Onboarding at a physiotherapy practice - documents and procedures

15 July 2026Michał Nowak

Magda is growing her practice and is hiring a physiotherapist on an employment contract for the first time.

Magda is growing her practice and is hiring a physiotherapist on an employment contract for the first time. The candidate is excellent, but Magda realises she has no idea what documents she needs to collect before the new hire so much as touches a patient. Verify the PWZFz? A GDPR authorisation? Health and safety (BHP) training? Without an organised onboarding process, she risks gaps surfacing at the first KIF, labour inspectorate, or Sanitary Inspectorate (Sanepid) inspection.

Good onboarding isn't just a nice formality -- it protects the practice. In this article we show the complete path for onboarding a new physiotherapist -- which documents to collect, what to sign, and in what order, so the new hire works legally from day one.

Why onboarding isn't just a "nice formality"

A new employee at a physiotherapy practice is someone who:

Provides healthcare services (must hold a PWZFz).
Processes patients' personal data (GDPR -- requires authorisation).
Works in an environment with biological hazards (health and safety, occupational risk).
Represents the practice to patients (procedures, standards).

Each of these areas is subject to inspection: the KIF checks qualifications, the labour inspectorate checks health and safety and the legality of employment, Sanepid checks sanitary procedures, and the data protection authority checks GDPR compliance. A missing document in any of these areas is a ready-made finding.

Stage 1 -- verifying qualifications

Before signing anything, check whether the candidate can practise the profession at all:

PWZFz (physiotherapy licence number) -- active, granted by the National Council of Physiotherapists.
KIF membership -- mandatory for everyone practising the profession.
Liability insurance -- for B2B cooperation (their own practice), the candidate must hold their own mandatory liability insurance; under an employment or civil-law contract, they're covered by your practice's insurance.
Certificates for specialist techniques (e.g. dry needling, manual therapy), if they will be performed.
Diploma / qualifications -- and, for a foreign diploma, confirmation that it's been recognised.

This is the first and most important filter. Allowing someone without an active PWZFz to see patients is a serious breach.

Stage 2 -- HR documents and legality of employment

Contract (employment, civil-law contract, or B2B) -- appropriate to the form of cooperation.
Personal questionnaire and data for registration (ZUS social insurance, tax office -- depending on the form).
Legality of work and residence for a foreign national (separate regulations).
Medical examinations and certificates required for the position, where applicable.

A new physiotherapist will process sensitive patient data (health data). That's why, before granting access to records, you need:

A personal data processing authorisation -- named, with a defined scope.
A confidentiality declaration / commitment to secrecy.
An entry in the register of authorised persons.
Training on the GDPR procedures in force at the practice.

Without a GDPR authorisation, the new hire has no formal right to view patient records -- and that's one of the first things checked during a data-protection inspection.

Stage 4 -- health and safety and sanitary procedures

Health and safety (BHP) training (initial training before being allowed to start work).
Familiarisation with the occupational risk assessment (biological hazards at the practice).
Disinfection procedures for equipment, treatment tables, and surfaces.
Rules for handling medical waste.
On-the-job instruction -- operation of specific equipment.

Stage 5 -- practice procedures and standards

Finally, substantive onboarding into how the practice operates:

Organisational regulations -- familiarisation.
Records-keeping standard (patient record, therapy plan, treatment log).
Informed consent procedure for patients.
Use of the system / electronic medical records (EDM).
Rules for patient contact and quality standards.

Onboarding stage	Key documents	Inspector
Qualifications	PWZFz, KIF, certificates	KIF
HR	Contract, legality of employment	Labour inspectorate
GDPR	Authorisation, confidentiality	Data protection authority
Health and safety	Training, occupational risk	Labour inspectorate / Sanepid
Procedures	Regulations, records standards	KIF / NFZ

[SP] Example -- Solo practice: Magda creates a simple, one-page onboarding checklist. For her first employee, she ticks off in turn: PWZFz verification, contract, GDPR authorisation, health and safety training, familiarisation with the regulations. Only a complete set of checkmarks means the new hire can see their first patient.

[GR] Example -- Group practice: At a larger practice, a designated coordinator runs onboarding, and each employee's complete set of documents goes into a personnel file. During a labour inspectorate or KIF inspection, it's enough to pull the file, which contains: PWZFz, contract, GDPR authorisation, health and safety training record, and signed regulations.

Onboarding and the form of cooperation -- employment, civil-law contract, B2B

The scope of onboarding depends partly on how you employ the new physiotherapist, but the medical part is common to all forms:

Employment contract -- the full scope of employer duties: health and safety, medical examinations, working-time records, personnel file.
Civil-law contract (zlecenie) -- narrower HR obligations, but a PWZFz, GDPR authorisation, and training on procedures are still required.
B2B cooperation -- the physiotherapist runs their own business, but processes your patients' data at your practice, so they still need a GDPR authorisation and an agreement governing the terms of cooperation and confidentiality; as a professional practice, they must also hold their own mandatory liability insurance.

Regardless of the form: verifying the PWZFz, the GDPR authorisation, and familiarisation with procedures are always mandatory. The form of cooperation changes HR and contribution obligations, but doesn't exempt you from the medical and data-protection parts.

The first week -- substantive onboarding

A complete set of documents isn't everything -- the new hire also has to actually be able to work to your standard. It's worth planning the first week:

Observing and jointly treating a few patients.
Checking that record entries meet the practice's standard.
Discussing difficult situations (adverse events, patient complaints, GDPR).
Confirming the new hire knows where to find procedures and forms.

Most common mistakes

Allowing access to patients before verifying the PWZFz.
Access to records without a GDPR authorisation.
Skipping health and safety training before starting work.
No single, repeatable checklist -- each employee onboarded "their own way."
Onboarding that's only verbal -- no signed documents confirming it took place.

Frequently asked questions

What should I check first when hiring a physiotherapist?

An active PWZFz and KIF membership. Without an active licence to practise, a person cannot provide physiotherapy services, regardless of experience. This is the first and non-negotiable condition. Their own mandatory liability insurance is required only for B2B cooperation (their own practice) -- an employee or contractor is covered by the practice's insurance.

Yes. Everyone with access to patient data must have a named authorisation to process personal data, a confidentiality declaration, and an entry in the register of authorised persons. Without this, access to records is unauthorised.

When must health and safety training be carried out?

Initial health and safety training is carried out before the employee is allowed to start work. It also covers familiarisation with the occupational risk assessment, including biological hazards present at a physiotherapy practice, and with sanitary procedures.

Can onboarding be carried out only verbally?

That's not safe. Onboarding should be documented -- signed authorisations, a health and safety training record, confirmation of familiarisation with the regulations and procedures. During an inspection, what counts is a document, not a claim that "everything was discussed."

CTA: Want to onboard every new physiotherapist using one proven framework? The STANDARD package includes an onboarding checklist, GDPR authorisation templates, confidentiality declarations, and ready-to-use health and safety documentation. See FizjoReady packages →

Related articles:
- GDPR at a physiotherapy practice -- a practical guide
- Health and safety at a physiotherapy practice -- occupational risk assessment
- KIF inspection at your practice -- what to expect and how to prepare