22.2 Scope of Practice, HIPAA, Informed Consent, Culture & Ethics

IV.B is legal and ethical practice: regulatory guidelines (HIPAA, scope of practice, informed consent), cultural awareness and inclusiveness, ethical practice, licensure/credentialing/privileging, and adverse and sentinel events / patient safety. Domain IV still has only eight scored items. These stems are often short and binary-feeling. They are not optional.

Quick Answer: Scope is state law—collaborative, supervisory, or independent depending on the map, never a single national SOP. HIPAA is minimum necessary. A pediatric patient who gives informed consent must understand risks and benefits of the proposed treatment. Pair parental permission with assent. Practice cultural humility, not a laminated competence card. Name beneficence, nonmaleficence, autonomy, justice. Use just culture and disclose harm. Keep license, certification, credentials, and privileges current. Do not discuss live exam items.

Scope of practice is state variation—not a national SOP

Nurse practitioner scope of practice is defined by the state (or US territory) in which you are authorized. The APRN Consensus Model (NCSBN/NAPNAP-aligned: role + population + education + certification + licensure) is a model, not a federal statute. Do not tell the exam that every CPNP-PC in the United States independently prescribes and practices without a collaborative agreement.

AANP's commonly taught map:

• Full practice authority: evaluate, diagnose, interpret, and prescribe under the licensure authority of the board of nursing.
• Reduced: at least one element of practice requires a collaborative agreement or is otherwise limited.
• Restricted: supervision, delegation, or team-management by another profession is required for at least one element (often prescribing).

After you pass CPNP-PC, the state board still decides how the credential maps onto APRN authorization, DEA, and Medicaid enrollment. Compact RN licensure is not automatic APRN compact practice. If you telehealth a child in another state, you generally need authorization in the patient's state. Read the statute you practice under. The exam will punish a candidate who answers "NPs are independent everywhere" or "PNPs may never prescribe."

HIPAA: minimum necessary, plus adolescent-record caveats

The HIPAA Privacy Rule limits use and disclosure of protected health information (PHI) to the minimum necessary to accomplish the purpose, with a treatment/payment/operations lane that is not a license to gossip. Do not discuss a patient in an elevator, post a de-identified-looking photo that is still identifiable, or email PHI to a personal account. Give the Notice of Privacy Practices. Verify identity before releasing records.

Adolescents. Confidentiality is not an on/off parent lock. Many states allow minors to consent to STI testing and treatment, contraception, prenatal care, mental health, and substance use services under specific statutes; Title X and other federal rules can add confidentiality for those services. Parents often still have rights to general medical records. The 21st Century Cures Act information-blocking rules push electronic access; clinics use confidential note flags and proxy-access settings so a portal login does not dump a chlamydia result onto a parent's phone. You must know what you can keep confidential in this state, what you must disclose (suicidal plan, homicidal plan, reportable abuse, some serious public-health risks), and how you document the confidential portion. Promise "your parent will never find out" only when the law and the record system can keep that promise.

Informed consent, parental permission, and assent

PNCB's published CPNP-PC sample is the teaching point: to provide informed consent, a pediatric patient MUST have the ability to understand the risks and benefits of a proposed treatment. The distractors on that sample are exactly the traps:

• Not "must be at least 18." Chronologic majority is the usual default, but capacity—not the birthday cake—is the consent criterion when a minor is legally allowed to consent.
• Not "only if the minor needs reproductive health care." Reproductive care is a common statutory lane; it is not the definition of informed consent.
• Not "must be able to read and fully understand the written treatment plan." Literacy of a form is not capacity. A child who can read a pamphlet may still lack understanding; a child who cannot read may still understand a verbal explanation with an interpreter and teach-back.

AAP Committee on Bioethics language you should keep separate:

Capacity elements (teach-back): understand the condition and the proposed treatment, appreciate consequences, reason among options, and communicate a choice.

Exceptions and special lanes (principles, then check state law):

• Emergency exception: treat to prevent death or serious harm when a parent is unavailable. Stabilize first; keep trying to reach the guardian.
• Mature-minor doctrine (state-variable): some jurisdictions recognize an adolescent with demonstrated capacity for certain decisions even without a specific statute.
• Emancipation: marriage, military service, or court order can confer adult legal capacity for health care.
• Statutory minor consent: STI, contraception, pregnancy-related care, mental health, and substance treatment as the state lists them.
• Research: additional federal protections for children (parental permission + child assent) under HHS/FDA rules; primary care is usually treatment, not a trial.

Clinic vignette. A 15-year-old wants treatment for a sore throat and, confidentially, an STI screen. You obtain parental permission for the pharyngitis visit as required, assent from the adolescent, and—if your state allows minor consent for STI services—informed consent from the adolescent for that screen after she teaches back risks, benefits, and reporting rules. You do not use her 8-year-old sibling as the interpreter for consent.

Cultural humility is not a competence checkbox (IV.B.2)

IV.B.2: integrate cultural awareness and inclusiveness into all professional practice. Cultural competence as a one-time module implies you finished learning. Cultural humility (Tervalon and Murray-García) is lifelong self-critique, redressing power imbalances, and partnering with communities. Ask how this family understands the illness. Use a qualified medical interpreter (in-person, video, or phone)—not a child, not a bilingual uncle for consent. Inclusive practice includes disability access (22.3), chosen name and pronouns, religious fasting around medications, and immigrant families' fear of public charge or ICE in the waiting room. Do not assume diet, pain expression, or household composition from surname or skin color.

Four principles, and the vaccine-refusal versus child-protection conflict (IV.B.3)

Parent refusing routine vaccines. Autonomy of the parent-as-proxy and nonmaleficence toward a low-probability vaccine adverse event collide with beneficence and justice (herd protection). For routine immunization at a well visit, the usual ethical and legal path is counsel, document refusal, offer again, maintain the relationship—not an automatic CPS report. Refusing life-saving treatment for a serious disease (insulin for DKA, antibiotics for meningitis, chemotherapy for a curable childhood cancer when the standard of care is clear) is a child-protection problem: consult, escalate, and report as maltreatment law requires (Chapter 20). The exam wants that distinction, not a rant about parents.

Encourage similar ethical conduct in peers: you do not stay silent when a colleague posts PHI, coaches a family to fabricate a sports physical, or pressure-charts a billing level the visit does not support.

Adverse events, sentinel events, just culture, disclosure (IV.B.5)

An adverse event is harm from medical care, not the natural course of disease. A sentinel event (Joint Commission language) is an unexpected occurrence involving death, serious physical or psychological injury, or the risk thereof—wrong-patient vaccine with anaphylaxis and death, infant discharged to the wrong family, suicide of a patient while under care. Sentinel events trigger immediate investigation, a root-cause analysis, and system change—not a quiet chart amendment.

Just culture separates human error (console, redesign the system), at-risk behavior (coach; why was the workaround needed?), and reckless behavior (discipline). Punishing a nurse for a look-alike vial without changing the drawer guarantees the next error.

Disclosure: tell the family what happened, what you are doing now, and how you will prevent recurrence. Honesty is ethical (PNCB Certificant Code of Ethics: report critical incidents, adverse events, and medical errors per law and policy). Many states have apology protections; they do not authorize a cover-up.

Licensure, credentialing, privileging (IV.B.4)

Prepare and maintain the file: diplomas, transcripts, license printouts, certification verification, privileging requests, CE, and malpractice certificates. A lapsed license plus embroidered "CPNP-PC" on a coat is unauthorized use of a protected credential and an IV.B failure.

Ethics in Testing—brief reminder from Chapter 1

You already completed PNCB's free CE Ethics in Testing: A Personal Responsibility before applying. You may say "review growth and development" or "Domain IV is 5%." You may not reconstruct a live item, share recall questions, or post a stem from today's form. NCCA accreditation through 2027 depends on that security. The Certificant Code of Ethics also bars falsifying Recert information. This is the last reminder in this guide; it is still a career-ending way to fail IV.B.