18.2 Health IT, EHR, and AI Ethics
Key Takeaways
- Beginning October 30, 2026, the FNP-BC TCO names responsible and ethical use of IT — voice recognition, AI, and the EHR — as Implementation knowledge; the FNP who signs remains accountable.
- Voice-recognition and AI-scribe drafts commonly drop “not,” reverse laterality, and mangle numbers or look-alike drug names; authenticate only after you check those fields.
- Copy-forward, note-bloat, and cloned notes are integrity problems: stale ROS, another patient’s exam, or a physical you did not perform.
- Do not paste identifiable PHI into a consumer chatbot; use only contracted tools under a business associate agreement, and still verify output for bias and error.
- Information blocking makes timely electronic access the default, with privacy and preventing-harm exceptions; portal misreads need explanation, not hiding routine results, and downtime needs a rehearsed paper-to-EHR reconciliation.
Beginning October 30, 2026, the FNP-BC Test Content Outline names responsible and ethical use of information technology as Implementation knowledge. The updated outline’s parenthetical is the one to study: voice recognition, artificial intelligence, and the EHR. The current outline (through October 18, 2026) already tests legal and ethical implications of technology under Implementation. Implementation itself grows from 43 scored / 29% to 50 scored / 33% at that cutover. This section teaches the October 30 item thoroughly so the guide remains valid on either side of the date.
ANCC is not testing whether you can name a vendor. It is testing whether the FNP who signs remains accountable when the machine drafted, copied, suggested, or posted the work.
Voice recognition is a draft, not a note
Speech-to-text is faster than typing and it is a high-yield error engine. Ambient microphones hear the room. Models guess. You authenticate.
| Error class | What it looks like in an FNP note | Why it harms |
|---|---|---|
| Omitted or inserted “not” | “Patient is suicidal” versus “Patient is not suicidal”; “No chest pain” becomes “chest pain” | The covering night NP, the next clinic, and a later review will believe the signed sentence. |
| Laterality | Left mastectomy documented on the right; right otitis treated as left | Wrong-side imaging, wrong-side procedures, wrong-side billing. |
| Numbers and units | “Fifteen” becomes 50; “fifty” becomes 15; mcg versus mg; “one point five” becomes 15 | Insulin, pediatric liquid antibiotics, levothyroxine, and anticoagulants are unforgiving. |
| Homophones and look-alike drugs | Hydroxyzine / hydralazine; clonidine / Klonopin; Foradil / Fioricet | Classic medication-error pairs that a spell-check will not catch. |
| Attribution | The patient’s words land in your assessment; a daughter’s history is written as if you examined the patient | Integrity failure and a billed exam you did not perform. |
The FNP who authenticates the note owns every word. Vendor claims about accuracy are not a defense. Read the note — especially the assessment, the orders, laterality, allergies, and every number — before you sign. If a human scribe or an AI draft produced the first version, the rule does not change.
A practical authentication pass: (1) does every problem on today’s list belong to this patient; (2) is every “not” where you meant it; (3) left versus right on any paired organ or limb; (4) every dose, decimal, and unit; (5) did you actually perform the exam paragraphs that appear. If any answer is no, fix it before Sign.
Copy-forward, note-bloat, and cloned notes
These are integrity problems, not productivity features.
Copy-forward of last visit’s review of systems, physical exam, or assessment imports stale data. The 2024 “no chest pain” is still sitting in a 2026 note on the afternoon the patient is having an NSTEMI. Copy-forward of a problem list is safer than copy-forward of a narrative exam — and even the problem list must be edited when the problem resolved.
Note-bloat is the 12-page progress note stuffed with imported labs, unedited device streams, and a cloned physical. It hides the clinical story. It is also how you document a 14-point review of systems you never asked.
Cloned notes are the same paragraph across patients, or the same exam on every visit. If the 6-month-old and the 86-year-old have identical musculoskeletal exams, the note is fiction. Payers and quality reviewers treat cloning as a credibility and compliance problem. Students lose items when the stem’s “efficient” option is yesterday’s note with a new date stamp.
FNP habit: start from today’s encounter. Import labs as data, not as narrative. If you copy last visit’s plan, edit it in the same sitting so today’s changes are visible. Chapter 17.4 is comprehensive documentation; this section is the ethics overlay — the signed note must be true of this visit.
AI scribes and clinical decision support
Ambient AI scribes, draft after-visit summaries, differential generators, and order-suggestion tools are already in primary-care rooms. The October 30 TCO expects you to use them responsibly.
Accountability. The FNP remains accountable for the signed note and the signed order. If the model omitted the penicillin allergy, invented a family history of sudden death, or suggested a fluoroquinolone the patient should not receive, you prescribed it when you clicked Sign. There is no “the model said so” defense, and there is no transfer of liability to the vendor that survives a board complaint about your authentication.
Verify before you act. Treat AI output as an unlicensed student: useful draft, always checked. Confirm laterality, allergies, medication list, and the assessment against what you actually heard and examined. Do not let a suggested order set add sliding-scale insulin you did not intend, or a CT you did not discuss.
Bias in training data. Models train on historical records that under-represent some groups, over-fit others, and encode racist, sexist, or ableist patterns. Pulse-oximetry performance in darker skin, pain scores, and risk calculators that treat race as biology are the teaching examples. If the AI “reassures” you that a Black woman’s chest pain is anxiety, you still do the ACS workup the history requires. Decision support is not a physical exam and not a substitute for knowing when a tool was trained on the wrong population.
Consumer chatbots are not the EHR. Do not paste identifiable PHI — names, dates of birth, medical record numbers, identifiable rash photographs, or a unique job plus a rare diagnosis — into a consumer chatbot that is not under a business associate agreement. “I will delete the chat later” is not a safeguard. The vendor’s training pipeline is not your medical-record system. De-identified hypotheticals for your own learning (“an adult with migratory polyarthritis — what is the differential”) are a different act from dumping today’s adolescent psychiatry HPI into a public model. Enterprise tools contracted by the health system, with a BAA, logging, and a data-use policy, are the only appropriate AI destination for real patient data — and you still verify the output.
Information blocking versus privacy
The 21st Century Cures Act and ONC information blocking rules make timely electronic access to electronic health information the default. Health-care providers, certified health-IT developers, and health information exchanges or networks are actors. A practice that is likely to interfere with access, exchange, or use of electronic health information is the problem the rule targets, unless required by law or a defined exception applies.
Information blocking is not a command to post everything, instantly, with no judgment. Defined exceptions include preventing harm and privacy (and others aimed more at developers and networks). The preventing-harm exception requires a reasonable belief that withholding will significantly reduce a risk of substantial harm to the patient or another person, and that the interference is no broader than necessary. “I have not had time to pre-counsel this routine TSH” is not substantial harm.
| Situation | Blocking risk or legitimate limit? |
|---|---|
| Holding a routine lipid panel until next week’s visit so you can “explain it in person” | High risk of being treated as interference without a qualifying exception |
| Delaying release when you reasonably believe access would cause substantial harm, no broader than necessary | May fit preventing harm — document the specific harm |
| Withholding psychotherapy notes or applying the privacy exception as the rule defines it | May fit — do not confuse “privacy” with “I prefer patients not see their record” |
| A lab mis-files someone else’s HIV result; you stop the portal release | Safety, not blocking |
| Patient requests an electronic copy; staff say “we don’t do that” | Classic blocking fact pattern |
HIPAA gives patients a right of access. Information blocking penalizes unreasonable interference with electronic access. They are not the same statute. Both push toward sharing. Neither requires you to ignore a real safety risk.
Patient portal misreads
Portals put raw numbers in front of people before you do. A “low” flag on a slightly out-of-range potassium, a CA-125 ordered for the wrong reason, or a radiology hedge (“cannot exclude malignancy”) can send a well person to the emergency department — or send a sick person into panic that delays the visit where you would have explained the plan.
FNP moves: write the indication on the order so the result has a story; use patient-facing result comments when the EHR allows; teach high-risk patients which flags mean “message the clinic today” versus “go to the ED”; do not hide routine results to avoid an awkward inbox (that is the blocking problem above); do pick up the phone for new cancer, new HIV, or a critical value. Portal access is not a substitute for a critical-value callback.
Downtime procedures
EHRs fail. Ransomware, upgrades, and power loss are Implementation events, not IT-only events.
A usable downtime plan has: paper or downtime-computer registration and note templates; a method to record allergies, medications, and last tetanus; a way to order and retrieve critical labs; who has authority to revert to paper; how controlled-substance prescribing works if electronic prescribing of controlled substances is down; and a named reconciliation process when the system returns so the paper insulin order and the electronic insulin order do not both fire.
Do not invent doses from memory when the allergy list is on a dark screen — use the downtime source of truth (printed census, last after-visit summary the patient brought, the medication bottle). When the system returns, someone named enters the downtime encounters. Unsigned downtime notes are how the next FNP restarts the metformin you stopped for rising creatinine.
In-practice vignettes
Voice. The ambient draft says “left lower quadrant” after you examined the right. You fix laterality before you sign. You do not assume the model “usually gets it.”
Chatbot. A colleague pastes a 14-year-old’s full psychiatric history into a consumer model to “make the note nicer.” That is a Privacy Rule problem and a professional-ethics failure, not a documentation shortcut.
Copy-forward. Last year’s “no suicidal ideation” is still in today’s note. Today the patient screened positive. Signing without an edit is an integrity failure.
Portal. A PSA of 18 ng/mL posts Friday at 9 p.m. You do not hide all PSAs forever to avoid weekend calls. You call.
Downtime. Saturday ransomware. You use the paper chest-pain pathway and EMS. Monday you reconcile so the troponin, the aspirin, and the allergy update exist in the legal record.
October 30 shorthand: the FNP who signs is the clinician; the model is a draft; PHI stays inside contracted systems; access is the default; downtime is a rehearsed procedure.
An ambient AI scribe drafts the visit note. The FNP is about to sign. Which statement is correct?
A colleague pastes a 14-year-old’s full psychiatric history, name, and date of birth into a consumer chatbot to “clean up the wording.” What is the correct professional position?
Which documentation practice is an integrity problem rather than a productivity win?
A routine lipid panel returns after hours. The FNP is tempted to hold every portal result until the next visit “so nobody panics.” Which statement is correct?