NDA: Track Changes to the Buyer Review Team

What does an NDA control?

An NDA is a nondisclosure agreement. In a practice sale, it records the parties' confidentiality commitments for the proposed review. The signature is one control in that process. It does not show that every person on a buyer's team may receive every file, or that patient information may lawfully be shared.

The FTC's merger-diligence guidance describes controls for sensitive information, including review of people added to clean teams. It is dated staff guidance, not a dental NDA form or a ruling on your transaction. Use counsel to determine the actual terms and permissions.

Build a recipient-change record

This compact tool addresses one recurring gap: the buyer's team changes after the agreement is signed. The broader NDA and confidentiality guide covers terms and the disclosure sequence. Here, record a change before granting the related access. Give each request its own status; do not overwrite the earlier decision.

The record should name the person who decides, the evidence considered and the version released. A pending request is not a refusal to cooperate. It tells the buyer which question remains open. A narrow approved report may let underwriting continue while a different request receives specialist review.

Worked case: a new team member joins

Consider an invented buyer review. Buyer A and CPA B have approved access to a redacted financial packet under counsel-reviewed terms. B leaves the assignment. A asks the coordinator to substitute CPA C and copy C's analyst D. None of these letters identifies a real person or client.

The coordinator separates the request into two decisions. C's identity and role are checked, and counsel confirms whether the agreement covers the substitution. D's proposed work is then described independently. If D only needs an aggregate expense schedule, the team can assess that narrower release instead of sending the entire packet by habit.

Next, the coordinator closes B's access according to the actual terms and records what happens to B's retained work. C does not gain rights merely because B once had them. Equally, closing B's login does not erase an earlier download. The case ends when each requested change has a documented result, including any permitted retained copies and continuing duties.

Keep contract coverage and file approval separate

A recipient can be covered by an agreement while a particular file remains unsuitable for release. The HHS minimum-necessary guidance describes limits on protected health information and exceptions to that standard. It does not turn an NDA into a patient-data authorization. Have the responsible privacy professional assess the legal basis, role and information needed.

Use separate fields for agreement coverage, business purpose, privacy review where relevant, and actual access. A single green check can conceal a missing decision. If the review requires patient-level evidence, use the HIPAA business-associate explanation and qualified advice to identify the proper arrangement. Do not improvise from this example.

End the review without losing the record

Preserve approved requests and access changes so the parties can explain what happened. That is different from preserving every confidential file indefinitely. Apply the actual return, destruction, lawful-retention and security requirements with counsel. If a file went to an unintended recipient, escalate the facts promptly rather than assuming that deleting a message solves the issue.

Begin outside buyer outreach with a seller-blind description. Obtain an NDA and approval before disclosing the practice identity. Plan staff involvement around their actual work. Tell them the facts they need for that work. Confidentiality should not delay required notices or necessary patient care. Review any new adviser or staff access for its own purpose.