What Must Be Posted on the Wall of a Physiotherapy Practice - the Complete List

Aneta spent weeks preparing for her first Sanepid inspection -- disinfection procedures written down, a treatment register kept up to date, a signed medical-waste collection agreement. The inspector walked in, took a few steps from the entrance, and stopped at a bare wall in the waiting room. He asked where patients could read about their rights. Aneta had no answer -- that was the one thing she'd forgotten.

It's a common scenario. Practices pour attention into records, procedures, and equipment, and overlook the one thing an inspector sees first -- the wall by the entrance and in the waiting room. Yet the duty to inform patients isn't just good practice; it's a requirement that follows directly from the law. In this article we round up the complete list of what must (or should) be posted in a physiotherapy practice, with the legal basis and practical tips on where and how to display it.

Why it's the first thing an inspector looks at

A KIF or Sanepid inspection effectively begins before the inspector sits down at a desk and asks for the records. The first impression is shaped by what's visible "from the door" -- the state of the waiting room, cleanliness, and above all whether the practice visibly informs patients of their rights. A bare wall, or a price list from years ago, tells the inspector that the rest of the records might be neglected too -- even if, in reality, they're perfectly in order.

For patients, the same boards carry a different meaning: it's the one place where they can easily find out who to complain to, what the price list looks like, or what happens to their data. A well-prepared information wall therefore works both ways -- it builds patient trust and turns the inspection into more of a formality. For more on how the visit itself unfolds, see our article on a Sanitary Inspectorate inspection at a physiotherapy practice.

Patient rights -- the mandatory board, item one

This is the most important, and most often overlooked, element. Under the Act on Patient Rights and the Patient Rights Ombudsman, an entity providing healthcare services must make information about patients' rights available in writing, in a place accessible to everyone -- usually the waiting room or the entrance. The text must include an extract of patient rights set out in the Act: the right to healthcare services, the right to information, the right to report adverse events, the right to confidentiality, the right to give consent, the right to privacy and dignity, the right to medical records, and the right to object.

The board doesn't need to be an elaborate legal document -- a clear extract of the key rights, together with contact details for the Patient Rights Ombudsman, is enough. What matters is that it's placed somewhere patients actually pass and can read, not tucked away in the treatment room where only staff go.

Organisational regulations and the price list

A healthcare entity's organisational regulations set out, among other things, the rules for providing services, work organisation, the fees for commercially provided services, and how complaints are handled. An extract from the regulations -- above all the part covering the price list and admission rules -- should be available to patients where services are provided, typically as a short board or binder at reception. We cover the full content of the regulations and what they must include in the article on organisational regulations for a physiotherapy practice.

The price list is something inspectors check almost every time -- it must be current, consistent with what patients actually pay, and posted somewhere visible before booking a visit, not only revealed after a treatment.

GDPR information notice -- the short version

The information duty under GDPR Article 13 can be met in two ways: giving the patient the full text of the notice at the first visit, and posting a short, "first layer" version somewhere generally accessible. The short version usually covers who the data controller is, for what purpose the patient's data is processed, on what legal basis, how long it's retained, and where to find the full notice (e.g. at reception or in the regulations). What the full notice must contain and how to word it is covered in detail in the article on the GDPR information notice for patients.

A short GDPR board is one of the elements a UODO or Sanepid inspector checks almost by reflex -- its absence looks bad even when the full GDPR documentation at the practice is otherwise complete.

CCTV notice -- if you have cameras

If the practice is covered by CCTV, GDPR requires informing anyone whose image is recorded before they come within camera range. In practice that means a pictogram with a CCTV notice at the entrance to the building or room, plus an extended notice (controller, purpose, legal basis, retention period for recordings) available somewhere easily reached, e.g. at reception. Missing such a board where cameras are actually running is one of the more common findings in GDPR inspections. We cover the full CCTV requirements in the article on CCTV at a physiotherapy practice.

Handwashing and hand-disinfection instructions at the sink

This is a purely sanitary requirement, but it's checked just as closely as GDPR records. Every sink accessible to staff and patients should have a clear handwashing instruction posted, and treatment rooms should additionally have a hand-disinfection instruction (technique, contact time with the product). Sanepid treats the absence of such instructions as a sign that hygiene procedures aren't taken seriously, regardless of whether staff actually follow them. The instruction should be posted directly above or next to the sink, at eye level, not on a wall further down the corridor.

Child Safeguarding Standards -- if you treat minors

Practices that treat minor patients must implement Child Safeguarding Standards, including making a short, accessible version available -- one that's understandable to a child too. In practice that means a poster or board in the waiting room, written in plain language, telling minor patients who they can turn to if they feel unsafe or badly treated, and what rights they have during a visit. We cover the full scope of this duty and how to prepare the Child Safeguarding documentation in the article on Child Safeguarding Standards at a physiotherapy practice.

What KIF and Sanepid check "from the door"

Before an inspector asks for the records, they usually glance at the wall by the entrance and in the waiting room. At that point they're checking several things at once: whether a patient-rights board exists at all, whether the price list is current, whether the CCTV notice (if cameras are running) is visible, and whether the practice looks orderly for a healthcare facility. That first impression -- positive or negative -- often colours the tone of the rest of the inspection.

What to post	Legal basis	Where to post it
Patient rights (extract from the Act)	Act on Patient Rights and the Patient Rights Ombudsman, Art. 11	Waiting room or entrance, a generally accessible spot
Extract from the organisational regulations and price list	Act on Medical Activity	Reception or waiting room, before booking a visit
GDPR information notice (short version)	GDPR, Art. 13	Reception or waiting room, a visible spot
CCTV notice	GDPR, Art. 13	Entrance to the building/room with a camera
Handwashing and hand-disinfection instructions	Sanitary-epidemiological requirements	At every sink, at eye level
Child Safeguarding Standards (short version)	Act on Counteracting Threats from Sexual Offences	Waiting room, if the practice treats minors

Format and placement -- practical tips

The content itself isn't everything -- the format and placement decide whether a board actually does its job, rather than just formally existing.

• Readability -- large enough type, no cramped legal text; a short version with a reference to the full text works better than a wall of small print.
• Height and visibility -- at eye level for someone sitting or standing, somewhere no one has to search for or ask to be shown.
• Unobstructed -- not behind a door, not behind a plant, not covered by an advertising poster -- this is one of the most common mistakes that spoils an otherwise good impression.
• Up to date -- the price list and contact details must match reality; an outdated board can be worse than none at all, since it suggests no one keeps it current.
• One place, the full set -- rather than scattering boards around the premises, it's worth gathering them in one clearly visible spot, e.g. an information board in the waiting room.

[SP] Example -- Solo practice: After the inspection, Aneta lists the six items from this article and prints them as a single, coherent A3 board at the waiting-room entrance -- patient rights, the price list, the short GDPR notice, and the hand-disinfection instruction at the sink. The next inspection starts with a compliment instead of a question.

[GR] Example -- Group practice: At a practice with several therapists and a separate room for children, the boards are duplicated -- one set at the main entrance for adult patients, a second, simplified, illustrated set in the paediatric waiting room together with the short Child Safeguarding Standards.

Frequently asked questions

Does every physiotherapy practice need a patient-rights board?

Yes. The duty follows from the Act on Patient Rights and the Patient Rights Ombudsman, and it applies to every entity providing healthcare services, regardless of the practice's size. An extract of patient rights must be available in writing, in a generally accessible place such as the waiting room.

Do you have to post the full text of the GDPR notice, or is a short version enough?

A short, "first layer" notice is enough, covering the controller, the purpose and legal basis for processing data, and where to find the full notice. The full document should be available on request, e.g. at reception or within the organisational regulations.

What happens if the required boards are missing during an inspection?

Most often, the inspection ends with a recommendation to fix the gaps within a set deadline, rather than an immediate penalty. But missing basic boards, especially patient rights, affects the overall assessment of the practice and tends to be read as a sign of neglect in other areas too, prompting the inspector to check the rest of the records more closely.

Is a CCTV notice needed if the cameras are only at the building entrance?

Yes -- if a camera records people's images, the information duty applies to every location covered by CCTV, including the building entrance, a corridor, or a car park in front of the practice, not just the treatment room itself.

CTA: Organisational regulations and the GDPR information notice are two source documents you can use to draft the content for your own boards and posters. The STARTER package includes ready-made organisational regulations, and the PREMIUM package additionally includes the full GDPR information notice -- both as editable templates you can easily turn into a short extract for posting. See FizjoReady packages →

Related articles:
- Sanitary Inspectorate inspection at a physiotherapy practice -- what they check and how to prepare
- Organizational Regulations for a Physiotherapy Practice -- What They Must Include (Template)
- GDPR Information Notice for Patients -- What It Must Include and Where to Post It
- CCTV at a Physiotherapy Practice -- Is It Legal and How to Implement It
- Child Safeguarding Standards at a Physiotherapy Practice -- a Legal Duty, Not an Option