ABA produces a lot of paperwork: an assessment report, a treatment plan, progress reports, session notes and graphs of your child's data. Those records belong in your hands as much as the provider's. You may want them to check progress, share with a new provider, support an insurance appeal or bring to an IEP meeting. This guide explains which Florida and federal laws give you access, how fast a provider must respond, what it can charge, the few exceptions, and how to ask.
Which laws give me a right to my child's ABA records?
Three layers of law can apply, depending on the provider.
| Law | Who it covers | What it gives you |
|---|---|---|
| Parents' Bill of Rights, s. 1014.04(1)(f) | Reserved to parents of minor children in Florida | "The right to access and review all medical records of his or her minor child," with narrow exceptions |
| Patient records law, s. 456.057 | Health care practitioners licensed by the Florida Department of Health, such as an LCSW or psychologist | Copies "in a timely manner, without delays for legal review," at limited cost |
| HIPAA Privacy Rule, 45 CFR 164.524 | HIPAA covered entities, which include most providers that bill health insurance electronically | Inspect or get a copy of records in the "designated record set," with a 30-day response deadline |
Florida does not license behavior analysts, so a BCBA is not a "health care practitioner licensed by the department" under s. 456.057 unless they also hold a DOH license. Many ABA organizations do, however, bill insurance and follow HIPAA, and many have a licensed clinician on staff. Ask the provider which rules it follows; the answer is usually in its Notice of Privacy Practices.
Under HIPAA, a parent with authority to make health care decisions for an unemancipated minor is generally treated as the child's "personal representative" (45 CFR 164.502(g)(3)), which means the parent can exercise the child's access rights.
What counts as my child's ABA record?
Records vary by provider, but a typical ABA file includes:
- intake forms, the diagnosis report and the prescription or referral you provided;
- the initial assessment report and any reassessments;
- the treatment plan and behavior plan, with each version you signed;
- progress reports sent to your insurer, and authorization letters;
- session notes and supervision notes;
- the data your child's team collects, and the graphs made from it;
- billing records and insurance information.
Section 456.057(6) covers "copies of all reports and records relating to such examination or treatment, including X rays and insurance information." HIPAA covers the designated record set, which includes medical and billing records and other records used to make decisions about the patient. If you want the raw session data or graphs, say so in your request, because some providers send only reports unless asked.
How fast must the provider respond?
Florida's rule for DOH-licensed practitioners is "in a timely manner, without delays for legal review." The statute does not give a number of days.
HIPAA sets a clear outer limit. A covered entity "must act on a request for access no later than 30 days after receipt of the request." If it cannot, it may extend once, by no more than 30 days, and only if it gives you a written statement of the reasons for the delay and the date it will finish within the first 30 days. It must provide the copy in the form and format you ask for (for example, electronic PDF) if it is readily producible that way.
Thirty days is a maximum, not a target. Many providers can send a treatment plan or a progress report within a few days.
What can a provider charge for copies?
- Florida: under s. 456.057(17), a practitioner furnishing copies "shall charge no more than the actual cost of copying, including reasonable staff time, or the amount specified in administrative rule by the appropriate board." Section 456.057(6) adds that furnishing copies "shall not be conditioned upon payment of a fee for services rendered." A provider cannot hold your records until you pay an unpaid bill.
- HIPAA: a covered entity may charge only "a reasonable, cost-based fee" limited to labor for copying, supplies, postage, and preparing a summary if you agreed to one.
Ask about any fee before the copies are made. Many providers send electronic copies at little or no cost.
Are there exceptions?
A few, and they are narrow:
- Psychotherapy records. When chapter 490 psychological or chapter 491 psychotherapeutic records are requested, the practitioner "may provide a report of examination and treatment in lieu of copies of records" (s. 456.057(6)). HIPAA separately excludes "psychotherapy notes" from the right of access. This matters if your child also receives mental health therapy; it does not usually cover ABA data or treatment plans.
- Criminal investigations. Section 1014.04(1)(f) does not apply if the parent "is the subject of an investigation of a crime committed against the minor child" and law enforcement asks that the records not be released.
- Court orders. In custody cases, s. 61.13(2)(c)7 says access to a child's medical, dental and school records "may not be denied to either parent" unless a court order specifically revokes those rights, including restrictions in a domestic violence injunction.
- Safety-based denials. HIPAA lets a covered entity deny a personal representative's access in limited cases where a licensed health care professional determines access is reasonably likely to cause substantial harm. You must be told and given a right to have the denial reviewed.
If you are co-parenting, see co-parenting and ABA consent in Florida for how both parents' access works.
How do I request my child's ABA records?
- Ask in writing. HIPAA lets providers require written requests. Email works for most.
- Be specific. List what you want and the dates: for example, "the initial assessment, all treatment plans, progress reports, session notes and data graphs from January 1 to today."
- Name the format. Ask for electronic copies by secure email or portal, or paper copies by mail.
- Keep a record. Note the date you sent the request. Under HIPAA, the 30 days run from receipt.
- Follow up. If you hear nothing in a week or two, call and ask for an expected date.
A short request might read: "I am the parent of [child's name], date of birth [date]. Under s. 1014.04 and s. 456.057, Florida Statutes, and 45 CFR 164.524, I am requesting copies of [list of records] from [start date] to [end date], sent electronically to [email]. Please let me know of any fee before preparing the copies. Thank you."
What if the provider says no or does not respond?
Ask for the reason in writing. A HIPAA denial must be written and must explain your review rights. For a DOH-licensed practitioner, s. 456.057(15) says licensees who violate the section "shall be disciplined by the appropriate licensing authority," and the Florida Department of Health accepts complaints about licensed practitioners. HIPAA complaints go to the U.S. Department of Health and Human Services Office for Civil Rights. For concerns about a BCBA's or RBT's conduct, see making a complaint about an ABA provider. If records are needed for a legal matter, a Florida attorney can advise.
Records and privacy at Hope Center
Every Hope Center family receives a privacy statement in the intake package, and our Notice of Privacy Practices is available on request. Our clinical director, Aisha Albright-Jourdan, MSW, LCSW, BCBA, is responsible for privacy. To request your child's records or ask a privacy question, email office@hopecenteraba.com or call 561-337-8865. Our page on your family's privacy at Hope Center explains what we collect and why, and Florida's Parents' Bill of Rights covers consent. New to ABA? Contact us for a free consultation and free benefits check.
This page explains the law in general terms. For a dispute about records in your family's situation, talk with a Florida attorney.