This privacy policy is to provide information to you, the patient, on how your personal information (which includes your health information) is collected and used within the practice, and the circumstances in which we may share it with third parties.

When you register as a patient of the practice, you provide consent for ythe GPs and practice staff to access and use your personal information so they can provide you with the best possible healthcare. Only staff who need to see your personal information will have access to it.

If we need to use your information for anything else, we will seek additional consent from you to do this.

This practice will need to collect your personal information to provide healthcare services to you. The main purpose for collecting, using, holding and sharing your personal information is to manage your health.

We also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (e.g., staff training).

The information we will collect about you includes your:

• Names, date of birth, addresses, contact details
• Medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors
• Medicare number (where available) for identification and claiming purposes
• Healthcare identifiers
• Health fund details

You have the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do

The practice may collect your personal information in several different ways:

1. When you make your first appointment: Practice staff will collect your personal and demographic information via your registration.
2. During the course of providing medical services: We may collect further personal information. Information can also be collected through electronic transfer of prescriptions (eTP), My Health Record, e.g., via Shared Health Summary, Event Summary. You will need to specify if your practice participates in any of these eHealth services.
3. When you interact with us electronically: We may also collect your personal information when you visit the website, send us an email or SMS, telephone us, make an online appointment or communicate with us using social media.
4. From other sources: In some circumstances, personal information may also be collected from other sources, often because it is not practical or reasonable to collect it from you directly. This may include information from:
   • Your guardian or responsible person
   • Other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services, and pathology and diagnostic imaging services
   • Your health fund, Medicare, or the Department of Veterans’ Affairs (as necessary)

We sometimes share your personal information:

• With third parties who work with the practice for business purposes, such as accreditation agencies or information technology providers – these third parties are required to comply with APPs and this policy
• With other healthcare providers
• When it is required or authorised by law (e.g., court subpoenas)
• When it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
• To assist in locating a missing person
• To establish, exercise or defend an equitable claim
• For the purpose of confidential dispute resolution process
• When there is a statutory requirement to share certain personal information (e.g., some diseases require mandatory notification)
• During the course of providing medical services, through eTP, My Health Record (e.g., via Shared Health Summary, Event Summary)
• Only people who need to access your information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, the practice will not share personal information with any third party without your consent

We will not share your personal information with anyone outside Australia (unless under exceptional circumstances that are permitted by law) without your consent.

If consent is granted, it will be sent encrypted to protect privacy.

Only information that is specifically asked for will be shared.

The practice will not use your personal information for marketing any of the goods or services directly to you without your express consent. If you do consent, you may opt out of direct marketing at any time by notifying us in writing.

The practice may use your personal information to improve the quality of the services we offer to patients through research and analysis of the patient data.

We may provide de-identified data to other organizations to improve population health outcomes. The information is secure, patients cannot be identified, and the information is stored within Australia. You can let the reception staff know if you do not want your information included.

Your personal information may be stored at the practice in various forms.
Refer to RACGP – Privacy & Managing Health information in General Practice.
Best Practice Medical Software and Automed, incorporating Cubiko.

• Our Practice will not collect health information unless the patient consents and the information is reasonably necessary for the delivery of their health care services
• Our Practice will collect personal information only by lawful and fair means, without being unreasonably intrusive or using methods of intimidation

Consent is not required where:

• The health information is collected in accordance with the law or rules established by competent health or medical bodies
• Consent is not required where it is unreasonable to seek it and the collection is necessary to lessen or prevent a serious threat to the life, health, or safety of an individual or public
• Unsolicited information received without asking must be destroyed unless your practice would originally have lawfully collected that information

Our practice stores all personal information securely:

• Password protected documents for all files
• File hosting storage services – Jose Health IT
• Encryption software
• Communication via a secure website portal
• Secure message delivery (SMD)
• Availability of these functions:
• Best Practice software procedures text or other documents, offers password protection of those documents
• Digital business kits available at www.racgp.org/digitalbusiness-kit/cloud-computing/

You have the right to request access to, and correction of, your personal information.

The practice acknowledges patients may request access to their medical records. We require you to put this request in writing to rmcreception@nillmc.com.au and the practice will respond within a reasonable time.

30 days is considered reasonable. Research Medical Centre will ensure we have your medical information uploaded and transferred to your requesting address within 30 days.

This Medical Centre has a $25 transfer of medical information fee. This will be invoiced to you upon receiving your request.

This practice will take reasonable steps to correct your personal information where the information is not accurate or up to date. From time to time, we will ask you to verify that your personal information held by the practice is correct and current. You may also request that we correct or update your information, and you should make such requests in writing to nmcreception@nillmc.com.au

We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing. We will then attempt to resolve it in accordance with the resolution procedure.

Please contact: Renee Dimech (Practice Manager) via email, or Anne Marie
Boulton via email, or alternatively contact the clinic: (03) 9430 8888

Practice Address: 1078 Main Rd, Eltham.

We will respond to your letter of complaint within 10 business days.

You may also contact the OAIC. The OAIC will require you to give them time to respond before they investigate. For further information visit www.oaic.gov.au or call the OAIC on 1300 363 992. You could also provide details to contact your relevant state or territory health authorities/ombudsman if they also have authority.

We only collect personal information via the website which is then encrypted via Automed and protected in the same manner as the storage of medical information policy.

This Medical Centre will review all feedback, monitoring, data collection & analysis that inform the nature, extent & outcome of the review.

The management & leadership team within the practice will ensure that all risk analysis of reviews is measured with an evidence-based outcome & primary healthcare.

When the practices amend the policies, this will be shown via patient information leaflets and the website.

If information is shared via telehealth consultation, it is the practice that the doctor must conduct the consultation in a private space, i.e., a consulting room or remote location where no one else can hear the conversation.

The doctor will also request from the patient with whom the telehealth consult is with that they are also in a private space. If the patient requests another person to be present, the doctor will ask who else is present in the conversation and this third person will be documented in the patient’s notes, as the patient has given consent for their presence.

The Privacy policy template for general practices is intended for use as a guide of a general nature only and may or may not be relevant to particular practices or circumstances. The Royal Australian College of General Practitioners (RACGP) has used its best endeavours to ensure the template is adapted for general practice to address current and anticipated future privacy requirements. Persons adopting or implementing its procedures or recommendations should exercise their own independent skill or judgement, or seek appropriate professional advice. While the template is directed to general practice, it does not ensure compliance with any privacy laws, and cannot of itself guarantee discharge of the duty of care owed to patients. Accordingly, the RACGP disclaims all liability (including negligence) to any users of the information contained in this template for any loss or damage (consequential or otherwise), cost or expense incurred or arising by reason of reliance on the template in any manner.