A physiotherapy clinic sale caught between two confidentiality problems at once

The situation

The letter arrived from a former associate physiotherapist who had left Dirk's clinic four months earlier, disputing the terms of her departure and, buried in the third paragraph, referencing patient files she claimed she had a right to review for a competing practice she was setting up nearby. Dirk had been quietly exploring a sale of the clinic for several weeks at that point, and the letter landed just as he was preparing to share financial and operational details with a serious prospective buyer.

The buyer was Marieke, a physiotherapist herself, looking to acquire an established practice rather than build one from scratch. She had brought in Yanni, a commercial pilot who was her financing partner and a co-signer on the loan she needed to complete the purchase, and both wanted their own accountant and the lender's underwriting team to review the clinic's patient volumes, billing records and financial statements before committing to a price. That kind of due diligence is standard for a practice sale of this size, and Dirk had no objection to it in principle.

The problem was that Dirk's clinic operated under a confidentiality agreement his own associates had signed years earlier, restricting disclosure of patient records and financial information to anyone outside the clinic's ownership, a document written with an eye toward protecting patient privacy and competitive information, not written with a future sale in mind. That same agreement was now the subject of the departing associate's letter, since she was arguing it did not bind her the way Dirk believed it did, and separately, it stood directly in the way of showing Marieke's accountant and lender the very records they needed to underwrite the purchase.

Dirk's first instinct was to treat the two as unrelated: settle the associate quietly and separately draft something for Marieke's team to sign before opening the file. That instinct, reasonable as it sounded, missed how closely the two problems were actually tied to the same underlying document and the same question of what it had ever been meant to protect in the first place.

Two problems, then, arrived in the same window: a dispute over what the confidentiality agreement actually meant with someone who had already left, and a live need to disclose protected information to people entirely outside the clinic in order for the sale to move forward at all. Handling either one carelessly risked making the other worse.

Why this was harder than it looked

The two problems were not actually separate, even though they looked that way at first. The departing associate's claim turned on how broadly the confidentiality agreement's restrictions applied and to whom, and any position Dirk took in resolving her dispute would effectively set a precedent for how the same agreement applied to the very disclosure Marieke's financing team needed. If Dirk conceded too much ground to the associate to make her dispute go away quickly, he risked handing her an argument that the clinic's confidentiality obligations were narrow enough that patient information could move around more freely than the practice's actual privacy commitments to patients allowed. If he took too rigid a position against her, he risked adopting an interpretation of the agreement so strict it would have blocked the very carve-out he needed to negotiate for Marieke's diligence team days later.

Patient health information sits under separate, more demanding protection than ordinary business confidentiality. A buyer's accountant and lender have a legitimate interest in verifying revenue and patient volumes, but they have no independent right to see identifiable patient records, and a clinic disclosing that kind of detail without proper safeguards risks a privacy breach entirely apart from anything in the sale agreement. The financial disclosure Marieke's team needed had to be built around aggregated and de-identified information wherever patient-level detail was not strictly necessary, which meant the standard due diligence checklist could not simply be handed over as-is. Building that kind of disclosure package also takes longer than pulling raw files, since every category of information has to be checked for whether it can be summarized without losing the underwriting value it was meant to provide.

Timing compressed both problems further. The associate's letter carried an implicit threat of a formal complaint if her concerns were not addressed, and a live dispute over patient confidentiality becoming public, or worse, becoming a regulatory complaint, in the middle of a sale process would have made any buyer's lender considerably more cautious about the whole transaction. Dirk needed the associate matter closed out quietly and on defensible terms before Marieke's due diligence went very far, not after, since a lender that later learned of an unresolved patient-records dispute would reasonably wonder what else about the practice's records it had not been told.

None of this was the kind of problem a standard non-disclosure agreement with a buyer solves. It required sorting out what could be shown, to whom, in what form, while a separate dispute over the same underlying document was still unresolved, and it meant treating the associate's letter as the first move in the sale process itself rather than as an unrelated matter to be handled off to the side.

What we did

1. Reviewed the confidentiality agreement's actual scope before responding to the associate. We read the agreement closely against what the associate was actually claiming, rather than responding to her letter's framing, and confirmed the agreement's restrictions on patient information were narrower in one respect and broader in another than either side had assumed, which shaped every step that followed and kept us from conceding a position on impulse.
2. Resolved the associate's dispute on terms that did not compromise the sale. We negotiated a short settlement confirming the associate had no ongoing right to patient files from her time at the clinic, closing out her complaint on terms consistent with how patient confidentiality needed to work for the rest of the practice, rather than conceding a position that would have undercut Dirk's position later in the sale.
3. Identified exactly what Marieke's accountant and lender actually needed to see. We worked through the buyer's due diligence request line by line with Marieke's own advisors, separating genuine underwriting requirements, like aggregate revenue and patient volume trends, from items that could be satisfied without disclosing identifiable patient information at all, which turned out to be most of the list once we pressed on why each item had been asked for.
4. Drafted a narrow confidentiality carve-out limited to the financing team. Rather than opening the file broadly, we built a carve-out permitting disclosure specifically to Marieke's named accountant and the lender's underwriting contact, bound by their own confidentiality undertakings, with patient-level detail excluded or de-identified throughout the entire package before it ever left the clinic. Naming the individuals rather than their firms meant the obligation followed the specific people reviewing the file, not just their employer's general policy.
5. Set conditions on how the disclosed information could be used and stored. The carve-out included requirements that the financing team destroy or return the material if the sale did not proceed, reducing the risk that sensitive clinic information would remain in outside hands indefinitely if the deal fell through partway through underwriting or afterward. It also limited use of the material strictly to underwriting the purchase, so nothing disclosed for financing purposes could later be repurposed for another use without Dirk's separate consent.
6. Confirmed the disclosure approach against Dirk's professional obligations. Before anything went out, we checked the planned disclosure against the confidentiality standards Dirk's regulatory college expects of a practice handling patient records, so the carve-out would not itself create a professional exposure separate from the sale and the associate dispute already sitting on his desk. That check caught a labelling gap in the draft package, which we corrected before anything was actually sent to Marieke's advisors.
7. Documented the whole sequence in case either matter resurfaced. We kept a clear written record of the associate settlement and the disclosure carve-out and their relationship to each other, so if either the associate or a regulator raised questions later, there was a coherent, defensible account of what had been shared, with whom, on what basis, and why each decision had been made at the time.

The outcome

The associate's dispute closed within a few weeks on terms that confirmed the clinic's ownership retained control over patient records, without conceding an interpretation of the confidentiality agreement that would have complicated the sale disclosure. No formal complaint was filed, and the matter did not resurface once settled. Dirk paid a modest settlement amount to close it out, small enough that it did not affect the sale price he ultimately negotiated with Marieke.

Marieke's accountant and the lender's underwriting team received the financial and volume information they needed to complete their review, under the narrow carve-out rather than open access to the clinic's files. The lender approved Marieke's financing on schedule, and at no point did patient-identifiable information leave the clinic's control. Yanni, reviewing the file alongside the lender as Marieke's co-signer, noted afterward that the carve-out actually made him more confident in the numbers, since aggregated figures backed by a documented methodology read as more credible than a raw file would have. Nothing about this outcome involved a dramatic recovery from a breach; the point of the work was that no breach occurred at all, on either the associate side or the disclosure side, despite both problems arriving in the same narrow window.

Dirk did give up some speed in exchange for that outcome, since building the carve-out and settling the associate matter properly took longer than simply handing over the requested file would have. The sale closed roughly ten weeks after the associate's letter first arrived, later than Dirk had initially hoped, but with both confidentiality issues resolved cleanly rather than left as open questions a regulator or a future dispute could have reopened after the clinic had already changed hands and Dirk was no longer in a position to respond to them directly.

Marieke, for her part, said afterward that the careful handling of the associate matter actually made her more comfortable with the purchase rather than less, since it showed her how Dirk's practice dealt with a real confidentiality problem when one came up, rather than leaving her to wonder how patient records had been handled in the years before she considered buying in. That was not the point of resolving the dispute properly, but it was a real side benefit of doing the work right rather than quickly.

What you can learn from this