Sign in to Peak Brain Path
Sign in to access your courses, books, and progress tracker. New here? Signing in creates your account automatically.
Want to explore courses first?
Browse courses and booksSign in to access your courses, books, and progress tracker. New here? Signing in creates your account automatically.
Want to explore courses first?
Browse courses and booksModule 16
Chapter 16 · 2 h · 8 quiz items · pass at 80%
This module covers IQCB Domain VIII (Ethics), 5% of the exam, and carries a higher 85% pass threshold because scope-of-practice and HIPAA questions are matters of professional and legal responsibility, not just exam points. Knowing what a QEEG-T may not do independently, and how brain-map PHI must be handled, protects both the patient and the practitioner. The higher threshold reflects that stakes.
The IQCB exam allocates 5% of its items to ethics, which is small enough that a candidate can be tempted to skim it and large enough to matter on a test where the pass threshold is 70%. The exam weight is not the reason to take this chapter seriously. The reason is almost every way a QEEG practitioner gets into real trouble runs through one of the topics in this chapter: practicing outside your credential, claiming a QEEG can diagnose, mishandling a patient's brain-map data, taking referral money in a way that compromises your judgment, or carrying a clinical map into a courtroom without the consent that move requires.
When you set up your IQCB account and submit your application, you accept the IQCB Standards and Ethics as a condition of certification. The acceptance is not a signature on a form you forget. It is the framework the board uses to decide whether a credentialed practitioner acted appropriately when a complaint arrives, and the framework you are agreeing to be measured against for as long as you hold the credential. This chapter walks through the framework: the Code of Ethics and what it constrains, the three credential levels and what each is authorized to do, the scope limits on what QEEG findings can claim, the rules governing how you advertise QEEG services, how HIPAA applies to brain-map data, when clinical data can be used for research, the supervision and report-review requirements that govern the path to independent practice, the conflicts of interest baked into a practice that owns both the map and the treatment, the consent that forensic use demands, and the professional-development obligations that keep the credential current.
A small number of currency-sensitive figures (fees, hour counts, recertification details) should be confirmed against the board's current published standards before you rely on them. Certification boards revise these periodically, and a book is a slower medium than a board's website. Treat the numbers as accurate at the time of writing and confirm current ones against the board directly.
The IQCB's formal ethics document is the Professional Standards and Ethical Principles (PSEP), a multi-page code available as a PDF on the board's site. You accept it at application and are held to it throughout practice. Read the current text on the board's site rather than relying on a paraphrase, because the board controls the wording and the wording is what a complaint is judged against. What follows is an annotation of the principles a QEEG code of this kind enforces and what each one means at the point of practice, so when you read the actual code you recognize what each provision is protecting.
Practice within your competence and your credential. The code binds you to the scope your certification authorizes. A QEEG-T does not sign independent interpretations; a QEEG-D does. Practicing past your credential is the most common and the most avoidable ethics violation, because it does not require bad intent, only willingness to answer a clinical question you are not certified to answer. The credential levels are detailed in §16.2; the code is what makes staying inside them an ethical obligation rather than a suggestion.
Do not misrepresent what QEEG can do. The code prohibits claims the technology cannot support, in reports, in conversation, and in advertising. QEEG describes patterns and compares them to a database. It does not diagnose, and a practitioner telling a patient their brain map "shows" a disorder has misrepresented the technology regardless of how the report was worded. This connects the report-language discipline of Chapter 13 to the marketing rules of §16.4: the same overclaim is an ethics violation whether it appears in a report, a sentence to a patient, or a line on a website.
Protect patient confidentiality and data. The code obligates you to safeguard the patient's information: the map, the raw recording, the report, and any database entry derived from them. HIPAA supplies the legal floor for practitioners it covers. The ethics code obligates the protection independent of whether HIPAA reaches you. Data handling is detailed in §16.5.
Obtain informed consent. The patient consents to the recording, to its use, and to any secondary use such as research or forensic submission. Consent for one purpose is not consent for another, a distinction becoming load-bearing in §16.9.
Disclose conflicts of interest. Where you have a financial interest in the treatment a QEEG might recommend, the code obligates you to recognize and manage the conflict rather than let it shape the interpretation. This is detailed in §16.8.
Maintain competence through ongoing education. The credential is not a permanent state. The code ties continued certification to continued learning, detailed in §16.10.
The through-line of the code is restraint. Most of what it asks is you not do things: not exceed your scope, not overclaim, not expose patient data, not let a financial interest bend your reading. Ethics in QEEG is less about heroic action and more about the discipline to stop at the edge of what your credential, your data, and your evidence actually support.
IQCB certifies at three levels, and the differences between them are differences in what you are authorized to do with a brain map. Confusing them is a scope violation, so the distinctions are worth stating precisely.
QEEG-T, the Technologist. The QEEG-T is certified to acquire and process QEEG data. A Technologist runs the recording, manages impedance and artifact, applies the processing pipeline, and produces the quantitative output. A QEEG-T does not independently interpret the data or issue an independent clinical report. The interpretation and the signed report belong to a Diplomate, and a QEEG-T's work is reviewed and signed by a supervising Diplomate (§16.7). The Technologist credential is real and demanding. It is the credential of the person who makes sure the data going into the interpretation are clean. It is not a license to read the map.
QEEG-D, the Diplomate. The QEEG-D is certified for full interpretation and reporting. A Diplomate reads the map against the patient, decides what the findings can and cannot support, writes the clinical correlation, and signs the report. The Diplomate is the practitioner whose judgment the report represents and whose name and credentials appear on it. The reporting standards of Chapter 13 are written to the Diplomate's deliverable, because the Diplomate is the one who delivers it.
QEEG-DL, the licensed Diplomate. The QEEG-DL holds the Diplomate certification together with a clinical license, and the licensure broadens the scope of what the practitioner can do clinically with QEEG findings, because the license carries diagnostic and treatment authority the certification alone does not. A licensed Diplomate operates within both the QEEG certification's scope and the clinical license's scope, and the two are not the same. The QEEG certification governs what the map can claim; the clinical license governs what the practitioner can do with a patient. Holding both does not let a QEEG report diagnose. It lets the licensed clinician, integrating the QEEG with everything else they are licensed to assess, make a diagnosis the report itself still does not make.
The boundary that matters most in daily practice is between acquisition and interpretation. A QEEG-T who interprets, or whose interpretation goes out without a Diplomate's review and signature, has crossed the line the credential structure exists to draw. The structure is not bureaucratic ceremony. It is the field's way of ensuring the person making clinical claims from a brain map is the person certified to make them.
The scope of what a QEEG finding can support is the same whether the finding lives in a report, a sentence to a patient, or a claim on a website, and it is the single most tested boundary in QEEG ethics. The technology describes electrical patterns and their statistical relationship to a normative sample. It does not establish disease, it does not establish cause, and no credential changes that.
A QEEG finding can support a statement a pattern is present and how far it sits from a normative mean. It can support a statement a pattern is consistent with a body of literature. It can support a statement a pattern converges with, or diverges from, other clinical data. It can inform a clinical consideration a treating clinician then weighs. These are associational and descriptive claims, and they are the claims the technology earns.
A QEEG finding cannot diagnose a medical, psychiatric, or neurological condition. It cannot establish the cause of a pattern. It cannot mandate a treatment, and it cannot promise an outcome. These limits are detailed as report-language rules in Chapter 13, but they are ethics rules before they are style rules, because the practitioner who states them is making a claim about reality, and a false claim about a patient's brain is an ethics violation regardless of where it appears.
The diagnostic line deserves its own emphasis because it is where good practitioners drift. A QEEG pattern occurs more often in groups carrying a given diagnosis, and it is tempting, after seeing the pattern correlate with the diagnosis across many patients, to let "consistent with" relax into "shows." The relaxation is a scope violation every time. The pattern occurs in people without the diagnosis and is absent in people with it. The map is one data stream, and diagnosis integrates many. A practitioner stating a diagnosis from a QEEG has claimed an authority the technology does not confer and the certification does not grant. The licensed Diplomate who makes a diagnosis does so on the strength of the clinical license and the full clinical picture, not on the strength of the map, and the distinction is not pedantic. It is the difference between a defensible practice and a complaint.
How you advertise QEEG is governed by the same scope limits that govern your reports, plus the general legal standard that advertising claims be truthful and not misleading, which in the United States is the province of the Federal Trade Commission. The FTC requires health-related advertising claims, including claims about QEEG, be backed by competent and reliable scientific evidence. Clinical or diagnostic claims require a higher level of substantiation. The IQCB's Professional Standards and Ethical Principles separately require honest representation of services and adherence to legal and regulatory requirements in advertising. The ethics exposure in marketing is high because marketing copy is written to persuade, and persuasion pulls toward overclaim.
The rule: a marketing claim cannot assert what a QEEG cannot support. "Our brain map diagnoses ADHD, depression, and anxiety" is false advertising and an ethics violation, because the QEEG does none of those things. "We use QEEG to identify patterns associated with attention and mood regulation, as one part of a clinical assessment" describes what the technology does. The gap between those two sentences is the gap between a defensible practice and an enforcement action.
Three marketing failure modes recur. The first is the diagnostic claim, treated above: any copy that says or implies the map diagnoses a condition. The second is the outcome promise, "our QEEG-guided protocol resolves [condition]," promising a result no assessment can guarantee. The third is the false-precision claim, language dressing a low-resolution estimate in the costume of a measurement, such as marketing a source-localization image as a precise readout of activity inside specific brain structures. Each of these takes a real capability and inflates it past what the evidence supports, and each is the kind of claim that is fine in an enthusiastic conversation and an ethics problem in print.
Testimonials and before-and-after imagery carry their own exposure, because a testimonial implying a typical result from an atypical case is misleading even when every word of it is true. The conservative posture, and the one the code supports, is to market QEEG as an assessment tool that describes patterns and informs clinical decisions, and to let the description be accurate rather than impressive. Accurate marketing of a useful tool is sustainable. Impressive marketing of an overclaimed tool is a liability waiting for a complaint.
A QEEG generates protected health information in several forms at once: the raw recording, the processed quantitative data, the topographic images, the written report, and any entry the data make into a normative or research database. For a practitioner who is a HIPAA-covered entity or a business associate of one, all of it is PHI, and the Health Insurance Portability and Accountability Act governs how it is stored, transmitted, and disclosed. Whether HIPAA reaches a given practitioner depends on the practice's structure, and a practitioner who is uncertain should determine their status rather than assume it, because the penalties attach regardless of intent.
The brain map is unusually identifiable PHI, which raises the stakes on de-identification. A QEEG is patient-specific, and the combination of the recording, the demographics, and the dates can identify an individual even when an obvious name is stripped. This matters most when clinical data move toward research or toward a shared database, because de-identification for those uses has to actually work. Removing the name from the top of a report is not de-identification if the date of recording, the age, and the referral details still point to one person. HIPAA provides two de-identification pathways: the Safe Harbor method, requiring removal of eighteen specified identifiers (including name, geographic detail below the state level, all date elements except year, and any unique identifying data), and the Expert Determination method, requiring a qualified expert to certify re-identification risk is negligible. A practitioner contributing clinical data to a research database has to meet one of those standards, not a casual approximation.
Cloud storage and electronic transmission are where QEEG data handling most often goes wrong, because QEEG is a digital, file-heavy modality and the files move. A QEEG report emailed unencrypted, a recording stored in a consumer cloud service with no business-associate agreement, a database hosted by a vendor whose security obligations were never specified: each is a routine convenience and a potential breach. The standard: any service storing or transmitting PHI on your behalf is handling PHI under your obligation, which means the security has to be real and the business-associate relationship documented in a signed BAA specifying the vendor's security obligations. The practical posture is to treat every brain-map file as identifiable patient data, encrypted in transit and at rest, access-controlled, and held only by vendors whose obligations you have actually established.
QEEG practice generates exactly the data that QEEG research needs, and the pull to use accumulated clinical maps for research, for a normative contribution, for a case series, for a database, is natural and, handled correctly, valuable to the field. Handled incorrectly, it is a consent and confidentiality violation, because clinical data were collected for clinical purposes and research is a different purpose.
The governing principle: consent for clinical care is not consent for research. A patient who consented to a QEEG to inform treatment did not thereby consent to have their map become a research data point, and using it that way absent separate authorization breaches both the ethics code's consent provision and, for covered practitioners, HIPAA. Research use of identifiable clinical data requires its own consent, and where the use is broad enough to constitute formal research on human subjects, it requires the oversight that human-subjects research carries, which for many studies means review by an institutional review board.
De-identification can change what is required, because data that are genuinely de-identified to the HIPAA standard are no longer PHI and can support certain uses that identifiable data cannot. The trap is the word "genuinely," treated in §16.5: a brain map carries enough patient-specific information superficial de-identification leaves it re-identifiable, and a re-identifiable map used for research absent consent is an identifiable map used absent consent. The conservative path, and the one that keeps a practitioner clear of both the ethics code and the law, is to obtain explicit research consent for any identifiable clinical data and to meet the full de-identification standard before treating any data as exempt.
The path from completing the didactic to practicing independently runs through a supervised mentoring period, and the mentoring is where abstract competencies of certification become demonstrated practice. The IQCB mentoring requirement specifies a minimum of ten contact hours spent reviewing patient data analyses and presenting completed QEEG reports to a mentor, with at least two of those hours conducted as direct observation, documented on a mentorship verification form.
The published requirement is a minimum of 10 mentoring contact hours, covering 10 patient or client data analyses and 5 QEEG report presentations, of which at least 2 hours are direct observation. Treat every one of those numbers as subject to revision and confirm against the board, because hour and case requirements are exactly the kind of specification a certification board revises between published cycles. The structure behind the numbers is the durable part: a credentialed mentor reviews your data work and your reports across enough cases to calibrate your judgment, and observes you directly for part of it so what is verified is your practice and not just your paperwork.
Report review is the load-bearing piece for a QEEG-T. A Technologist's work does not reach a patient as an independent interpretation. It reaches the patient through a Diplomate who reviews the data and the draft and signs the report (§16.2). This is both a supervision requirement and a quality control: the Diplomate's review is where a misread artifact, an overreaching correlation, or a buried disclaimer gets caught before it leaves the practice. The review is not a rubber stamp on the Technologist's competence. It is the field's mechanism for ensuring every clinical claim from a brain map carries a Diplomate's accountability, which is the same logic that runs through the whole credential structure.
The mentoring relationship also carries its own ethics. A mentor signs a verification form attesting to work that actually happened, and a mentor signing for cases not reviewed, or hours not spent, has falsified a certification record, an ethics violation for both parties. The verification log is a documentation requirement precisely because the board relies on it as evidence, and fabricated evidence corrupts the credential it supports.
A common QEEG practice owns both ends of a chain: it performs the brain map and provides the treatment the map might recommend. The structure is not inherently unethical, and it is not unusual, but it builds a conflict of interest directly into the interpretation, and the ethics code obligates you to recognize and manage the conflict rather than pretend it is not there.
The mechanism of the conflict is simple. If the same practice that reads the map also bills for the neurofeedback the map points toward, then every "consistent with a pattern informing attention-regulation intervention" is also a sentence generating revenue for the reader. The reader is not necessarily corrupt, and most are not, but the incentive is real, and an incentive to find treatable patterns is an incentive that bends interpretation toward finding them. A practitioner insisting they are immune to the incentive has misunderstood how incentives work. The protection is not personal virtue but disclosure and process.
The management is disclosure and restraint. Disclose the financial relationship to the patient, so the patient knows the practice that found the finding is the practice that profits from treating it. Hold the interpretation to the same scope discipline regardless of where the treatment would happen, so the report says exactly what the data support and not one finding more, whether or not the practice provides the recommended intervention. And calibrate recommendations to the evidence rather than to the practice's service menu, so a borderline finding does not become a treatment recommendation because the practice happens to offer the treatment. The forensic version of this conflict, where the practitioner is paid by a party to the litigation, is sharper still and is treated in §16.9.
The referral conflict also runs the other direction. A practitioner referring patients to a particular treatment provider in exchange for referrals back, or for any other consideration, has a financial interest in the referral the patient is entitled to know about. The code's conflict provision is not satisfied by good intentions. It is satisfied by disclosing the interest and keeping the clinical judgment uncontaminated by it.
A QEEG recorded for clinical purposes and a QEEG submitted as forensic evidence are, in a real sense, two different acts performed on the same data, and the move from one to the other requires consent the clinical recording did not include. A patient who consented to a brain map to inform care did not consent to have the map entered into a lawsuit, and using it without separate authorization is a consent violation regardless of which party the use would help.
The consent issue is the ethics floor. The rest of forensic QEEG practice is the subject of Chapter 18, which covers admissibility, the expert-witness role, and the report requirements a courtroom adds. What belongs here is the ethical structure that governs the dual use. Forensic submission of a patient's QEEG requires the patient's informed authorization for that specific use, because forensic use exposes the data to adversarial scrutiny, to the opposing party, and to a permanent legal record, none of which clinical consent contemplated.
Forensic work also intensifies the conflict-of-interest problem of §16.8, because the practitioner is now paid by a party with an interest in a particular finding. The retaining attorney wants the QEEG to support their case, and the practitioner who lets that want shape the interpretation has stopped being an expert and become an advocate. The ethical obligation in forensic work is independence from the retaining party: the interpretation says what the data support, whether or not it helps the side paying for it, and a practitioner who cannot maintain independence should not take the case. The scope limits do not relax in a courtroom. A QEEG unable to diagnose in a clinic cannot diagnose in a deposition, and the adversarial setting makes the overclaim more dangerous, not less, because opposing counsel is specifically looking for it.
The credential is current only as long as you keep it current. IQCB ties continued certification to ongoing professional development on a three-year recertification cycle, and a practitioner letting the requirements lapse lets the credential lapse with them. The specific continuing-education hour requirements and renewal fee are not published on IQCB's public pages. Confirm them directly with the board.
The specific requirements, the length of the recertification cycle, the number of continuing-education units, the categories that count, are exactly the parameters a board revises, so confirm current ones against the board rather than against any number a book gives you. The principle behind them is stable even when the numbers move: QEEG is a field where databases get revised, source-localization methods improve, the evidence base shifts, and the standards of practice evolve, and a credential earned five years ago does not certify competence with the field as it stands. Recertification is the mechanism that keeps the credential meaning what it claims to mean.
Professional development is also where the ethics in this chapter stay alive in practice. The scope limits, the data-handling standards, the consent requirements, and the conflict disclosures are not learned once and retained forever. They are sustained by continued engagement with a field that keeps clarifying them. The practitioner who treats recertification as a renewal fee has missed its function. Its function is to ensure the person reading brain maps for patients a decade from now is held to the standard of the field a decade from now, which is the same reason the credential existed in the first place.
The compliance posture all of this adds up to is unglamorous and specific. Know which credential you hold and stay inside it. Write and speak about QEEG findings within scope, in reports, with patients, and in marketing. Treat every brain-map file as identifiable patient data and handle it accordingly. Get separate consent for research use and for forensic use, because the clinical consent does not cover them. Disclose the financial interests a practice owning both the map and the treatment unavoidably creates. Document the mentoring honestly, and keep the credential current. None of that is heroic. All of it is the difference between a QEEG practice that holds up and one that does not, which is what the board is certifying when it puts the credential next to your name.