Client Confidentiality

Before an engagement

Do not disclose trade secrets, identifiable patient information, unpublished research, proprietary budgets, or confidential contracts in an initial inquiry. A public form or unsolicited email does not establish attorney-client privilege or a signed confidentiality agreement.

Define confidentiality in writing

Before restricted records are exchanged, identify the contracting parties, authorized users, permitted purpose, access restrictions, retention or return requirements, and approved systems in the engagement agreement, NDA, data-processing agreement, or BAA as appropriate.

Limit access and disclosure to the work authorized. Sharing with subcontractors, software providers, or AI services requires an appropriate review of permissions, contractual restrictions, and safeguards. An NDA alone does not authorize PHI handling.

Client examples and exceptions

Identifiable client names, logos, testimonials, results, or case studies require documented permission before publication. Removing a name alone may not sufficiently anonymize a healthcare organization or patient.

Confidentiality terms should address information already lawfully public, independently developed, lawfully received elsewhere, or required to be disclosed by law. Required disclosure does not create a general right to publish client records.