Privacy Policy

Privacy Statement

In compliance with the Commonwealth Privacy Act, Australian Privacy Principles (APPs) and the Health Privacy Principles (HPPs) (Health Records Act 2001), Harar Medical Centre has prepared an APP Privacy Policy to describe the way and circumstances under which personal information is collected, stored, used and disclosed and how complaints are handled by our Practice.

The policy is intended as a guide to staff and patients of this practice and for the advice of the broader community.

Our principal concern is the health of patients who visit our Practice. A high level of trust and confidentiality is required to ensure the confidence of the patients we serve.

Collection

Collection of personal information must be fair, lawful and not intrusive. We recognise that the information we collect is often of a highly sensitive nature and will always ensure that all personal information collected is protected.

Our Practice will only collect personal information (including health and sensitive information) regarding patients for the purpose of providing medical services and treatment to patients. We endeavour to obtain sufficient information to provide optimal ongoing management of each patient’s health, care and wellbeing.

Personal information collected will generally include the patient’s:

• Name, address and telephone number,
• Medicare / health care card / pension card number,
• Current medications or treatments used by the patient,
• Previous and current medical history, including family medical history,
• The name of any health service provider to whom the patient is referred, copies of any letters of referrals and copies of any reports back,
• Ethnicity,
• Allergies,
• Immunisations and other treatments.

We may access information:

• provided directly by the patient (primary source);
• provided on the patient’s behalf with the patient’s consent;
• from a health service provider who refers the patient to medical practitioners
• from health service providers to whom patients are referred.

Storage

Because of the sensitive nature of the information collected by our Practice, extra precautions are taken to ensure the security of that information. All medical records are stored in individual electronic files, which are password-protected on several levels (with differing access for clinical and reception staff. Our computer files are backed up daily and backup is stored offsite. Any paper-based sensitive information is scanned directly into the patient’s electronic file and the paper-based copy destroyed (shredded).

As required by law, our Practice keeps health information for a minimum of 7 years from the date of last entry in the patient record (unless the patient was a child in which case the record must be kept until the patient attains or would have attained 25 years of age).

Use and Disclosure

Our Practice will ensure that personal information will only be used for the purpose it was collected, or that would reasonable be expected by the patient providing the information.
If the identified information is to be used for secondary or unrelated purposes, such as data analysis or research, we will obtain informed consent from the patient and the patient will be given the opportunity to refuse such use or disclosure.

Secondary purposes which are directly related to the primary purpose of collection for which we may use or disclose personal information may be for quality assurance, training, liaising with government offices regarding Medicare entitlements and payments and as may be required by our insurers.

Our Practice undertakes quality improvement activities using our medical software program. Data obtained via our quality improvement activities is used for internal purposes only. Any data transmitted to third parties is strictly de-identified and directly related to our internal quality improvement activities.

If a patient is physically or legally incapable of providing consent, a responsible person (as described under the Act) may do so. Information may then be disclosed to the responsible person.

Personal information collected by us may be used or disclosed as required for:

• the delivery of the health service to the patient;
• the ordinary operation of our services (i.e. to refer the patient to another health service provider);

We will only disclose personal information without consent where:

• Such disclosure is required by law, or for law enforcement
• There is a serious threat to an individual’s life, health and/or safety
• There is a serious threat to public health and/or safety

We will keep records of any such use and disclosures.

We will not disclose personal information to overseas recipients.

We require all our employees and contractors to sign a confidentiality undertaking and observe obligations of confidentiality in the course of their employment/contract.

Accessing your information

If a patient requests their medical history to be transferred to another medical practice, the patient is required to attend the new practice and sign their consent form. Upon receipt of this consent form, our Practice will securely forward the patient’s personal and health information to the recipient medical practice.

If a patient wishes to access their personal and health information held by our Practice, the patient must sign a form and arrange an appropriate method of access with our reception staff. Access can be gained via a printed paper-based copy of their medical history, or a supervised electronic viewing with our staff.

Where a patient seeks correction of their personal information, this can be done through reception staff for information such as address, Medicare Card number etc.
Where a patient seeks to change health information, the patient will be required to consult with the Doctor and complete a form detailing the reasons for correction and authorising the changes.

Complaints

Where a patient wants to make a complaint about a breach of the APPs, they are encouraged to address the complaint directly with the Doctor or Practice Manager. Our Practice takes your complaints seriously and will respond to your complaint in person or in writing, as necessary.

If, however, the patient would like to discuss the matter with an external agency, they may contact:

The Health Care Complaints Commission
Level 30, 570 Bourke Street
Melbourne, Vic 3000
Tel: (03) 8601 5222

Or:

The Office of the Australian Information Commissioner
GPO Box 5218 Sydney NSW 2001 Or GPO Box 2999 Canberra ACT 2601

Further information

To obtain further information in relation to any of the above, please contact our Practice Privacy Officer by telephone on 9791 4988 or via mail at:

The Privacy Officer
Harar Medical Centre
163 Cleeland st, Dandenong VIC 3175