A Student Intern at Your Physiotherapy Practice - Agreement, GDPR and Documents

September and October are the months when universities look for placement spots for physiotherapy students. If you run a practice, sooner or later a university or a student will ask you to host a placement. It is a good opportunity: you get to know a potential future employee, and the student learns the profession in real conditions. There is a flip side, though. The student will have contact with patients and their medical data, and you are responsible for everything that happens at the practice. Before you let an intern into the treatment room, prepare a full set of documents - much like when hiring a physiotherapist, with a few important differences.

This article walks you through what to sign with the university, which GDPR documents the student needs, when patient consent is required and how to document supervision.

The basis of cooperation - an agreement with the university

Student placements are part of the study program. Formally, the university organizes them, and your practice is the place where they happen. The basis of cooperation is usually a placement agreement between the university and the practice.

What the agreement should include

Before you sign the document prepared by the university, check that it covers:

• The parties and the placement location - details of the university, your practice and the site where the student will work.
• Duration and hours - start and end dates and the number of placement hours.
• The placement program - which skills the student is meant to acquire and which activities they may perform.
• The placement supervisor - a physiotherapist from your practice who oversees the student.
• Liability and insurance rules - who insures the student (accident cover usually comes from the university or the student) and how liability for damage works.
• Data protection and confidentiality rules - a clause stating the student will be authorized to process data and bound to confidentiality.

If the university has no template or its template is very general, propose an annex with your practice rules: sanitary procedures, GDPR rules and the organizational regulations.

A student applies directly, without the university

Sometimes a student asks about a "private" placement outside the university program. Be careful. Without a university agreement there is no formal framework: no program, no university accident insurance, no course credit. Such a person is in practice a volunteer or trainee - and still needs a data authorization, a confidentiality statement and supervision. The safest route is always a written document, even a simple graduate internship or volunteering agreement.

The student and patient data - GDPR duties

This is the most commonly overlooked area. During the placement the student sees patient records, hears health interviews and takes part in treatments. That means access to health data - a special category of personal data.

Authorization to process personal data

Anyone acting under the controller's authority with access to personal data may process it only on the controller's instructions - this follows directly from the GDPR. In practice the student needs a written authorization to process personal data, just like an employee. We described authorizations and the register of authorized persons in detail in the article on staff data-processing authorizations.

For a student it is worth narrowing the scope: access only to the records of patients whose therapy they take part in, with no access to the booking system, HR or accounting data.

Confidentiality statement

Alongside the authorization, the student should sign a confidentiality statement - a commitment to keep secret everything they learn about patients, also after the placement ends. Confidentiality about a patient's health does not expire on the last day of the internship.

A short induction on practice rules

Before the student starts working with patients, run a short induction: GDPR rules at the practice, the clean desk policy, a ban on photographing records and patients, phone rules in the treatment room. One hour and a signed attendance sheet are enough - and that signature makes a huge difference if something goes wrong.

Example: A third-year student joined Monika's practice. On day one she photographed an interesting case from a patient card "for study purposes" and sent it to her year group chat. The patient was identifiable from the card header. Formally, a personal data breach occurred, which Monika had to assess and record as the controller. Had the student gone through an induction and signed a confidentiality commitment with an explicit ban on photographing records, the incident would most likely not have happened - and the practice would have proof of due diligence.

Patient consent to a student's presence

The Patient Rights Act protects the patient's right to intimacy and dignity. The presence of persons other than those performing the treatment - and a student is such a person - requires the patient's consent. Exceptions exist for entities whose remit includes teaching (e.g. university clinics), but they do not cover a typical private practice.

A simple mechanism is enough in practice:

• Inform the patient before or at the start of the visit that a supervised student will take part in the treatment.
• Ask for consent and record it - ideally with a short entry in the records or a one-sentence statement.
• Respect a refusal - the patient has every right to decline an intern's presence and must not face any consequences for it.

Remember that consent to a student's presence is different from consent to the treatment itself - these are two separate patient decisions.

What a student may and may not do

A physiotherapy student has no professional license. All activities are performed under the direct supervision of the placement supervisor and within the placement program. Entries in the medical records are approved by an authorized person - the supervisor, not the student.

Area	The student may	The student may not
Interview and assessment	Take part, practice under supervision	Independently qualify patients for therapy
Treatments	Assist, perform elements under the supervisor's eye	Run a treatment alone without supervision
Records	Draft proposed entries	Sign entries in the medical records
Patient data	Use within the authorization	Copy, photograph or take data away
Patient contact	Talk, coach exercises under supervision	Give independent advice and recommendations

For harm caused to a patient during the placement, the practice is liable as the healthcare provider - which is why supervision must be real, not nominal. Also check whether your liability policy covers events involving interns; more on policy scope in the article on physiotherapist liability insurance.

Document checklist before the first placement day

Before the student first enters the treatment room, your binder should contain:

1. The placement agreement with the university (or a graduate internship agreement).
2. The placement program with the student's scope of activities.
3. Appointment of the placement supervisor - can be a clause in the agreement.
4. Authorization to process personal data with a narrowed scope.
5. Confidentiality statement covering the period after the placement.
6. Confirmation of the induction - GDPR, sanitary procedures, workplace safety.
7. The student's accident insurance document (from the university or their own).
8. An entry in the register of authorized persons for data processing.

You can reuse this pattern for every future intern - the student simply goes through a narrower version of the procedures you keep ready for onboarding a new employee.

End of the placement - what to remember

The end of a placement brings formalities that are easy to forget:

• Revoke or deactivate access - if the student had a login to the EMR or scheduler, block the account on the last day.
• Record the end of the authorization in the register of authorized persons - it expires with the placement.
• Complete the university paperwork - placement diary, completion certificate, supervisor's opinion.
• Archive the intern's document set together with the practice's HR records.

A well-run placement is often the start of future recruitment. A student who knows your procedures and standard of work is a natural hire once they obtain their professional license.

Frequently asked questions

Does a physiotherapy student need an authorization to process personal data?

Yes. During the placement the student has access to patients' health data, so the same rules apply as for staff: a written authorization from the data controller, a confidentiality statement and an entry in the register of authorized persons. It is worth narrowing the scope to the records of patients whose therapy the student actually takes part in.

Does the patient have to consent to a student being present during treatment?

Yes. The presence of a person other than the one performing the treatment requires the patient's consent - this follows from the patient's right to intimacy and dignity. Inform the patient about the intern, ask for consent and note it in the records. The patient's refusal is binding and needs no justification.

May a student perform physiotherapy treatments independently?

No. A student has no license to practice physiotherapy, so all activities are performed under the direct supervision of the placement supervisor and within the placement program. Entries in the medical records are signed by the supervising authorized person, not the student.

Who is liable for harm caused to a patient by an intern?

Towards the patient, the practice is liable as the healthcare provider, because the intern acts under its supervision. That is why real supervision by the placement supervisor matters, along with checking whether the practice's liability policy covers events involving interns. The student's own accident insurance is usually regulated by the agreement with the university.

CTA: Taking on a student and want the full document set ready to go? The FizjoReady TARCZA package includes a data-processing authorization template, a confidentiality statement, a register of authorized persons and GDPR procedures ready to implement at your practice. See FizjoReady packages →

Related articles:
- Hiring a physiotherapist - contract and qualifications
- Staff data-processing authorizations - who, when, how
- Onboarding at a physiotherapy practice - documents and procedures
- Patient consent to physiotherapy treatment - template