myABAKiS Logo
Book a Demo
Login
CPBAO COMPLIANCE STANDARD CHANGES - WHAT DOES IT MEAN?

The rules changed for Applied Behaviour Analysts.

Has your record-keeping?

In 2026, Ontario amended the regulations governing Applied Behaviour Analysts under the Psychology and Applied Behaviour Analysis Act. Client records aren't a back-office afterthought anymore—they are a serious matter of professional accountability under provincial privacy law. myABAKiS handles the tracking and security automatically, ensuring your practice is fully compliant, so you can close the binders and get back to the learner.

I want to be compliant!
REGULATOR
CPBAO
GOVERNING LAW
PHIPA, 2004
IN FORCE SINCE
July 1, 2024
WHO'S AFFECTED
All Ontario BCBAs
The Shift

The rules changed.
Your data has to keep up.

Before July 2024, keeping records was mostly about following clinic policy or your certification guidelines. It was good practice, but it wasn't provincial law.

Now that the CPBAO is active, behaviour analysts in Ontario are regulated health professionals. Suddenly, those client files aren't just an administrative chore—they are a matter of legal accountability under provincial privacy law.

An inspector isn't going to show up at your office tomorrow to audit your desk. But if a family, a former employee, or a funder ever raises a question about data privacy, the legal framework is completely different today.

myABAKiS handles the security and tracking automatically. We keep your practice compliant behind the scenes, so you can spend less time worrying about legal risks and more time with the learner.
Since Ontario regulated behaviour analysts under the Psychology and Applied Behaviour Analysis Act, client records aren't a back-office afterthought anymore—they are a serious matter of professional accountability under provincial privacy law. myABAKiS handles the tracking and security automatically. We keep your practice fully compliant, so you can close the binders and get back to the learner.
DEC 2021
PABA Act passes Royal Assent
The Psychology and Applied Behaviour Analysis Act, 2021 creates a regulated health profession for ABA.
Jul 2024
Act is proclaimed in force
"Behaviour Analyst" becomes a restricted title. CPBAO begins regulating registrants.
Jul 2024
Standards of Professional Conduct, 2024 apply
Standard 8 (Confidentiality & Privacy) and Standard 9 (Records) become enforceable.
Ongoing
PHIPA applies to client records
As regulated health professionals, behaviour analysts fall within PHIPA's definition of health information custodians.

A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information… is protected against theft, loss and unauthorized use or disclosure.

— PHIPA, 2004 · Section 12(1)

This rule anchors everything.

Every CPBAO standard, professional expectation, and risk of discipline flows from this one core obligation. If a learner's information is in your custody or control, you must take reasonable steps to protect it.

Where that record actually sits changes nothing. The obligation stays with you.

Section 12(2) adds a companion duty. If personal health information is lost, stolen, or shared without authority, you have to notify the affected individual at the first reasonable opportunity—and certain breaches must also be reported to the Information and Privacy Commissioner of Ontario.

Where friction appears

Binder-based workflows were never prohibited.
But they strain compliance in four places.

CPBAO hasn't banned paper, and we aren't saying they should. But the bar has changed. If a question ever comes up, you need to show you took real, reasonable steps to protect that data. When loose binders are constantly floating between your backseat, a family's kitchen table, and the clinic, proving that gets tough.
Loss & theft exposure

The record leaves your control.

A binder left on a kitchen table or tossed in your backseat can easily get lost or fall into the wrong hands. If that happens, the responsibility lands squarely on you—because keeping that learner's data safe is your legal obligation.
Engages: PHIPA s.12(1) · s.12(2)
Unauthorized access

Anyone in the home can see it.

When a binder is left open on the kitchen counter, anyone walking through the house can look at it. It could be the plumber or a neighbor dropping by. Paper doesn't have a password—and you'll never really know who read your learner's private data.
Engages: "unauthorized use or disclosure"
Demonstrable control

"Reasonable steps" get harder to prove.

PHIPA doesn't demand perfection. It just asks you to do what's reasonable. But the moment a record lives in a space you can't control, the odds stack against you. You can't prove you're protecting a learner's data—not when the safeguards aren't there.
Weakens: custodian's s.12(1) defence
Breach response

You can't notify what you can't reconstruct.

If a binder gets lost, Section 12(2) means you have to call the family and tell them. But if you don't know who picked it up, when they did it, or what notes they read, you are completely in the dark.
Engages: PHIPA s.12(2) · s.12(3)
A note on enforcement: There is no CPBAO auditor knocking on doors. Exposure typically arises from a complaint (by a client, a family member, a former employee, a funder, etc.) and is then assessed against statutory obligation. The right time to strengthen records is before that moment, not during it.
The defensible posture
CPBAO hasn't banned paper records. But the law says you are always responsible for keeping your learner's data safe. Leaving a binder in a family's home just introduces too many wild cards—like lost pages, or a visitor reading things they shouldn't. When you're a regulated professional, you just can't control those risks consistently.
A defensible system of record

myABAKiS was built with "reasonable steps" designed into every session.

We didn't set out to build a compliance tool. We just wanted to make something behaviour analysts actually enjoy using. It turns out, when you focus on keeping things simple, you automatically check every box CPBAO and PHIPA ask for. Every piece of data stays right where it belongs—safe, organized, and ready to go. If anyone ever asks for proof that you're doing things the right way, it's already there.
Custody & Control
Records never leave the platform
Your data gets logged right during the session and goes straight onto secure Canadian servers, not onto a paper sheet rolling around in a tote bag on the drive home. That means custody and control stay exactly where the regulator expects them: with you.
Role-Based Access
Only the right eyes, on the right data
Your therapists, BCBAs, admins, and families only see what they are supposed to. Access is tailored to every role, so nobody stumbles into private data they shouldn't. It means the supervision boundaries in CPBAO Standards 4 and 8 are built right into the software.
Audit Trail
If a question is raised, you have answers
Every tap, edit, and login is automatically tracked. Handling a Section 12(2) breach is a whole lot simpler when you can look at the history and see exactly what happened instead of calling a family to say, "We think the binder was..."
Encryption in Transit & at Rest
Protection, demonstrated
When PHIPA talks about taking "reasonable steps," it's asking how your setup compares to the rest of the professional world. These days, things like built-in encryption, secure logins, and tracked access aren't premium upgrades, they are the bare minimum for keeping a learner's data safe.
Retention & Disposal
Records managed, not misplaced
Section 13(1) of PHIPA is pretty clear: you have to store, move, and get rid of records securely. When your system handles that timeline automatically, you completely avoid the classic paper traps: cardboard boxes piling up in the basement, dusty binders hidden in the attic, and old files that somehow outlive the actual practice.
Simple Enough To Actually Use
Adopted across the team in a lunch break
Rules don't protect your clinic if your team is too overwhelmed to follow them. We designed myABAKiS to be simple enough to learn over lunch. It keeps your data safe and legal even during a chaotic session, so you stay covered and your therapists can keep their eyes exactly where they belong: on the learner.
BEFORE

Binder-based workflow.

Records travel between homes, cars, and offices.
No meaningful access log.
Loss or misplacement is effectively invisible until discovered.
"Reasonable steps" must be argued after the fact.
Breach notification relies on reconstruction from memory.
AFTER

With myAbakis.

Records stay inside a controlled digital environment.
Every access is timestamped and attributed.
Loss events are structurally difficult to create.
"Reasonable steps" are visible in the system itself.
Section 12(2) responses start with a full event record.
YOUR NEXT STEP

See what defensible record-keeping looks like in practice.

Let's chat for 20 minutes. We'll show you how Ontario clinics and consultants are finally ditching the messy binders—without adding hours of extra work to your week or endless training for your staff.
Book a Demo
See Pricing

Disclaimer

This page is published by myABAKiS for informational purposes only and does not constitute legal advice or an interpretation of any specific provision of PHIPA, the Psychology and Applied Behaviour Analysis Act, 2021, or CPBAO standards. Registrants with specific questions about their obligations should consult CPBAO, the Information and Privacy Commissioner of Ontario, or qualified legal counsel. Statutory quotations are reproduced as enacted; full text is available on the Government of Ontario's e-Laws.

Primary Sources

myABAKiS ABA Software Logo
Request a Demo
Menu
Support
© ABAKIS Ltd. All Rights Reserved | Privacy Policy | Terms & Conditions