Privacy Policy
1. Purpose
This Privacy Policy explains how the practice collects, uses, stores, and discloses personal and health information, and how patients can access or correct their information. The practice is committed to protecting patient privacy and complying with applicable Australian privacy laws.
2. Scope
This policy applies to all patients, parents/guardians, referrers, staff, contractors, and any individual whose personal information is handled by the practice.
3. Definitions
- Personal Information: Information that identifies or could reasonably identify an individual.
- Health Information: Information about a person’s physical or mental health, medical history, or healthcare provided. Health information is considered sensitive information under privacy law.
4. What Information We Collect
The practice may collect personal and health information including (but not limited to):
- Name, date of birth, address, phone number, email
- Medicare number, private health fund details, DVS details
- Referrer details and correspondence
- Medical history, test results, clinical notes, images, and reports
- Appointment details and billing information
- Emergency contact details
- Information provided via forms, online portals, phone calls, or in person
5. How We Collect Information
Information is collected:
- Directly from patients or their parents/guardians
- From referrers, other treating health professionals, hospitals, or allied health providers
- Via online forms, patient portals, email, telephone, or practice management systems
- Through Medicare, My Health Record (where applicable), and health insurers (with consent)
Where it is not practical to collect information directly from the individual, the practice will take reasonable steps to ensure the individual is aware of the collection.
6. Why We Collect, Use, and Disclose Information
The practice collects, uses, and discloses personal and health information for purposes including:
- Providing safe and appropriate healthcare
- Managing appointments and recalls
- Communicating with patients, parents/guardians, and referrers
- Billing, Medicare claims, and private health insurance claims
- Quality improvement, accreditation, and clinical audit
- Legal, regulatory, and professional obligations
- Practice administration and staff training
Information will only be used or disclosed for purposes related to the provision of healthcare or as otherwise permitted or required by law.
7. Disclosure of Information
The practice may disclose personal and health information to:
- Other healthcare providers involved in the patient’s care
- Pathology, imaging, and diagnostic services
- Medicare, private health insurers, and payment providers
- Practice software providers and IT support services (under confidentiality agreements)
- Regulatory bodies where required by law
- Parents or guardians with parental responsibility (unless legally restricted)
The practice will not sell or rent personal information.
8. My Health Record
Where applicable, the practice may access and upload information to My Health Record in accordance with legislation. Patients may opt out of My Health Record or request limitations on access in line with government policy.
9. Data Storage and Security
The practice takes reasonable steps to protect personal and health information from misuse, loss, unauthorised access, or disclosure. Safeguards include:
- Secure electronic practice management systems
- Password protection and access controls
- Secure storage of paper records
- Staff confidentiality agreements
- Regular system updates and security measures
When information is no longer required, it is securely destroyed or de-identified in accordance with legal retention requirements.
10. Access to and Correction of Information
Patients (or parents/guardians with authority) have the right to:
- Request access to their personal or health information
- Request correction of inaccurate or incomplete information
Requests must be made in writing. Access may be subject to identity verification and, in some cases, a reasonable administrative fee. Access may be refused where permitted by law.
11. Complaints and Concerns
If you have a concern about how your information has been handled, please contact the practice in writing. The practice will investigate and respond within a reasonable timeframe.
If you are not satisfied with the response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
12. Overseas Disclosure
The practice does not routinely disclose personal or health information overseas. If overseas disclosure is required (e.g. for cloud-based services), reasonable steps are taken to ensure compliance with Australian privacy laws.
13. Policy Review
This Privacy Policy is reviewed regularly and may be updated to reflect changes in legislation, technology, or practice procedures. The most current version is available on request or on the practice website.