16 minutes readA confidentiality agreement is a binding contract that defines what information a worker cannot share, how they may use it, and how they must handle it. Its protection works best when the agreement matches your actual access controls, security procedures, and incident-response process.
A practice manager often discovers the gap during an ordinary workday. A bilingual remote assistant has access to patient messages, scheduling notes, insurance documents, and a shared inbox, but the agreement only says the worker will “keep all information confidential.” That sentence sounds protective, yet it doesn't explain whether the assistant may use a personal laptop, upload a document to an AI tool, save a screenshot, or continue accessing the system after the engagement ends.
For U.S. medical practices, confidentiality agreement legal drafting is therefore both a contract exercise and an operations exercise. The document should identify protected information, limit access to assigned duties, address permitted tools and devices, require prompt reporting, and coordinate with any HIPAA obligations. It should also protect the practice without claiming ownership over a worker's ordinary skills or preventing future employment.
The sections below explain the legal foundation, distinguish an NDA from a noncompete and a HIPAA Business Associate Agreement, identify clauses that hold up better in daily workflows, and provide adaptable language for a remote staffing arrangement.
A confidentiality agreement, also called a nondisclosure agreement or NDA, is a contract between a practice and a worker, contractor, staffing provider, or other party. It defines what information is protected, why the recipient may access it, who may receive it, and what happens when the relationship ends. The agreement can support a breach-of-contract claim when someone uses or discloses covered information outside the permitted purpose.
For a medical practice, protected information may include patient contact details, appointment records, insurance information, referral sources, pricing, internal procedures, credentials, vendor terms, and nonpublic business plans. Some information may also be protected by HIPAA, professional duties, state privacy laws, or the practice's own policies. Those categories overlap, but they aren't identical, so the agreement should avoid treating every document as one undifferentiated class of confidential material.
A workable document answers practical questions before a dispute arises:
A broad promise of secrecy doesn't answer these questions. Precision helps the worker comply and gives the practice evidence that it treated sensitive information seriously. The agreement should also include exclusions for information that is public, independently developed, lawfully received from another source, or required to be disclosed by law.
An NDA won't protect a practice if the assistant receives a shared password, can download an entire patient database, or continues using a personal messaging account for patient communication. The contract is one layer alongside role-based permissions, training, device requirements, vendor controls, logging, and documented offboarding.
A virtual medical receptionist may need access to a telephone platform and scheduling calendar, but not complete clinical notes. An insurance verification specialist may need eligibility information for assigned patients, but not unrestricted access to unrelated records. Define the role first, then draft the agreement and system permissions around that role.
Although this guide focuses on medical practices, the same confidentiality principles matter to law firms that use remote bilingual support. Legal assistants and administrative staff may handle client identities, matter files, litigation strategy, intake records, pricing, and internal procedures. The contract should protect those categories without pretending that every task, template, or general administrative skill is proprietary.
The modern U.S. framework behind trade-secret protection is rooted in the Uniform Trade Secrets Act, first published in 1979 by the Uniform Law Commission. The UTSA was designed to reduce inconsistency among state rules by offering a model definition of a trade secret and standardized civil remedies for misappropriation. Its framework generally looks for independent economic value because information isn't generally known or readily ascertainable, together with reasonable measures to preserve secrecy. The Congressional Research Service overview of trade-secret law explains why contractual controls and practical secrecy measures work together.
A signed agreement helps show that the owner took reasonable steps, but it isn't conclusive by itself. A practice or firm should be able to show that it limited access, trained personnel, used appropriate permissions, and restricted disclosure through its systems and policies.
For a remote worker, reasonable measures might include:
A small firm hiring a remote personal assistant for administrative support should apply the same discipline as a larger organization. A simple workflow can be effective if the firm consistently follows it. A long document that conflicts with actual practice can be less useful than a shorter agreement supported by clear controls.
The Defend Trade Secrets Act, effective May 11, 2016, created a federal civil cause of action for trade-secret misappropriation while preserving parallel state remedies. It applies when the relevant product or service is used in, or intended for use in, interstate or foreign commerce. That reach can matter when a firm, worker, vendor, and data are located across different states or countries.
Trade-secret case filings increased approximately 30% between 2015 and 2017, from fewer than 1,100 cases to nearly 1,400, and filings later remained around 1,400 cases annually, according to Finnegan's explanation of the DTSA. By 2019, 72% of trade-secret cases filed in U.S. federal district courts included a DTSA claim, while cases filed without one declined from 676 in 2016 to 393 in 2019, as reported in the same source.
Those figures don't mean every practice needs aggressive litigation language. They do show why a confidentiality agreement should be operational. Define permitted access, prohibit unauthorized copying and disclosure, require prompt reporting, cover electronic systems and personal devices, and state what survives termination. The agreement must also preserve legally protected reporting and cooperation with government authorities.
A confidentiality agreement protects information. A noncompete restricts a person's ability to work for a competitor or start a competing business. A Business Associate Agreement governs specific HIPAA-related responsibilities when a covered entity gives protected health information to a business associate. These documents can appear in the same staffing arrangement, but they solve different problems.
The central drafting question is whether the clause targets information or the worker's ability to earn a living. A medical practice can reasonably prohibit a departing scheduler from retaining patient records, credentials, referral data, and internal procedures. It generally shouldn't claim that the person cannot work for another medical organization because they learned how to schedule appointments or use familiar practice-management software.
A confidentiality clause becomes vulnerable when it prevents a worker from using ordinary skills, experience, general training, or information readily available to other employers. This issue is particularly clear with remote support roles. A bilingual patient coordinator may use similar scheduling workflows for different practices. That doesn't mean the first practice owns the coordinator's communication skills or general knowledge of appointment systems.
A legal analysis discussing the FTC's proposed noncompete framework distinguishes permissible nondisclosure limits from restrictions covering an employee's general knowledge, skill, experience, or readily accessible information. The analysis is available through Nova Southeastern University's discussion of restrictive covenants. Although the FTC later abandoned its blanket noncompete approach, its 2025 position moved toward fact-specific scrutiny of restrictive covenants, particularly where routine restrictions impede worker mobility.
| Agreement Type | Primary Purpose | Enforceability Risk | Key Limitation |
|---|---|---|---|
| Confidentiality agreement | Prevent unauthorized use or disclosure of defined information | Increases when information is vague or the clause restricts ordinary skills | It should protect information, not general employability |
| Noncompete | Limit work for a competitor or operation of a competing business | Highly dependent on applicable law, drafting, and practical effect | It can restrict future work rather than protect a specific secret |
| Business Associate Agreement | Establish HIPAA duties for a business associate handling PHI | Fails if the parties misclassify the relationship or omit required duties | It doesn't replace broader business confidentiality terms |
A confidentiality agreement isn't a substitute for a HIPAA BAA when a remote worker or staffing arrangement meets HIPAA's definition of a business associate. The HHS guidance on business associates explains that a covered entity may disclose PHI to a business associate only after obtaining satisfactory assurances in a written contract or other arrangement that the information will be safeguarded.
First determine whether the assistant is part of the practice's workforce or works through an outside organization. That classification affects whether a BAA is required. An NDA can cover pricing, procedures, patient-list information, and internal operations, but it shouldn't be the only document governing PHI when HIPAA requires a BAA.
If a business associate uses subcontractors, the contract must address downstream access. HHS Security Rule guidance describes the need for reasonable and appropriate administrative, physical, and technical safeguards and for equivalent obligations involving subcontractors that create, receive, maintain, or transmit ePHI. Review the entire contractual chain, including staffing personnel, technology vendors, payroll organizations, and other parties that may access patient information.
The most useful confidentiality agreement is specific enough to guide conduct on a normal workday. A worker should be able to tell whether they may download a document, send a message through a particular platform, share information with a supervisor, or retain a local copy after an assignment ends.
Start with categories that reflect actual work. For a medical practice, that may include patient identifiers, appointment and referral information, insurance records, credentials, internal pricing, vendor terms, staff information, financial records, and nonpublic operating procedures. For a law firm, the list may include matter files, privileged material, client communications, litigation strategy, intake records, and firm-specific pricing.
Then define the permitted purpose. A scheduler may use patient information to arrange an appointment. A billing assistant may use claim details to perform assigned billing work. Neither role should receive unlimited permission to browse unrelated records.
Include customary exclusions for information that:
The Cornell Law School explanation of NDAs) notes that an NDA can support a breach-of-contract action and may support preliminary injunctive relief when continuing disclosure threatens irreparable harm. That remedy depends on the facts and applicable law, so don't treat the agreement as an automatic court order.
A useful agreement identifies approved systems and prohibited behaviors. It should address case-management software, document repositories, email, messaging, screenshots, translation services, cloud storage, local downloads, personal devices, and generative-AI tools.
The security clause should require:
A practice that stores records in a system such as a supported electronic health record, practice-management platform, or secure document repository should align the contract with the system's actual permissions. Its law-firm document management workflow should similarly identify who can create, view, edit, export, and delete records.
Confidentiality duties may continue after the worker leaves, especially for information that remains protected under applicable law. The document should require return or secure destruction of records, termination of access, deletion of local copies, and confirmation when appropriate. It should also preserve legally required disclosures, protected whistleblowing, and cooperation with government authorities.
Avoid indefinite language that treats every category identically. A practice may need continuing protection for patient information and trade secrets, while ordinary administrative instructions may lose their sensitivity once they become public or are replaced. Counsel should review the duration and governing law because state rules differ.
A remote arrangement exposes weaknesses that may remain invisible in an office. An assistant in Latin America may work during U.S. business hours, communicate fluently with English- and Spanish-speaking patients, and perform assigned administrative tasks efficiently. The risk appears when the worker receives a screenshot through a personal messaging app, translates a document using an unapproved service, or discovers that a browser session remains active on a shared computer.
A remote bilingual receptionist may need a firm-controlled phone account, scheduling calendar, and approved messaging platform. A patient coordinator may need access to demographic and appointment information, while a billing specialist may need claim and insurance data. The agreement should identify those functions and prohibit onward disclosure to family members, friends, unapproved vendors, or other clients.
Cross-border work adds jurisdictional and vendor questions. The agreement should state where the worker may access systems, whether subcontracting is prohibited, who controls cloud accounts, and how the practice handles translations, screenshots, exports, and local copies. Enforcement can vary across jurisdictions, so the contract shouldn't be drafted as if a U.S. remedy automatically operates identically abroad.
A practical virtual email assistant arrangement should specify whether the assistant may triage messages, draft replies, attach documents, or communicate directly with patients. The safer answer isn't always to prohibit every action. It is to define the permitted action, require supervision for sensitive communications, and limit access to the inboxes and folders required for the role.
A generic promise not to disclose information doesn't tell a worker whether they may paste a patient message into a generative-AI service. State the rule directly. Unless the practice has approved a tool and assessed its use, prohibit entering patient, matter, credential, financial, or other confidential information into external AI services.
The agreement should also require:
Recent commentary identifies AI-related assets as an area requiring renewed confidentiality review and emphasizes that protection practices vary across jurisdictions. Benesch's trade-secret and restrictive-covenant review connects contract language with the question courts may ultimately ask: did the practice take reasonable steps to protect the information?
Operational rule: A longer NDA isn't automatically safer. A shorter agreement supported by controlled access, training, logging, and documented offboarding can better reflect how the practice treats sensitive information.
The following examples are starting points, not a substitute for counsel's review. Adapt the defined terms to the role, systems, state law, HIPAA classification, and staffing structure. Don't promise controls that your practice doesn't maintain.
“Confidential Information” means nonpublic information disclosed to or accessed by Worker in connection with assigned services, including patient information, appointment and insurance records, credentials, financial information, pricing, vendor information, internal procedures, and information contained in the Practice's approved systems. Worker may use Confidential Information only to perform assigned services for the Practice and may disclose it only to persons authorized by the Practice who need the information for that purpose.
Confidential Information does not include information that becomes public without Worker's breach, was lawfully known without a confidentiality duty before disclosure, is independently developed without use of Confidential Information, or is lawfully received from a third party without a duty of confidentiality. Worker may disclose information when required by law or legal process, provided Worker gives the Practice prompt notice when legally permitted and reasonably cooperates with the Practice's response.
Worker will use only the accounts, devices, applications, storage locations, and communication channels approved by the Practice. Worker will not download, copy, screenshot, transmit, or enter Confidential Information into an unapproved device, messaging service, translation service, storage system, or generative-AI tool. Worker will promptly report any suspected unauthorized access, loss, misdirection, disclosure, compromised credential, or security incident.
When services end or the Practice requests it, Worker will stop accessing Practice systems and promptly return or securely delete Confidential Information, including local files, printed records, screenshots, and downloaded materials, except where retention is legally required. The duties in this agreement continue for as long as the information remains protected under applicable law.
Have qualified counsel review the final version. A clause that doesn't match your actual technology, staffing relationship, or HIPAA obligations may create confusion rather than protection.
A strong confidentiality agreement legal strategy protects defined information, not a worker's general skills or future employment. For medical practices, the document should address patient information, permitted duties, approved tools, device use, incident reporting, return or deletion, and post-engagement access. If an outside organization handles PHI as a business associate, use the required BAA as well as broader confidentiality terms.
Treat the agreement as a living operational document. Review the role, permissions, vendors, AI policy, cross-border access, and offboarding process together, then update the document when the workflow changes. Requirements vary by jurisdiction and relationship, so confirm the final terms with qualified legal or compliance counsel.
Virtual Legal Assistants connects U.S. law firms with pre-vetted bilingual English-Spanish professionals in Latin America for roles such as legal assistants, intake specialists, receptionists, and case managers. If you need remote support that can work under your confidentiality and data-handling requirements, review the available options at Virtual Legal Assistants.
