HIPAA Training for Speech Therapists: How to Back Up AAC Device Vocabularies Before Replacement

Understanding HIPAA Compliance for AAC Devices

What counts as PHI in AAC workflows

AAC devices can store protected health information (PHI) in surprising places: names on buttons, photos, voice recordings, notes, therapy goals, contact details, and session logs. Under the HIPAA privacy rule, treat any information that can identify a patient or relate to their care as PHI, even if it appears inside a custom vocabulary.

Core safeguards you must implement

• Administrative: written AAC vocabulary data backup protocols, workforce training, role-based access, vendor due diligence, and incident response plans.
• Technical: strong authentication, automatic locking, encryption at rest and in transit aligned to data encryption standards, and audit logs for access and changes.
• Physical: secure storage, transport controls, and a documented chain of custody during device replacement.

Consent, minimum necessary, and documentation

Apply the minimum necessary standard when exporting or sharing vocabularies. Follow patient consent requirements for using personally identifiable media (e.g., faces, home photos, unique recordings), especially if sharing outside treatment, payment, and healthcare operations. Record who backed up what, where it was stored, and when the restore was tested.

Backing Up Vocabulary on ProSlate 6 MAX

Pre-backup checklist

• Identify the AAC app(s) in use and the active vocabulary profiles that need preservation.
• Confirm the device has a passcode and encryption enabled; disable unapproved sharing (email, social apps) during export.
• Prepare an approved destination (secure cloud storage compliance solution or encrypted, organization-managed computer/drive).

In-app export of vocabularies

From the AAC app, use its Export/Backup function to create a complete archive of the current vocabulary. Save the file to the device’s local Files storage first, using a neutral file name that omits PHI (for example, “ClientA_Vocab_2026-09-11_v03”). If the app supports password-protected or encrypted exports, enable them.

Device-level encrypted backup

Create an encrypted device backup to an organization-managed computer or mobile device management (MDM) system. Use a strong backup password and store it in your approved credential vault. This layered approach protects not only vocabulary files but also voices, photos, and settings that affect communication.

Verification and documentation

• Validate the backup by importing it to a test device or sandbox user within the app.
• Log the backup date, file version, destination, verifier’s initials, and retention period to maintain device replacement data integrity.

Securing Data on Proloquo2Go and TouchChat HD

Proloquo2Go

Within Proloquo2Go, use the app’s backup/export feature to generate a full archive of the user’s vocabulary and settings. Save locally first, then move the archive to your approved, encrypted destination. Avoid personal cloud accounts and disable automatic sharing features not covered by a business agreement.

TouchChat HD

Use TouchChat HD’s vocabulary management menu to export the active vocabulary set(s). Store the export in local Files, apply an approved naming convention, and transfer only via sanctioned channels (MDM, SFTP, or encrypted external media). Document each step to ensure traceability.

Security hardening tips

• Keep both apps updated to receive security patches and backup reliability improvements.
• Restrict AirDrop or ad-hoc sharing unless your policy explicitly permits it and you can document recipients.
• Ensure exports exclude unnecessary PHI; when needed, replace faces with icons and remove geotagged media before backup.

Utilizing Cloud Services for AAC Backup

Choose a compliant cloud foundation

• Use only providers that sign a business associate agreement and meet your secure cloud storage compliance controls (encryption at rest and in transit, access logging, retention policies).
• Enable multi-factor authentication, least-privilege access, and alerts for link-based sharing or downloads.

Operational controls that matter

• Folder architecture: one protected workspace per patient; prohibit personal accounts.
• Lifecycle: automatic versioning, defined retention windows, and defensible deletion schedules.
• Key management: store encryption keys in organization-approved services; never embed keys in filenames or notes.

Transfer and validation

Move exports from the device to the cloud using approved secure channels (MDM clients, managed file transfer, or encrypted VPN). Verify file integrity by comparing file size and testing a restore on a nonproduction device when feasible.

Regular Backup Best Practices for Speech Therapists

Frequency and coverage

• Baseline: export immediately after the initial customization is complete.
• Routine: back up after any significant vocabulary change or at least every 30 days.
• 3-2-1 rule: maintain three copies on two different media, with one offsite in a compliant cloud.

Quality, naming, and retention

• Standardize names (ClientCode_Vocab_YYYY-MM-DD_vNN) and maintain a simple change log.
• Test restores quarterly to confirm recoverability; record results.
• Purge outdated files per policy to limit PHI exposure while meeting retention requirements.

People and process

• Assign responsibility (primary and backup staff) and define escalation paths.
• Include AAC vocabulary data backup protocols in your HIPAA training and onboarding.

Managing Device Replacement and Data Restoration

Before replacement

• Confirm the latest good backup and note app versions, voices, and any licensed add-ons.
• Obtain or verify patient/guardian authorization when required, especially for transferring media.
• Prepare the new device: enable encryption, set passcode/biometrics, install MDM, and preload AAC apps.

During restoration

• Choose the restore path: device-level encrypted restore (fastest for whole-device migrations) or in-app import (precise vocabulary recovery).
• Validate category layout, button actions, custom voices, and media after import; reapply system settings that impact access (keyguards, switch access).

After replacement

• Perform a live communication check with the user and caregiver to confirm readiness.
• Update inventory records, destroy or securely wipe the old device, and archive the change log to preserve device replacement data integrity.

Crisis Management and AAC Device Replacement Resources

Immediate actions for loss, theft, or damage

• Activate remote lock/wipe through MDM; rotate app and cloud credentials used on the device.
• Notify your privacy officer for risk assessment and breach response steps if PHI may be exposed.
• Issue a loaner device or low-tech board; import the most recent validated backup to minimize downtime.

Stabilize and recover

• Document the incident timeline, the backup used, and testing performed before returning the device to service.
• Run an after-action review to improve safeguards, training, and backup frequency.

Conclusion

Reliable, compliant backups keep communication uninterrupted when devices change. By following the HIPAA privacy rule, limiting PHI, enforcing strong encryption and access controls, and practicing tested backup-and-restore routines, you ensure swift, safe transitions and protect your patients’ voices.

FAQs.

What are the HIPAA requirements for backing up AAC device vocabularies?

You must safeguard PHI under the HIPAA privacy rule with administrative, technical, and physical controls: written backup protocols, encryption at rest and in transit, role-based access, audit logging, and incident response. Use only approved storage with a business associate agreement, apply the minimum necessary standard, and document each backup and restore test.

How can speech therapists securely back up custom AAC vocabularies?

Export vocabularies within the AAC app, save locally with a neutral file name, and transfer to approved encrypted storage via MDM or managed file transfer. Use password-protected exports when available, keep at least three copies across two media, verify a test restore, and record who performed the backup, where it resides, and its retention period.

What steps ensure HIPAA compliance when replacing AAC devices?

Before replacement, confirm a current encrypted backup and needed authorizations. Prepare the new device with encryption, passcode, and required apps. Restore using a device-level backup or in-app import, validate functionality and media, conduct a live use check, and securely wipe the old device. Log everything to maintain device replacement data integrity.

How can data loss be prevented during AAC device transitions?

Follow a 3-2-1 backup strategy, schedule routine exports after changes, test restores quarterly, and maintain version control and naming standards. Use compliant cloud storage with MFA and least-privilege access, avoid personal accounts, and run a checklist-driven handoff during replacement so nothing is missed.