Introduction
This Privacy Policy provides information on how personal information is collected, used, and stored within the practice, and the circumstances in which it may be shared with third parties.
All personal information collected in the course of providing a health service is considered health information. Health information is ‘sensitive information’ which means there are stricter requirements when handling this information.
Why and when consent is necessary
When you register as a patient of our practice, you provide consent for our doctors and practice staff to access your personal information for the purpose of delivering your health care. Only staff who need to see your personal information will have access to it.
Why we collect, use, hold and share your personal information
Our practice collects personal information primarily to manage your health. We also use it for directly related business activities, such as financial claims and payments, audits and accreditation, staff training, and business processes improvement.
What personal information do we collect?
The information we collect about you includes:
- Names, dates of birth, addresses and contact details
- Medical history, medications, genetic information, allergies, adverse events, immunisations, social and family history
- Billing information and Medicare numbers
- Healthcare identifiers
- Health fund details
If you do not provide us with all the personal information we request, our doctors may not be able to provide optimal services to you.
Dealing with us anonymously
You have the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do so or unless we are required or authorised by law to only deal with identified individuals.
How we collect your personal information
Our practice may collect your personal information in several different ways, including:
- When you make your first appointment and register with the practice
- Three-point verification of your identity (full name, date of birth, address)
- Through Electronic Transfer Prescriptions (eTP) and My Health Record
- Through our website, emails, telephone calls, online bookings and social media
- From third parties including guardians, other healthcare providers, health funds, Medicare and the Department of Veterans’ Affairs
- Photos and medical images (with your consent)
- SMS reminders via the HotDoc platform (encrypted; you may opt out at any time)
Providing your information to other doctors and healthcare professionals
The doctors in this practice respect your right to decide how your personal health information is used or disclosed. Your consent is the guiding principle for all disclosures, including referrals and electronic prescription systems.
Practice doctors access only their own patients’ records unless covering for colleagues on leave. Staff access is restricted by role: clinical staff access medical files, administration staff add correspondence, and the accounts team access financial history only.
Providing your information to others
Your doctor will not disclose your personal health information to a third party unless:
- You have consented to the disclosure; or
- Disclosure is necessary to prevent harm and you are unable to consent; or
- There is a legal obligation to disclose (for example, notification of infectious diseases, suspected abuse, subpoena or court order); or
- The information is necessary to obtain Medicare payments or insurance rebates; or
- There are overriding public health and safety interests in the disclosure.
In any of the above cases only information which is necessary to achieve the objective will be provided.
Third-party service providers engaged by the practice are bound by confidentiality agreements and their access is limited to the information necessary to perform their services.
We do not use your personal information for marketing purposes without your express consent. You may opt out of marketing communications at any time by notifying us in writing. Your personal information is not shared outside Australia without your consent, except where permitted by law.
How we store and protect your personal information
Your information is stored in electronic records, paper files, and visual formats such as X-rays, CT scans and photos. Electronic records are protected with password access and firewall security as advised by our IT consultants. Hard copies are stored in locked, security-monitored facilities. All staff and contractors sign confidentiality agreements.
We are required to keep health information:
- For at least 7 years from the last occasion on which we provided a health service to the patient — if we collected the information when the patient was 18 years old or older; or
- At least until the patient turns 25 — if we collected the information when the patient was under 18.
How we use your information to improve our services
Our practice uses personal information to improve the quality of services through research, analysis of patient data and staff training. De-identified data may be provided to other organisations to improve population health outcomes. You can request to be excluded from de-identified data sharing.
You may be offered the opportunity to participate in research only after the practice has obtained your initial consent; researchers will not approach you directly without your express consent. If you participate, you will receive specific information about the research project before deciding whether to take part.
Document automation technologies
Document automation generates electronic documents using your existing data. The practice creates referrals through secure Healthlink software containing only relevant medical information.
All users of the medical software have their own unique user credentials and password and can only access information that is relevant to their role in the practice team.
The practice complies with Australian privacy legislation and the Australian Privacy Principles (APPs), following guidance from the Royal Australian College of General Practitioners.
AI scribes
The practice uses the Heidi AI scribe tool to support note-taking during consultations, using audio recordings to generate clinical notes. The practice uses AI scribe data solely for the delivery of your health care. Please speak with your doctor if you have questions about the use of an AI scribe during your consultation, or if you would prefer it not be used.
Accessing and correcting your personal information
You have the right to request access to your personal information and to request corrections. Written requests will receive a response within 30 days; fees may apply for recovery, copying and postage.
The practice will take reasonable steps to correct information that is not accurate or up to date. Please verify your information and request corrections in writing or via email to pm@mtbarkerbalhannahmedicalclinics.com.au.
Notifiable data breaches
The practice reports eligible data breaches to the Office of the Australian Information Commissioner. A data response team assesses, takes remedial action, and reports suspected breaches as required.
Privacy complaints
If you have concerns about how your privacy has been handled, please express them in writing or by email to the Practice Manager at pm@mtbarkerbalhannahmedicalclinics.com.au. We will attempt to resolve your complaint within 30 days.
You may also contact the Office of the Australian Information Commissioner (OAIC). Generally, the OAIC will require you to have contacted Mt Barker & Balhannah Medical Clinics and given us time to respond, before they investigate.
Further information: www.oaic.gov.au or 1300 363 992.
Privacy and our website
All provisions of this privacy policy apply to your interactions with our website.
Policy review
This policy is reviewed regularly to ensure it remains compliant with any changes. Substantive amendments will be notified on our website and in our waiting areas.