Policies and Practice Information

Email Policy Email can be used by a Practice to transmit information outside the Practice. Ideally communication should be via secure messaging or encryption but this is generally not possible when emailing patients. The Practice has an obligation to take reasonable steps to protect the privacy and security of information it holds including when it is transmitted or disclosed outside the organisation. The Practice follows the RACGP recommendations to reduce the risk of interception of data and sending emails to incorrect addresses, including: use of passwords for sensitive information verification of the patient’s email address obtaining patient consent & notation of this in the patient’s record use of secure messaging facilities between Practices where available Procedure Request for information to be sent via email If a patient requests information to be sent by email, the Practice: Explains to the patient that email is not a secure form of communication Seeks the patient’s consent to use email and asks the patient to provide the email address they would like the practice to use (in the same way the Practice asks for a contact phone number). make a notation in the patient’s records when consent was given and to what exact material they consent to be emailed. Notes that sensitive information will be sent by password-protected PDF Phones the patient to provide the password to open the PDF. The Practice should document the patient consent and maintain a record of information sent via email to the patient in accordance with the email policy. 5.4.1 Communication with patients via electronic means Policy Staff are mindful that even if patients have provided electronic contact details they may not be proficient in communicating via electronic means and patient choice should be obtained before using electronic communication Patients are able to obtain advice or information related to their care or appointment reminders by electronic means, where the doctor determines that a face-to-face consultation is unnecessary. Electronic communication includes email, fax, and SMS. Practice staff and doctors determine how they communicate electronically with patients, both receiving and sending messages. All significant electronic contact with patients is recorded in patient health records. Patients are informed of any costs incurred prior to electronic consultations. Practice staff and doctors should be aware of alternative modes of communication used by the disabled. Communication with patients via electronic means (e.g. email and Fax) is conducted with appropriate regard to the privacy Laws relating to health information and confidentiality of the patient’s health information. (Refer Section Privacy and Personal Health Information) Staff and Patients using email/SMS or other forms of electronic messaging should be aware that it is not possible to guarantee that electronic communications will be private. All personal health information or sensitive information sent by email must be securely encrypted. (Refer Section Privacy and Personal Health Information). When an email message is sent or received in the course of a person’s duties, that message is a business communication and therefore constitutes an official record. Internal or external parties, including patients, may send electronic messages. Messages from patients or those of clinical significance require a response to confirm receipt and should be documented in the patient medical record if appropriate. Employees should be aware that electronic communications could, depending on the technology, be forwarded, intercepted, printed and stored by others. Electronic mail is the equivalent of a postcard. Staff members have full accountability for emails sent in their name or held in their mailbox, and are expected to utilise this communication tool in an acceptable manner. This includes (but is not limited to): limiting the exchange of personal emails refraining from responding to unsolicited or unwanted emails deleting hoaxes or chain emails & contact IT for advice email attachments from unknown senders should not be opened virus checking all email attachments maintaining appropriate language within e-communications ensuring any personal opinions are clearly indicated as such confidential information (e.g. patient information) must be encrypted. The Practice reserves the right to check individual email as a precaution to fraud, viruses, workplace harassment or breaches of confidence by employees. Inappropriate use of the Email facility will be fully investigated and may be grounds for dismissal. The practice uses an email disclaimer notice on outgoing emails that are affiliated with the practice. This email message (and any attached files) is intended for the addressee named and may contain confidential or privileged information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and not necessarily the views of Torquay and Craignish Doctors. This email has been scanned for viruses but we cannot guarantee that either the message or attachments are free of viruses or other defects. Virus scanning is recommended and is the responsibility of the recipient. Please consider the environment before printing this e-mail.

PRACTICE POLICY STATEMENT This statement sets out the Hervey Bay and Craignish policies relating to the collection and use of personal information. Personal information is information about you and identifies you. Your personal information is important to us The Practice recognises that your privacy is very important to you and that you have a right to control your personal information. We know that providing personal information is an act of trust and we take that seriously. Unless you give us explicit consent to act otherwise, the following policy will govern how the Practice handles your personal information and safeguards your privacy. The Practice is committed to protecting your personal information and giving you choice in who can use your personal information and how it can be used. We believe that our privacy policy not only complies with relevant laws but also represents best practice. Collecting personal information about you If you are a patient, we collect personal information about you in order to provide you with the full benefits of health care. We collect information from you directly and also from time to time thereafter if you provide us with additional information. Once you are a patient, we maintain a health care record for you and a medical history with the Practice. Personal information is collected in a private setting and patient records are kept inaccessible to the public. Information is only released to third parties after a signed consent form. Even so disclosure is limited to that which is authorised or required. All research information collected by the Practice is done only when consent is given by the patient, and de-identified. Use of patient information for quality assurance and professional development is de-identified. Using and disclosing your personal information The Practice will not use or disclose any information about you without your consent unless: • Required by law • We believe it necessary to provide you with a service that you have requested • To implement our terms of use • To protect the rights or property of the Practice, any Practice user, or any member of the public. • To lessen a serious threat to a person’s health or safety. • In order to provide some services to patients, the Practice may be required to provide Patients contact details to third party suppliers of services. The Practice provides the opportunity for you to opt-out of such third party arrangements. If any Patient does not want their contact details passed onto third parties for the purposes of health care, please contact Torquay Doctors on 4125 2422. Any medical students attending the Practice has limited or no access to personal records, only with permission of patient, whilst in attendance. When a patient transfer the Practice to another, a signed release of patient information request is required. A Health summary, a copy of recent progress notes and copies of recent results or specialist letters are then sent to the requesting Practitioner. At times, the continuing doctor is phoned up as well. Storage and security of your personal information The Practice will endeavour to take all reasonable steps to keep secure any personal information which we hold about you, and to keep this information accurate and up to date. Your information is stored on secure servers or is protected in controlled facilities. In addition, our employees and the contractors who provide services related to our information systems are obliged to respect the confidentiality of any personal information held by the Practice. However, the Practice will not be held responsible for events arising from unauthorised access to your personal information. You can access the information we keep about you If you wish to know what information we hold about you, please contact Torquay Doctors on 4125 2422. We will respond to your request within 30 days. What to do if you have a problem or question If the Practice becomes aware of any ongoing concerns or problems with our personal health records on our system, we will take these issues seriously and word to address these concerns. If you have any further queries relating to our privacy policy, or you have a problem or complaint, please contact our Practice Manager on 4125 2422. This Practice has a process whereby complaints can formally be made to any member of staff or the Doctor on duty. Alternatively the QLD Health Care Complaints Commission, Locked Bag18, Strawberry Hills NSW 2012 (Phone 1800 043 159) or else the Aged Care Complaints Resolution Scheme (Phone 1800 550 552). Management of information no longer required This Practice has the following in place for the destruction of patient information no longer required, by shredding; we use a commercial shredding firm (Endeavour Document Shredding Services). We retain all information for seven years, or until the patient reaches the age of 25 years (whichever is longer). For electronic information – it is made “inactive”, and no longer visible to current users. Future changes From time to time, our policies will be reviewed and may be revised. The Practice reserves the right to change its privacy policy at any time and notify you by posting an updated version of the policy on our Notice Boards at each of our Practices and on our website.