As an Australian-based organisation, any data and information collected is held, used and disclosed in accordance with the Privacy Act 1988.

The information we collect about a patient can include medical details, family information, name, address, employment and other demographic data, past medical and social history, current health issues and future medical care, Medicare number, accounts details, and any health information such as a medical or personal opinion about a person’s health, disability or health status.

For each patient we have an individual patient health record containing all clinical information held by our practice relating to that patient. Our practice ensures the protection of all information contained within these files.

Our general practitioners, clinical and allied health team members and all other staff and contractors associated with this practice have a responsibility to maintain the privacy of personal health information and related financial information; the privacy of this information is every patient’s right.

The maintenance of privacy requires that any information regarding individual patients (including practice team members who may be patients) may not be disclosed either verbally, in writing or by copying it either at the practice or outside it, during or outside normal opening hours, except for strictly authorised use within the patient care context at the practice or as legally directed.

There are no degrees of privacy. All patient information must be considered private and confidential, even that which is seen or heard and therefore must not to be disclosed to family, friends, members of the practice team not involved in that patient’s care, or any other people without the patient’s approval.

In the event that a data breach does occur, our practice complies with the Office of the Australian Information Commissioner’s (OAIC) Notifiable Data Breach (NBD) Scheme where notification must be made where the breach is deemed ‘eligible’ for notification.

An eligible data breach is when there is evidence of unauthorised access, unauthorised disclosure, or loss of personal health information; the breach is likely to result in serious harm to one or more individuals; and the practice has not been able to prevent the risk of harm through remedial actions.

If all three of these criteria are filled, Apollo Medical & Skin Clinic reports the breach to the OAIC using the Notifiable Data Breach Form available from their website. We then ensure we have notified any patients or personnel affected by the breach, as well as our medical indemnity insurer and all practice GPs’ personal insurance providers.

For breaches relating to My Health Record, the Australian Digital Health Agency will also need to be notified in addition to the notification made to the OAIC.

Personal health information is kept where only those with authorisation can access it, and is kept out of view of and unable to be accessed by the public. To minimise this risk, automated screensavers are activated on all computer screens.

Members of the practice team have different levels of access to patient personal health information as appropriate to their roles and, to maintain security all computer hardware and software passwords are kept confidential and are not disclosed to others.

Any team members positioned in the practice common areas are to avoid discussing confidential and sensitive patient information in these areas.

Whenever sensitive documentation is to be discarded, our practice uses an appropriate method of destruction in a confidential document bin which is collected and shredded by Cleanaway.

Email communications with other healthcare providers is undertaken securely through the use of encryption.

Where patient information is sent by post, the use of secure postage or a courier service is determined on a case-by-case basis.

Incoming patient correspondence and diagnostic results are opened and viewed only by a designated practice team member.

Items for collection or postage are left in a secure area not in view of the public.

Facsimile, printers and other electronic communication devices in the practice are located in areas that are only accessible to the general practitioners and other authorised team members. Faxing is point to point and will, therefore, usually only be transmitted to one location.

All facsimiles containing confidential information are sent only after ensuring the facsimile number dialled is the designated receiver before pressing ‘Send’.

Details of confidential information sent by facsimile are recorded in a designated logbook which incorporates the date of transmission, patient name, description of the contents and the designated receiver (name and facsimile number).

Patient privacy and security of information is maximised during consultations by closing the consulting room doors. When the consulting, treatment room or administration office doors are closed, practice team members must ensure they knock and wait for a response prior to entering.

It is the general practitioner/clinical team member’s responsibility to ensure that prescription paper, patient health records and related personal information is kept secure if they leave their room during a consultation or treatment, or whenever they are not in attendance in the consulting/treatment room.

The physical health records and related information created and maintained for the continuing management of each patient are the property of this practice. Requests for access to a patient’s health record will be acted upon only if the request is received in written format.

Both active and inactive patient health records are kept and stored securely.

Our practice has systems in place to protect the privacy, security, quality and integrity of the personal health information held electronically.

Members of the practice team have different levels of access to personal patient health information as appropriate to their roles; and to maintain security, all computer hardware and software passwords are kept confidential and are not disclosed to others.

Our general practitioners and other clinical team members, including locums, are made aware of and ensure that a record is to be made for every consultation in computerised health record system. Our general practitioners ensure that all allergy information and medication details are recorded only in the computerised patient health record.