Different practices run differently. One hospital I tried to shadow in required that I have workers comp insurance through my school... just to follow around a doc and not touch any patients. Another required I sign a form saying I agreed not to disclose any patient information, etc. Another didn't require anything.
However, in terms of patient confidentiality, don't talk about a specific patient, ever. If you saw 5 patients, mix up their ages and genders and whatnot, or give one person multiple problems, etc. That's the rule in medicine, and you should get used to it now.