Free non-disclosure agreement template: When your practice needs one

Key takeaways

A non-disclosure agreement is a binding contract that stops staff, contractors, and vendors from sharing your practice’s confidential information.

Practices need one for onboarding, locum and IT contractor access, vendor integrations, and any conversation with investors or buyers.

A one-way agreement covers almost every practice situation, and a mutual version suits merger talks or joint marketing.

An enforceable agreement defines what counts as confidential, sets a duration, names the governing law, and protects disclosure to regulators.

An NDA never replaces a HIPAA business associate agreement or a UK GDPR processor contract, so vendors still need both.

Practice management software like Pabau stores the signed agreement on the staff record, so you can prove who agreed to what.

Every practice shares confidential information with people who are not on the payroll. A non-disclosure agreement turns the expectation of confidentiality into a contract you can enforce. It binds employees, locums, and outside vendors to keep private what they see.

The file above is a printable non-disclosure agreement that you can also send for a digital signature. Treat this free NDA template as a sample NDA to adapt, not a finished contract. Which clauses you keep depends on who is signing it.

This guide covers what an NDA protects, when your practice needs one, and which clauses hold up if you ever rely on them. It also shows where an NDA stops short, since GDPR obligations need a separate contract with any vendor that processes patient data.

What is a non-disclosure agreement?

A non-disclosure agreement is a binding contract that stops the people who sign it from repeating information you have named as confidential. You will also see it called a confidentiality agreement, or a confidential disclosure agreement in research and clinical trial work. The three terms carry the same legal weight.

In a practice, the named information is usually patient data, treatment protocols, pricing, supplier terms, and the systems you have built. The definition is the part that decides whether the document is worth anything.

So the label matters less than the scope. A one-page agreement naming four categories of information beats a ten-page one that says “all business information”. A court reads the definition, not the title on the front page.

When your practice needs one

Use an NDA whenever someone reaches sensitive practice data outside their normal role or relationship. The six situations below cover most of what a practice runs into.

• New hires: Employees sign during onboarding, before they get a login to patient records, treatment protocols, or practice financials.
• Independent contractors: Locums, physical therapists, and visiting injectors sign before you open a patient portal account for them.
• Software vendors: IT contractors and system integrators who configure your platform or migrate data sign before the work starts.
• Business partners: Referral partners and suppliers in joint marketing often ask for one, and may want a mutual agreement.
• Investor conversations: Anyone reviewing your financials during a funding round or a practice sale signs first.
• Med spas: Before-and-after photos are patient data, so everyone handling them at a med spa signs one.

What a HIPAA non-disclosure agreement template must cover

A HIPAA non-disclosure agreement template covers confidentiality between you and the signer, and nothing more, so it never satisfies HIPAA on its own. Any vendor that creates, receives, or stores protected health information, known as PHI, needs a business associate agreement as well.

The two documents do different jobs. The business associate agreement is what the HIPAA Privacy Rule demands, and it sets breach notification duties and the permitted uses of PHI. Your NDA is a private contract, so it can reach information HIPAA ignores.

Pricing, supplier terms, injector technique, and your marketing plans all sit outside PHI. A vendor could hand every one of them to a competitor without ever touching HIPAA. That is the part the NDA is there to close.

Sign the two documents with different counterparties. The business associate agreement goes to the vendor company, and the NDA goes to the individual engineer or technician who will be on site. A signed BAA does not stop one person repeating what they saw on a screen.

For your own team, the layering runs the other way. Employees count as your workforce under HIPAA, so no business associate agreement applies to them. Your HIPAA training and the signed NDA carry the weight instead.

NDA clause checklist: What every agreement needs

Eleven clauses do the work, and the table below says what each one is for. Keep the ones that apply to the person in front of you, and cut the rest before you send it.

The last two rows often get bolted onto the same document, and they are worth pulling apart. A combined non-compete non-disclosure agreement mixes confidentiality with a restriction on where someone can work next. The confidentiality half usually holds, while the non-compete half depends entirely on local law.

A non-solicitation agreement is the narrower and more durable of the two. It stops a departing injector contacting your patients or recruiting your front desk. It does not stop them practicing down the road, which is why courts uphold it more readily.

One more thing on layout. There is no legal format for non-disclosure agreement documents, so a signed one-page letter binds as tightly as a fifteen-page contract. Both signatures and a specific definition are what count. The same discipline applies to the rest of your practice documentation.

Employee agreements and their limits

An employee confidentiality agreement is the most common type, and the easiest to get wrong. Staff reach patient data as part of the job, so the document is about handling rules rather than access. Spell out what good handling looks like day to day.

GDPR and UK employment law both limit what you can restrict. An NDA cannot stop a nurse raising unsafe care with the CQC, and it cannot override statutory whistleblower rights. Those rights come from UK whistleblower protection law, which allows disclosure to prescribed persons and regulators.

Write the carve-out in plain words. A line such as “Nothing in this agreement prevents you from reporting safety concerns to a prescribed body, including the CQC” does the job.

Build signing into the first-day checklist so it never slips. Staff onboarding tools can hold the task, and a digital signature means the copy lands in the record instead of a drawer.

Contractor and vendor agreements

Contractors and vendors should sign an agreement scoped to what they actually touch. A locum sees clinical notes. An IT contractor usually sees database structures and staff names, and has no reason to open a consultation record.

Put that scope in the document itself. For a systems integrator, confidential information might cover system architecture, database structures, and integration settings, with clinical and financial data excluded.

Then make the software agree with the paperwork. A clause that limits a contractor to system settings means little if their login opens every client record. Permissions are what turn the written scope into something you can evidence later.

An NDA on its own is not enough for a vendor that handles patient data. UK GDPR requires a written processor contract with specific terms under Article 28. In the US, HIPAA requires a business associate agreement. Signing an NDA and stopping there leaves that requirement unmet.

Unilateral vs. mutual NDA: Which do you need?

You need a unilateral agreement in almost every case, because only one side is handing over confidential information. Reach for a mutual non-disclosure agreement template when both parties share something sensitive, such as merger talks with another practice.

The mutual version costs you something the one-way version does not. Once you owe a duty back, your team has to know what they may not repeat about the other side. That turns a filing job into a briefing job.

Watch for the quiet swap. A vendor sent a one-way agreement will often return a mutual one, which puts your practice under the same restrictions. The heading on page one rarely changes, so check the parties clause before anyone signs.

Are NDAs enforceable?

Yes, in both the UK and the US, provided the agreement is specific and reasonable. Courts decline to enforce terms that are vague, unreasonably wide, or unsupported by consideration. Consideration means each side gets something of value, such as the job offer itself.

• Define the information: “All business information” is too broad, so list the categories you actually mean.
• Set a reasonable duration: Indefinite protection suits patient data, and several years is typical for trade secrets.
• Name the governing law: A practice with remote billing staff in another state has to say whose courts decide a dispute.
• Respect the law above it: HIPAA rules in the US and ICO GDPR guidance in the UK sit above any private contract.
• Keep the whistleblower carve-out: UK law protects disclosure to regulators, and blocking it puts the whole agreement at risk.

Governing law is the clause practices skip most often. A remote coder in another state, or a locum who lives abroad, can leave you arguing about venue before anyone looks at the breach. Name a single state or country and be done with it.

If you suspect a breach, take legal advice before you act. Injunctions are available but expensive, so a tight agreement and controlled access to data are the cheaper protection.

How to customize the template

Read the file as an example of non-disclosure agreement template wording rather than as legal advice for your jurisdiction. Fill in your details, keep the clauses that apply to the signer in front of you, and cut the rest.

1. Insert your practice details: Add the practice name, address, and registration number to the header.
2. Define confidential information: List the categories that apply to you, such as patient records, treatment photos, pricing, and system access.
3. Name the signer and their scope: Record the individual, their title, and what they will be able to see.
4. Set the confidentiality period: Use indefinite for patient data and three years after employment for business information.
5. Add the exceptions: Include legally required disclosures, whistleblower protection, and information already in the public domain.
6. Name the governing law: State which country or state the agreement runs under, and whose courts hear a dispute.

Send it for signature through your digital forms rather than printing it. Signed copies then sit in one place, and access stays with the people who need it.

Which practices need one?

Any practice holding patient data or proprietary information needs one on file. That covers private practices, med spas, physical therapy, mental health practices, and diagnostic centers.

UK practices regulated by the CQC should treat these agreements as part of information governance. US practices under HIPAA use them alongside the business associate agreements vendors must sign. Compliance tools track who signed and when each agreement expires.

What a signed agreement protects

A signed agreement gives you legal recourse if information leaks. It also sets expectations for staff and contractors before anything goes wrong, which is where most of its value sits.

It gives you something to show an inspector or a buyer. During a practice sale, the buyer’s advisors will ask how patient data is controlled, and signed agreements are part of that answer.

Patients and referral partners notice the difference too. Keeping confidential notes inside one system, rather than in email threads and personal phones, is what makes the agreement more than paperwork. Client records with per-user access do most of that work.

How Pabau keeps signed agreements with the staff record

Most practices email the NDA as a PDF and hope the signed copy comes back. It gets printed, signed, scanned, and saved somewhere on a shared drive. When an inspector or a buyer asks who signed what, someone loses an afternoon looking for it.

Practice management software like Pabau turns that paperwork into a digital form instead. The signer completes it on any device, and the signed copy is stored against their record with a date on it. Nothing sits in an inbox waiting to be filed.

Access control does the other half of the job. Permissions decide which staff can open a client record, and the system logs who looked at it. That gives your confidentiality clause something to stand on when a regulator asks how patient data is protected.

Keep signed agreements with the right record

Digital forms, user permissions, and access logs keep every signed agreement attached to the person who signed it. You can show who agreed to what, and when.

Book a demo

Conclusion

Filling in the template takes ten minutes. Making it hold up takes a little more thought. Name the information you actually mean, scope each signer to what they touch, and pick a governing law.

Leave the whistleblower route open, and remember that a vendor handling patient data needs a processor contract or a business associate agreement as well. Do that, and confidentiality stops depending on everyone remembering the rules. It becomes a term someone agreed to, with a date and a signature behind it.

Storage is the last piece, since an agreement nobody can find protects nothing. Book a demo to see how Pabau keeps signed agreements and access records together for your practice.

Continue your research

Need another form ready to sign? The cosmetic surgery consent form follows the same structure, with the risks a patient has to acknowledge before treatment.

Documenting a psychiatric intake? The psychiatric evaluation template covers the history and risk sections those records need.

Chasing insurers for approvals? The medical prior authorization form collects the clinical detail payers ask for before they approve treatment.

Want team meetings on record? The meeting summary template keeps decisions and action items in one place after every staff meeting.

Running nutrition consultations? The nutrition assessment form structures intake, dietary history, and goals in a single document.

Frequently asked questions