Applied Behavior Analysis Office System
What ABARecords can do
Agreements, people and access, policies and communication today, and the clinical work of an ABA agency as it reaches production, with each agency's data kept as its own. Choose an area to see what each part does and, for each one, what it keeps and who can see it. It grows with every release.
30 parts and 127 features:19 live5 being set up6 preview
Our commitment
ABARecords works for an agency only after its HIPAA Business Associate Agreement is signed.
- Your agency's information is encrypted and kept in your agency's own database.
- No one at ABARecords sees it without your agency's written permission.
- Your data belongs to your agency, and only to your agency, forever.
Explore by area
- Agreements and signed recordsNothing works before the agreements are signed, and nothing signed can be changed.4 live1 being set upSee its 5 parts →
- People and accessWho can sign in, what each person can see and do, and the record of every change.7 live1 being set upSee its 8 parts →
- Your agency's dataThe agency's records live in the agency's own database, and nothing is stored anywhere else.3 live2 being set upSee its 5 parts →
- PoliciesEach agency decides its own rules, signs them, and its staff sign that they read them.1 liveSee its 1 part →
- CommunicationEmails that say what is waiting and where, and never anything clinical.1 liveSee its 1 part →
- How ABARecords runsIts own server in the United States, updated by itself, and releases that carry code only.2 live1 being set upSee its 3 parts →
- ABA practice toolsThe clinical and office work of an ABA agency. They run on synthetic data until production starts.1 live6 previewSee its 7 parts →
LiveWorks on abarecords.com today.
Being set upBuilt; it switches on once its last step outside the code is done.
PreviewRuns on synthetic or demo data only. No real client information is accepted until production starts.
Your agency's data, one question at a time
Each answer is a term of the agreements every agency signs; the page linked under it says more.
Nothing before the Business Associate Agreement
An agency changes nothing in ABARecords until its authorized signer signs its agreements, the HIPAA Business Associate Agreement among them, and ABARecords countersigns them.
HIPAA & Data Agreements →Where the data lives
In the United States only. The agency's clinical and personnel records are kept in the agency's own database, in a cloud account the agency owns, under its own agreement with that provider. ABARecords' account holds only what the platform needs to run, and no information about a client.
Privacy Policy →Who can see it
The agency's own users, according to their roles. ABARecords' staff have no access because of their job; they see an agency's data only with a written, time-limited grant from the agency's director, for a stated purpose.
Terms of Service →How it is protected
Encryption in transit (TLS 1.2 or later) and at rest, two-step sign-in, audit logs the agency can review, and signed records sealed so they cannot be changed.
Privacy Policy →AI, only in your own AWS account
AI that reads your agency's information runs only on Amazon Bedrock in your agency's own AWS account, under your agency's own AWS Business Associate Addendum and with its written approval. ABARecords holds no AI key.
HIPAA & Data Agreements →What ABARecords never does
It never sells data, never uses it for advertising, never contacts an agency's clients, never shares one agency's information with another, and never uses it to train AI models.
How We Use Data →When an agency leaves
It keeps read-only access for 90 days to export everything; then its data is returned or destroyed, as the Business Associate Agreement provides.
Terms of Service →Code, keys and passwords
GitHub receives source code only: no agency data, no real person's details, no keys and no passwords. Demonstrations and tests use made-up people and the example NPI that CMS publishes, and the code is checked for anything else. Keys and passwords are typed by their owner on their own page, stored encrypted and never shown again; ABARecords never asks for them by chat or email.
HIPAA & Data Agreements →What's new
October 18, 2026
- A links page for each person — Each person in an agency can have one page with their work links, their profiles and a favorite quote, with its QR code, at an address of 22 random letters and digits.
- Time off in the calendar — Each person asks for time off from their own calendar; the agency approves it, and the schedule and the links page follow it.
- Updates without stopping — Each new version is built and started beside the one that serves, and everyone moves to it only once it answers.
- Conferences, trainings and meetings — The agency's trainings, conferences and meetings: their sessions, who attends, a personal pass for each person that opens only for them, and who was there, session by session.
October 17, 2026
- Sealed records — Signed agreements, access documents, policies, acknowledgments and supervision forms cannot be changed or deleted, and anyone holding a copy can check it.
- The rules, in public — The legal pages summarize every agreement an agency signs, and abarecords.com/platform shows what ABARecords does, part by part.
- Permissions on every request — Every screen and every request checks what the person may do, in their own organization only.
- ABARecords' own team and roles — ABARecords is an organization of its own, with ten roles, and its console answers only there.
- Signed access documents — Every change to what someone on ABARecords' team can do is a document the manager and the person sign.
- Your agency's own databases — Optional: the agency connects its own PostgreSQL databases, for example Amazon RDS in the agency's own AWS account. One is the main database, and others can hold specific records.
- Your agency's address and its own domains — Every agency has its own address, <name>.abarecords.com, kept for its page and its forms. Connecting a domain the agency owns is optional.
- Agency policies — A catalog of 54 policies in nine areas that each agency decides for itself.
- Email from no-reply@abarecords.com — Signing requests, password resets, sign-in alerts and notices, with ABARecords' look and in the agency's time zone.
October 16, 2026
- Five agreements, signed inside ABARecords — An agency works only after its authorized signer signs its agreements in full and ABARecords countersigns them.
- Drawn signatures, on the screen or on a phone — Sign with a finger or a mouse, or scan a QR code and sign on the phone.
- Sign-in with two-step verification — Email and password or Google, a second step with an authenticator app, and a sign-in policy per agency.
- One account, several workspaces — A person who works for more than one organization moves between them from the account menu.
- Website forms stored only where they belong — What an agency's website sends is written to the agency's own database, or nowhere.
- ABARecords' own server — ABARecords runs on its own server in AWS, in Ohio, with its platform database on the same server.
