Patient privacy templates

A one-page statement that tells patients how your clinic handles their information, with an acknowledgement to sign and keep on file. Free, editable, and written in plain language.

Last reviewed: November 2026 · For clinic owners, office managers and privacy officers

What’s included

Canada: patient statement and acknowledgement, in English.
Québec: the same, in French and in English, naming your person in charge of protecting personal information.
United States: a plain-language patient statement and a Notice of Privacy Practices acknowledgement.

Each comes as a fillable PDF and a Word file. For Canada and Québec there are two versions: one for clinics whose review copies stay in the country or province, and one for clinics whose review copies are held in the United States. What patients are told has to match your setup, and PulseAI confirms yours at onboarding.

Get the templates

Canada (outside Québec)

Patient statement and acknowledgement (Canada, English)Use if your review copies are held in Canada.PDF, fillable Word
Patient statement and acknowledgement (Canada, English), review copy in the United StatesUse only if PulseAI confirmed at onboarding that your review copies are held in the United States.PDF, fillable Word

Before you hand it out

Fill in the blanks: your clinic’s name, your privacy officer’s title and how to reach them. The retention line is pre-filled for Ontario physicians (10 years); change it if your province or college sets another period.
Choose the version that matches your setup. PulseAI confirms at onboarding where your review copies are held. If they are held in the United States, use the version that says so.
Give each patient the statement at intake or before their first report. You can hand it out, post it, or add it to your intake form or website.
Have the patient sign the acknowledgement once, before their first report. File it in the patient’s chart and keep it for as long as you keep their record.
If a patient withdraws consent, don’t upload new files for them. Their existing records are kept for the period the law requires.
Questions you can’t answer? Send them to your privacy officer. PulseAI’s security package has the full technical detail.

Québec

Déclaration et accusé de réception (Québec, français)Use if your review copies are held in Québec.PDF, fillable Word
Déclaration et accusé de réception (Québec, français), copie de révision aux États-UnisUse only if PulseAI confirmed at onboarding that your review copies are held in the United States.PDF, fillable Word
Patient statement and acknowledgement (Québec, English)Use if your review copies are held in Québec.PDF, fillable Word
Patient statement and acknowledgement (Québec, English), review copy in the United StatesUse only if PulseAI confirmed at onboarding that your review copies are held in the United States.PDF, fillable Word

Before you hand it out

Offer the French version first. The English version is there for patients who ask for it.
Fill in the blanks: your clinic’s name, and the title and contact of your person in charge of protecting personal information, which must also be on your website. The retention line is pre-filled with the Collège des médecins du Québec minimum (5 years after the last entry); change it if your order or policy sets a longer period.
If PulseAI confirmed that your review copies are held in the United States, use that version, and complete your privacy impact assessment before you start. Québec requires both the assessment and telling patients that information may leave Québec.
Have the patient sign once, before their first report, and keep the acknowledgement in their file for as long as you keep the record.
If a patient withdraws consent, don’t upload new files for them. Their existing records are kept for the period the law requires.

United States

Patient statement and Notice of Privacy Practices acknowledgement (United States)For every US clinic.PDF, fillable Word

Before you hand it out

Fill in the blanks: your clinic’s name, your privacy officer’s title and a way to reach them, and the record-retention period your state requires.
Give each patient the statement with your Notice of Privacy Practices, at intake or before their first report. The statement adds to your Notice; it doesn’t replace it.
Ask the patient to sign the acknowledgement at their first visit. HIPAA asks you to make a good-faith effort to get written acknowledgement that the patient received your Notice. If a patient won’t sign, note the date and that you offered it.
Keep signed acknowledgements for at least six years, in the patient’s chart or your HIPAA records.
Offer language help. If you serve patients who prefer another language, provide the statement in that language or offer help reading it.
Questions you can’t answer? Send them to your privacy officer. Your business associate agreement with PulseAI covers the rest.

Want a second set of eyes on your setup?

Our Clinic IT Diagnostic is free and takes thirty minutes. Book a Call

This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation. The templates are a starting point. Your privacy officer or lawyer should review them before you use them.

Your privacy responsibilities: the other pages

OntarioDuties of a health information custodian.
QuébecLaw 25 and the health information act.
Rest of CanadaPIPEDA and provincial health acts.
United StatesDuties of a covered entity.
Working with vendorsBAAs and service agreements.
Using AI with patient dataFive plain rules.
If something goes wrongBreach basics, and who to tell.

How we protect your patients’ information is on our Trust Center.