Compliance for ABA

Yes. ABA therapy practices are covered entities or business associates under HIPAA whenever they handle protected health information (PHI) — which includes session notes, assessment results, insurance billing, and client records. Every employee who touches PHI, from BCBAs and RBTs to front-desk staff, is required to receive HIPAA training. Civil penalties reach up to $2.19 million per violation category per year. Criminal violations — including wrongful disclosure of PHI — can result in up to 10 years in federal prison.

Yes. Free forever, for up to 25 team members. No credit card required.

Yes, if staff have occupational exposure to blood or other potentially infectious materials. Exposure to blood and bodily fluids can and frequently does occur in ABA therapy settings. OSHA's Bloodborne Pathogen standard (29 CFR 1910.1030) requires initial training at hire and annual retraining thereafter. If your practice doesn't have documented training records, you're exposed — OSHA violations can result in fines up to $16,550 per citation, and willful violations can reach $165,514. Beyond the fines, an incident without documented training puts your practice, your staff, and your contracts with schools and regional centers at serious risk.

HIPAA requires training for all new employees and retraining whenever policies or procedures change. Most ABA practices train annually to stay current with OCR guidance and payer requirements. We know high staff turnover is an inherent challenge of running an ABA practice — Stampwell makes onboarding and retraining effortless, so compliance never falls behind your hiring.

OSHA (29 CFR 1910.1030) requires Bloodborne Pathogen training at the time of initial assignment and at least annually thereafter. New job duties that introduce occupational exposure also trigger required retraining. Bites and scratches are part of the reality of ABA therapy — your staff deserves to know how to protect themselves, and your practice deserves documentation that proves you took that seriously.

Yes. Every Stampwell certificate includes a QR code linked directly to the Certificate Ledger. An HHS OCR auditor, insurance credentialing team, or school district and regional center partner scans it and gets instant validation — no phone calls, no paperwork, no doubt.

Yes. HIPAA applies regardless of where services are delivered — clinic, home, school, or telehealth. If your RBTs access PHI on tablets or phones in client homes, they need training. BBP training applies to any staff with potential occupational exposure to blood or bodily fluids, including those providing in-home services.

Yes. Stampwell automatically logs everything your compliance program produces: every training completion, every signed policy and employee attestation, and every officer appointment, all timestamped. You can demonstrate compliance during an HHS OCR HIPAA audit or an OSHA inspection, and your records are always ready to download.

Yes. KnowQo is now Stampwell. We renamed the company in 2026. Same team, same software, same free tier. Anything you have read about KnowQo HIPAA compliance software describes Stampwell.