Yourprivacy.

Warwick Doctors ("the practice", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of the personal information we hold about our patients, their carers, visitors to the clinic and users of this website.

As a private general practice in Queensland, we are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles made under it. We also follow the privacy requirements in the RACGP Standards for general practices, and the confidentiality obligations that apply to every registered health practitioner under the Health Practitioner Regulation National Law.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It applies to everyone who works at or for the practice: doctors, nurses, reception and administrative staff, practice management, contractors, students on placement and our IT providers.

When you register as a patient, you consent for our doctors and staff to access and use your personal health information so they can provide you with care. Only staff who need to see your record to do their job can access it.

That consent covers the routine business of running a general practice: making appointments, taking a history, ordering tests, writing referrals and prescriptions, billing Medicare, and recalling you when a result needs following up.

When we ask again

We will ask for your consent separately, and record it, when the use goes beyond your direct care, including:

• Releasing your record to an insurer, an employer, a solicitor or any other third party
• Preparing a report for a legal, insurance or employment purpose
• Sending your information to a doctor outside your usual care team who is not involved in treating you
• Using any clinical photograph for teaching or quality improvement
• Supplying de-identified data to a research or quality improvement project

Withdrawing consent

You can withdraw your consent at any time by telling any member of our team, in person, by phone or in writing. Withdrawing consent does not affect anything already lawfully done, and it does not remove records we are required to keep. If a withdrawal would affect your care, a doctor will explain how before it takes effect.

Children and young people. A parent or guardian usually consents on behalf of a child. As young people mature, a doctor will assess whether they are able to consent for themselves. From that point their consultations and records are treated confidentially, in the same way as an adult’s, subject to the safety exceptions set out below.

Your patient health record is the complete file the practice holds about you. It is a clinical and legal document, and it allows any doctor at the practice to care for you safely when your usual doctor is away. It typically contains:

• Your demographic and contact details
• Notes made at each consultation, including the reason for the visit, examination findings, the doctor’s clinical reasoning and the plan
• Your medical history, family history, allergies and adverse reactions
• Current and past medicines and prescriptions issued
• Immunisation history
• Pathology and imaging results, and correspondence from specialists and hospitals
• Referrals, care plans, health assessments and medical certificates
• Records of phone calls, telehealth consultations, recalls and reminders
• Billing and Medicare claiming records

The physical or electronic record is the property of the practice. The information within it is about you, and you have a right of access to it, explained in the section on accessing and correcting your information.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is written down.

At the practice this includes your name, date of birth, address, phone number, email address, Medicare number, DVA number, concession card details, private health fund details, emergency contact and next of kin, and your billing history.

It also covers information that identifies you indirectly. A combination of details that would let someone work out who you are, such as an unusual condition together with a town and an age, is still personal information, and we treat it that way.

Sensitive information is a subset of personal information that carries a higher risk of harm if mishandled, so the law gives it extra protection. It includes information about your health, and also about your racial or ethnic origin, religious beliefs, sexual orientation, criminal record, and membership of a professional or trade association.

Nearly everything in a general practice record is sensitive information. We may only collect it with your consent and where it is reasonably necessary for our work, and we may only use or disclose it for the purpose it was collected for, or a directly related purpose you would reasonably expect, unless the law requires or permits otherwise.

In practice, this means your health information is not shared with family members, employers, insurers or anyone else without your consent, other than in the limited circumstances described in the section on sharing your information.

We collect and hold the information we need to provide safe, continuous care and to run the practice. Depending on your circumstances, this may include:

Identity and contact information

• Name, date of birth, gender, address, phone numbers and email address
• Next of kin, emergency contact, and the details of a carer, guardian or nominated representative
• Aboriginal or Torres Strait Islander status, where you choose to tell us, so we can offer the health assessments and programs you are eligible for. You are never required to answer
• Preferred language and whether you need an interpreter

Financial and entitlement information

• Medicare card number and individual reference number
• DVA, pensioner concession, Health Care Card or Commonwealth Seniors Health Card details
• Private health fund details, where relevant
• Account and payment records

Clinical information

• Presenting problems, symptoms, history and examination findings
• Diagnoses, clinical opinions and management plans
• Medicines, allergies and adverse drug reactions
• Immunisation records, including those reported to the Australian Immunisation Register
• Pathology, imaging and other test results, including results from 4Cyte Pathology collected at the clinic
• Specialist letters, hospital discharge summaries and allied health reports
• Family and social history relevant to your care

Practice administration

• Appointment history, including attendance and non-attendance
• Records of phone calls and messages relating to your care
• Correspondence between you and the practice
• Feedback and complaints you have made

We do not collect information we do not need.

A doctor may take a photograph as part of your care, most commonly of a skin lesion, a wound being monitored, or a rash. Clinical images are part of your health record and are protected in the same way as your written notes. Where a clinical image is taken:

• The doctor will explain why, and ask for your consent first
• The image is taken on practice equipment or a practice-managed device and stored directly in your record
• Images are not stored in a personal camera roll, and are not sent by ordinary text message or personal email
• Where an image needs to go to a specialist, it is sent through secure clinical messaging

We will not use a clinical photograph for teaching, publication, quality improvement or any promotional purpose without asking you separately and recording your consent. You can decline, and it will not affect your care.

Recording in the consultation room. Please ask before recording audio or video of a consultation. Recordings that capture other patients or staff are not permitted anywhere in the practice.

Wherever reasonable and practical, we collect personal information directly from you, for example when you:

• Complete a new patient registration form, in the clinic or online through HotDoc
• Book an appointment in person, by phone on (07) 4527 1070, or through HotDoc
• Talk to a doctor or nurse during a consultation, in person or by telehealth
• Provide or update your details at reception
• Contact us by phone or complete a form on this website

Collection from other sources

Sometimes we collect information about you from someone else, because it is necessary for your care and impractical to obtain directly from you, including:

• Another doctor or practice referring you, or transferring your record at your request
• Pathology and diagnostic imaging providers reporting results a doctor has ordered
• Specialists, hospitals, community health services and allied health practitioners involved in your care
• My Health Record, where you have one and have not restricted access
• The Australian Immunisation Register
• Medicare and the Department of Veterans’ Affairs, to confirm your eligibility
• A parent, guardian, carer or responsible person, where you cannot provide the information yourself

Where we receive information about you from a third party, we take reasonable steps to make sure you are aware of it and of this policy.

You are not obliged to give us any particular piece of information, but it helps to know the possible consequences. If we cannot collect the information a doctor needs:

• The doctor may not be able to reach a diagnosis, or may need to take a more cautious approach
• Prescribing may be unsafe, particularly where allergies, current medicines or past reactions are unknown
• We may not be able to bulk bill you, because Medicare and DVA claims need valid card details
• We may not be able to contact you about a result that needs acting on, or send you a recall
• We may be unable to write a referral, care plan or report that another organisation will accept

A doctor will tell you at the time if missing information is limiting what they can safely do, and you can then decide.

You can deal with us anonymously, or under a pseudonym, where it is lawful and practicable. For example, you can ask a general question about our services or fees without giving your name.

It is not practicable for a consultation. To provide clinical care we must be able to identify you, keep an accurate record, prescribe safely and match results to the right person. Medicare and DVA claiming also need your correct identity, so an anonymous consultation cannot be bulk billed.

If you have a particular concern about being identified, please raise it with our Practice Manager on (07) 4527 1070.

We collect your personal information to provide you with health care and to run the practice that provides it. We use it to:

• Assess, diagnose, treat and monitor your health, so any doctor at the practice can care for you safely
• Maintain an accurate and complete clinical record
• Communicate with other practitioners involved in your care, through referrals and reports
• Send you results, recalls and reminders about follow-up and preventive care
• Prescribe medicines safely
• Claim Medicare and DVA benefits on your behalf, and manage billing
• Meet our legal and regulatory obligations, including reporting notifiable conditions to Queensland Health
• Run internal quality improvement and clinical audit, using de-identified data wherever possible
• Train the doctors, nurses and students who work at the practice, with your consent
• Manage feedback, complaints and, if it ever arose, a legal claim

We do not sell your personal information. We do not use it for marketing by third parties, and we do not disclose it to advertisers or data brokers.

A telehealth consultation is a real consultation, and everything in this policy applies in the same way. When you have a telephone or video consultation with us:

• The doctor will confirm your identity at the start of the call
• The consultation is not recorded by the practice. The notes the doctor types are the record
• Video consultations use a platform intended for clinical use, with the connection encrypted in transit
• Prescriptions and referrals are sent electronically, to you or to a pharmacy you nominate
• The doctor takes reasonable steps to conduct the consultation from a private space

We cannot control the privacy of the space you are in, or the security of your network and device. If you can be overheard, tell the doctor and they can call back or arrange for you to come in. Telehealth is offered in some circumstances and is not suitable for every problem.

The practice holds patient records electronically in clinical software. Where paper records exist, they are held in a secure area that patients and visitors cannot access.

Technical measures

• Every user has an individual login. Accounts are not shared, and access is removed when someone leaves
• Access is set by role, so staff can reach only the information they need
• The clinical system keeps an audit log of who opened which record and when
• Data is encrypted in transit and backed up on a regular, tested schedule
• Practice computers are protected with current security updates and anti-malware
• Screens lock automatically and are positioned so they cannot be read from the waiting area
• Clinical information is exchanged with other providers through secure messaging, not ordinary email

People and process

• Every staff member signs a confidentiality agreement, and obligations continue after they leave
• Privacy and information security are covered in induction and ongoing training
• Contractors and IT providers are bound by written confidentiality obligations
• Records are destroyed securely once the retention period has passed

Email. Ordinary email is not a secure channel. We only send patient information by email if it is securely encrypted, and we do not send patient information to personal email addresses. We do not accept patient enquiries or requests by email. Please call the practice instead.

We keep your health record for a minimum period, in line with RACGP guidance and our professional obligations, and we do not destroy records simply because you have stopped attending.

• For an adult, we keep the record for at least seven years from the date of the last entry
• For a person who was under 18 at the time of the last entry, we keep the record until they turn 25

In some circumstances we keep records for longer, for example where a record is relevant to a legal claim, a coronial matter or a regulatory investigation. When a record reaches the end of its retention period it is destroyed securely, or de-identified.

If you move to another practice, we send a copy or summary to your new doctor at your request, and retain the original for the period above.

Your health information is confidential. We disclose it in the following circumstances, and not otherwise.

For your care, with your consent

• Specialists and other doctors we refer you to
• Pathology and diagnostic imaging providers carrying out tests a doctor has ordered, including 4Cyte Pathology
• Hospitals, community health services and after-hours services treating you
• Allied health practitioners, pharmacists and other members of your care team
• Your nominated carer, guardian or representative
• My Health Record, unless you have opted out or restricted access

To run the practice

• Our clinical software provider and IT support, under written confidentiality obligations
• Medicare, the Department of Veterans’ Affairs and your health fund, for claiming and billing
• Our accountants, auditors and insurers, on a limited and confidential basis
• Debt recovery, where an account remains unpaid, limited to the details necessary and never your clinical information

Where the law requires or permits it

• Notifiable condition reporting to Queensland Health
• Immunisations reported to the Australian Immunisation Register
• Mandatory reporting where a child is at risk of significant harm, under Queensland child protection law
• A subpoena, court order, search warrant or other legal requirement
• A serious threat to the life, health or safety of you or another person, where disclosure is necessary to lessen or prevent it
• Cancer registries and other statutory registers

Where we are required to disclose information, we release the minimum necessary, note it in your record, and tell you unless the law prevents us.

We do not discuss your care with family members without your consent, including a spouse, a parent of an adult child, or an adult child of an older parent. If you would like someone to speak with us on your behalf, tell us and we will record that authority on your file.

My Health Record is a national online summary of your key health information, operated by the Australian Digital Health Agency under the My Health Record Act 2012 (Cth).

Where you have a My Health Record and have not restricted access, our doctors may view it, and may upload a shared health summary or event summary after a consultation. You control your own My Health Record. Through myGov you can:

• Set access controls, including a code that limits which providers can view it
• Hide or remove individual documents
• See an audit log of every organisation that has accessed it
• Cancel the record entirely

Tell us if you would prefer that we do not upload information from your consultations, and we will record that preference.

Healthcare identifiers

Under the Healthcare Identifiers Act 2010 (Cth) you have an Individual Healthcare Identifier (IHI), a sixteen-digit number that helps make sure information is matched to the right person. We use it when sending and receiving clinical information electronically, and protect it in the same way as the rest of your record.

You can read every page of this website without telling us who you are. We do not require you to register, and we do not run advertising trackers or sell data about visitors.

What the site collects

• Standard server information logged with any web request: IP address, browser type, device type, the pages requested, and the date and time
• Aggregate analytics about how the site is used, which is not used to identify individual visitors
• Anything you choose to type into a form on the site and submit to us

Cookies

The site uses a small number of cookies to keep it working and to measure aggregate usage. You can block or delete cookies in your browser and the site will still work. We do not use cookies to build advertising profiles.

Online booking

Online booking is provided by HotDoc, a third-party platform. Details you enter are handled by HotDoc under its own privacy policy and terms, and then transferred into our clinical system. You can always book by phoning (07) 4527 1070 instead.

Links to other sites

We link to other organisations, such as healthdirect, Queensland Health or a support service, because the information is useful. We do not control those sites and are not responsible for their privacy practices.

Social media. If you contact us through a social media platform, that platform holds the message under its own terms. Please do not send clinical details, symptoms or images through social media. Call the practice on (07) 4527 1070.

With your consent, we may contact you to:

• Tell you a result needs discussing, and ask you to make an appointment
• Remind you that a test, review or immunisation is due, such as cervical screening, a care plan review or a vaccination
• Confirm or remind you about an upcoming appointment
• Let you know about a change to our hours, services or doctors

These messages are brief and do not include clinical detail, because we cannot be sure who else can see your phone or letterbox.

We contact you by SMS, phone, letter or email according to the preference on your file. You can change that preference, or opt out of reminders, by telling reception or calling (07) 4527 1070. Opting out will not affect your care, but it means we will not prompt you when something is due. We do not send commercial marketing.

You have a right to access the personal information we hold about you, and to ask us to correct it.

Asking for access

Please put your request in writing to the Privacy Officer, or ask reception for the request form. We will verify your identity before releasing anything, and respond within 30 days. In most cases we will provide a copy of your record, or a summary prepared by a doctor. A doctor will usually offer to go through it with you.

Fees

We do not charge for making a request. A reasonable administrative fee may apply for producing and copying a large record, and we will tell you the amount before we begin.

When access can be refused

We may refuse, in whole or in part, where:

• Giving access would pose a serious threat to the life, health or safety of you or another person
• It would have an unreasonable impact on someone else’s privacy
• The information relates to existing or anticipated legal proceedings
• The request is frivolous or vexatious, or the law otherwise permits refusal

If we refuse, we will tell you why in writing and explain how to complain.

Correcting your information

Tell us whenever your contact or Medicare details change. If you believe clinical information in your record is inaccurate, out of date, incomplete or misleading, ask us to correct it. Where a doctor does not agree, because a note records what was observed at the time, we will add a statement of your view to the file. We will tell you in writing either way.

Requests can be posted to the Privacy Officer, Warwick Doctors, 74–80 Albion St, Warwick QLD 4370, or discussed first by calling (07) 4527 1070.

Step one: talk to us

Raise your concern with our Practice Manager, in person, by calling (07) 4527 1070, or in writing to the Privacy Officer, Warwick Doctors, 74–80 Albion St, Warwick QLD 4370. We will acknowledge your complaint within seven days, investigate it, and give you a written response within 30 days. If it will take longer, we will tell you why. Complaining will not affect your care.

Step two: external bodies

• Office of the Australian Information Commissioner (OAIC), for complaints under the Privacy Act 1988 (Cth). Phone 1300 363 992 or visit oaic.gov.au
• Office of the Health Ombudsman (Queensland), for complaints about a health service or practitioner in Queensland. Phone 133 OHO (133 646) or visit oho.qld.gov.au

A data breach happens when personal information is lost, or accessed or disclosed without authorisation. We work to prevent breaches, and we have a written response plan. If we become aware of a suspected breach we will:

1. Contain it immediately
2. Assess what information was involved, whose, and what harm could follow
3. Take steps to reduce the harm and prevent a recurrence
4. Notify the people affected, and the regulator, where the law requires it

Under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth), where a breach is likely to result in serious harm, we must notify the affected individuals and the OAIC as soon as practicable.

It is our strong preference that clinical records stay in Australia. Some services a modern practice depends on, such as email filtering, secure backup, software support and appointment reminders, may store or process limited data outside Australia. Where that is the case:

• We take reasonable steps to ensure the provider handles the information consistently with the Australian Privacy Principles
• Confidentiality obligations are set out in our written agreement
• We prefer providers who store Australian health data in Australia

We do not otherwise disclose your health information to overseas recipients without your consent, except where the law requires it.

We review this policy regularly and update it when our practices, providers or the law change. The current version is always published on this page, with the review date shown at the top. A printed copy is available at reception, and we can provide it in large print or arrange for it to be explained through an interpreter.

If you have a question about this policy, please contact our Privacy Officer.

• Phone: (07) 4527 1070
• Post: Privacy Officer, Warwick Doctors, 74–80 Albion St, Warwick QLD 4370
• In person: ask at reception to speak with our Practice Manager

In an emergency, call 000. Do not use email, this website or social media to tell us about an urgent medical problem. For health advice any time, call healthdirect on 1800 022 222.