Somebody has to own it.
In most ABA clinics, compliance is nobody's actual job. It is a thing the founder does at eleven at night. A fractional compliance officer is the answer to one question: who is responsible on an ordinary Tuesday, when nothing is on fire?
Compliance does not fail loudly.
It belongs to nobody
So it loses to a scheduling crisis. Every week. Nobody decided to ignore it. It just never had a name attached.
It describes a clinic you used to be
The risk analysis predates half your systems. The policy set was bought, not built. It was accurate once.
The folder becomes the exhibit
Documentation that does not match what you actually do is not a shield. It proves you knew the requirement and said you met it.
Compliance is not a legal function. It is an operational one.
What a named officer actually does.
Owns the program
Not advice about the program. The program. The risk analysis, the remediation that follows it, training, vendors, incidents, and the evidence trail underneath all of it.
Keeps it true
A program is only worth what it describes. Ours describes your clinic this month, not the one you were two years ago.
Handles the lawyers
Some questions need counsel. Recognising which, briefing them properly, and turning the answer into something your clinic can do is the job, not an exception to it.
Knows ABA
Roles, supervision data, parent access, telehealth. A generic vendor will hand you a policy set written for a dental practice, which is worse than nothing.
Three levels of scope.
All ongoing. All with a named officer. Scope is agreed before anything starts.
HIPAA Officer
We own your HIPAA program end to end.
- Risk analysis and the remediation that follows
- Policies that describe your actual clinic
- Workforce training, tracked by role
- Vendor and business-associate register
- Incident and breach handling
- Six-year evidence trail
Compliance Officer
HIPAA plus the wider compliance surface.
- Everything in HIPAA Officer
- Entity and licensure obligations
- Payer enrollment and credentialing
- The rules of the states you actually operate in
Compliance and Security Officer
The full remit, including the security posture underneath it.
- Everything in Compliance Officer
- Controls and access model
- The technical posture your privacy obligations assume you already have
Scope is confirmed in conversation, not published as a checklist. The right remit depends on what you already have.
It runs on a system, not a spreadsheet.
Every engagement sits on WiseUpHIPAA, built for ABA from the first line. Controls backed by real records. A six-year evidence trail, because six years is what the rule requires you to keep.
A fractional officer working out of spreadsheets is someone you pay to maintain a folder. On a system, you are paying them to make decisions.
We take a small number of these.
Deliberately. An officer spread across twenty clinics is a subscription with a face attached. Engagements are limited, scoped individually, and reviewed on short terms rather than locked into long ones. That is your protection as much as ours.
If you would be better served running it yourself on the platform with us assisting, we will tell you. It costs less.
Who is watching it today?
Tell us what you have, what you do not, and what is keeping you up. We will tell you which level of scope actually fits, including the possibility that you do not need us to own it.
Start a conversationABAWiser provides compliance-program management and advisory services. We are not a law firm, we do not provide legal advice, and no engagement creates an attorney-client relationship. No software or service confers HIPAA certification; no such certification exists.