Privacy and Confidentiality Policy
We respect your rights to privacy and take our privacy obligations seriously. We comply with the Australian Privacy Principles, found under the Privacy Act 1988.
The Diabetic GP Clinic collects information from you for the primary purpose of providing you with healthcare services. We require you to provide us with your personal and health information so that we may provide our services to you. We will also use the information you provide in the following ways:
Effectively communicate with third parties, including Medicare Australia, private health insurers, government departments and other practitioners involved in your healthcare including the Allied Health Practitioners that work from The Diabetic GP Clinic.
Appropriately manage our practice, such as conducting audits, undertaking accreditation processes, manage billings and education/training staff.
For more information you can download and read our brochure The Diabetic GP Clinic: Keeping Your Personal Information Private in Our Practice.
Privacy in Australia
One crucial aspect of any practice is the management and storage of patient information. The Privacy Amendment (Private Sector) Act 2000 sets the standards for the way in which private sector organisations collect, use and disclose information about individuals.
From March 2014, the Australian Privacy Principles (APPs) detail these standards. These APPs replace the National Privacy Principles, and govern the collection and production of personal information.
There are 5 components of the Australian Privacy Principles:
Management of personal information in a open and transparent manner;
Dealing with unsolicited information;
Use and disclosure of information and government related identifiers;
Integrity, quality and security of personal information; and,
Access to and ability to correct personal information.
The 13 Australian Privacy Principles are:
1. Open and transparent management of personal information
2. Anonymity and pseudonymity
3. Collection of solicited personal information
4. Dealing with unsolicited personal information
5. Notification of the collection of personal information
6. Use or disclosure of personal information
7. Direct Marketing
8. Cross-border disclosure of personal information
9. Adoption, use or disclosure of government related identifiers
10. Quality of personal information
11. Security of personal information
12. Access to personal information
13. Correction of personal information.
Australian Privacy Principles (APP Policy)
For further information, please refer to the Australian Privacy Principles (APPs) website.
Part A – Purpose and Context
The Diabetic GP Clinic is committed to ensuring the privacy and confidentiality of all personal information affiliated with the Health Service’s business undertakings.
The Diabetic GP Clinic follows the terms and conditions of privacy and confidentiality in accordance to the Australian Privacy Principles (APPS) as per schedule 1 of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth), forming part of the Privacy Act 1988 (‘the Act’).
The point of contact regarding any queries regarding this policy is Vanessa Pearson (Practice Manager)
Part B – Australian Privacy Principles
As a private sector health service provider and under permitted health situations, The Diabetic GP Clinic is required to comply with the APPs as prescribed under the Act.
The APPs regulate how The Diabetic GP Clinic may collect, use, disclose and store personal information and how individuals, including The Diabetic GP Clinics patients may:
Address breaches of the APPs by The Diabetic GP Clinic;
Access their own personal information; and,
Correct their own personal information.
In order to provide patients with adequate health care services, The Diabetic GP Clinic will need to collect and use personal information. It is important to be aware that if the patients provide incomplete or inaccurate information or the patient withholds personal health information, The Diabetic GP Clinic may not be able to provide the patient with services they are requesting.
“personal information” as defined by the Privacy 1988 (Cth). Meaning “information or an opinion including information or an opinion forming part of a database, whether true or not, and whether recorded in a material format or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion”; and,
“health information” as defined by the Privacy Act 1988 (Cth). This is a particular subset of “personal information” and means:
Information or opinion about the health or disability (at any time i.e. past, present or future) of an individual that can be classified as personal information;
Information or opinion about an individuals expressed wished about the future provision of health services that can be classified as personal information;
Information or opinion about health service provided, or to be provided, to an individual, that can be classified as personal information;
Other personal information collected to provide, or in providing, a health service;
Other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or,
Genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.
Personal information also includes ‘sensitive information’ which is information including, but not limited to a patient’s:
Sexual preferences; and or,
Information deemed ‘sensitive information’ attracts a higher privacy standard under the Act and is subject to additional mechanisms for the patient’s protection.
Part C – Types of Personal Information
The Diabetic GP Clinic collects information from each individual patient that is necessary to provide the patient with adequate health care services.
This may include collecting information about a patient’s health history, family history, ethnic background or current lifestyle to assist the health care team in diagnosing and treating a patient’s condition.
Part D – Collection & Retention
This information will in most circumstance be collected directly from the patient through but not limited to the following mediums:
The Diabetic GP Clinic patient consent form;
Medical treatment form; and or,
Face to face consultation.
In other instances, The Diabetic GP Clinic may need to collect personal information about a patient from a third party source. This may include:
Other health service providers.
This will only be conducted if the patient has provided consent for The Diabetic GP Clinic to collect his/her information from a third party source; or, where it is not reasonable or practical for The Diabetic GP Clinic to collect this information directly from the patient. This may include where:
The patient's health is potentially at risk and his/her personal information is needed to provide them with emergency medical treatment.
The Diabetic GP Clinic endeavours to store and retain a patient's personal & health information electronically onto a domestic server.
Part E – Purpose of Collection, Use and Disclosure
The Diabetic GP Clinic only uses a patient’s personal information for the purpose(s) they have provided the information for unless one of the following applies:
The patient has consented for The Diabetic GP Clinic to use his/her information for an alternative or additional purpose;
The disclosure of the patient’s information by The Diabetic GP Clinic is reasonably necessary for the enforcement of criminal law or a law imposing a penalty or sanction, or for the protection of public revenue;
The disclosure of the patient’s information by The Diabetic GP Clinic will prevent or lessen a serious and imminent threat to somebody’s life or health; or,
The Diabetic GP Clinic is required or authorised by Law to disclose the patient’s information for another purpose.
i. Health Professionals to provide treatment
During the patient’s treatment at The Diabetic GP Clinic, he/she may be referred to alternative medical treatment/services (i.e. Pathology or radiology) where The Diabetic GP Clinics staff may consult with senior medical experts when determining a patient’s diagnosis or treatment.
The Health Service’s staff may also refer the patient to other health service providers for further treatment during and following the patient’s admission. These services include, but are not limited to:
- Physiotherapy; or,
- Outpatient or community health services.
These health professionals will be designated health service providers appointed to use the patient's health information as part of the process of providing treatment. Please not that this process will be conducted whilst maintaining the confidentiality and privacy of the patient’s personal information.
ii. Alternative Health Services
At any point a patient wishes to be treated by an alternative medical practitioner or health care service that requires access to his/her personal/ health information The Diabetic GP Clinic requires written authorisation which is to state that the patient will be utilising alternative health services and that these health services have consented for a transfer of personal/health information.
iii. Other Third Parties
The Diabetic GP Clinic may provide the patient's personal information regarding a patient’s treatment or condition to additional third parties. These third parties may include:
- Other relatives;
- Close personal friends;
- Guardians; or,
- A person exercising a patient’s power of attorney under an enduring power of attorney.
Where information is relevant or reasonable to be provided to third parties, written consent from the patient is required.
Additionally, the patient may at any time wish to disclose that no third parties as stated are to access or be informed about his/her personal information or circumstances.
iv. Other Uses of Personal Information
In order to provide the best possible environment to treat patients, The Diabetic GP Clinic may also use personal/health information where necessary for:
- Activities such as quality assurance processes, accreditation, audits, risk and claims management, patient satisfaction surveys and staff education and training.
- Invoicing, billing and account management;
- To liaise with a patient’s health fun, Medicare or the Department of Veteran’s Affairs, as necessary; and,
- The purpose of complying with any applicable laws-i.e. in response to a subpoena or compulsory reporting to State or Federal authorities.
If at any point or for any of the aforementioned reasons The Diabetic GP Clinic uses or discloses personal/health information in accordance with the APPs, The Diabetic GP Clinic will provide written notice for the patient's consent for the use and/or disclosure.
Part F – Access and Changes to Personal Information
If an individual patient reasonably requests access to their personal information for the purposes of changing the information, he/she must engage with the relevant practice manager.
The point of contact for patient access to personal information is:
Phone: 4724 0700
Once and individual patient requests access to his/her personal information, The Diabetic GP Clinic will respond within a reasonable period of time to provide the information.
All personal information will be updated in accordance to any changes to a patient’s personal circumstances brought to The Health Services attention. All changes to personal information will be subject to patients consent and acknowledgement.
If an individual requests access to his/her personal information The Health Service will charge $X. Please note that this fee is associated with administrative costs only.
Part G – Complaints Handling
How an individual patient may complain about a breach of the Australian Privacy Principles, or a registered APP code (if any) that binds the entry, and how the entity will deal with such a complaint.
Part H – Personal Information and Overseas Recipients
Use of Overseas Parties:
The Diabetic GP Clinic does not engage with any overseas entities, with which personal or health information would be transferred, appointed or disclosed.
The aforementioned entities engaged overseas are subject to the legislative requirements as stipulated by the APPs.
Part I – Disposal of Personal/Health Information
If The Diabetic GP Clinic receives any unsolicited personal information that is not deemed appropriate for the permitted health situation, The Diabetic GP Clinic will reasonably de-identify and dispose of the information accordingly.
Part J – Access to Policy
On the computer under clinic.
A hard copy will be store in the practice manager’s office.