An ABA practice spends its day in other people's homes and schools, so team chat has to work on an RBT's phone in a driveway and still protect client information. A tool that signs a Business Associate Agreement, with a scheduling channel for the whole team and a private clinical channel for each BCBA's caseload, replaces the group text. Parents are never in it.
A practice that works in homes and schools
An applied behavior analysis (ABA) practice is unusual: almost nobody works at the office. A Board Certified Behavior Analyst (BCBA) writes treatment plans and supervises. Registered Behavior Technicians (RBTs) deliver sessions in homes, schools and clinics. A scheduler moves sessions around, an intake and authorization coordinator tracks approved hours, a biller submits claims, and the clinical director or owner carries a caseload too. A practice of 10 to 15 people may have RBTs who have never met each other.
Sessions get cancelled an hour out, kids get sick, schools change their bell schedules, and a new behavior shows up mid-session that the RBT needs the BCBA's guidance on. All of it gets messaged, and all of it is about a child.
Daily situations where staff message
- Cancelled session. A parent tells the RBT at 2:15 that the client is sick for the 3pm. The RBT tells the scheduler, who looks for a makeup slot and a client who can use the open hour.
- Mid-session question. The RBT sees a new self-injurious behavior that is not addressed in the behavior intervention plan and needs the BCBA's direction before the next session.
- Supervision. The BCBA has to observe a share of each RBT's hours and must fit two observations into Thursday, around the school's schedule.
- Authorization hours. The authorization coordinator sees that a client has only a few approved hours left this period, and the renewal request needs the BCBA's updated assessment.
- School site logistics. The school moved sessions to the library and changed its badge system, and the RBT needs the new check-in process.
Parents stay out of staff chat
Parents communicate with the practice through the parent portal, the scheduler's phone line or whatever caregiver-facing tool the practice has chosen. They are not in staff chat, for two reasons. First, team shorthand about a child should not be read by that child's parent out of context. Second, a staff channel that includes parents becomes a place where staff stop talking honestly. If an RBT receives a parent text, the content gets summarized in the team channel; the parent is never added.
What is PHI in ABA messages
Protected health information (PHI) means anything that identifies a client and relates to their health, treatment or payment. A child's name with a session time is PHI. A description of a behavior tied to a client is PHI. The fact that a particular family is an ABA client is PHI on its own, because the service implies a diagnosis. 'I am free at 3 for a makeup' is not PHI. 'The library is the new session room' is not PHI unless the client is named.
An ABA practice that bills insurance electronically is a covered entity under HIPAA, so the Privacy and Security Rules apply directly. Any vendor storing staff messages must sign a Business Associate Agreement (BAA), the contract obliging it to protect PHI under HIPAA, before it handles that data (45 CFR 164.502(e)). WhatsApp, personal SMS and Facebook Messenger sign no BAA, which rules them out for every message in the list above.
A channel map for a 10 to 15 person practice
| Channel | Who is in it | What goes there |
|---|---|---|
| #scheduling | Scheduler, all RBTs and BCBAs | Cancellations, makeups, open hours, drive-time problems, initials only |
| #caseload-bcba-name (private) | One BCBA and the RBTs on that caseload | Plan questions, new behaviors, data concerns, session notes to follow up |
| #supervision (private) | BCBAs, clinical director | Observation schedules, competency checks, supervision logs |
| #authorizations (private) | Authorization coordinator, BCBAs, biller | Hours remaining, renewals due, payer requests |
| #school-sites | RBTs and BCBAs at schools | Check-in procedures, bell schedules, room changes, no client detail |
| #materials | Everyone | Reinforcers, data sheets, tablets, mileage forms |
| #leadership-private | Owner, clinical director, office manager | Hiring, payer contracts, incidents |
Mistakes ABA practices make
- A group text to every RBT: 'Anyone free to cover J's 3pm in Westside?' with the client's first name and neighborhood. SMS is unencrypted, and the practice cannot pull it back from twelve phones.
- A WhatsApp group between a BCBA and her RBTs, including videos of sessions for feedback. WhatsApp signs no BAA, and an RBT who leaves keeps the videos.
- Facebook Messenger between RBTs for ride sharing to a school, which fills with client names.
- Session data photographed and texted to the BCBA because the data app crashed.
RBTs are often early in their careers and on personal phones. The policy has to be simple, and the tool has to be where they already look. Our HIPAA internal communication policy template gives you a one-page version to hand out.
Setting it up
- The clinical director creates the workspace and invites each person by their practice email. Invite-only means an RBT who leaves cannot stay in by accident.
- Create #scheduling, #school-sites and #materials as open channels. Create one private caseload channel per BCBA, plus private #supervision and #authorizations.
- Each BCBA is the manager of their caseload channel; their RBTs are members; nobody else is in it. The scheduler can be a viewer in caseload channels if she needs to read session changes.
- Turn on passkeys for everyone, since RBTs sign in on personal phones, and rely on the 15-minute inactivity lock for a phone left in a car.
- Post two rules in the #scheduling topic: initials only, and never a diagnosis or a behavior in this channel.
- Pick a date to end the group text and the WhatsApp groups, and have the director leave last.
Yodl's Team plan is $10 a month per location for five users, 20 GB of storage and a signed BAA, with each additional person at $2 a month. A 14-person practice pays $28 a month, and RBTs can be added and removed as the roster changes with no contract. Push notifications show no message content, so a client's name never appears on a lock screen in a school hallway.
Like Slack and Microsoft Teams, Yodl is encrypted in transit and at rest rather than end-to-end, which is what lets the clinical director search, set retention and export an audit log when a payer or licensing board asks. To move the team off the group text, Yodl is $10 a month for five people, with the signed BAA on every plan.
ABA teams message from driveways and school hallways. Give each BCBA a private caseload channel, keep #scheduling to initials, keep parents out, and sign the BAA before the first message.
Frequently asked questions
Can RBTs use their personal phones for team chat?
Yes, through the web app on any phone, with passkeys and the inactivity lock. The practice removes the account on the RBT's last day, and the messages stay with the practice.
Should parents be in the chat?
No. Staff chat is staff-only. Parents use the practice's caregiver-facing channels, and anything they tell an RBT gets summarized by staff in the team channel.
Is a client's first name in a scheduling message PHI?
Yes. A first name plus a session time identifies the child, and being an ABA client implies a diagnosis. Use initials in #scheduling and keep details in the private caseload channel.
Can supervision notes go in chat?
Scheduling and quick feedback, yes, in the private #supervision channel. The formal supervision record still belongs in the practice's documentation system.