This privacy policy is to provide information on how patients’ personal information (which includes how patient health information) is collected and used within our practice, and the circumstances in which we may share it with third parties.

Why and when is the patient’s consent necessary

When a patient registers with our practice, they provide consent for our GPs and practice staff to access and use their personal information so we can provide the patient with the best possible healthcare. Only staff who need to see the patient’s personal information will have access to it. If we need to use patient information for anything else, we will seek additional consent from the patient to do this.

Why we collect, use, hold and share patients’ personal information?

Our practice will need to collect patients’ personal information to provide healthcare services to said patient. Our main purpose for collecting, using, holding and sharing patient personal information is to manage their health. We also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (e.g. staff training).

What personal information do we collect?

The information we will collect about patients includes their:

• names, date of birth, addresses, contact details
• medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors
• Medicare number (where available) for identification and claiming purposes
• healthcare identifiers
• any concession cards

Dealing with us anonymously

The patient has the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do so or unless we are required or authorised by law to only deal with identified individuals

How we collect patients’ personal information?

Our practice may collect your personal information in several different ways.

1. When the patient make their first appointment, our practice staff will collect their personal and demographic information via their registration.

2. During the course of providing medical services, we may collect further personal information via the following methods:
   a. My Health Record
   b. electronic transfer of scripts
   c. provider login to My Health Doctor Portal

Where practical Verbal consent is request prior to accessing the above methods and then noted in the patient’s chart

3. We may also collect patients’ personal information when they telephone us.
4. In some circumstances, personal information may also be collected from other sources. Often this is because it is not practical or reasonable to collect it from the patient directly. This may include information from:

• a guardian or responsible person
• other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services and pathology and diagnostic imaging services
• the patient’s Medicare, concession card or the Department of Veterans’ Affairs (as necessary).

When, why and with whom do we share patients’ personal information?

We sometimes share patient personal information:

• with third parties who work with our practice for business purposes, such as accreditation agencies or information technology providers – these third parties are required to comply with APPs and this policy
• with other healthcare providers
• when it is required or authorised by law (e.g. court subpoenas)
• when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
• to assist in locating a missing person
• to establish, exercise or defend an equitable claim
• for the purpose of confidential dispute resolution process
• when there is a statutory requirement to share certain personal information (e.g. some diseases require mandatory notification)

During the course of providing medical services, through eTP, My Health Record (e.g. via Shared Health Summary, Event Summary).

Only people who need to access patient information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without the patient’s consent.

We will not share patient personal information with anyone outside Australia (unless under exceptional circumstances, that are permitted by law) without the patient’s consent.

Our practice will not use patients’ personal information for marketing any of our goods or services directly to the patient without the patient’s express consent. If the patient does consent, they may opt out of direct marketing at any time by notifying our practice in writing.

Our practice may use patient personal information to improve the quality of the services we offer to our patients through research and analysis of our patient data.

We may provide de-identified data to other organizations to improve population health outcomes. The information is secure, patients cannot be identified and the information is stored within Australia. The patient can let our reception staff know if they do not want your information included.

How do we store and protect patient personal information?

Patient personal information is stored at our practice in their personal electronic file which is protected by individual personal log on passwords.  Any paper information securely stored in a lock filing room until it can be imported into the patient’s electronic file.

How can Patients access and correct their personal information at our practice?

Patients have the right to request access to, and correction of, their personal information.

Our practice acknowledges patients may request access to their medical records. We require the patient to put this request in writing and our practice will respond to their request within a 30 days.  There may be a nominal administration fee for this request. 

Our practice will take reasonable steps to correct any patient’s personal information where the information is not accurate or up to date. From time to time, we will ask the patient to verify that their personal information held by our practice is correct and current. The patient may also request that we correct or update their information, and they should make such requests in writing to:

Practice Manager
Pittsworth Medical Center
PO Box 83
PITTSWORTH  QLD  4356

Lodging a privacy related complaint and handling of that lodgment

We take complaints and concerns regarding privacy seriously. The patient should express any privacy concerns they may have in writing.  We will then attempt to resolve it in accordance with our resolution procedure within 30 days of receiving any complaint.  The patient is to address  any complaint to:

Practice Manager/Practice Principal
Pittsworth Medical Center
PO Box 83
PITTSWORTH  QLD  4356

The patient may also contact the OAIC. Generally, the OAIC will require the patient to give them time to respond before they will investigate. For further information visit www.oaic.gov.au or call the OAIC on 1300 363 992.