and contingency planning and data backups. Check whether staff and contractors understand how to report a lost device, suspected disclosure, or other security incident. The requirements appear in 45 CFR § 164.308.
• Physical safeguards: Examine facility access, visitor procedures, workstation use and security, and controls over devices and media. For mobile ABA work, consider how staff secure devices during travel and sessions, prevent unauthorized viewing, and dispose of or reuse electronic media safely. See 45 CFR § 164.310.
• Technical safeguards: Review unique user identification, access controls, emergency access, audit controls and audit logs, integrity protections, authentication, and transmission security. Check whether access is limited to people and software that have been granted appropriate rights, and whether information-system activity can be reviewed. See 45 CFR § 164.312.

Also check whether backups are retrievable and whether recovery steps are workable, rather than relying solely on a vendor’s assurance that data is backed up. The Security Rule includes required data backup, disaster recovery, and emergency mode operation specifications in its contingency plan standard at 45 CFR § 164.308(a)(7).

How can ABA providers document findings and corrective actions?

Keep a written or electronic record that shows what you assessed and how you reached your decisions. A useful report identifies the assessment’s scope and date, the ePHI and systems reviewed, relevant locations and vendors, the assessment method, identified threats and vulnerabilities, existing safeguards, risk ratings, and the reasoning behind priorities.

For each finding, record the planned response: the corrective action, responsible owner, target date, interim protections if needed, and how the provider will verify completion. Distinguish risks accepted by authorized leadership from risks still awaiting action, and update the record when safeguards are implemented or conditions change.

The Security Rule does not specify a required template. It does require covered entities and business associates to maintain written records of required actions, activities, and assessments, and to review and update documentation as needed in response to environmental or operational changes. Required documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. See 45 CFR § 164.316.

When should an ABA provider reassess security risks?

HIPAA does not set one universal calendar interval for repeating a risk analysis. It does require periodic evaluation and ongoing review of security measures. Reassess when meaningful changes could affect ePHI—for example, adopting a new clinical platform, changing vendors, expanding home or school services, adding remote access, experiencing a security incident, or changing how staff use mobile devices. HHS describes periodic technical and nontechnical evaluations and reviews in response to environmental or operational changes in its summary of the Security Rule.

Set a review schedule that fits the size and complexity of your organization, then trigger an earlier review when a significant change or newly recognized risk warrants it. Document the review and any resulting updates. A reassessment should revisit the whole risk picture, not simply confirm that a previous action item was completed.

How do home, school, clinic, and community services affect ePHI security?

Each service setting changes the risks and safeguards you need to consider. In a clinic, review controlled entry, visitors, workstation placement, conversations within earshot, and unattended screens. At home or in the community, consider device loss or theft, public or shared networks, visible screens, printed materials, and whether staff can access ePHI privately and securely.

For mobile work, assess how devices are protected, who can unlock and use them, whether ePHI is stored locally, and what happens if a device is lost or connectivity fails. Evaluate transmission methods and access controls in light of actual field practices. HHS states that mobile devices may be used to access ePHI in a cloud when the organization analyzes the risks and applies reasonable and appropriate safeguards; see its mobile-device and cloud FAQ.

School-based services require particular care about which organization maintains the records and in what capacity. Some student health records maintained by a school or a provider acting on its behalf are education records subject to FERPA rather than HIPAA; records held by an outside provider not acting for the school may be treated differently. Review the facts and applicable arrangements instead of assuming all information handled on school grounds is governed by one law. See the HHS FAQ on school student health records.

In short, a practical ABA security risk assessment maps ePHI across systems and settings, evaluates threats and vulnerabilities, reviews administrative, physical, and technical safeguards, and documents corrective actions. Keep it current as your services and security environment change.

FAQs.

Are ABA providers required to conduct a HIPAA security risk analysis?

Covered entities and business associates subject to the HIPAA Security Rule must conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to ePHI. An ABA provider’s HIPAA status depends on whether it meets the definition of a covered entity or business associate; not every organization is automatically covered solely because it provides ABA services. See 45 CFR § 164.308 and HHS’s covered-entity guidance.

What electronic health information should an ABA provider include in the assessment?

Include all ePHI the regulated organization creates, receives, maintains, or transmits. Depending on your operations, this may include clinical records, assessments, behavior plans, session notes, billing data, identifiable caregiver communications, electronic files, backups, mobile-device data, and information handled by vendors. Map where the information is stored and how it moves between people, systems, and service locations.

Does HIPAA require a specific format for documenting a risk analysis?

No. The Security Rule requires documentation of required assessments but does not prescribe one specific format. Use a format that clearly records the scope, method, findings, risk decisions, safeguards, and corrective actions, and retain required documentation for the applicable period under 45 CFR § 164.316.

When should an ABA provider update its security risk assessment?

Review and update it periodically and when environmental or operational changes affect ePHI security. Examples include new technology or vendors, expanded service settings, significant changes to mobile workflows, incidents, or newly identified threats. HIPAA does not establish one universal reassessment interval, so choose a review cadence suited to your organization and document the reviews.