Privacy and confidentiality

Introduction

Lakes Boulevard Medical, part of ICO Health Group, is committed to keeping patient information private and handling your personal information responsibly. We do this in line with the Privacy Act 1988 (Cth), the Privacy Amendment (Enhancing Privacy Protection) Act 2012, the Australian Privacy Principles and the relevant State and Territory privacy laws (together, privacy legislation).

This policy sets out how we collect, use and disclose your personal information, how you can see it and ask for it to be corrected, and how to complain if you think privacy legislation has been breached.

This policy applies from [To be confirmed: date this policy takes effect] and is reviewed every year. When our policy, processes or systems change, we update this policy and make the new version available on our website and at the clinic.

By registering as a patient, you consent to our GPs and clinic staff accessing and using your personal information to give you healthcare. Only the staff who need your information can see it. If we need to use it for any other reason, we will ask for your consent first.

Collection

What we collect

We collect the information we need to give you medical care and to run the clinic. It may include your name, address, date of birth, gender and contact details; your Medicare number (where available, to identify you and to make claims); healthcare identifiers; your medical history, medicines, allergies, adverse events and immunisations; your social and family history and health risk factors; diagnostic investigations; and credit card and direct debit details. Please tell us when your details change, so your record stays up to date.

We may also collect personal information about patients' emergency contacts, and about job applicants and their referees. What we collect depends on how each person deals with Lakes Boulevard Medical.

How we collect it

Where we can, we collect information in writing, or otherwise through implied consent. Sometimes we need information from someone else, such as another health service provider, your insurer or a guardian. We do this only with your consent and only when it's needed for your healthcare.

Our medical and non-medical staff may collect information in person, over the phone, in writing or online. In an emergency, we may need to collect information from your family or friends.

How your information is stored

We may hold your information as paper or electronic records, x-rays, CT scans, videos, photos and audio recordings.

Every administrative and clinical staff member who can access personal health information has signed a privacy and confidentiality agreement, to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure.

Your electronic medical record is password protected, and only authorised staff can open it. Where practical, other information we hold is converted to digital form and kept in that record. It is encrypted and backed up regularly on site, with a secure encrypted backup stored off site. Access authentication, antivirus software and firewalls help stop anyone getting in, changing or disclosing information without permission.

Use

Under the Australian Privacy Principles, "use" is how we handle information inside the clinic: for example, opening, reading, analysing, updating and making decisions based on it.

Lakes Boulevard Medical uses your personal information to:

• give you healthcare services and treatment
• manage billing, Medicare claims and payments
• manage appointments and records
• contact you about your healthcare and about the clinic
• meet our legal and regulatory obligations
• run direct marketing, including e-newsletters, promotions and special offers

If we send you marketing and you'd like it to stop, use the opt-out in that message and we'll stop within a reasonable time. Opting out costs you nothing and won't disadvantage you in any way. Now and then, we may give our marketing material to third parties to send on our behalf.

Disclosure

"Disclosure" means making information available to a person or organisation outside the clinic: for example, sharing or transferring it to a third party, publishing it, or letting someone outside access it.

In line with privacy law, we take all reasonable steps to keep your personal information in Australia. We don't transfer, publish or store your personal information in cloud systems or on servers outside Australia. If we disclose information to contracted third parties overseas, we take reasonable steps to make sure they follow local laws at least as strong as Australia's, and that they don't hold, use or disclose it in a way that conflicts with Australian privacy law.

We may disclose personal information:

• for medical defence purposes
• when the law requires it, such as mandatory reporting of communicable diseases
• when it's needed to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, or when it isn't practical to get the patient's consent
• to help find a missing person
• for a purpose your doctor explained to you in your consultation
• as part of your normal care, such as a referral to a specialist or another health service
• for a confidential dispute resolution process
• to third parties we engage for business purposes, such as accreditation or information technology, who must follow this policy

Primary and secondary purposes

Primary purpose

We use and disclose your personal information for the reason we collected it, or otherwise as privacy law allows or as you consent. This can include disclosing it to people or organisations outside Lakes Boulevard Medical, such as:

• our staff, partners, agents, contractors and consultants who are involved in your care or in providing services to you
• other health service providers involved in your care, and their staff
• banks and other financial institutions, Medicare, DVA or your private health insurer, for billing
• your authorised or responsible contact, or your next of kin
• government and regulatory authorities and other organisations, as the law requires or allows, including those that run public health registers

Secondary purpose

We use or disclose your personal information for any other purpose only if:

• you have consented, subject to the exceptions the Privacy Act allows (such as reasonably expected use, legal or regulatory compliance, health and safety, and the public interest)
• it's for the general management and running of the clinic, such as billing and debt recovery, service monitoring, funding, complaint handling, incident reporting, service planning, quality assurance, audits and accreditation
• it's for educating and training our staff, where de-identified information won't do
• it's for third parties that provide services to the clinic, such as information technology, maintenance and repairs, marketing and payment systems
• we reasonably believe it's needed to lessen or prevent a serious and imminent threat to someone's life, health or safety, or a serious threat to public health or safety
• the law requires or allows it

Data breaches

The Notifiable Data Breaches scheme (Privacy Amendment (Notifiable Data Breaches) Act 2017) requires organisations covered by the Privacy Act to assess suspected data breaches and, where required, tell the people affected.

Our data breach response plan helps us contain, assess and respond to a breach quickly, limit any harm and meet the scheme's requirements. Some small breaches can be fixed straight away, such as recalling an email sent to the wrong address. Others go to our response team.

When we respond to a breach or a suspected breach, we:

• contain the breach
• assess the risks
• decide whether to notify
• review what happened and take steps so it doesn't happen again

Accessing and correcting your information

We will take reasonable steps to give you access to your information, or to correct it, within 30 days of your request. In some situations the law lets us refuse access. If so, we'll tell you why in writing and explain how to make a complaint.

You, your authorised representative, your lawyer or your insurer can access your information with your written request or written permission.

We may disclose information without your consent when:

• the law requires it
• it's needed to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, or it isn't practical to get the patient's consent
• it's needed to help find a missing person
• it's needed to establish, exercise or defend a legal or equitable claim

Questions about privacy? Phone us on (03) 9436 0966.

Privacy complaints

If you're worried about how we've handled your personal information, please tell us. You can give feedback in person, by phone or in writing. For a formal complaint, please put it in writing so it can be recorded and passed on to the right person.

Please address written complaints to [To be confirmed: the person or role who handles privacy complaints, for example the practice manager]. You can hand your complaint in at reception at 547 The Lakes Boulevard, South Morang VIC 3752, or phone reception on (03) 9436 0966 and we'll tell you where to email it. If you'd like help writing your complaint, our reception team can help.

If you're not happy with our response, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at oaic.gov.au (opens in a new tab). For complaints about health services, you can also contact the Health Complaints Commissioner on 1300 582 113.