Privacy policy

Our commitment

BrisbaneHPB is committed to protecting the privacy and confidentiality of personal information, including health information. This policy explains how we collect, hold, use and disclose personal information in connection with the healthcare services we provide.

We manage personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and other applicable laws, professional obligations and standards. This policy does not limit any duty of confidentiality owed by our clinicians or staff.

This policy applies to our patients, prospective patients, parents and guardians, authorised representatives, carers, referrers, contractors and other people whose personal information we handle.

Information we collect and how

Information we may collect

Depending on the services you receive, we may collect and hold:

• identity and contact details, including name, date of birth, address, telephone number, email address, emergency-contact details and preferred communication method;
• government-related identifiers and billing details, such as Medicare, DVA, concession, private-health-insurance and Individual Healthcare Identifier details where relevant;
• health information, including medical and family history, symptoms, diagnoses, medications, allergies, clinical notes, referrals, reports, correspondence, images, pathology and imaging results, treatment plans and health-service records;
• information relevant to healthcare access and safety, including communication, interpreter, cultural, support-person and accessibility needs;
• payment, appointment, correspondence, feedback and complaint information;
• information supplied by an authorised representative, referrer, treating clinician, hospital, pathology or imaging provider, pharmacy, allied health practitioner, insurer or government body; and
• limited technical information if you use our website, patient portal or electronic communication services, as described in any relevant website or portal notice.

We collect information by lawful and fair means. We usually collect it directly from you, but may collect it from other sources where you authorise this, it is unreasonable or impracticable to collect it directly from you, or the law permits or requires us to do so.

Children and people with impaired capacity

Where a person is unable to provide informed consent or communicate a decision, we will manage information in accordance with applicable law and professional obligations. We may collect information from, or disclose information to, a parent, guardian, substitute decision-maker or responsible person where authorised, permitted or necessary in the circumstances. Authority will be checked where appropriate.

Why we use and disclose information

Our primary purpose is to provide safe, appropriate and continuous healthcare. We may use or disclose personal information to:

• assess, diagnose, treat, prescribe, refer, coordinate care and communicate with you;
• share relevant information with other health-service providers involved in your care, including general practitioners, specialists, hospitals, pathology and imaging services, pharmacists, allied-health practitioners, aged-care providers and emergency services;
• receive and review referrals, reports, results and correspondence;
• manage appointments, fees, debt recovery where necessary and lawful, and Medicare, DVA, private-health-insurance or other claims;
• operate, administer, audit, accredit, improve and secure our practice and systems, including quality assurance, clinical governance, training and risk management;
• communicate recalls, clinically necessary follow-up, test-result instructions, appointment reminders and other care-related messages;
• meet legal, regulatory, public-health, professional, insurance, court/tribunal, mandatory-reporting and notifiable-disease obligations;
• respond to a serious threat to life, health or safety, where permitted by law;
• investigate and manage complaints, incidents, claims, suspected fraud or unlawful activity; and
• undertake research, education, teaching, quality-improvement or health-management activities using de-identified information where practicable and permitted by law.

We may use or disclose information for a secondary purpose only where you consent, where you would reasonably expect the use or disclosure and it is directly related to the primary purpose for sensitive information, or where another exception in the Privacy Act or other law applies.

We use document-generation and referral systems with controls intended to ensure that only relevant information is included. Clinicians remain responsible for reviewing clinical correspondence and disclosures.

My Health Record

We may access or upload information to My Health Record in accordance with the My Health Records Act 2012 (Cth), system access controls and applicable patient controls. Please ask us if you would like information about how this applies to your care.

Research, teaching and quality improvement

We prefer to use de-identified information for research, teaching, training, quality-improvement and service-planning activities. If identifiable information is proposed for research or teaching, we will obtain consent where required and comply with applicable ethics, privacy and legal requirements. Your decision will not affect your access to care.

Marketing

We do not sell patient information. We do not use health information for direct marketing.

Communication and results

We may contact you by telephone, SMS, email, post, patient portal or other agreed method for appointment, administrative and care-related purposes. You may tell us your preferred contact method and update it at any time.

Electronic communications can carry privacy and delivery risks. We limit the information included in standard SMS and email where practical, verify contact details, and use secure messaging or encryption for clinical communications with other health services where appropriate. Please tell us promptly if your contact details change or if another person may access your phone, email or mail.

Our clinicians review results received by the practice and decide what follow-up is required. We use reasonable attempts to contact patients when clinically indicated, taking account of urgency and available contact details. Patients remain responsible for attending appointments, following clinician instructions and seeking urgent care when needed. A patient must not assume that a result is normal merely because the clinic has not contacted them.

Security, storage and retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Safeguards may include:

• role-based access controls, unique user accounts, authentication and audit logging;
• staff confidentiality obligations, training and supervision;
• secure electronic medical-record systems, encrypted or secure transfer methods where appropriate, backups and information-security controls;
• secure storage and disposal of paper records and devices; and
• due diligence and contractual safeguards for relevant service providers.

Only authorised personnel may access patient records and official practice documents, and only where needed for their role. We retain health records for the periods required by applicable law, professional obligations and legitimate clinical and business needs. When information is no longer required and no retention obligation applies, we take reasonable steps to destroy or de-identify it securely.

Overseas disclosure and service providers

We may engage carefully selected service providers to support functions such as practice-management software, cloud hosting, backup, secure messaging, billing, transcription, information technology, document management and communications. They may handle personal information only as needed to provide their services and subject to appropriate privacy and security arrangements.

We do not ordinarily disclose personal information to overseas recipients. If this changes, we will update this policy and take the steps required by APP 8 before making the disclosure.

Access and correction

You may request access to personal information we hold about you, or ask us to correct information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Please make requests to our Privacy Officer using the contact details above. We may need to verify your identity and clarify the scope of your request. We will respond within a reasonable period and give access in the requested manner where reasonable and practicable. We do not charge for making a request. If a permitted charge applies for providing access, it will not be excessive and we will tell you before it is incurred.

We may refuse access or correction only where permitted by law. If we refuse, we will provide written reasons and information about complaint options unless it would be unreasonable to do so. If we decline a correction request, you may ask us to associate a statement with the record noting that you consider the information inaccurate, out of date, incomplete, irrelevant or misleading.

Anonymity and pseudonymity

Where lawful and practicable, you may deal with us anonymously or using a pseudonym. This may not be possible if we need to identify you to provide safe healthcare, meet legal obligations, process a claim, prescribe or arrange a referral or investigation.

Privacy complaints

If you have a privacy question, concern or complaint, please contact our Privacy Officer in writing or by phone using the details above. Please describe the issue and the outcome you seek. We will acknowledge your complaint, investigate it fairly and respond within a reasonable period. If more time is needed, we will tell you why and keep you informed.

If you are dissatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

You may also seek advice from your state or territory health-complaints body where relevant.

Changes to this policy

We may update this policy from time to time to reflect changes to our practices, technology or legal obligations. The current version will be available at brisbanehpb.com.au/privacy and from reception. The effective date and review date appear at the end of this policy.