Sign in to Peak Brain Path
Sign in to access your courses, books, and progress tracker. New here? Signing in creates your account automatically.
Want to explore courses first?
Browse courses and booksSign in to access your courses, books, and progress tracker. New here? Signing in creates your account automatically.
Want to explore courses first?
Browse courses and booksModule 23
Chapter 23 · 2 h · 8 quiz items · pass at 80%
BCIA Domain X is the ethics and professional-conduct domain, and this module is the course's accountability checkpoint. It covers the BCIA Code of Ethics, scope of practice for the licensed and unlicensed routes, HIPAA, advertising limits under FTC guidance, and the mentoring and recertification obligations a candidate must meet. Because an ethics or scope failure is a professional risk, the quiz passes at 85%, mirroring professional-standard discipline for ethics and scope-of-practice content. Currency-sensitive BCIA figures in this module are flagged for verification against current requirements.
Everything in the preceding twenty-two chapters concerns what you do to a signal: how you record it, read it, and train it. This chapter concerns what you owe the person attached to the electrodes, and the profession you are joining. It is the content of BCIA Domain X, and it is the part of the blueprint that practitioners are most tempted to skim and most likely to be harmed by skimming. A protocol error costs a client a few unproductive sessions. An ethics error, a claim you could not support, a record you could not produce, a scope you exceeded, can cost you your certification, your license, and your practice.
The material here is also the part of the book most sensitive to the calendar. Codes are revised, fee schedules change, mentoring requirements get restructured, and federal privacy rules are amended. Where this chapter cites a specific number or rule, treat it as accurate to the source it was drawn from and verify it against the current published code before you rely on it. The discipline of checking the current rule rather than the remembered one is itself a professional obligation, and it is the right habit to build before you ever sit the exam.
A neurofeedback practitioner answers to two ethical frameworks, and on the exam you are expected to know both by name.
The first is the BCIA Professional Standards and Ethical Principles, the code you agree to when you certify and recertify. It is written for biofeedback and neurofeedback providers specifically, and it is the document a complaint to BCIA is adjudicated against. The second is the ISNR (International Society for Neuroregulation and Research) Ethical Principles of Practice for Neurofeedback Professionals, the standards of the field's primary professional society. If you are also licensed in a regulated profession, psychology, counseling, social work, medicine, nursing, you answer to a third framework, your licensing board's code, and where these conflict the licensing board generally governs your scope and the BCIA code governs your conduct as a certificant. Holding all of them at once is normal; they overlap far more than they diverge.
The BCIA code organizes its obligations around a familiar set of principles, and it is worth knowing them as categories because exam scenarios map onto them.
Competence. You practice within the boundaries of your training, education, and supervised experience, and you do not offer services or use techniques you are not qualified to deliver. This is the principle that governs most of the scope material below, and it is the single most consequential idea in the chapter. The whole point of certification is to certify a boundary, and the obligation is to stay inside it.
Integrity. You are honest with clients and colleagues. You do not misrepresent your credentials, your training, or what neurofeedback can do. You describe outcomes in terms the evidence supports, and you correct a client's misunderstanding rather than letting a useful exaggeration stand.
Responsibility to clients. You act in the client's interest, protect their welfare, obtain informed consent, safeguard their confidentiality, and refer when their needs exceed your competence or your scope. The contraindication and referral obligations below all live under this principle.
Responsibility to the profession. You uphold the standards of the field, maintain your competence through continuing education, supervise ethically when you supervise, and conduct any research and any advertising honestly.
The ISNR principles cover the same ground with the emphases of a research society: candor about the evidence base, integrity in how findings are represented, and the responsible conduct of both practice and research. Where BCIA and ISNR align, which is most places, you have a clear standard. Where a question is silent in one and addressed in the other, the stricter reading is the safer one to practice by.
Scope of practice is where ethics becomes concrete, and it is the area to verify most carefully because the regulatory details change.
BCIA awards a single entry-level neurofeedback credential, Board Certified in Neurofeedback (BCN), regardless of the holder's license status. What differs by license status is not the credential title but the scope of practice it authorizes.
Licensed practitioners. A BCN holder who already holds a license to treat diagnosed medical or psychological disorders, together with at least a bachelor's degree in a BCIA-approved health care field from a regionally accredited institution, practices within a scope set primarily by that license. BCIA requires that when neurofeedback is used to treat a medical or psychological disorder, the practitioner hold a current license or credential issued by the state in which they practice in a BCIA-approved health care field. A licensed psychologist who holds BCN can assess, diagnose within their license, and treat, and the neurofeedback certification adds a credential within that existing scope.
Unlicensed practitioners. A BCN holder who does not hold a clinical license may obtain the same credential if they meet BCIA's degree, didactic, mentoring, and exam requirements, but the scope the credential authorizes is narrower in a way that is easy to violate without noticing. You may do performance and self-regulation work. You may not diagnose, you may not treat a diagnosed disorder on your own authority, and you may not present what you do as treatment for a medical or psychological condition. If a client with a diagnosis comes to you for symptom relief, that work belongs under the supervision of a licensed professional, with the diagnosis and the treatment owned by the licensed clinician and the neurofeedback delivered within that relationship.
Technician level. For those without a qualifying health care degree, working under the legal supervision of a licensed and BCIA-certified provider.
The dividing line that does the most work in daily practice is diagnostic language. An unlicensed practitioner does not say a client "has ADHD" or "has anxiety disorder," does not say a brain map "shows depression," and does not say neurofeedback "treats" a named condition they are not licensed to treat. The map shows patterns of electrical activity, faster or slower than a normative range, more or less coupled than expected. You can describe those patterns and what you intend to train. The translation of a pattern into a diagnosis is a licensed act. This is not pedantry; it is the difference between describing data and practicing medicine without a license, and a careless sentence in a report or a marketing page can put you on the wrong side of it.
The related distinction is assessment versus screening. A QEEG that informs your protocol is assessment of the EEG, within scope for a trained practitioner. Using that same recording to render a clinical diagnosis is outside an unlicensed scope. When in doubt, describe what you measured and what you will train, name the patterns, and leave the diagnostic conclusion to a licensed clinician, your own or one you coordinate with.
The competence principle has a specific application that the exam tests and that supervisors watch for: you do not run a protocol you were not trained to run safely, even when your equipment offers it and a client asks for it. Several protocols in this book are explicitly not first-year work. Alpha-theta carries real risk of abreaction and emotional flooding and belongs to practitioners with the clinical background to contain what surfaces. SCP and seizure-oriented training belong to clinicians who work with the relevant populations and coordinate with treating physicians. Coherence and z-score work assume QEEG literacy you have to actually possess.
The obligation is not "never expand your scope." It is "expand it through training and supervision, not through improvisation." When a client presents a need beyond your current competence, you have two honest paths: get the training and supervision to meet it competently, or refer to someone who already can. The dishonest path, attempting it because the client is in front of you and the software has the option, is the one the competence principle exists to forbid.
Neurofeedback has a strong safety profile, which is exactly why the situations that demand caution or referral deserve to be memorized rather than improvised. Some presentations are not yours to train, at least not without specialist involvement and not as a first-line intervention.
Active psychosis or acute mania. These are states needing stabilization, usually pharmacological, before regulatory training is appropriate. Neurofeedback has been studied as an adjunct alongside antipsychotic medication, but it is not a first-line intervention for someone in acute crisis, and an unlicensed practitioner has no business managing it.
Acute suicidality or active self-harm. The priority is safety-focused intervention by an appropriate clinician. Neurofeedback belongs in the longer-term plan once acute risk is managed, not in the acute window, and a practitioner who encounters active risk has a referral obligation overriding any training plan.
Unstable seizure disorders. Neurofeedback grew out of epilepsy research and some protocols raise seizure thresholds, but training without proper assessment, or with protocols that increase excitability, can lower them. Seizure-relevant work requires experience with epilepsy and coordination with a treating neurologist, not a generalist running a standard protocol.
Implanted electrical devices. Standard EEG recording is safe with most implants, but some devices, certain pacemakers and deep brain stimulators, can interact with equipment, and full disclosure of any implanted device is part of intake.
Heavy sedation from medication. Benzodiazepines and opioids at high doses can blunt the plasticity the operant loop depends on. This rarely forbids training outright, but it requires you to know what the client is taking and adjust expectations and sequencing, which is why a complete medication history is mandatory before a brain map and before training.
None of these except the acute psychiatric emergencies is an absolute, blanket prohibition. They are triggers for clinical judgment, mandatory referral, or coordination with a treating clinician. The professional failure is not "treating a hard case," it is treating a case requiring a referral you did not make, or coordination you did not seek, because the boundary was inconvenient.
Under federal law, a health care provider is a HIPAA covered entity only if it transmits health information in electronic form in connection with a HIPAA-standard transaction. Billing insurance electronically is the common trigger. A cash-only practice that never submits electronic claims or engages in other HIPAA-standard electronic transactions is generally not a covered entity under HIPAA, though it remains subject to state privacy laws and the BCIA confidentiality principle. Because those parallel obligations cover much of the same ground, the safe default is to assume HIPAA-level protections apply and build the practice accordingly.
A few HIPAA mechanics matter enough to know by name.
Covered entity versus business associate. You are a covered entity if you provide health care and handle protected health information. A vendor who handles that information on your behalf, a billing service, a cloud platform that stores your records or brain maps, an EEG database company that holds identifiable client data, is a business associate, and you are required to have a Business Associate Agreement in place with each of them before they touch protected information. The brain-map database vendor and the practice-management software are the two business associates a neurofeedback practice most often forgets to paper.
Protected health information in your specific records. PHI is any individually identifiable health information you create or hold. In a neurofeedback practice that includes the obvious, intake forms, session notes, correspondence, and the less obvious, the brain maps themselves and any EEG recordings stored in a normative-database system tied to a client's identity. A QEEG file with a client's name is PHI exactly as much as a chart note is, and it has to be stored, transmitted, and disposed of with the same care.
Notice of Privacy Practices and the minimum necessary standard. A covered entity must give clients a Notice of Privacy Practices describing how their information is used and disclosed. And the minimum necessary standard requires that when you use or disclose PHI, you limit it to the minimum needed for the purpose. You do not send a client's entire record when a treating physician asks for a summary, and you do not leave maps and notes accessible to staff who have no need to see them.
Breach notification. When unsecured PHI is breached, lost laptop, misdirected records, unauthorized access, you must notify the affected individuals within sixty calendar days of discovery. For breaches affecting five hundred or more individuals, you must also notify HHS and prominent media outlets in the affected jurisdiction within that same sixty-day window. Smaller breaches must be logged and reported to HHS within sixty days after the end of the calendar year in which they were discovered. The practical implication is you should know, before anything goes wrong, what your breach-response steps are, because the clock starts at discovery, not at convenience.
A defensible practice is a documented practice, and documentation serves three masters at once: clinical continuity, the ethical and legal record, and, for licensed practitioners, insurance and supervision. The standard is not "write a lot," it is "record what a competent reviewer would need to reconstruct your reasoning and your client's course."
For the practice record as a whole, that means: a complete intake including history, presenting concerns, medications, prior treatment, and contraindication screening; the informed consent the client signed; the clinical rationale for the protocol you chose, the assessment-to-protocol reasoning Chapter 13 builds; and a session-by-session record of what you ran and what changed. For each session, the defensible note captures the date, the protocol and parameters, observations during the session, any adverse effects, and the plan, the same elements Chapter 19 lays out as the session note. Outcome measures administered over the course, the rating scales and continuous performance tests of Chapter 20, belong in the record too, because they are the evidence the work is or is not helping.
Two documentation duties are easy to underweight. The first is the rationale: a record showing what you did but not why you did it cannot defend a clinical decision to a board, a supervisor, or a court. The second is the adverse-event note: because neurofeedback lacks a centralized adverse-event registry, your own record is the only systematic surveillance there is, and noting a client became irritable after a session, and what you did about it, is both good care and good protection.
Certification requires supervised practice, and the mentoring requirement is the part of the path candidates most often underestimate in time. BCIA mentoring for the entry-level credential comprises 25 contact hours with a BCIA-approved mentor, of which at least 2 must be face-to-face, covering 10 personal self-regulation sessions, 100 patient or client sessions, and 10 case-study presentations, with up to 5 BCIA mentoring webinars permitted to substitute for 5 contact hours and the 10 case studies. Verify every one of those numbers against the current requirement before you build a plan around them, because the structure of the mentoring requirement is exactly the kind of thing BCIA periodically revises.
Finding a mentor is part of the work. A BCIA-approved mentor holds the certification, meets BCIA's mentor criteria, and is willing to take you through the required sessions and case presentations. BCIA maintains a directory, and many candidates find a mentor through the training program that delivered their didactic education.
The mentoring log is the document proving the supervised hours happened, and it has to be kept contemporaneously and completely. It records, at minimum, the dates and durations of contact, the mode of each contact (in-person, video, phone, or webinar), the self-regulation and client sessions reviewed, the case studies presented, cumulative totals for each requirement, and the mentor's attestation confirming accuracy. A log assembled from memory at the end is both a credentialing problem and an integrity problem; keep it as you go. The back matter provides a mentoring-log template aligned to the required elements.
The therapeutic relationship in neurofeedback carries the same dual-relationship hazards as any clinical relationship, and the long course of treatment, often dozens of sessions over months, gives them time to develop. A dual relationship is any situation where you hold a second role with a client, social, business, financial, familial, alongside the clinical one, and the problem is the second role can compromise your judgment and the client's freedom to disagree, end treatment, or decline a recommendation.
The governing standard is to avoid dual relationships that could impair your objectivity or exploit the client, and where a secondary relationship is genuinely unavoidable, in a small community, for instance, to manage it transparently and in the client's interest. Treating close friends and family members is to be avoided because objectivity is compromised from the start. Bartering and financial entanglements beyond the fee for service invite exploitation and are best avoided. And the power asymmetry of the clinical relationship is the reason romantic or sexual relationships with current clients are categorically prohibited under every code you practice under. The unifying question is simple: does the second relationship put your judgment or the client's autonomy at risk. If it might, the relationship is the problem, not the inconvenience of avoiding it.
Fee structure is an ethics matter because it shapes the incentives a client can see in your recommendations. Fees should be disclosed clearly and in advance, and the structure should not create pressure to sell sessions the client does not need. Large prepaid packages are the specific hazard: a block of forty sessions paid up front, with no built-in reassessment point and no exit if the client is not responding, aligns your revenue against the client's interest in stopping when the work is not helping. A practice that sells big packages lacking reassessment points and offering no refund or exit path for non-response is structurally tempted toward the wrong recommendation, and the codes' integrity and client-welfare principles point the other way.
Informed consent for neurofeedback is the document and the conversation that make the contract honest, and it has required elements you should be able to list. A complete neurofeedback consent covers: what the proposed protocol is and why it was selected; the realistic range of outcomes including the genuine possibility of non-response; the expected timeline and session count, framed as an approximation rather than a promise; the side effects to expect, transient fatigue, headache, irritability, emotional activation, and when to report them; the reassessment schedule; the total expected cost and the exit points; the limits of confidentiality and the privacy practices that govern their data; and, where it applies, a candid statement that for many conditions neurofeedback is not yet a first-line, guideline-endorsed treatment even where clinical experience runs more favorable than the published evidence. Consent for remote or home-based delivery adds elements, the limits of remote supervision, artifact and emergency-planning constraints, which Chapter 21 details. Consent is not a signature you collect once; it is an understanding you establish and refresh, and the form is the record that you did.
What you say in public about neurofeedback is regulated, and not only by the professional codes. In the United States the Federal Trade Commission has authority over deceptive and unsubstantiated advertising claims under Section 5 of the FTC Act, and health claims are exactly the kind it acts on. The governing principle is that an objective claim about what neurofeedback does, especially a claim it treats or cures a condition, must be substantiated by competent and reliable evidence at the time you make it. The FTC's enforcement history in the broader brain-training and health-device space is the warning every neurofeedback practice should heed: claims that outrun the evidence are not a marketing flourish, they are a legal exposure.
In practice this means your website, your intake materials, and the things you say to a prospective client have to track the evidence base the way your consent conversation does. You can say neurofeedback is a training method, describe what it trains, and report outcomes in the careful, tiered language this book uses throughout. You should not say it cures ADHD, reverses depression, or guarantees a result, both because the codes forbid the dishonesty and because the FTC can act on it. Testimonials carry the same standard: a client success story presented as a typical result, when it is not typical, is a deceptive claim no matter that it is true of that one client. The honest practice advertises the way it consents, by matching the strength of the claim to the strength of the evidence.
Reporting obligations are jurisdiction-specific, and the responsibility is to know the ones that bind you where you practice rather than to assume a single national rule. In most jurisdictions, certain professionals are mandated reporters of suspected child abuse and neglect, and many jurisdictions extend that to abuse of elders and dependent adults, and to specific duties around imminent danger to self or others. No single federal mandatory-reporting law covers all categories; these obligations are state-specific, and the Child Welfare Information Gateway maintained by HHS publishes the most reliable state-by-state summaries for child abuse and neglect reporting. Whether you are a mandated reporter, and exactly what triggers the duty, depends on your jurisdiction and your license status, which means an unlicensed performance practitioner and a licensed clinician in the same city may carry different obligations. Find out which apply to you, in writing, before you are in the situation that invokes them, and know in advance how and to whom a report is made, because these duties arrive suddenly and the failure to report can itself be an offense.
Competence is not a state you reach at certification and keep by default; it is a thing you maintain. BCIA certification carries a four-year recertification cycle. BCN certificants must complete thirty-six hours of continuing education in each cycle, including at least three hours in professional ethics, from BCIA-accepted providers. These figures are worth confirming against the current BCIA requirement, because they are revised periodically and a lapse in tracking them is a lapse in your credential.
The deeper point underneath the recertification mechanics is the one this chapter started with. The field's evidence base moves, its protocols evolve, its codes and its regulatory environment change, and the practitioner who stopped learning at certification is, within a few years, practicing from an out-of-date map. Continuing education is the formal expression of the competence principle over time, and the same habit it enforces, checking the current rule and the current evidence rather than the remembered one, is the one this whole chapter asks you to build.
That habit is also the practice's compliance posture in miniature. A practice that knows which codes bind it, keeps its consent and its records honest, papers its business associates, logs its mentoring as it goes, matches its advertising to its evidence, and verifies the current rule before relying on it, is a practice that will pass an audit, survive a complaint, and serve its clients without exposing them or itself. None of it is glamorous, and all of it is the work. The chair, the session, and the signal are where the clinical skill lives. The posture described in this chapter is what lets you keep practicing them.