M18 exists because the field graduates practitioners enter is not the same as the field the curriculum was written in. Regulatory frameworks, research findings, digital tools, and professional norms will shift across a practitioner's career. M18 equips students to navigate those shifts — not by predicting them, but by building the operational and professional infrastructure that makes sustained competent practice possible regardless of what the landscape looks like. This is the program's closing argument: here is how you practice well over time.
- 1Implement basic digital security practices — encrypted documentation, minimal data, and secure communications — in a real facilitation workflow.
- 2Execute a pre-session preflight protocol for remote facilitation and demonstrate a structured response to a mid-session telehealth incident.
- 3Facilitate an online integration group safely — managing virtual confidentiality, participant distress, and group boundary violations.
- 4Draft a one-page advocacy brief that is factual, scope-compliant, and free of clinical efficacy claims.
- 5Position their practice in accurate, scope-compliant language and map an initial referral network across key provider categories.
- 6Evaluate their current professional learning infrastructure and produce a specific 12-month continuing education plan.
| Source | Code | Standard | M18 Coverage |
|---|---|---|---|
| iETA | X.4 | Advanced Specialized Training: encrypted documentation and data security, telehealth and remote session safety, online group facilitation safety, digital literacy, advocacy and policy engagement. | L1–L6 · Full coverage · Primary module |
| CO NMTP | — | No direct equivalent. Documentation hygiene elements partially addressed in CO Sections C and H; M18 goes substantially beyond those requirements. | No crosswalk required |
Direct prerequisites: M11 (Administration — documentation practices), M12 (Integration — post-session communication), M13 (Facilitator Development — professional infrastructure), M17 (Specialized Populations — population-specific documentation considerations). Assessment architecture: No written exam. One OSCE (telehealth incident). Four artifact assessments (security audit, advocacy brief, practice positioning worksheet, professional infrastructure self-assessment). Two reflection prompts. Module closes Phase 6 — all portfolio artifacts reviewed before Capstone clearance.
M18 is the final content module before the Capstone. The artifacts produced in M18 — the security audit, advocacy brief, practice positioning worksheet, referral network map, infrastructure self-assessment, and CE plan — are live professional documents, not academic exercises. Students who treat them as such will be better prepared for Capstone oral defense questions on PC7 than those who do not. Program directors should review all M18 portfolio artifacts before clearing a student for Capstone.
M18 doesn't carry the emotional weight of Trauma-Informed Care or the existential gravity of End-of-Life facilitation. What it has is operational consequence. A facilitator who doesn't understand basic data security is a liability to their participants. One who can't describe what they do without making clinical claims is one complaint away from a regulatory problem. One who stops learning the year they graduate is practicing in a field they increasingly don't recognize.
Your facilitation job here is different from earlier modules. You're not holding emotional weight. You're modeling professional self-awareness — the practitioner who has thought carefully about digital hygiene, who knows exactly what they will and won't say on their website, who has a supervision structure they actually use. If you haven't done this work yourself, do it before you teach this module. Students will know the difference.
Groundedness and specificity. Not "use secure tools" but "here is what I use and why." Not "build a referral network" but "here is what mine looks like and what I wish I'd done differently." The more concrete you are, the more useful this module is.
- L1: Security Audit Worksheet · Encrypted Tools Card · Minimal Data Card
- L2: Preflight Checklist · Digital Consent Supplement Card · Connection-Loss Flowchart
- L3: Online Group Safety Protocol · Group Facilitator Prep Checklist · Virtual Confidentiality Agreement · Moderation Scenario Cards ×2
- L4: Advocacy Brief Template · Professional Associations Card · Regulatory Comment Quick-Reference
- L5: Practice Positioning Worksheet · Language Audit Card · Referral Network Map · Referral One-Pager Template
- L6: Infrastructure Self-Assessment · CE Planning Worksheet · Research Literacy Card · Frozen Practice Warning Signs Card
L1 and L3 are the heavy-content sessions at 3 hrs each — protect the security audit time in L1 and the group simulation time in L3. Both exercises teach better than any lecture. L5 and L6 close as the "building your practice" duo — treat them as a pair, give them room. L2 content feeds directly into the OSCE; run the OSCE after L2 is complete.
Part 1 — Why this field is distinct (12 min): A data breach exposing a participant's psilocybin session notes — including experience content, personal disclosures, and the participant's identity — can affect professional licenses, security clearances, employment, family relationships, and custody situations. Veterans, people in recovery, LGBTQ+ participants, anyone in a profession where participation could trigger consequences: for each of these populations, documentation exposure carries stakes that generic healthcare breach response does not capture. The security standard is calibrated to those stakes, not to general healthcare.
Ask: "Which populations from M17 face the highest documentation exposure stakes — and why?" Let the group name them. Then: "What you just identified is why the security standard here is specific, not generic. Security is participant protection."Part 2 — The three documentation categories (18 min): Session notes belong in end-to-end encrypted applications — not Google Docs, not Apple Notes, not plain text files. Standard Notes (open-source, E2E encrypted) and Joplin (local storage option) are accessible starting points. Participant communications — texts, emails, voice memos — should use encrypted channels: Signal for messaging, ProtonMail for email. Standard SMS and Gmail are not acceptable for communications containing participant information. Consent forms are administrative documents most facilitators handle carelessly — they contain the participant's name, session date, and signature connected to the nature of the service and should be stored with the same encryption as session notes. For digital signatures: DocuSeal (open source) or PandaDoc HIPAA-compliant tier.
Ask: "Of the three categories — notes, communications, consent — which do you think most facilitators handle most insecurely?" Answer: communications, specifically texts, because they feel informal. That informality is exactly what makes them a vulnerability.Part 3 — The minimal data principle (12 min): Minimal data means collecting and retaining only what the facilitation relationship actually requires. Session notes document: observable behaviors and states (descriptive, not interpretive), interventions offered with consent, safety-relevant events, post-session orientation and stated wellbeing, follow-up plan. Session notes do not document: content of visions or experiences unless directly safety-relevant, personal disclosures not relevant to facilitation, clinical interpretation. The test: if this note were accessed in a legal proceeding, would its content protect the participant or expose them? Retention: minimum 7 years from last contact absent jurisdiction-specific guidance; build an annual record review into your calendar.
- Learners who are overwhelmed: Three decisions (where are your notes, comms, consent) and one principle (only keep what you need for as long as you need it). That's the whole framework.
- Learners using cloud services: Google Drive, Dropbox, iCloud are not acceptable for sensitive documentation. Don't soften this.
- Learners in formal licensed settings: Their job is to know their organization's security standards and follow them. This lecture gives them the framework for asking the right questions.
- Individual audit. Be honest about what doesn't meet the standard. 30 min
- Pairs: compare findings. What surprised you? What gap had you not noticed before? 15 min
- Class discussion: most common gaps? The single most important change most people need to make? 10 min
- "Meets standard" without specificity: "Encrypted" is not an answer. "Standard Notes with E2E encryption" is an answer. Push for the specific tool.
- No current workflow: Complete the "what you will do" column as a planning document. Building right from the start is more valuable than retrofitting.
Submit completed Security Audit Worksheet + L1 reflection (150–250 words): What is the single most important security gap you found, and why does it matter specifically for the participants you expect to work with? Name the population or context, the specific vulnerability, and the specific change you are committing to make within 30 days. Pass standard: audit submitted honestly, reflection names a specific gap and a specific committed change — not "I need to be more secure."
Part 1 — The preflight protocol (12 min): Three domains. Technical: platform tested, backup contact confirmed, encrypted documentation ready, recording status confirmed. Participant readiness: environment confirmed private, current state checked, digital consent supplement confirmed. Safety (critical — any item unconfirmed = delay the session): support person available or on call, emergency contact confirmed reachable, participant's current physical address confirmed, connection-loss protocol reviewed with participant explicitly. The Student Guide contains the complete preflight checklist. Walk through it one item at a time; for each item ask why it matters specifically in a remote context.
Distribute preflight checklist from Student Guide now. For each critical item ask: "What happens if we skip this one?" This converts a checklist from a compliance form into an understood safety structure.Part 2 — Digital consent adaptations (8 min): Standard consent needs specific additions for remote work: the platform and its security status explained in plain language; recording policy stated explicitly; what happens if connection is lost and the specific protocol; the privacy limitations of the participant's own environment; and that emergency services would go to the participant's physical location. See Digital Consent Supplement Card in Student Guide. Timing: review in the preparation conversation, not five minutes before the session.
Part 3 — The connection-loss response flowchart (8 min): Five steps: attempt immediate reconnect → contact via backup method → contact support person → activate safety protocol → post-incident documentation and debrief. Timing for each step established in the preflight conversation and documented. Participants should not be surprised by any step — they were briefed before the session. The flowchart is the facilitator's reference; the briefing is the safety mechanism. Students fill in their specific timing windows on the flowchart before using it.
- Preflight as overhead: A 10-minute preflight conversation is not bureaucratic cost — it is the safety infrastructure. Name that.
- Skipping the connection-loss conversation: It feels awkward. It's also the single most important safety preparation for remote work. "I want to walk through what happens if our connection drops" is a professional statement, not a concerning one.
- Racing through the checklist: Each item is a confirmation conversation, not a recitation. Items should be discussed.
- Solving complications for the participant: "Don't worry, it'll be fine" is not a response to an unavailable support person. The honest response includes the possibility of rescheduling. Help learners distinguish reassurance from assessment.
Practice the full preflight protocol on your own — walk through every item as if preparing for a real remote session. Fill in the timing windows on your Connection-Loss Response Flowchart. If a peer is willing to run through it as a mock participant, do it. The OSCE will test this protocol under simulated time pressure.
Part 1 — Platform setup and confidentiality (15 min): Minimum platform configuration before any group session: waiting room enabled; recording disabled at platform level, not just verbally; participant screen sharing disabled; breakout rooms pre-configured and tested; know how to remove a participant. Virtual group confidentiality is structurally different from in-person: a screenshot can leave the room at any time without the facilitator's knowledge. The Virtual Group Confidentiality Agreement (Student Guide) addresses this explicitly and should be reviewed verbally in the first session — not emailed as a pre-session document only. Review creates shared accountability; emailing creates individual compliance.
Ask: "What scenario would the confidentiality agreement not protect against, even if everyone signed it?" Answer: a participant who decides to share outside the group regardless. The agreement creates an ethical commitment, not technical protection. Participants are trusting each other, not a platform.Part 2 — Distress response in an online group (15 min): Graduated response when a participant becomes visibly distressed: Step 1 — slow the group: "I want to pause here for a moment." Step 2 — minimal direct address to the distressed participant: "I see you. I'm here. Thumbs up or down — are you okay right now?" Step 3 — offer private space: "I'd like to step aside with you for a few minutes. Group — can we take a short break?" Move to breakout room. Step 4 — if unresponsive: contact backup while holding group in break. The ceiling principle: the distressed participant's need is real and the group's experience is also real. The response addresses both — doesn't sacrifice one for the other.
Part 3 — Boundary violations and online group dynamics (12 min): Specific scenarios and responses in the Online Group Safety Protocol Card (Student Guide): the participant who makes an inappropriate comment, the participant giving peer advice, the camera-off participant whose state is unknown (15 minutes off without explanation = brief check-in via chat), the participant needing removal. Removal is a host function — know how to use it before you need it. Maximum group size for a single facilitator: 6–8 participants. Beyond that: co-facilitator or split groups.
- Underestimating online distress: "They can just turn off their camera if they need space" — a camera-off participant in distress is less visible and less reachable, not safer.
- Continuing the group while someone is visibly distressed: The group is waiting for the facilitator to respond. Pausing is what they need.
- Advice-giver correction that shames publicly: "That's not appropriate here" in front of the group damages trust. The move is a gentle redirect that honors the impulse while correcting the behavior.
- Moving to breakout without checking in first: This can feel like being separated at a vulnerable moment. The graduated steps exist for this reason.
Complete the Online Group Facilitator Preparation Checklist in the Student Guide as if you are preparing for the first session of a real online integration group. Every item should be genuinely confirmed — not hypothetically.
Part 1 — Advocacy within scope vs. outside scope (12 min): Within scope: speaking to regulatory bodies about the facilitation relationship and what it requires to be conducted safely; providing public comment on proposed regulations; participating in professional organizations; describing the facilitator's role accurately in public contexts. Outside scope: making efficacy claims about psilocybin's treatment potential; positioning facilitation as treatment for specific conditions; making clinical predictions about participant outcomes; lobbying for drug policy changes beyond facilitation practice. The line is not about enthusiasm or commitment — it is about what facilitators can know from their position and speak to with integrity.
Part 2 — CO/NV regulatory landscape and comment periods (12 min): Colorado's Prop 122 created the Natural Medicine Health Act with the Colorado Department of Revenue Natural Medicine Division overseeing licensing. As of this curriculum's publication, the licensing framework was in active development — verify current requirements at cdor.colorado.gov before teaching. Nevada has not established a comparable framework; facilitators there should consult legal counsel and monitor the Nevada legislature. Finding open comment periods: Colorado Secretary of State regulatory activity database; Nevada Register of Administrative Regulations; federal: Federal Register and regulations.gov. See Regulatory Comment Period Quick-Reference Card in Student Guide. Coordinating with professional organizations (ATMA, PMA) multiplies the impact of individual comments.
Ask: "What would you want a regulator drafting licensing rules for natural medicine facilitation to understand that they might not know from reading the research literature?" Take 3–4 responses. This question frames the advocacy brief exercise — the brief is the vehicle for that kind of scope-compliant experiential knowledge.Part 3 — The advocacy brief (8 min): A one-page document: specific issue named, position stated clearly and briefly, grounded in evidence or direct experience, specific ask. For a facilitator, the "evidence or direct experience" component is drawn from facilitation practice — direct observations described without identifying participants, specific features of the regulatory landscape named, published research cited accurately. Not efficacy statistics. Not therapeutic outcome data unless directly cited from peer-reviewed research. The Advocacy Brief Template in the Student Guide provides the structure.
- Learners who resist language constraints: "But I do help people heal — why can't I say that?" What you can say: "I provide a facilitation context in which participants often find..." The constraint is specific, not a denial of the work's value.
Complete and submit advocacy brief + L4 reflection (150–200 words): What was hardest about staying within scope while writing your brief? Where did you want to say more than your standing allowed? Pass standard: brief submitted, completed, free of clinical efficacy claims; reflection names a specific moment of scope tension.
Part 1 — The positioning challenge (12 min): The positioning statement has three requirements: accurately describe what the facilitator does and doesn't do; differentiate from therapy clearly enough that a participant or referring provider understands the distinction; resonate with people who would genuinely benefit without attracting those for whom it is contraindicated. None of these can be traded off against the others. The Language Audit Card in the Student Guide walks through specific phrases that overclaim and phrases that work. Distribute it now, walk through 2–3 examples, give students 2 minutes to look at their warmup writing and identify which category it falls into.
Distribute Language Audit Card from Student Guide. After students have looked at their warmup: "Without judgment — what did you find? One person, what was the overclaim or underclaim you caught?" The conversation that follows will be the most practically useful 5 minutes of the lesson for most students.Part 2 — Building the referral network (15 min): The referral network runs in both directions — providers who can refer to you, and providers to whom you can refer. Priority categories: licensed therapists (especially trauma-informed), primary care physicians and psychiatrists, peer support and community organizations, other facilitators with complementary specializations. The most common failure mode is approaching referral network building as marketing — reaching out to generate referrals before those providers understand the facilitation context. The effective approach is mutual education: "I'd like to meet for 20 minutes to explain what I do and learn about your practice — so we both understand when it might make sense to refer to each other." The Referral Relationship One-Pager (Student Guide) is the leave-behind for those conversations.
Part 3 — The professional landscape and the long view (8 min): The facilitation practitioners who build their practices now are building the field's professional identity alongside their individual practices. The language choices they make, how they communicate with referring providers, how they position themselves collectively — these shape how the field is perceived by regulators, the medical community, and the public. This is not an abstract professional obligation. It is the practical consequence of being early in a field that matters and that will be judged partly by the quality of its practitioners' self-presentation.
Complete the Referral Relationship One-Pager Template for one specific provider type you plan to approach. It should be specific enough to actually leave with that provider. Finalize the referral network map.
Part 1 — Supervision and peer consultation as infrastructure (14 min): Supervision is the ongoing professional relationship in which a facilitator brings their practice — difficult cases, ethical dilemmas, personal reactions, scope questions — to an experienced practitioner for structured reflection. It is not remediation for problems. It is regular maintenance that keeps practice current and grounded. Minimum viable structure: one supervision session per month; after EOL sessions, high-complexity cases, or any unexpected session event — supervision within the week. This is not optional at the standard of care this program produces. If students graduate without a supervision arrangement in place, finding one is the first act of beginning practice. Peer consultation is complementary — collegial mutual support from people navigating the same landscape. It supplements supervision; it does not replace it.
Ask directly: "Who is your current or planned supervisor? If you don't have an answer, what is your specific plan for finding one — and by what date?" Make it concrete. Not "I'll look for one" but "I will contact [specific organization] by [specific date]."Part 2 — Research literacy (12 min): The psychedelic research literature is expanding rapidly and unevenly. Media coverage consistently over-indexes positive findings, under-covers adverse event data, and frames preliminary results as established conclusions. Five questions for any study: What was the population? What was the sample size? Was there a control condition? Has it been replicated? Who funded it? These don't require graduate methods training — they require the habit. Key studies every facilitator should know: Griffiths et al. (2016) and Ross et al. (2016) — foundational EOL research; Davis et al. (2021) — major depressive disorder, open-label, preliminary; 2023 FDA Advisory Committee on MDMA — more complicated than headlines; accumulating adverse event literature. Students should read the Research Literacy Reference Card in the Student Guide.
Part 3 — Frozen practice and the CE plan (10 min): Frozen practice is the predictable endpoint of not building a learning infrastructure: a practitioner who practices the way they practiced when they graduated, regardless of how the field has developed. The Frozen Practice Warning Signs Card in the Student Guide describes the behavioral patterns. The CE Planning Worksheet is the antidote. It asks for three things: specific learning goals for the next 12 months (specific enough to verify), specific CE sources (names, not categories), and one action scheduled within 90 days with a specific date. Build it in before the momentum of training ends and the inertia of practice begins.
- Supervision conflated with therapy: Supervision is focused on practice, professional decisions, and use of self in the facilitation relationship. It is not personal therapy. If personal material needs attention, the path is personal therapy — not more supervision.
- Vague CE plans: "Read more articles" is not a CE plan. Push for specificity. The 90-day action must be specific enough to verify.
Submit CE Planning Worksheet + Module Reflection (300–400 words): Prompt 1 (required): Looking at your infrastructure self-assessment — what is the gap you are most concerned about, and what specifically will you do about it by what specific date? Prompt 2 (choose): (A) What was the most important thing you learned in M18 that you didn't expect? (B) Looking at your practice positioning worksheet and referral network map — what is the gap between where your practice stands and where it needs to be before you can ethically offer services? Pass standard: CE plan submitted with a specific dated 90-day action; both prompts specific, not generic.
The candidate is 85 minutes into a remote psilocybin facilitation session with Jordan (32, working through anxiety related to a recent career transition). Jordan has been in a calm, inward state for the past 20 minutes — eyes closed, headphones in, minimal verbal communication. Last check-in 15 minutes ago: thumbs-up. Connection then drops. The candidate cannot reconnect via the primary platform. Jordan's phone number is on file as a backup contact. Jordan's support person is their partner, Alex. Jordan's current physical address is on file.
The OSCE begins at the moment of connection loss. Demonstrate your tiered response — what you do, in what order, and why. You may speak your reasoning aloud. At the close of the OSCE, produce a brief written documentation note covering the incident. The assessor will ask you to explain your decision-making at each step.
You are Jordan. Your video connection dropped about 8 minutes ago. You were fine — a little surprised, a little worried, but okay. You tried to reconnect once and couldn't. When the facilitator calls, you pick up. You tell them you're okay — a little disoriented from the interruption, but not in distress. You're relieved they called. You'd like to finish the session if possible.
- Attempts reconnect via primary platform before moving to backup contact — does not skip directly to phone
- Contacts Jordan via backup (phone) after a defined wait period — not immediately and not indefinitely
- Assesses Jordan's state on the call before deciding whether to continue, close, or escalate
- Does not contact emergency services or support person before attempting backup contact with Jordan directly
- Makes a clear, reasoned decision about next steps and can articulate it to the assessor
- Documentation note produced: factual, with timestamps, covering what happened and actions taken — no session content, no interpretation
- Articulates what would have changed their response if Jordan had not answered the backup contact
| Domain | Full Credit (25) | Adequate (15–24) | Insufficient (<15) | Score | Notes |
|---|---|---|---|---|---|
| Protocol sequence | Follows tiered protocol in order — reconnect → backup contact → support person → emergency. Does not skip steps or invert order. | Correct direction with one step out of order or unclear timing; overall trajectory appropriate | Skips directly to emergency services or support person; or takes no action during the wait period | __ /25 | |
| State assessment | Assesses Jordan's state specifically on the call — not just confirms Jordan is alive but what state they are in and what they need next | Checks in but doesn't fully assess state; makes a reasonable decision from incomplete information | Does not assess state before deciding; or makes decision based on assumptions rather than Jordan's report | __ /25 | |
| Decision quality | Clear, reasoned decision about next steps based on Jordan's state and the circumstances; articulates reasoning to assessor | Reasonable decision but reasoning not fully articulated; or slightly over/under-cautious but defensible | Arbitrary or unexplained decision; or defers entirely to Jordan without providing professional guidance | __ /25 | |
| Documentation | Factual note with timestamps: what happened, when, actions taken in sequence. No session content, no interpretation. Could stand as a professional incident record. | Mostly factual but missing timestamps; or one minor interpretive element | Contains session content, clinical interpretation, or too vague to function as an incident record | __ /25 | |
| Total Score | __ /100 | Cut score: 70 · No domain below 15/25 | |||
Most common failure: Skipping directly to emergency services or support person without attempting backup contact with Jordan first. The escalation should be proportional to what is known — and at the backup contact step, what is known is that the connection dropped and Jordan hasn't reconnected. That is not yet a safety emergency. It becomes one only if Jordan is unreachable. Grade protocol sequence carefully.
Continue vs. close: Both are acceptable given Jordan's stable state when reached. The candidate should articulate the reasoning either way. Grade on the quality of the reasoning, not the direction of the decision.
Documentation ceiling: "Connection lost at approximately [time]. Attempted reconnect via [platform] at [time] — unsuccessful. Contacted participant via backup phone at [time]. Participant confirmed safe and stated [general state — no content]. Decision made to [continue/close]. Post-session check-in scheduled for [date]." That is the standard.
M18 closes Phase 6 and the program's content modules. The Capstone oral defense tests PC7 directly. The questions won't ask what you know — they'll ask what you've built. "What is your documentation security practice and why?" is a Capstone question. "How do you describe what you do to a referring physician?" is a Capstone question. "What does your supervision structure look like?" is a Capstone question. Students who engaged seriously with M18 portfolio work will feel that preparation in the oral defense. Students who performed rather than built will feel the gap.
-
Our downloads have everything you need to supplement this course.