1. About this policy
Manly Haematology (“we”, “us”, “our”) is committed to protecting the privacy of your personal information. We handle your personal information in accordance with:
- the Privacy Act 1988 (Cth), including the Australian Privacy Principles
- the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles
- the Healthcare Identifiers Act 2010 (Cth)
- the My Health Records Act 2012 (Cth)
This policy explains what information we collect, why we collect it, who we share it with, how we keep it secure, how long we keep it, and what you can do if you want access to it or are unhappy with how we have handled it.
This policy is available free of charge on our website and from our reception. If you need it in another format, please ask and we will do our best to accommodate you.
2. What information we collect
We collect:
- your name, date of birth, address, telephone numbers, email address, and next of kin or emergency contact details
- your Medicare number, Individual Healthcare Identifier, and Department of Veterans’ Affairs number where applicable
- your private health fund details, and pensioner or concession card details
- your health information, which includes your medical history, symptoms, examination findings, test and investigation results, diagnoses, medicines, treatment and progress. This is “sensitive information” under the Privacy Act and “health information” under the HRIP Act, and it attracts a higher level of protection than other personal information
- family and genetic history where it is relevant to your care
- your billing and payment records
- correspondence between you and the practice
3. Payment card details
We do not record or store your credit or debit card details. Card payments are collected and processed by a third-party payment service provider engaged by the practice, which collects your card details directly and handles them under its own privacy policy and the applicable payment card security standards.
We will never email you asking for your card or bank account details. If you receive a message of that kind appearing to come from us, please telephone the practice before responding to it.
4. How we collect your information
Wherever possible we collect information directly from you: through our reception staff, the registration form and health questionnaire we ask you to complete before your first appointment (online, or on paper if you prefer), the enquiry form on our website, or during a consultation.
We also collect information about you from others where the Privacy Act or another law allows it, including your referring doctor, your general practitioner, other treating specialists, pathology and diagnostic imaging providers, hospitals and day facilities, other health care providers involved in your care, your private health fund, and Services Australia.
We receive referrals, pathology and diagnostic imaging results and other clinical correspondence through secure clinical messaging services, which are described in sections 9 and 11.
In an emergency, or where you are not able to provide information yourself, we may collect it from a person responsible for you.
Where we collect information about you from someone else, we will take reasonable steps to make you aware that we have done so, unless an exception under the Privacy Act applies.
5. Why we collect, hold, use and disclose your information
The primary reason we collect your information is to provide you with specialist haematology care. Specifically, we collect, hold, use and disclose your information:
- to assess, diagnose and treat you, and to provide your continuing care
- to communicate with you, including appointment confirmations, reminders and recalls, results, and clinically necessary follow-up
- to correspond with your referring doctor, your general practitioner and other practitioners involved in your care
- to request and receive pathology, diagnostic imaging and other investigations
- to arrange hospital admissions, procedures, transfusions and day-infusion services
- to bill for our services and to claim from Medicare, the Department of Veterans’ Affairs, your private health fund or another payer, and to follow up unpaid accounts
- to manage our accounts, administration and practice operations
- to meet our legal obligations, including mandatory notification of notifiable conditions, and to respond to subpoenas, court orders and other lawful requests
- for accreditation, clinical audit, quality improvement and risk management
- for the training and education of health professionals
- for research, as described in section 6
- to respond to a complaint, claim, insurance or medico-legal matter
Some of these functions are carried out for us by service providers that we engage. These include our reception service, our practice management system and our secure messaging providers. They act only on our instructions, they access only what their role requires, and they are bound by confidentiality obligations. We remain responsible for how they handle your information.
We may also use or disclose your information for another purpose that is directly related to providing your care and that you would reasonably expect, where the Privacy Act and the Health Privacy Principles permit it.
We do not sell your information, and we do not use or disclose it for direct marketing. Appointment reminders, recalls and results notifications are part of providing your care and are not direct marketing.
6. Research, audit and quality improvement
Where we contribute to research, audit or quality improvement, we use de-identified information wherever practicable. De-identified information does not identify you and cannot reasonably be used to identify you.
Where identifiable health information is needed for research, we will either seek your consent or rely on approval from a Human Research Ethics Committee given in accordance with the guidelines issued by the National Health and Medical Research Council under section 95A of the Privacy Act.
7. Your consent
When you register as a patient, you consent to the clinicians and administrative staff of the practice accessing and using your personal information to provide your care, and to the disclosures described in section 5. Within the practice, access is limited to those who need it for your care or to administer your account.
We do not treat your registration as consent for anything beyond this. If we want to use or disclose your information for a purpose that is not described in this policy and is not otherwise permitted by law, we will ask you first.
You can withdraw or limit your consent at any time by contacting us. We will tell you honestly if doing so affects our ability to provide or continue your care.
8. Healthcare identifiers and My Health Record
We collect and use your Individual Healthcare Identifier to identify you accurately and to communicate reliably with other providers involved in your care. We use and disclose healthcare identifiers only as permitted by the Healthcare Identifiers Act 2010, which restricts their handling and imposes penalties separate from those under the Privacy Act.
We may view information in your My Health Record and upload information about your care to it, as permitted by the My Health Records Act 2012. You control who can see your My Health Record. You can set access controls, restrict access to specific documents, or cancel your record through myGov, or by calling the My Health Record help line on 1800 723 471. If you do not want us to upload information about your care to your My Health Record, please tell us and we will record your request.
9. Disclosure outside Australia
We do not routinely send your health information outside Australia to provide your care, and your clinical records are held in Australia.
Some of the services we rely on are supplied by providers that operate internationally. Limited personal information may therefore be accessible from, or processed or backed up in, other countries:
- Our website uses Google Analytics. It collects technical information including your IP address, device and browser characteristics and your interactions with our pages, and discloses it to Google LLC in the United States, which handles it under its own privacy policy at policies.google.com/privacy
- Our website embeds a Google map showing the location of the practice. The map loads only when you choose to open it; doing so discloses your IP address and request data to Google LLC in the United States, which handles it under its own privacy policy at policies.google.com/privacy
- Our email, office and online forms systems, including the online health questionnaire and any form you return to us by email, use Microsoft 365. Our tenant data is stored at rest in Australia. Microsoft’s global support and engineering personnel may access data from other countries, including the United States and countries in the European Union, under contractual confidentiality and security obligations
- We receive and send clinical correspondence through the secure messaging services HealthLink and Medical Objects. Each delivers its services in Australia, and each states that some of its systems, service providers or backups may operate outside Australia
- Our practice management system, including the Patient Portal where you complete your registration form online and can upload documents, holds your records on servers located in Australia, as described in section 11
- We do not store your credit or debit card details, and your health information is never sent to Tyro or disclosed overseas as part of payment processing. Tyro is a long-established, PCI-DSS compliant Australian payments company used by many Australian medical practices. As with any Australian business using an international payment platform, a small number of Tyro’s own infrastructure and support providers operate overseas – currently in the United States, India, New Zealand, Ireland, the Netherlands, Singapore and China – but these providers only ever see limited payment-processing data, never your clinical records. Tyro’s own privacy policy, at tyro.com/legal/privacy-policy, sets out the full detail
Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that it is handled in a way consistent with the Australian Privacy Principles.
10. Our website
We do not use advertising cookies on our website, and we do not sell or trade information collected through it.
We use Google Analytics to understand how our site is used, including which pages are visited, the approximate location and device type of visitors, the sites that refer people to us, and the search terms used to find us. Google Analytics uses cookies to do this. It is reported to us in aggregate, and we do not use it to identify you.
We also use a small cookie to remember that you have closed our website notice, so that it does not appear on every page.
Our home page and Contact page include an embedded Google map showing where we are. The map is a placeholder until you choose to load it; loading it involves disclosure to Google as described in section 9. Our address and directions are also set out in text on the Contact page.
Our enquiry form is protected against spam by a simple check that runs on our own website and does not send information to any other organisation. Google Analytics and the map involve disclosure to Google as described in section 9. If you would prefer to avoid them, you are welcome to contact us by telephone or in person instead.
Information you send through our enquiry form reaches us by email. Please do not use it to send detailed clinical information, and do not use it for anything urgent. Telephone the practice instead.
11. How we keep your information secure
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These include:
- storing your records, including information you enter or upload through the Patient Portal, in our practice management system, an Australian-hosted system which holds data on secure servers located in Australia
- exchanging referrals, results and clinical correspondence through the secure clinical messaging services HealthLink and Medical Objects, which encrypt information in transit. Their privacy policies are available at healthlink.com.au/policies and medicalobjects.com/privacy
- processing card payments through Tyro, which collects your card details directly and handles them under its own privacy policy, available at tyro.com/legal/privacy-policy, and the applicable payment card security standards
- holding email, office documents and online forms (including the online health questionnaire, and any form returned to us by email) in Microsoft 365, with the data residency position described in section 9
- limiting access to your information to those who need it for your care or to administer your account, with unique passwords and multi-factor authentication on the systems that hold it
- scanning paper documents into the practice management system and then destroying them as confidential waste
- securing our premises and the devices we use
- requiring our staff, contractors and service providers, including our reception service, to protect your information under confidentiality and contractual obligations, and training our staff in privacy
- maintaining a documented data breach response plan, and conducting regular privacy reviews, a disclosure register and a complaints register
No system is completely secure. If we become aware of unauthorised access to, or unauthorised disclosure or loss of, your personal information, we will act under our data breach response plan. Where a breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where a breach involves the My Health Record system, we will notify the Australian Digital Health Agency and the Office of the Australian Information Commissioner as required by the My Health Records Act 2012.
12. How long we keep your information
We keep your health records for at least seven years from the date we last provided you with a service. If you were under 18 at the time of your last service, we keep your records until you turn 25. These are minimum periods set by the Health Records and Information Privacy Act 2002 (NSW), and we may keep records for longer where there is a medico-legal, insurance or other legal reason to do so.
When we no longer need your information and are no longer required to keep it, we destroy or de-identify it securely.
If a patient has died, we continue to protect their health information, which remains protected under the HRIP Act for 30 years after death.
13. Access to and correction of your information
You can ask for access to the personal information we hold about you, and you can ask us to correct it if it is wrong, out of date, incomplete or misleading.
Please put your request in writing to reception@manlyhaematology.com.au, or by post to Level 5, 22 Darley Road, Manly NSW 2095. We will ask you to verify your identity before we release anything.
If you are asking on behalf of someone else, as a parent or guardian, under an enduring guardianship or power of attorney, as a substitute decision-maker, or as the executor or administrator of an estate, we will ask you for evidence of your authority.
We will respond within 30 days. There is no charge for making a request. We may charge a reasonable fee for the staff time, retrieval and copying involved in giving you access. Any such fee will not be excessive, we will tell you the amount before we proceed, and it cannot be claimed from Medicare.
In limited circumstances the law allows us to refuse access or correction. These include where giving access would pose a serious threat to the life, health or safety of any person, where it would unreasonably affect another person’s privacy, or where we are required by law to refuse. If we refuse, we will tell you why in writing and explain how to complain. Where it is appropriate we will offer an alternative, such as providing the information to a health practitioner you nominate or giving you a summary.
If we correct information that we have already disclosed to someone else, we will tell that recipient about the correction on your request, where it is practicable to do so.
14. Automated decision-making
We do not use computer programs to make decisions about you, or to do anything substantially and directly related to making decisions about you, that could reasonably be expected to significantly affect your rights or interests. Decisions about your care are made by your treating specialist.
15. Anonymity and pseudonyms
The Privacy Act gives you the option of not identifying yourself when you deal with us, except where it is impracticable for us to deal with you anonymously or the law requires us to identify you.
You are welcome to make a general enquiry of the practice without giving your name. We cannot, however, provide clinical care anonymously. Identifying you accurately is essential to safe treatment, to requesting pathology and imaging in your name, to corresponding with your referring doctor, and to claiming from Medicare or a health fund.
If you would prefer to be treated under a pseudonym, please contact us before making an appointment so that we can discuss what is possible.
16. Complaints
If you have a question about privacy, or you want to complain about how we have handled your personal information, please contact our Privacy Officer:
Privacy Officer, Manly Haematology
Level 5, 22 Darley Road, Manly NSW 2095
02 9052 1896 · reception@manlyhaematology.com.au
You can make your complaint verbally or in writing. We will acknowledge it within five business days, investigate it, and tell you the outcome as soon as practicable and usually within 30 days.
If you are not satisfied with our response, you can contact:
- the Office of the Australian Information Commissioner, on 1300 363 992 or at oaic.gov.au
- the NSW Information and Privacy Commission, in relation to health information held in New South Wales, on 1800 472 679 or at ipc.nsw.gov.au
- the Health Care Complaints Commission, in relation to the clinical care you received, on 1800 043 159 or at hccc.nsw.gov.au
17. Changes to this policy
We review this policy periodically to take account of changes in the law, in technology, and in how the practice operates. The current version is always available on our website and is dated at the top of this page.