Can BCBAs use AI to write reports? Ethics, HIPAA and clear limits

The current Ethics Code took effect on January 1, 2022, and it does not mention AI¹. What it does is apply to all of your professional work, written and digital included, and several of its items decide how you can use a tool¹:

• Truthfulness and accountability. You give accurate information, correct errors as soon as you find them, and answer for your services (1.01 and 1.03).
• Competence. You only use what you understand well enough to defend the result (1.05 and 1.06).
• Confidentiality. You prevent accidental sharing of client information, including in documents, data and electronic communication (2.03), and you share only what is essential and with consent (2.04).
• Documentation. You protect and retain physical and electronic records (2.05), and your reports and billing are accurate (2.06).
• Informed consent, including for exchanging client information (2.11).
• Supervision. You answer for the work of the people you supervise, and you delegate only after confirming they are competent (4.04 and 4.09).

In its July 2024 newsletter, the BACB warned that what you type into a generative AI application may be used as learning material, reminded certificants that the Ethics Code still applies, and recommended getting legal and technical guidance before setting policies². It does not prohibit AI or require disclosing it².

The 2025 CASP guidelines go further³:

• AI should support clinical work, not replace it.
• The use of AI is clearly disclosed in the work product.
• Do not assume payers accept or pay for every use of AI. If the policy is silent, describe the use to the payer.
• Clients can be given the option to decline AI.

If a cloud tool creates, receives, stores or transmits protected health information on your behalf, the vendor is a business associate and you need a signed BAA with it, even if it only stores encrypted data⁴. Even with a BAA, share only what the task requires, in line with HIPAA’s minimum necessary standard⁵.

The table summarizes each vendor’s official pages^9101213. OpenAI offers a version for clinicians, but today it only admits physicians, nurse practitioners, physician assistants and pharmacists with an NPI, so a BCBA does not qualify¹¹.

A BAA alone does not settle everything either: OpenAI notes that signing one does not by itself make your use meet HIPAA requirements, because configuration and use remain your responsibility⁹. Plan names and terms change often, so check the vendor’s page on the day you decide.

Removing the name is not enough. HIPAA recognizes two ways to de-identify: Safe Harbor, which requires removing 18 types of identifiers and having no actual knowledge that the person could be re-identified, and expert determination⁶. Those identifiers include dates (except the year), locations smaller than a state, account numbers and photos⁶.

A clinical report in free text usually contains details like these, such as siblings’ names, the school or dates, so review carefully before you paste any excerpt.

If unsecured information is breached, HIPAA requires notifying the affected individuals no later than 60 days after discovery. If 500 or more people are affected, HHS must also be notified, and the media when more than 500 residents of a state are involved. The business associate, in turn, must notify you within 60 days⁷.

In Florida, state law requires notifying individuals within 30 days and, when 500 or more are affected, the Department of Legal Affairs as well⁸. Ask your legal advisor how the two rules combine in your case.

If a tool suggests diagnoses, hours or medical necessity, treat it as a clinical decision support tool. Since May 1, 2025, a federal nondiscrimination rule (45 CFR 92.210) requires health programs that receive federal financial assistance from HHS, for example through Medicaid, to identify those tools and reduce their risk of discrimination¹⁴. Whether a report draft falls under that definition depends on what the tool does: check with your legal advisor.

No Florida law on AI in health care passed in the 2026 session. The bill requiring human review of claim denials died in committee, as did the bill limiting AI in psychology, counseling and therapy¹⁵¹⁶.