All features
Everything ABARecords does, feature by feature. Each one opens its own page: what it does, how it works where that helps, how its part handles an agency's data, and where it stands. It grows with every release.
Showing all 127 features of 30 parts
Agreements and signed records
Five agreements, signed inside ABARecordsLive
- Sign the five agreementsThe agency completes its profile, then its authorized signer reads and signs the HIPAA Business Associate Agreement, the Services and Subscription Agreement, the Platform Terms of Use, the Privacy Notice and Data Processing Terms and the PHI Access Attestation.
- Nothing changes before they are signedUntil all five are executed, the agency's workspace cannot change anything.
- Return, withdraw, change or voidBefore the countersignature, ABARecords can return an agreement and the agency can withdraw its signature. Both sides can ask for changes, and an executed agreement is voided only when both agree.
- What is waiting, on every pageWhatever is waiting, and for whom, shows on every page from sign-in, with the next agreement one click away.
Sealed recordsLive
- Locked in the databaseThe database refuses any change to a signed record, except the next step the rules allow, and refuses every deletion.
- Sealed and chainedEvery signature is sealed with ABARecords' server key and chained to the seal before it.
- A verification code on every pageEvery PDF carries a verification code and a QR code on each page, and readers do not let it be edited.
- Check any copyThe code and the document's 6-digit security PIN open the sealed original on abarecords.com, to compare it with any copy.
A write-once copy of every sealBeing set up
- The legal pagesPrivacy, cookies, terms, the agreements and how data is used: each page summarizes the agreement it reflects, with the date its text last changed.
- This site, a page for each partabarecords.com/platform is a small site: a simple front page, a page for each area with filters, and a page for each part with what it does, its privacy and where it stands.
- Every feature on its own pageEach part lists its features, and each feature has its own page: what it does, how it works where that helps, how it handles the data and where it stands. «All features» lists every one, with a search.
- Your data and what's newHow an agency's data is handled, one question at a time, and what is new, newest first. It changes with every release.
- Checked by testsTests check that both say only what the code does, and that no page carries anything about a client or a real person.
People and access
Sign-in with two-step verificationLive
- Two-step verificationTwo-step verification with an authenticator app, with recovery codes for a lost phone.
- Each agency's sign-in policyEach agency sets its own policy: two-step required or not, password expiry, session length and failed attempts allowed.
- An email for a new deviceA sign-in from a new device sends the person an email.
- Forgot password, and reporting a resetForgot password works by email. A reset nobody asked for can be reported, which kills the link and tells the agency's administrators.
The public provider directoryBeing set up
- Search by name, NPI, ZIP code, credential, agency and languageSearch by name or NPI, ZIP code, credential, agency and language, a page at a time.
- Listed only by choiceEach person chooses to be listed, and which languages, ZIP codes and NPI show. Their agency's administrator can change it too.
- Verified credentialsA credential shows as verified only when the agency verified it and it has not expired.
- Check an NPI with CMS«Check», next to each NPI on a listing or a card, opens the person's page in NPPES, the CMS registry. The listing then says the name, specialty and state CMS lists for that NPI, and whether the name matches.
- Verify a BACB credential«Verify», next to each BACB credential on a listing or a card, shows step by step how to check it in the BACB's Certificant Registry, with the link to go there.
- Distance in milesDistances in miles switch on once the Census ZIP code list is installed. Until then a ZIP code finds whoever works from it or serves it.
A links page for each personLive
- Made by the person, or by HRThe person makes it in «My links page», or the agency's administrators and HR make it for them in «Links Pages».
- Fills itself inIt fills itself in from what is on file: the person's phone and email, the agency's phone and website (its page at abarecords.com once it is online) and the person's professional card. A switch next to each says whether it shows.
- WhatsApp and the NPIA button that opens a WhatsApp chat on the person's phone on file, which only the person turns on, and their NPI with a link to the CMS NPI Registry (NPPES), shown when the NPI on file has the right check digit.
- Their profilesInstagram, LinkedIn, X, Facebook, TikTok, YouTube and a website of their own. The person writes a username or pastes the address of a profile; the page keeps only the username and opens the profile on the service's own site.
- A favorite quoteA favorite quote under their name, and who said it: one line of up to 160 characters, without web addresses.
- Links of their ownUp to 12 more links of their own, each with a name, that open a web page over https, an email or a phone number.
- A logo for each linkEach link of their own can carry a logo, a PNG or JPEG of up to 512 KB. It shows beside the link once the agency's administrators or HR approve it; one not approved goes back with the reason.
- A photo the agency approvesA photo of the person, which shows once the agency's administrators or HR approve it. Until a new photo is approved, the one approved before keeps showing; one not approved goes back with the reason.
- Available today, or awayThe page says whether the person is available today, from their approved time off in the calendar and from the system, in the agency's time zone: «Available», «Away · back on …», or that they no longer work with the agency. Time off is asked for and approved in the calendar; the page only reads it.
- A new address at any momentA new address can be made at any moment; the old address and its QR code stop working at once.
- Ask for time offVacation, PTO, sick, a day off, a holiday, a leave of absence or other, by whole days in the agency's time zone, with a note only whoever approves it reads.
- Approve, or say why notHR, the administrators, supervisors and clinical directors see the requests waiting, oldest first, with the sessions still booked in those days, and approve each one or say why not. Each request is decided once.
- Added by the agencyWhoever manages time off adds it for anyone in the agency, approved at once, and removes it with a reason the person reads.
- One period at a timeA person never has two periods of time off on the same day: the second one is refused and points to the first.
- The schedule follows itNo session can be booked, moved or brought back over a provider's approved time off, and the schedule says until when.
- The links page follows itWhile approved time off covers today, the person's links page says «Away · back on …»; it never says why.
Your agency's data
Your agency's own databasesLive
- A verified, encrypted connectionABARecords verifies the encrypted connection (TLS) and prepares its tables in each database.
- The cloud agreement firstThe agency records its own business associate agreement with its cloud provider before a database is used.
- Several databases, one mainEach additional database has a name and says what it is for: clinical records, staff and HR, messages, or documents. The agency can change a connection, make another database the main one, or disconnect one at any time.
Website forms stored only where they belongLive
- Stored only when everything is in placeReferrals, intake forms and job applications are stored only once the agency's Business Associate Agreement is executed, its database is connected with its cloud agreement, and production has started.
- Nothing stored beforeUntil then nothing is stored, not even in quarantine, and the website keeps what it received.
Your agency's address and its own domainsLive
- The agency's addressThe address is made from the agency's name when the agency is created, free among the others', and the agency's administrator can change it.
- Verify a domainFor each domain the agency adds, ABARecords gives one DNS TXT record to create at _abarecords.<domain>. When the agency presses Check, ABARecords looks it up and the domain is verified. It also says whether the domain points to the agency's page.
- Several domains, each on recordThe agency can add several domains, check one again at any time, and remove one. Who added, checked or removed each one is recorded.
Your agency's page at <name>.abarecords.comBeing set up
- What the page showsThe page shows the agency's name, logo, skin and tagline, the contact of its letterhead and the news it publishes in Website content.
- Online within minutesIt goes online within minutes of being published, with its own secure certificate, and goes offline when the agency takes it down or is suspended.
- Only the page thereUnder the agency's address there is only its page: no sign-in and no other part of ABARecords.
- “Powered by” at the footAt the foot of every page there, “Powered by” and ABARecords' logo, linked to this page.
Your agency's own AI, on Amazon BedrockBeing set up
- Bedrock in the agency's own AWS accountThe agency's administrator connects Amazon Bedrock in the agency's own AWS account, through a role the agency creates. ABARecords' server may use that role only with the agency's own external ID, and the role may call only the model the agency chose.
- A test with one fixed sentenceA test with one fixed sentence, and nothing of the agency, proves it works. A new role, Region or model asks for a new test.
- Direct AI stops with real patient informationAI tools that call a model provider directly stop once real patient information is on, so that information goes only to the agency's own Bedrock.
Policies
Agency policiesLive
- Decide each policyFor each policy the agency decides whether it applies it and how: suggested answers it can change, its own words and the date it starts.
- Every version signedEvery version is signed by the agency's authorized signer.
- Staff sign in one signatureEach member of the staff signs, in one signature, the policies that apply, and again whenever one changes.
Communication
How ABARecords runs
- Security updates by themselvesSecurity updates for the operating system install by themselves.
- HTTPS everywhereEvery page and every request travels over HTTPS, and the certificate renews by itself.
- Releases pulled by the serverEach release is pulled from GitHub by the server itself; GitHub has no way into the server.
- Checked after each releaseAfter each release the server checks that the website and the API answer, and that the locks on signed records hold.
One mark on every page and documentBeing set up
- The agency keeps its own brandEach agency keeps its own name, logo and photos on its pages; ABARecords shows only in the “Powered by” line at the foot.
- Once on every pageEvery page of the app, every agency page and every public page shows the line once; ABARecords' own pages show its logo at the top instead.
- On every PDF and printed pageEvery PDF ABARecords makes (agreements, access documents, policies and the documents of the app) carries it at the foot of each page, and so does each page printed with the Print button.
- One family of logosABARecords uses one family of logos: the AR ABArecords logo in its forms, and the marks of a function (HIPAA, security, the modules and portals).
- Two copies of ABARecordsThe server keeps two copies of ABARecords. A release is built in the copy that is not serving, at lower priority and with a memory ceiling, so the one that serves keeps answering.
- Database changes only addDatabase changes in a release only add, so the copy that serves keeps working while the new one starts.
- One step, only when it answersEveryone moves to the new copy in one step, and only after its website and its API answer. If they do not, nothing moves, the old copy keeps serving, and the release says why.
- Agency pages move tooAgency pages move in the same step.
- A page that says it is updatingIf no copy can answer, for example while the server restarts, ABARecords shows a page that says it is updating, and an agency's page shows a neutral one. Both come back by themselves.
- Never looks stuckEach part of a release says how long it took last time and, while it runs, prints a line every two minutes, so a long build never looks stuck. A release stopped halfway records where it stopped and stops its build; the copy that serves is never touched.
- Releases by itselfThe server releases a new version by itself: every three minutes it asks GitHub, with a key that can only read, whether there is one. GitHub never reaches the server. A version that fails is not tried again until the next one, and a change to the documentation alone builds nothing.
ABA practice tools
SchedulingPreview
- AppointmentsAppointments for clients and staff.
- One session at a timeA provider is in one session at a time, and so is a client, except protocol modification (97155) while the technician delivers direct therapy (97153). The rule holds when a session is booked, moved or brought back from cancelled, and the refusal says when the other session is.
- A move keeps the rulesA session moved keeps to the week's cap for its service, without counting against itself, and to the family's days and hours.
- Every change saved, or refused with the reasonOn the calendar, booking, dragging, resizing, rescheduling, changing the status and cancelling are each saved by the schedule. When it refuses one, the session goes back where it was and the schedule's reason shows on the page. A cancelled session keeps its record.
- The agency's own peopleThe calendar books the agency's clients and active providers, by name: whoever schedules for the agency sees every open client, anyone else the clients assigned to them. Each person's own calendar is theirs, and approved time off shows as whole days.
- No session over time offA session cannot be booked, moved or brought back over a provider's approved time off, and the schedule says until when. A day off is that whole day in the agency's own time, wherever the agency is.
- My own calendarEach person's calendar shows only their own sessions, their time off on its days, and the meetings they take part in.
- Meetings and events, with who takes partMeetings and events are kept in the schedule with who takes part: each person is required, so no session can be booked for them during it, or optional, still free to work. A meeting takes a few hours or whole days, like a training day, and it is added only when no one required has a session then.
- A client's own dayA client's appointments, with the minutes to get there and to come back, routines like school or a nap, and time away are kept in the schedule. No session for that client is booked over them, travel included. Time away can be added over sessions already booked: the calendar says how many, so they can be moved.
- Days the agency is closedWhoever schedules for the whole agency closes a day, or several in a row. No session can be booked on them for anyone, and the calendar says how many sessions were already booked then, so they can be moved.
- Moved or cancelled, never erasedA meeting, a client entry or a closed day is moved or cancelled by whoever added it, or by whoever changes sessions; anyone else sees it read only. Whoever did not add it says why it is cancelled, and the record stays, with who cancelled it and when.
- The reason that matters firstWhen a session falls on a closed day or while the client is away, the schedule says so before anything else, so nobody is asked to choose another time on a day that cannot be booked.
- The booking form says what is on fileWhile a session is booked, the form shows the authorization it counts against and its units left, or why the schedule will refuse it; the client's insurance in force; where the session takes place; and the provider's NPI and Medicaid ID. What is not on file says so: nothing is made up.
- One count of unitsThe schedule when it books, the booking form and the client's authorizations count units the same way: the client's own sessions, not cancelled, inside the authorization's days and with its code. A session being changed does not count against itself.
Fieldwork trackerPreview
- The week, day by dayEach week is one sheet from Sunday to Saturday: the setting, the activity, the hours, restricted and unrestricted, and the supervision of each day. On a phone the week is a list with today first, and today is the day on the phone, not in another time zone.
- The week filled in from the calendarThe sessions the trainee worked come in as hours: direct therapy as restricted, assessment, protocol modification and caregiver training as unrestricted. The supervisor's sessions with the same client while the trainee worked come in as contacts observed with the client, and meetings with the supervisor as contacts, group when others were there. Nothing counts until a person adds it, with the same checks as hours typed by hand; each is added once, and one that is not fieldwork is set aside and can be brought back.
- The supervision form of each contact, signed by bothEach supervision contact has its form, the encounter page of the workbook: the activities supervised, the task list items covered (A.1 to I.7), the clients by their initials, what was observed or reviewed, sixteen points of the supervisee's performance and the overall rating, the summary and the feedback given, and the tasks for the next encounter. It starts with what the contact already says. The supervisor fills it in and signs with a drawing; the supervisee reads it and signs the same text; until then the supervisor can take the signature back. Signed, neither the form nor its contact changes. Signed by both, it is sealed: its PDF, made by the server with the agency's own name and logo, carries a verification code and a QR code on every page, and the form's 6-digit PIN opens the sealed original.
- The hours from before the tracker, confirmed and countedFieldwork accrued before the tracker, under another supervisor or at another agency, is entered as one block per supervisor: the months, the fieldwork type, the total hours and how many of them were unrestricted and supervised, and the signed verification forms behind them. A block counts once the supervisor or a manager of the agency confirms it, saying they have seen those forms; then the target, the hours to go and the unrestricted and supervised share of all accrued hours count it, and so do the report, the readiness checklist, the packet, the audit and the workbook. Before confirming, the screen says what to look at: months that also have hours in the tracker, months shared with another supervisor's block, too little supervision. A confirmed block never changes: it is archived with its reason and entered again.
- The BACB's monthly and final forms, ready to copyFor each month, the values the BACB's monthly fieldwork verification form asks for, in its order: the trainee and their BACB ID, where the fieldwork occurred, the supervisor and their certification number, the independent and supervised hours, the observation time under the 2027 requirements, the total and the share supervised. A month is prepared only when everything the form needs is on file, and its values freeze with it; the trainee signs, then the supervisor, and the month locks. Each month shows the day its BACB form is due (the last day of the following month) in the agency's own day, and a month whose hours changed since it was prepared is prepared again before anyone signs. At the end, the final form of each supervisor, from the months they signed and the confirmed hours from before the tracker. The tracker never fills in the BACB's own forms: the people copy the values into them and sign them there.
- Supervision meetings, individual or groupA supervisor schedules a supervision meeting with one of their trainees, or with several, in person or online, from their fieldwork page: who, how and when. It is a meeting of the agency, in everyone's calendar, with each trainee's pass, sent by email when the supervisor chooses, and nobody on it can have a session with a client then. Afterwards, each trainee's own check-in and check-out come into their fieldwork week as a supervision contact, in person or online, with the minutes they were there, to add with its note. Individual or group goes by who was there: one trainee there with the supervisor is individual supervision, two or more is group.
- The month's checks as it is filledEach month is checked against the BACB rule set in force on its dates: the hours of the month, the share supervised, the contacts, individual and group supervision, observation with a client, and the unrestricted hours.
- The supervisor reviews each entryThe supervisor approves or returns each entry, and an approved entry that is changed goes back for approval.
- An Excel workbook with the agency's own name and logoThe fieldwork downloads as an Excel workbook that computes itself, with the agency's name, address, phone and logo on every sheet. The workbook names no other agency and no other person.
Conferences, trainings and meetingsLive
- An event and its sessionsA training, a conference or a meeting, held in person, online or both, with its sessions: each with its day and hours on the event's own clock, its presenter and its room. The event is prepared out of sight and published when it is ready; until then, the screen says what it still needs: a session, and the place when it is held in person.
- Three ways in: the sign-in, a code or a linkThe agency's own people see the events they are on the list for in «My conferences», with their sign-in. Anyone else comes in at abarecords.com/join with a code, typed or pasted, or with the link or QR code that carries it. Codes have 8 letters and digits for the event and 12 for a person, without 0, 1, I, L or O, so they read aloud and type without mistakes.
- Open, or by invitationAn open event lets whoever has its code or link register with their name and email, and the phone or a reference number when the event asks for them, until its places are full; each one gets their own pass at once. An event by invitation shows its code's holders only its name and times, and takes no registrations: each person on its list comes in with their own code.
- A pass that opens only for its ownerEach pass is tied to its owner's email, phone number or a reference number, such as an employee ID. On a new device it opens only after its owner confirms it is them: with a 6-digit code sent to their email, or by typing the phone or the reference number on file. At most three devices per pass; five wrong tries close it for fifteen minutes. The organizer can give a person a new code, which stops the old link at once, or forget their devices.
- The pass by email, with its calendar fileEach pass goes by email from the agency's own mailbox, or from ABARecords' on its behalf, with a calendar file that adds the sessions to any calendar; when the times change, sending the passes again moves them there. The online meeting's own link, from Dialpad, Zoom, Teams or Google Meet, is never in an email: it opens on the pass, so a forwarded email does not let someone else in.
- In the agency's calendarOnce published, each session is in the agency's calendar for its own people on the list, as a meeting or as an event, and they are required there: no session with a client is booked over it. Before the event is published, the organizer sees who of them has a session with a client during it, and when; it is published once each of those sessions moves or the person comes off the list. A published event takes nobody who has a session with a client then, and no new time that would overlap one.
- With a client, or at the event: one or the otherNobody of the agency is with a client and at one of its events at the same time. Checking in to a visit with a client is refused while the person is checked in to a session of an event, and checking in to a session of an event is refused while they are checked in to a visit; the screen says which one to check out of first. A check-in or check-out the organizer records by hand is refused at a time the person was with a client.
- Check-in in the room, with a code that changesEach session has a check-in screen for the room's projector or a tablet at the door: a QR code whose code changes every 30 seconds, so only someone in the room can read it. People scan it with their phone's camera, or type the code on their pass, from 30 minutes before the session until it ends, and again when they leave. A code read from the screen works for 90 seconds; ten wrong codes in ten minutes make that person wait.
- Online check-inAt an online session, each person checks in and out on their pass with one tap; at an event held both ways, they say whether they are in the room or online. Online, the codes and questions the presenter asks show that they are still there.
- Codes and questions during a sessionThe presenter asks everyone in the session for a code, read aloud or shown, or for the answer to a question with two to six choices, open for one to thirty minutes. Only the people checked in to the session can answer, once each; five wrong codes close it for that person. The screen shows how many answered and how many chose each answer, and each person's answers stay on their attendance.
- At the placeAn event held in person can check that people are at the place when they check in and out in the room. The organizer sets where the place is from a device there, or types its coordinates, and how far counts, from 50 meters to 2 kilometers. A device farther away, or one that will not say where it is, cannot check in or out in the room; the organizer can check that person in by hand, with the reason.
- Who was there, session by sessionFor each session and each person on the list: when they checked in and out, the minutes in between, how many codes and questions they answered, how they came in, and whether they attended all of it (no more than five minutes missed and every code and question answered), part of it, did not check out, or were absent. A check-in or check-out the organizer records by hand carries its reason. Nothing in it is changed or erased: a correction is one more entry. The attendance downloads as a spreadsheet.
- Your own meetings, from your own accountBesides the agency's organizers, each analyst (BCBA or BCaBA) organizes their own trainings and meetings from their own account: a meeting with their technicians, a supervision meeting with their trainees. Each one sees and manages only the events they created; the agency's organizers see them all.
- Cancelled with the reason, never erasedA session, a person on the list or the whole event is cancelled with its reason, never erased. When a published event is cancelled, the organizer can tell everyone on its list with an email, with a calendar file that takes it off their calendars; its entries in the agency's calendar are cancelled too.
- The list, to downloadThe list downloads as a spreadsheet: each person, how they came in, whether their pass went and on how many devices they confirmed it.
