What Information We Collect
Personal health information is a particular subset of personal information and can include any information collected to provide a health service. This information includes medical details, family information, name, address, employment and other demographic data, past social history, medical information (including medical history medications, allergies, adverse events, immunisations, family history and risk factors), current health issues and future medical care, Medicare number, health fund details, healthcare identifiers, accounts details and any health information such as a medical or personal opinion about a person’s health, disability or health status.
It includes the formal medical record whether written or electronic and information held or recorded on any other medium e.g. letter, fax, or electronically or information conveyed verbally.
Why We Collect, Use, Hold and Share Personal Information
The practice will need to collect personal information to provide healthcare services to patients. The main purpose for collecting, using, holding and sharing personal information is to manage your health. It is also used it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (e.g. staff training).
Why and When Patient Consent is Necessary
When people register as a patient of our practice, patients provide consent on the new patient from for our Doctor and staff to access and use patient’s personal information so they can provide you with the best possible healthcare. Only staff who need to see patient’s personal information will have access to it. If the practice needs to use information for anything else, the Practice Manager will seek additional consent from patients to do this.
Anonymity
Patients have the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do so or unless we are required or authorised by law to only deal with identified individuals.
Medical Records
The physical medical records and related information created and maintained for the continuing management of each patient are the property of this practice. This information is deemed a personal health record and while the patient does not have ownership of the record, he/she has the right to access under the provisions of the Commonwealth Privacy and State Health Records Acts. Requests for access to the medical record will be acted upon only if received in written format.
How We Collect Information
Personal information is collected by the following means:
- When patients make their first appointment our staff members will collect their personal and demographic information, allergies, smoking and alcohol status and medications via their registration form
- While providing medical services, we may collect further personal information
- When patient contacts us to make an appointment
- In some circumstances personal information may be collected from other sources, often this is because it is not practical or reasonable to collect it from you directly. This may include information from:
- Patient’s guardian or responsible person
- Other involved health providers, such as specialists, allied health professionals, hospitals, community health services, pharmacists and pathology and diagnostic imaging services
- Patient’s health fund, Medicare or Department of Veterans Affairs (if applicable)
- My Health Record e.g. via Shared Health Summary, Event Summary (providing patient has consented our clinic to access)
- Electronic transfer of prescriptions
The collection statement informs patients about how their health information will be used including other organisations to which the practice usually discloses patient health information and any law that requires the particular information to be collected. Patient consent to the handling and sharing of patient health information should be provided at an early stage in the process of clinical care and patients should be made aware of the collection statement when giving consent to share health information.
In general, quality improvement or clinical audit activities for the purpose of seeking to improve the delivery of a particular treatment or service would be considered a directly related secondary purpose for information use or disclosure so we do not need to seek specific consent for this use of patients’ health information, however we include information about quality improvement activities and clinical audits in the practice policy on managing health information.
We inform our patients about our practice’s policies regarding the collection and management of their personal health information via:
- A sign at reception,
- Our patient information sheet
- New patient forms “Consent to share information”
- Verbally if appropriate
Privacy Signs & Brochures
Notices and brochures regarding the practice’s privacy policy are on display in the reception area.
Disclosing Information
Personal health information and medical records may be collected, used and disclosed for the following reasons:
- For communicating relevant information with other treating Doctors, specialists, allied health professionals and pharmacists
- When it is necessary to lessen or prevent serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
- During the course of providing medical services, through ETP, My Health Record (e.g. via Shared Health Summary, Event Summary), providing the patient grants us access
- For patient follow up or recall reminder services
- For National or State Register and reminder systems (e.g. immunisation and cervical screening records)
- Accounting, Medicare or health insurance account purposes
- With third parties who work with this business for quality assurance activities such as accreditation and who are required to comply with the APPs and this policy
- For disease notification as required by law (e.g. infectious diseases)
- For use by all Doctors in this practice when consulting with you
- To assist in locating a missing person
- For legal related disclosure as required by a court of law (e.g. subpoena, court order, suspected child abuse)
- For research purposes (de-identified, meaning you are not able to be identified from the information given)
- To establish, exercise or defend an equitable claim
- For the purpose of confidential dispute resolution process
Only people that need access to medical information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without patient consent. Our practice will not share personal information with anyone outside Australia (unless exceptional circumstances that are permitted by law) without consent.
This information is only accessed by the Doctor and staff members. It is not released to third parties without consent unless required by law. The information is kept secure with restricted access.
If patients have any concerns or wish to restrict access to their personal health information this should be discussed with the Doctor or staff. This practice adheres to principles of the RACGP Standards and Australian Privacy Principles this policy is available to all patients for inspection.
Marketing
Our practice will not use patient’s personal information for marketing any of our goods or services directly to you without patient’s express consent. If you do consent, you may opt out of direct marking at any time by notifying our practice in writing.
Privacy Complaints
Patient complaints and concerns about privacy are taken very seriously. Patients expressing these concerns are encouraged to provide them in writing to our postal address and our practice will attempt to resolve the issue in accordance with our complaints resolution procedure. Patients can also contact the Office of the Australian Information Commissioner on 1300 363 992 to make their complaint. Generally, the OAIC will require patients to give them time to respond before they will investigate.
Policy Review
This policy will be reviewed annually to ensure that the remains relevant and compliant with standards.