Privacy

In this policy we use a number of terms, that are contained within the Privacy Act which are explained here

• ‘personal information’ this is ‘information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion’. Essentially, personal information is any information or an opinion that identifies a person (notably there is no definition of person and it is unclear whether the Act applies to deceased or only living persons).

• ‘sensitive information’ is a type of personal information that is given extra protection and must be treated with additional care. It includes any information or opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record. It also includes health information and biometric information.

• ‘Health information’ is a subset of sensitive information. It is any information or opinion about the health or disability of an individual, the individual’s expressed wishes about the future provision of health services and a health service provided, currently or in the future, to an individual that is also personal information. Health information also includes personal information collected in the course of providing a health service.

• A ‘record’ includes a ‘document’ or an ‘electronic or other device’ where there is writing, anything from which sounds, images or writings can be reproduced.

The Practice will ensure each of the following:

• That this policy is available, free of charge, to any individual where requested;
• That our staff are aware of our obligations under the APP’s;
• That our staff that they comply with the AAP obligations through the implementation of the appropriate systems, processes and procedures;
• That our staff appropriately respond to questions or inquiries regarding information collected by us;
• That we collect information only for the primary purpose of managing the individual’s healthcare requirements, including the management of financial claims and payments associated with those health care services.

Our staff are responsible for ensuring that each individual is aware of the following:

• The information that has been collected or is to be collected and why;
• How that information will be used and disclosed;
• When the individuals consent will be needed and why;
• How the individual can access and have their information corrected;
• How the individual can make a complaint; and
• When requested provide you with a copy of this policy

When collecting information the Practice will seek a client’s consent to do so, and if necessary it may seek to their consent should they wish to use the information for a purpose other than that which was contained in the original consent process.

The type of information the Practice collects and holds includes (but is not limited to) personal information, including health and other sensitive information, about:

• The client whether collected before, during and after the course of treatment provided to, or received by them, at the Practice;
• It can include a client’s name, address and contact details, their Medicare number or some other number or code that helps in identifying the client or claiming payments (e.g. the clients health insurance number);
• A specific health care identifier such as a medical record number;
• Information within the client’s medical history, including medical information, allergies, medications, immunisations, social history, family history, risk factors and previous incidents or adverse events.

Personal Information the client provides

The Practice will generally collect personal information, whether in a paper based or electronic form, held about an individual by way of the following:

• Forms filled out by the client, or if appropriate their parents or care givers,
• From face-to-face consultations, emails and telephone calls.
• On occasion’s people other than the client, their parent or care giver may provide personal information.
• Information may be in the form of paper based records, electronic records or even images such as X-rays, scans, photos of the client or videos. In some cases even an audio recording may contain information about the client

Personal Information provided by other people

In some circumstances the Practice may be provided with personal information about an individual from a third party, for example a report provided by a medical professional or a reference from another Practice.

The Procedure for collecting Information at the Practice

1. When a client arrives at the Practice, whether for the first or subsequent visits the staff will collect or confirm a patients’ personal and demographic information. Clients who attend for the first time are encouraged to read the collection statement within the form and where necessary ask questions about the management of collected information and patient privacy.
2. When the client is being provided a service by the Practice, the healthcare practitioners will collect further personal information during the consultation.
3. Personal information may also be collected from the patient’s guardian or responsible person (where practicable and necessary), or from any other healthcare practitioner that has been involved in the patients care.

The Practice will then store all personal information securely, whether in electronic or paper based format, in protected information systems or in hard copy format in a secured environment.

The personal information the Client provides will only be used for the purpose of providing health care services and for claims and payments, unless otherwise consented to by the patient.

The Practice may disclose personal information to other health care professionals where we request services for you such as x-rays, pathology tests etc. or where we ask them to provide you with a health care service, such as specialist opinion.

On occasions we are required by the law to disclose certain personal information about a patient, such as the notification of certain diseases, and in such a circumstance the Practice will discuss this with the Client.

Finally the Practice may disclosure some information to third parties engaged by or for the Practice for business purposes, such as accreditation or for the provision of information technology services. Where we do it is important to note that these third parties are required to comply with the same principles within this policy.

The Practice does not disclose information to any individual or group outside of Australia without a genuine need and unless consent to do so has been provided by the Client.

In general terms the Practice will not disclose personal information to any third party other than in the course of providing medical services, without first providing you with the reason for the information being transferred and having received your consent to do so.

There are however, times where the Practice is permitted to disclose information about an individual without their consent, including where the information is:

• required by law
• necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
• to assist in locating a missing person
• to establish, exercise or defend an equitable claim
• for the purpose of a confidential dispute resolution process.

The Practice will not use any personal information in relation to direct marketing to a patient without that patient’s express consent. Patients may opt-out of direct marketing at any time by notifying the Practice in a letter or email.

The Practice evaluates all unsolicited information it receives to decide if it should be kept, acted on or destroyed.

The Practice’s staff are required to respect the confidentiality of patient’s personal information and the privacy of individuals.

The Practice has in place steps to protect the personal information the Practice holds from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and password access rights to computerised records.

In order to provide you with the highest standard of care and attention, it may be necessary for the practice to transmit your personal information electronically to a portable electronic device operated and controlled by your treating doctor. We will take all reasonable steps to ensure that the transmission and storage of subsequently transmitted information is as secure as possible from interference or unauthorised access.

Your doctor is committed to ensuring that any personal information they receive or access on a portable electronic device will be only viewed by themselves and no other person.

Under the Commonwealth Privacy Act [and the Health Records Act], an individual has the right to obtain access to any personal information which the Practice holds about them and to advise the Practice of any perceived inaccuracy.

There are some exceptions to these rights set out in the applicable legislation.

The Practice will take reasonable steps to correct personal information where it is satisfied they are not accurate or up to date. From time to time, the Practice will ask patients to verify the personal information held by the Practice is correct and up to date. Patients may also request the Practice corrects or updates their information, and patients should make such requests in writing.

To make a request to access or update any personal information the Practice holds about you please contact the Practice Manager in writing and the Practice will respond within a reasonable timeframe. The Practice may require you to verify your identity and specify what information you require. The Practice may charge a fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, the Practice will advise the likely cost in advance. If we cannot provide you with access to that information, we will provide you with written notice explaining the reasons for refusal.

When making a request to access your personal information held by the Practice you should be aware that there will be occasions when access to this information is denied. Such occasions would include where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of the Practice’s duty of care to you as our client.

If you would like further information about the way the Practice manages the personal information it holds, or wish to complain that you believe that the Practice has breached the Australian Privacy Principles please contact the Practice Manager. The Practice will investigate any complaint and will notify you of the making of a decision in relation to your complaint as soon as is practicable after it has been made.