North Dakota ABA Therapy Session Video Privacy Laws: What Caregiver Coaching Portals Need to Know

Informed Consent for Video Recording

Before any ABA therapy session is recorded, obtain explicit, informed permission from everyone who will appear in the video. In caregiver coaching portals, that typically means the parent or legal guardian, the child if developmentally appropriate for assent, and any staff who may be captured.

What to include in Caregiver Consent Forms

• Purpose and scope of recording (e.g., caregiver coaching, supervision, quality improvement).
• What will be captured (audio/video), when recording occurs, and who initiates it.
• Where recordings are stored, retention timelines, and deletion procedures.
• Who may view recordings (Authorized Personnel Access) and how access is controlled.
• Risks, safeguards, and how to revoke consent at any time for future recordings.

Use plain language and provide a copy of signed Caregiver Consent Forms. Reconfirm consent when the use, audience, or technology changes, or when a minor’s custody status shifts.

Assent and staff acknowledgments

Seek age-appropriate assent from the child and written acknowledgments from clinicians and technicians. Make it clear that recording is not a condition of receiving medically necessary services unless required by a payer or program—and then only with notice and consent.

Confidentiality of Recorded Content

Therapy Session Video Confidentiality hinges on treating recordings as protected health information (PHI). Store videos in secure systems, limit viewing to the minimum necessary, and document every access.

Authorized Personnel Access

• Define roles allowed to view recordings (e.g., BCBA supervisors, treating clinicians, designated caregivers).
• Apply role-based permissions, time-limited links, and multifactor authentication.
• Maintain immutable audit logs showing who viewed, when, and why.

Retention, redaction, and sharing

Follow a written retention schedule that meets payer and regulatory requirements. When possible, segment or redact unrelated individuals, identifiers, or scenes. Prohibit downloads to personal devices and block forwarding outside the portal.

Authorization and Revocation Processes

Authorization should be documented, versioned, and tied to the client record. Tag each recording with the applicable authorization so you can prove purpose, scope, and allowed viewers.

How revocation works

• Accept revocations in writing through the portal or a designated form.
• Stop new recordings immediately and confirm the effective date in writing.
• Update access lists and notify staff and supervisors.
• Evaluate existing recordings against retention and legal obligations; restrict viewing to what is strictly necessary.

Keep a clear trail: original authorization, modifications, and revocation confirmations. Train staff to route revocation requests the same day they are received.

State Privacy and Consent Laws

North Dakota law protects individuals against nonconsensual recording in private settings and against surreptitious monitoring. Review applicable criminal privacy provisions—such as N.D. Cent. Code § 12.1-15-02—together with employment and professional rules when planning video capture in homes or clinics.

Because therapy sessions occur where people have a reasonable expectation of privacy, use written all-parties consent for any audio or video. Posting notice or signage is not a substitute for individual consent in these contexts.

Home, clinic, and community settings

Spell out locations where recording may occur and how bystanders are handled. If anyone enters mid-session, pause recording and obtain consent before resuming or exclude them from the frame.

Audio versus video

Audio and video can be governed by different rules. When combined, apply the stricter standard and ensure consent covers both media types explicitly.

Federal HIPAA Compliance

Under the Health Insurance Portability and Accountability Act, session videos that identify a client and relate to care are PHI. Your portal must satisfy the HIPAA Privacy Rule (use, disclosure, and minimum necessary) and Security Rule (technical, administrative, and physical safeguards).

Privacy Rule essentials

• Limit access to workforce members with a treatment or operations need.
• Honor authorized caregiver access while protecting third parties captured in the video.
• Define whether recordings are part of the designated record set and how clients can request access.

Security Rule controls

• Encryption in transit and at rest, strong identity management, and least-privilege roles.
• Comprehensive audit logging, anomaly detection, and incident response procedures.
• Business Associate Agreements with vendors that store, process, or transmit recordings.

Protection of Minors' Therapy Information

Minor Counseling Privacy Protections require careful handling of who can consent, view, and share recordings. Generally, parents or legal guardians control permissions, with limited exceptions recognized by law.

Data minimization for children

• Capture only what is necessary to meet the coaching or clinical objective.
• Frame the camera to avoid siblings, family photos, addresses, or other identifiers.
• Use redaction or blurring when unrelated individuals are inadvertently recorded.

Caregiver access and boundaries

Define what caregivers can see, how long access lasts, and whether they can download or re-share. Make clear that secondary distribution (e.g., social media) is prohibited and may violate privacy laws and therapy agreements.

Technology Use in ABA Therapy Sessions

Design your caregiver coaching portal to default to privacy: require explicit consent prompts, remind users when recording is active, and block local device storage. Align engineering controls with the policies you present in consent materials.

Recording architecture

• Use secure cloud storage with per-file keys, server-side encryption, and geographic residency controls.
• Disable platform-level auto-backups to personal clouds and prevent screen recordings when feasible.
• Watermark streams, expire links, and verify identity at each access.

Electronic Visit Verification

Electronic Visit Verification (EVV) tracks service time and location for Medicaid compliance; it does not require video. Keep EVV logs distinct from recordings, and do not treat EVV consent as permission to record therapy sessions.

Operational safeguards

• Pre-session environment checks: camera angles, bystander control, and device privacy settings.
• Staff training on when to pause, delete drafts, or re-consent after interruptions.
• Documented retention schedule, secure deletion procedures, and key-management practices.

Key takeaways

• Use clear, written, all-parties consent that covers purpose, scope, access, and revocation.
• Treat recordings as PHI under HIPAA, enforce minimum necessary access, and log all viewing.
• Account for North Dakota privacy provisions (e.g., N.D. Cent. Code § 12.1-15-02) when recording in private settings.
• Separate EVV from session videos and apply strict Technology Use controls throughout the recording lifecycle.

FAQs.

What are the consent requirements for recording ABA therapy sessions in North Dakota?

Obtain written, all-parties consent before recording. The form should specify the purpose, what will be captured, who can view it, retention, and how to revoke permission. Because sessions occur in private settings, align consent with North Dakota privacy provisions (including N.D. Cent. Code § 12.1-15-02) and your program’s policies, then reaffirm consent if the use or audience changes.

How does HIPAA affect video recordings in caregiver coaching portals?

Recordings that identify a client are PHI. Apply the HIPAA Privacy Rule’s minimum-necessary standard, define whether videos are in the designated record set, and maintain strict Authorized Personnel Access. Under the Security Rule, enforce encryption, MFA, role-based permissions, audit logs, and Business Associate Agreements with any vendor that stores or transmits videos.

Can caregivers revoke permission for session recordings?

Yes. A caregiver can revoke permission at any time for future recordings. Upon revocation, stop recording immediately, confirm the effective date in writing, update access controls, and restrict viewing of existing videos to what is legally or contractually required by your retention policy and applicable regulations.