Privacy Policy

This Privacy Policy sets out how Murray House Clinic manages personal information (including health information) provided to or collected by it.

Murray House Clinic is bound by the Australian Privacy Principles (APPs) contained in the Commonwealth Privacy Act. In relation to health records, Murray House Clinic may also be bound by State specific legislation.

The 13 APPs provide a privacy framework that regulates the manner in which Murray House Clinic collects, stores, uses and allows information about an individual to be accessed and where necessary corrected. Information that is regulated by these APPs may be in a paper based or digital format.

Murray House Clinic may, from time to time, review and update this Privacy Policy to take account of new laws and technology, changes to Murray House Clinic ’s operations and practices and to make sure it remains appropriate to the services it provides.

Definitions

In this policy we use a number of terms, contained within the Privacy Act, which are explained here:

-‘personal information’ this is ‘information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion’. Essentially, personal information is any information or an opinion that identifies a person (notably there is no definition of person and it is unclear whether the Act applies to deceased or only living persons).

-‘sensitive information’ is a type of personal information that is given extra protection and must be treated with additional care. It includes any information or opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record. It also includes health information and biometric information.

-‘Health information’ is a subset of sensitive information. It is any information or opinion about the health or disability of an individual, the individual’s expressed wishes about the future provision of health services and a health service provided, currently or in the future, to an individual that is also personal information. Health information also includes personal information collected in the course of providing a health service.

-A ‘record’ includes a ‘document’ or an ‘electronic or other device’ where there is writing, anything from which sounds, images or writings can be reproduced.

Our procedures

Murray House Clinic will ensure each of the following:

That this policy is available, free of charge, to any individual where requested;
That our staff are aware of our obligations under the APP’s;
That our staff comply with the AAP obligations through the implementation of the appropriate systems, processes and procedures;
That our staff appropriately respond to questions or inquiries regarding information collected by us;
That we collect information only for the primary purpose of managing the individual’s healthcare requirements, including the management of financial claims and payments associated with those health care services.

Our staff are responsible for ensuring that each individual is aware of the following:

The information that has been collected or is to be collected and why;
How that information will be used and disclosed;
When the individuals consent will be needed and why;
How the individual can access and have their information corrected;
How the individual can make a complaint; and
When requested provide you with a copy of this policy

When collecting information Murray House Clinic will seek a client’s consent to do so, and if necessary it may seek their consent should they wish to use the information for a purpose other than that contained in the original consent process.

What kinds of personal information does Murray House Clinic collect and hold? How does Murray House Clinic collect it?

The type of information Murray House Clinic collects and holds includes (but is not limited to) personal information, including health and other sensitive information, about:

The client whether collected before, during and after the course of treatment provided to, or received by them, at Murray House Clinic ;
A client’s name, address and contact details, their Medicare number or some other number or code that helps in Identifying the client or claiming payments (e.g. the clients health insurance number);

A specific health care identifier such as a medical record number;
The client’s medical history, including medical information, allergies, medications, immunisations, social history, family history, risk factors and previous incidents or adverse events.

Murray House Clinic evaluates all unsolicited information it receives to decide if it should be kept, acted on or destroyed.

Personal Information the Client Provides

Murray House Clinic will generally collect personal information, whether in a paper based or electronic form, held about an individual by way of the following:

Forms filled out by the client, or if appropriate their parents or care givers,
Face-to-face consultations, emails and telephone calls.
Personal information provided, on occasions, by people other than the client, their parent or care giver.
Paper based records, electronic records or even images such as X-rays, scans,  -photos of the client or videos. In some cases even an audio recording may contain information about the client.

Personal Information provided by other people

In some circumstances Murray House Clinic may be provided with personal information about an individual from a third party, for example a report provided by a medical professional or a reference from another clinic.

The Procedure for collecting information at Murray House Clinic:

1. When a client arrives at Murray House Clinic, whether for the first or subsequent visits the staff will collect or confirm a patients’ personal and demographic information. Clients who attend for the first time are encouraged to read the collection statement within the form and where necessary ask questions about the management of collected information and patient privacy.
2. When the client is being provided a service by Murray House Clinic, the healthcare practitioners will collect further personal information during the consultation.
3. Personal information may also be collected from the patient’s guardian or responsible person (where practicable and necessary), or from any other healthcare practitioner that has been involved in the patient’s care.
Murray House Clinic will then store all personal information securely, whether in electronic or paper based format, in protected information systems or in hard copy format in a secured environment.

How will Murray House Clinic use the personal information you provide?

The personal information the Client provides will only be used for the purpose of providing health care services and for claims and payments, unless otherwise consented to by the patient.

Murray House Clinic may disclose personal information to other health care professionals where we request services for you such as x-rays, pathology tests etc. or where we ask them to provide you with a health care service, such as specialist opinion.

On occasions Murray House Clinic is required by the law to disclose certain personal information about a patient, such as the notification of certain diseases, and in such a circumstance Murray House Clinic will discuss this with the Client.

Murray House Clinic may make use of the Personally Controlled Electronic Health Record (‘PCEHR’) system and electronic prescription systems such as eTP. When such systems are used your personal information may be collected, held or disclosed through those systems in accordance with this Privacy Policy.

Murray House Clinic may disclose personal information to parties we engage for business related purposes. This might include assessing us for accreditation, or providing information technology services. These parties are required to comply with this policy.

Murray House Clinic does not disclose information to any individual or group outside of Australia unless consent to do so has been provided by the Client.

In general terms Murray House Clinic will not disclose personal information to any third party other than in the course of providing medical services, without first providing you with the reason for the information being transferred and having received your consent to do so.

There are however, times where Murray House Clinic is permitted to disclose information about an individual without their consent, including where the information is:

Required by law
Necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
To assist in locating a missing person
To establish, exercise or defend an equitable claim
For the purpose of a confidential dispute resolution process.

Management and security of personal information

Murray House Clinic’s staff are required to respect the confidentiality of patient’s personal information and the privacy of individuals.

Murray House Clinic has in place steps to protect the personal information Murray House Clinic holds from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and password access rights to computerised records.

Marketing

Murray House Clinic will not use any personal information in relation to direct marketing to a patient without that patient’s express consent. Patients may opt-out of direct marketing at any time by notifying the Practice in a letter or email.

Access and correction of personal information

An individual has the right to obtain access to any personal information which Murray House Clinic holds about them and to advise Murray House Clinic of any perceived inaccuracy.

There are some exceptions to these rights set out in the applicable legislation.

Murray House Clinic will take reasonable steps to correct personal information where it is satisfied they are not accurate or up to date. From time to time, Murray House Clinic will ask patients to verify the personal information held by the Practice is correct and up to date. Patients may also request the Practice to correct or update their information, and patients should make such requests in writing.

To make a request to access or update any personal information Murray House Clinic holds about you please contact the Practice Manager in writing at the address printed at the end of this policy. Murray House Clinic will respond within a reasonable timeframe.

Murray House Clinic may require you to verify your identity and specify what information you require. Murray House Clinic may charge a fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, Murray House Clinic will advise the likely cost in advance. If we cannot provide you with access to that information, we will provide you with written notice explaining the reasons for refusal.

When making a request to access your personal information held by Murray House Clinic you should be aware that there will be occasions when access to this information is denied. Such occasions would include where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of Murray House Clinic’s duty of care to you as our client.

Enquiries and complaints

If you would like further information about the way Murray House Clinic manages the personal information it holds, or wish to complain that you believe that Murray House Clinic has breached the Australian Privacy Principles please make a written complaint to the Practice Manager at the address printed at the end of this policy. Murray House Clinic will investigate every complaint and will respond within a reasonable time. If appropriate, you may receive updates during the investigation. If you are not satisfied with the response that you have received from Murray House Clinic , you may wish to discuss the matter with the Office of the Australian Information Commissioner by telephoning 1300 363 992 or sending an email to enquiries@oaic.gov.au.