Jump to a section
Key takeaways
- Read the actual confidentiality terms before receiving or forwarding information.
- Keep permitted use, authorized recipients and records access as separate decisions.
- Confirm what happens to access and retained copies when discussions end.
Why the actual terms matter
IBBA identifies an NDA as a confidentiality agreement used in business transactions. That definition explains the basic purpose, but it cannot tell a buyer what a particular document requires. Read the agreement and obtain counsel's advice on its meaning and enforceability in the relevant jurisdiction. (Source: IBBA)
Before signing, clarify the permitted purpose, covered information and allowed recipients. Ask how exceptions, required disclosures and obligations after negotiations are handled. Check any restrictions on contacting employees or referral sources. These are questions for the actual agreement, not a list of terms that every NDA automatically contains.
How it differs from information access
A CIM explains the business. The NDA addresses confidentiality, while the seller approves which business details to release at the agreed stage. Opening a data room is another action that needs an access decision.
| Question | What should answer it |
|---|---|
| May this information be used for the proposed review? | The agreement's permitted purpose and applicable rules |
| May a particular adviser receive it? | Recipient terms and the approved access process |
| May sensitive care records be disclosed? | A separate review of lawful purpose and safeguards |
| What happens when discussions stop? | Reviewed access, return and retention instructions |
An illustrative forwarding request
Consider a fictional assisted living buyer who has signed an NDA and received a CIM. A financing contact asks for a copy. The buyer should check whether that person may receive it and whether further approval or safeguards are needed before forwarding it.
This check should include the actual file being shared. A summary and an attached resident list present different information risks. Do not send the attachment simply because the main document was approved. Record what was released, to whom and for which review purpose.
The NDA permissions guide turns that release decision into an exact file and recipient check. Its fictional export has two unapproved fields and one extra user. A matching NDA record does not resolve those differences.
What a signature cannot resolve
Where HIPAA applies, minimum-necessary requirements have a defined scope and exceptions. A signed NDA does not decide whether sharing a particular health record is lawful. Review that question with the privacy adviser, and use the care-records guide to organize the separate custody and access issues. (Source: HHS)
The NDA and patient-record access exercise starts with a fictional approved financial summary. Later requests change the records, recipient and future purpose while the NDA stays unchanged. Use the comparison to describe each change for the person who reviews access.
Keeping information private also takes everyday controls. FTC guidance supports limiting personal information and restricting access to a legitimate need. Review permissions when a bidder or adviser leaves, and follow the applicable retention instructions for downloaded copies. A contract does not automatically turn off a shared link. (Source: FTC)
Frequently asked questions
What does an NDA mean when buying a business?
NDA means nondisclosure agreement. It sets duties for the private information covered by its terms. Review the actual agreement to understand permitted use, recipients, exceptions and duties after discussions end.
Can a buyer send the CIM to an accountant?
Check whether the agreement allows that person to receive it and what terms apply before sharing. Confirm the accountant's role and the approved access process. Do not assume that signing an NDA allows sharing with every adviser.
Does an NDA authorize patient-record access?
No. The agreement alone does not establish a lawful basis for disclosing protected health information. The responsible privacy adviser must assess the records, purpose, recipients and safeguards under the rules that apply.
Does signing an NDA commit the buyer to purchase?
A confidentiality agreement serves a different purpose from a purchase agreement. Read all its provisions before signing, including any fees, contact limits or other commitments. Do not infer the document's full effect from its title.
Sources
Sources are dated to distinguish current guidance from earlier publications. They support the identified facts; the transaction questions and examples are educational analysis.
- IBBA glossary: CIM, CBR and nondisclosure agreement (Undated). Retrieved September 6, 2026.
- HHS: minimum necessary requirement (2003). Retrieved September 5, 2026.
- 45 CFR 164.501: health care operations (2026). Retrieved September 5, 2026.
- FTC: Protecting Personal Information, A Guide for Business (2026 retrieval). Retrieved September 5, 2026.