Privacy Policy - Gosford Doctors

Contents

What is in this policy.

About this policy

Gosford Doctors (“the practice”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal information we hold about our patients, their carers, visitors to the clinic and users of this website.

We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles made under it and, because we provide health services in New South Wales, by the Health Records and Information Privacy Act 2002 (NSW) and the fifteen Health Privacy Principles it contains. Where the two sets of rules differ, we apply the one that gives you the greater protection.

This policy covers information collected during consultations and procedures, at reception, over the phone, through our online booking system, through this website, and from the other health services involved in your care.

Privacy contact

The Practice Manager
Gosford Doctors
Shop 12, 297–299 Brisbane Water Drive, West Gosford NSW 2250
Phone: (02) 4311 3800
Email: info@gosforddoctors.com.au

Consent

When you register as a patient, you consent to our GPs, nurse and administrative staff collecting and using your personal information so that they can provide you with health care. Only the staff who need to see your information in order to do their job have access to it.

If we want to use your information for a purpose that is not directly related to your care, we will ask you first. You can withdraw or limit that consent at any time by telling reception or your GP, and doing so will not affect the care you receive.

In a small number of situations the law allows or requires us to collect, use or disclose your information without your consent. Those situations are set out under When, why and with whom we share it.

Health records

What is a patient health record?

Your health record is the collection of information the practice holds about your health care. It exists so that whoever is treating you has the right information in front of them, both now and years from now. A record typically contains:

Your medical history, including past conditions, procedures and immunisations
The reason for each visit and the clinical notes made at the time
Examination findings, observations and measurements
Test and imaging requests, and the results that come back
Allergies and adverse reactions
Current and past medicines, including prescriptions issued
Referrals to, and letters from, specialists and other health services
Care plans, reviews and recalls

Keeping this record complete and accurate is part of providing safe care, and health service providers in New South Wales are required to keep it under the Health Records and Information Privacy Act 2002 (NSW).

Definitions

What is personal information?

Personal information is any information or opinion from which you can reasonably be identified. It includes your name, date of birth, address, phone number, email address, occupation, Medicare number and payment details, whether or not the information is true and whether or not it is recorded in a material form.

Definitions

What is sensitive information?

Sensitive information is a subset of personal information that attracts stronger protection under the law. Health information is sensitive information. So are details of your racial or ethnic origin, religious beliefs, sexual orientation and criminal record, where those are relevant to your care.

Throughout the rest of this policy we use “personal information” to mean both personal and sensitive information.

What we hold

What information we collect

Identifying and administrative information

Name, date of birth, gender and pronouns if you tell us
Residential address, phone numbers and email address
Emergency contact, next of kin, and carer or guardian details
Medicare card number, and DVA, pension or concession card details
Individual Healthcare Identifier
Private health insurance details, where relevant
Billing and payment records
Appointment history, including cancellations and non-attendance

Health information

Medical, family and social history
Presenting symptoms and clinical notes
Diagnoses, care plans and reviews
Medicines, prescriptions and repeat authorisations
Allergies and adverse drug reactions
Pathology and diagnostic imaging results
Immunisation history, including records held on the Australian Immunisation Register
Correspondence with specialists, hospitals and allied health providers

Other information

Enquiries you send us through the website or by email
Feedback, compliments and complaints
Information needed to meet a legal or reporting obligation

Clinical images

Clinical images and records

In the course of your care we may take clinical photographs, ECG tracings, spirometry traces or other records of examinations and procedures. These form part of your health record, are stored in the same secure clinical system, and are used for your diagnosis, treatment and ongoing care.

Images are never used in our advertising

We do not use identifiable patient photographs, clinical images or before-and-after imagery in any advertising or promotional material.

We also do not publish patient testimonials or reviews about clinical care, and we do not ask patients for them. Section 133 of the Health Practitioner Regulation National Law (NSW) prohibits the use of testimonials in advertising a regulated health service, and prohibits advertising that is false or misleading, that creates an unreasonable expectation of benefit, or that encourages the unnecessary use of health services. That restriction applies whether or not a patient has given consent.

If we ever wish to use a de-identified image for teaching or quality-improvement purposes, we will seek your specific written consent first, and you are free to decline.

How we collect

How we collect your information

Wherever it is reasonable and practicable to do so, we collect your personal information directly from you — on a registration form, during a consultation, over the phone, or through our online booking system.

Sometimes that is not practicable. In those cases we may collect it from:

Your parent, guardian, carer or an authorised representative
Other health services involved in your care, such as specialists, hospitals, allied health providers, community health services, pathology and imaging providers
Your previous general practice, where you have asked for your records to be transferred
Medicare, the Department of Veterans’ Affairs, the Australian Immunisation Register or your health fund, where this is needed for your care or for billing
My Health Record, where you have one and have not restricted access

Incomplete information

If we cannot collect your information

You do not have to give us the information we ask for. However, if you choose not to, we may not be able to provide the service you have asked for, and your GP may be working from an incomplete picture, which can affect the safety and accuracy of the care you receive. Your GP will tell you if that is the case at the time.

Anonymity

Dealing with us anonymously

You have the right to deal with us anonymously or under a pseudonym where it is lawful and practicable. In general practice it is rarely practicable, because we need to identify you correctly to keep an accurate record, to prescribe safely, and to claim a Medicare benefit on your behalf. If this matters to you, raise it with reception and we will explain what is possible.

Purpose

Why we collect your information

We collect, hold and use your personal information in order to:

Provide you with medical care, and assess, diagnose and treat you
Keep an accurate and complete health record
Coordinate your care with other health services
Manage appointments, recalls and reminders
Issue prescriptions, referrals, requests and certificates
Bill for services and claim Medicare and health fund benefits
Meet our legal, regulatory, accreditation and professional obligations
Manage enquiries, feedback and complaints
Review and improve the quality and safety of the care we provide, using de-identified information wherever possible

We only collect what is reasonably necessary for these purposes.

Telehealth

Telehealth consultations

Where a consultation happens by phone or video, the information discussed is recorded in your health record in exactly the same way as an in-person visit, and is protected in the same way.

We take reasonable steps to conduct telehealth consultations securely and privately. We do not record the audio or video of a telehealth consultation. Please bear in mind that we cannot control the privacy of the space you are calling from, so choose somewhere you can speak freely.

Security

How we store and protect your information

Your health record is held electronically in a clinical information system. A small amount of paper correspondence may be received; it is scanned into that system and then securely destroyed.

Our security measures include:

Individual logins and passwords, with access limited to the staff who need it for their role
Automatic screen locking on unattended computers
Encrypted, regularly tested backups held securely off site
Firewalls, antivirus software and applied security updates
Secure messaging for correspondence with other health providers
Physical security of the premises, and secure destruction of any paper records
Confidentiality agreements signed by every staff member and contractor
Privacy and information-security training for staff, and a documented business continuity plan

Please keep your contact details up to date with reception. Out-of-date details are one of the more common reasons a result or a recall does not reach the person it is meant for.

Retention

How long we keep your records

We are required to keep your health record for a minimum period set by the Health Records and Information Privacy Act 2002 (NSW):

If you were an adult at your last visit — for at least seven years from the last occasion on which we provided a health service to you
If you were under 18 at your last visit — until you turn 25

When information is no longer needed and the retention period has passed, it is destroyed or de-identified securely. If your records are transferred to another practice at your request, we keep a note of where and when they were sent.

Disclosure

We share only what is necessary, and only with those who need it. Your information may be disclosed:

To other health services involved in your care — specialists, hospitals, allied health providers, pathology and diagnostic imaging providers, and after-hours or locum services
To Medicare, the Department of Veterans’ Affairs or your health fund, for claiming and billing
To the Australian Immunisation Register, as required for immunisations we give
To your nominated carer, guardian or authorised representative, with your consent or where the law allows it
To contracted service providers who support the practice — our clinical software provider, IT support, secure backup and hosting, our online booking provider and our accountant — all of whom are bound by confidentiality obligations and by the Australian Privacy Principles
Where it is required or authorised by law, for example a court subpoena or a search warrant
Where certain conditions must be notified to NSW Health under the Public Health Act 2010 (NSW), or where a mandatory report must be made to the Department of Communities and Justice about a child at risk of significant harm
Where it is necessary to lessen or prevent a serious threat to someone’s life, health or safety, or to public health or safety, and it is not practicable to get your consent first
To assist in locating a missing person, or to establish, exercise or defend a legal claim

Other than as described above, we will not share your personal information with a third party without your consent. We do not sell, rent or trade personal information, and we do not disclose it for marketing by anyone else.

My Health Record

My Health Record and healthcare identifiers

If you have a My Health Record, your GP may upload a shared health summary or event summary to it, and may view what is already there, as part of providing your care. You control your My Health Record — you can set access controls, remove documents or cancel the record entirely through myGov, or by calling the My Health Record help line on 1800 723 471.

We also use Individual Healthcare Identifiers, assigned under the Healthcare Identifiers Act 2010 (Cth), to make sure the right record is matched to the right person.

Website

Our website, online booking and analytics

When you visit this website we may collect technical information such as your IP address, browser and device type, the pages you viewed, and the date and time of your visit. This is used to keep the site working, to understand which information people are looking for, and to protect the site from misuse.

Where you book an appointment online, that booking is handled by our third-party booking provider under its own privacy policy, and the details come through to our clinical system. Where you send us an enquiry by email or through a form, we use it to respond to you and, if it relates to your care, we record it in your health record.

Email is not a secure medium. Please do not send clinical details, results or anything sensitive by email — ring reception instead. Our website may link to other sites, and we are not responsible for the privacy practices of those sites.

Communications

Reminders and health communications

With your consent, we may contact you by SMS, email, phone or post about matters relating to your care, including:

Appointment reminders and confirmations
Results that need to be discussed, and requests to make an appointment
Recalls and reminders for preventive health, screening, immunisation or a care plan review
Practice information, such as a change to our opening hours

You can opt out of reminders at any time by telling reception, replying to an SMS as directed, or writing to us. If you opt out, we will still contact you where we need to about something clinically important, and you may not receive reminders for screening or immunisation that would otherwise have been sent to you.

We do not use your health information to send you advertising, and we do not provide your details to anyone else for marketing purposes.

Your rights

Accessing and correcting your information

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete or misleading.

Please put your request in writing and address it to the Practice Manager, either by post to Shop 12, 297–299 Brisbane Water Drive, West Gosford NSW 2250, or by email to info@gosforddoctors.com.au. We will ask you for proof of identity before releasing anything.

Timeframes and fees

We will respond within 45 calendar days of receiving your request, as required under the Health Records and Information Privacy Act 2002 (NSW). A reasonable administrative fee may apply for providing copies; we will tell you what it is before we do the work. There is no fee for making the request, or for asking for a correction.

There are limited circumstances in which we may refuse access — for example where giving access would pose a serious threat to someone’s life or health, would unreasonably affect another person’s privacy, or where we are prevented by law. If that happens we will tell you in writing, give our reasons, and explain how you can have that decision reviewed.

If we do not agree that a correction is warranted, you may ask us to attach a statement of your view to the record, and we will do so.

Complaints

Making a privacy complaint

If you are concerned about how we have handled your personal information, please tell us first — most concerns can be sorted out quickly. Put your complaint in writing and address it to the Practice Manager at the details above. We will acknowledge it, investigate, and respond within 45 calendar days.

If you are not satisfied with our response, or you would rather go elsewhere, you can contact:

Information and Privacy Commission NSW — the NSW Privacy Commissioner handles complaints under the Health Records and Information Privacy Act 2002 (NSW). Phone 1800 472 679, email ipcinfo@ipc.nsw.gov.au, or visit ipc.nsw.gov.au
Office of the Australian Information Commissioner — handles complaints under the Privacy Act 1988 (Cth). Phone 1300 363 992 or visit oaic.gov.au
Health Care Complaints Commission — for complaints about the health care itself rather than privacy. Phone 1800 043 159 or visit hccc.nsw.gov.au

These bodies will usually expect you to have raised the matter with us first, and to have given us a reasonable chance to respond.

Data breaches

If personal information we hold is lost, or is accessed or disclosed without authorisation, we will act immediately to contain the incident and assess what has happened.

Where a breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). We will tell you what happened, what information was involved, and what you can do about it.

Overseas

Information sent or stored overseas

We do not routinely disclose personal information to recipients overseas. Some of the software and cloud services we rely on may store or process data on servers located outside Australia. Where that is the case, we take reasonable steps to satisfy ourselves that the provider handles the information in a way consistent with the Australian Privacy Principles.

If your care requires us to send information to a health provider overseas — for example if you are moving abroad and want your records transferred — we will ask for your consent first.

Updates

Changes to this policy

We review this policy regularly and may update it to reflect changes in the law, in technology, or in how the practice operates. The current version is always available on this page, and the version number and review date are shown at the top.

Contact

Contacting us

If you have a question about this policy, want to see or correct your record, or wish to raise a privacy concern, please contact the Practice Manager. We treat every request confidentially and will aim to resolve it promptly.

Gosford Doctors

Shop 12, 297–299 Brisbane Water Drive, West Gosford NSW 2250
Phone: (02) 4311 3800
Fax: (02) 4317 5595
Email: info@gosforddoctors.com.au
Open Monday to Friday, 8:30am – 5:00pm. Closed weekends and NSW public holidays.

In an emergency, call 000. Outside our hours, call Healthdirect on 1800 022 222, or go to Gosford Hospital, 75 Holden Street, Gosford — (02) 4320 2111.