Privacy and confidentiality | Kilmore Village Medical

Introduction

We are committed to protecting the privacy of patient information and to handling your personal information responsibly, in accordance with the Privacy Act 1988 (Cth), the Privacy Amendment (Enhancing Privacy Protection) Act 2012, the Australian Privacy Principles and relevant State and Territory privacy legislation (together, privacy legislation).

This policy explains how we collect, use and disclose your personal information, how you can access and correct it, and how you can make a complaint about a breach of privacy legislation.

This policy is current from 1 July 2024 and is reviewed annually. If we change our policy, processes or systems, we will update this policy, and the changes will be available on our website and in the clinic.

When you register as a patient, you consent to our GPs and clinic staff accessing and using your personal information so they can provide you with healthcare. Only staff who need to see your information will have access to it. If we need to use your information for anything else, we will ask for your consent.

Collection

What we collect

We collect information that is necessary and relevant to provide you with medical care and to manage the clinic. This may include your name, address, date of birth, gender, contact details, Medicare number (where available, for identification and claiming), healthcare identifiers, medical history, medications, allergies, adverse events, immunisations, social and family history, health risk factors, diagnostic investigations, and credit card and direct debit details. Please let us know if your details change, so our records stay accurate.

We may also collect personal information from patients' emergency contacts, and from job applicants and their referees. How much we collect depends on how the person is dealing with Kilmore Village Medical.

How we collect it

We collect information in writing where practicable, or through implied consent. We may need to collect information from third parties, such as another health service provider, your insurer or a guardian. We only do this with your consent and when it is needed to provide you with healthcare.

Information may be collected over the phone, in writing, in person or online, by medical and non-medical staff. In an emergency, we may need to collect information from your relatives or friends.

How your information is stored

Your information may be held as paper records, electronic records, x-rays, CT scans, videos, photos and audio recordings.

To protect it from misuse, interference, loss, unauthorised access, modification or disclosure, all administrative and clinical staff with access to personal health information have signed privacy and confidentiality agreements.

Your electronic medical record is password protected and accessed only by authorised staff. Where practicable, other information we hold is converted to digital form and kept in the password-protected record. It is encrypted and backed up regularly on site, with a secure encrypted backup kept off site. We use access authentication, antivirus software and firewalls to prevent unauthorised access, modification or disclosure.

Use

Under the Australian Privacy Principles, "use" means how we handle and process information within the clinic, such as accessing, reading, analysing, updating and making decisions based on it.

Kilmore Village Medical uses your personal information to:

provide healthcare services and treatment
administer billing, Medicare claims and payments
manage appointments and records
communicate with you about your healthcare and clinic matters
meet legal and regulatory obligations
run direct marketing campaigns, including e-newsletters, promotions and special offers

If you receive marketing from us and want it to stop, use the opt-out in that material and we will stop within a reasonable time. We won't charge you or disadvantage you in any way for opting out. We may occasionally give our marketing material to third parties to distribute on our behalf.

Disclosure

"Disclosure" means making information available to a person or organisation outside the clinic, such as sharing it with or transferring it to a third party, publishing it, or allowing external access to it.

We take all reasonable steps to keep your personal information in Australia, in line with privacy law. We do not transfer, publish or hold your personal information in cloud systems or servers outside Australia. Where information is disclosed to contracted third parties outside Australia, we take reasonable steps to make sure they follow local laws that are equal to or better than Australia's, and that they don't hold, use or disclose it in a way that is inconsistent with Australian privacy law.

We may disclose personal information:

for medical defence purposes
as required by law, such as mandatory reporting of communicable diseases
when it is necessary to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, or when it is impracticable to get the patient's consent
to help locate a missing person
for a purpose your doctor explained to you during your consultation
as needed in the normal course of care, such as a referral to a specialist or other health service
for a confidential dispute resolution process
to third parties engaged for business purposes, such as accreditation or information technology, who must comply with this policy

Primary and secondary purposes

Primary purpose

We use and disclose your personal information for the purpose it was collected, or otherwise in accordance with privacy law or your consent. This can include disclosure to people or organisations outside Kilmore Village Medical, such as:

our staff, partners, agents, contractors and consultants involved in your care or in providing services to you
other health service providers involved in your care, and their staff
financial institutions, Medicare, DVA or your private health insurer, for billing
your authorised or responsible contact or next of kin
government and regulatory authorities and other organisations, as required or authorised by law, including those running public health registers

Secondary purpose

We only use or disclose your personal information for another purpose if:

you have consented, subject to exceptions allowed under the Privacy Act (such as reasonably expected use, legal or regulatory compliance, health and safety, and the public interest)
it is for the general management and running of the clinic, such as billing and debt recovery, service monitoring, funding, complaint handling, incident reporting, service planning, quality assurance, audits and accreditation
it is for educating and training our staff, where de-identified information isn't enough
it is for third-party service providers to the clinic, such as information technology, maintenance and repair, marketing and payment systems
we reasonably believe it is necessary to lessen or prevent a serious and imminent threat to someone's life, health or safety, or a serious threat to public health or safety
it is required or authorised by law

Data breaches

Under the Notifiable Data Breaches scheme (Privacy Amendment (Notifiable Data Breaches) Act 2017), organisations covered by the Privacy Act must assess suspected data breaches and notify affected individuals where required.

Our data breach response plan helps us contain, assess and respond to a breach quickly, reduce potential harm, and meet the scheme's requirements. Some minor breaches can be resolved straight away, for example by recalling an email sent to the wrong person. Others are escalated to our response team.

When responding to a breach or suspected breach, we:

contain the breach
assess the risks
consider whether to notify
review what happened and act to prevent it happening again

Accessing and correcting your information

We will take reasonable steps to give you access to, or correct, your information within 30 days of your request. In some circumstances the law allows us to refuse access. If that happens, we will explain why in writing and tell you how to make a complaint.

Your information may be accessed by you, your authorised representative, your lawyer or your insurer, with your written request or written authority.

We may disclose information without your consent where it is:

required by law
necessary to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, or it is impracticable to get the patient's consent
needed to help locate a missing person
needed to establish, exercise or defend a legal or equitable claim

Questions about privacy? Call us on (03) 4714 8400.