PERSONAL / HEALTH INFORMATION MANAGEMENT POLICY

Introduction
Peninsula Sleep Clinic acknowledges our obligations to you under the Australian Privacy Principles (APP) found in the Privacy Amendment (Enhancing Privacy Protection) Act 2012 which amends the Privacy Act 1988. This policy describes how the Clinic manages any personal / health information it collects, holds and discloses about you.

What personal / health information the Clinic collects & holds:

• Name, address, telephone number, email address
• Date of birth
• Occupation
• Next of kin details
• General practitioner and referring doctor details and any referral letters
• Marital status
• Indigenous status and language spoken at home
• Financial details associated with services we have provided to you
• Medical history and relevant health information
• Current and past records of treatment given at this Clinic
• Any additional information provided to us by you and any letter/s written to you
• Medicare card numbers, Department of Veterans Affairs card number & type and Health Fund details, including ‘eligibility checks’ and any other details provided by your Health Fund regarding your admission.
• All forms relating to each admission
• Any ‘alert/s’, allergies or sensitivities or adverse events
• Copies of ‘Advance Care Directive’ or ‘Enduring Guardian Directives’
• For CPAP users only: downloads and CPAP compliance data

How the information is collected & held:

• The information collected and held about you is provided by you or arises as a consequence of information provided by you or pertains directly to your admission.
• Includes both paper and electronic records
• As part of this process it is important that all information that we hold about you is accurate & up to date.
• For each admission you will be required to complete all the associated paperwork
• For CPAP users only: data may be collected, transmitted, stored and downloaded from the various ‘Cloud’ services – your written approval for this service will be sought separately

The purpose for collecting holding and or disclosing your information:

• To provide medical treatment and care to you
• To assist treating doctors, nursing staff and allied health professionals in providing medical treatment and care to you
• To assist with any calls you make to the Clinic
• For the accounting and billing purposes
• For processing private health fund claims
• To provide you with any expected out-of-pocket expenses
• To provide information to other medical practitioners, registered nurses and allied health professionals who are involved in your treatment and ongoing care
• Benchmarking and clinical indicator reporting in a de-identified form
• To provide the Private Hospitals Data Bureau, the NSW Ministry of Health, your Health Fund and the Department of Veterans information in coded format regarding your medical condition/s and procedure (as required by legislation).
• To arrange repairs of CPAP equipment, upgrades or follow up on warranty issues
• To manage CPAP compliance and identify any issues
• To provide information to other relevant organisation such as emergency services in the case of an emergency
• To follow up on any adverse events, accidents or incidents
• To follow your wishes in the case of a medical emergency
• If directed by a court of law or if subpoenaed

Anonymity & Pseudonymity:
Peninsula Sleep Clinic believes it is impracticable to deal with individuals who have not identified themselves unless your pseudonym / alias are registered with Medicare Australia and your health fund.

Access:
You may request access to personal / health information the Clinic holds about you. Contact the Clinic directly for further information. All requests must in writing and on an approved form. You do not have to provide a reason for requesting access. Where the Clinic holds information that you are entitled to access we will endeavour to provide you with a suitable range of choices as to how you may access it. Where any information is delivered or sent to you, you will be required to acknowledge receipt of same in writing.
You will not be permitted to remove any of the contents of your medical record file from the Clinic, nor will you be permitted to erase information contained within your medical record file. The medical record file remains the property of Peninsula Sleep Clinic.
Photographic proof or another form of identification will be required and all photocopies must be certified copies.
The receipt of your written request for access to personal / health information will be acknowledged within 14 days of the date of receipt of the request. Information will be checked prior to release for accuracy and completeness and to ascertain whether any information should be withheld.

Reasons for withholding information include:

• Where access would pose a serious threat to the life or health of any individual
• The information contains information about another person
• The request is frivolous or vexatious (for example there have been repeated requests by the same person)
• Where denying access is required or authorised by or under law
• Where providing access would likely prejudice an investigation of possible
  unlawful activity
• Where providing access would be likely to prejudice action by or on behalf of an enforcement body in relation to unlawful activity or seriously improper conduct

Information that is required to be withheld will be removed from the record provided to you and you will be notified that information has been withheld and the reasons.
An administrative fee of $50 will be charged on production of information requested. Copies of information may be supplied at a fee of 50 cents / page.

Access by ‘persons responsible’:
If the patient is incapable of giving or communicating consent, request for access to personal information can be made by ‘persons responsible’ for the individual to whom the information relates.
‘Persons responsible’ include –

• A partner
• A family member
• A carer
• A guardian
• A close friend
• A person exercising power under an enduring power of attorney

Personal / health information disclosed to a ‘person responsible’ is limited to that which is reasonable and necessary to the care and treatment of the individual to whom the information relates.
In addition to proof of identification, a ‘person responsible’ will be asked to provide some form of proof of the relationship between themselves and the individual to whom the information relates. A reason for the request must be specified.

Correction of Information:
If you believe that your personal / health information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you may request amendment of it.

• Following consideration amendment/s will be made to the relevant record or
• If the Clinic does not agree that there are grounds for amendment, the Clinic will add a note to the personal information stating that you disagree with it.

Complaints about a breach of privacy / data:
Any questions about this policy or any complaint regarding treatment of your privacy by the Clinic should be made in writing to the Business Manager. All written complaints are referred to the Management Review Committee and in some cases the complaint maybe forwarded to the Medical Advisory Committee. In any case you can expect a written response to your complaint within 30 days. In addition where a serious notifiable data breach has occurred you will be notified directly as well as the Office of the Australian Information Commission.

Storage and security:

• Paper based documents / files are stored in dedicated storage facilities which is locked out of hours
• All individual records have an individual Medical Record Number and each
• admission has an individual episode number
• Electronic records are password protected and access is limited to appropriate staff
• All new employees sign a confidentiality agreement and are bound by this policy
• As a guide the law requires the Clinic to retain your medical records for a period of seven years or until an individual has attained the age of 25 years
• Out of hours the facility is back to base alarmed
• Unsolicited information is de-identified and destroyed as soon as possible and the organisation from where the information came notified
• At times it may be necessary for computer software companies to have access (under supervision) to the electronic data files to rectify problems or update software

Direct marketing:
Peninsula Sleep Clinic will not disclose your personal health information for marketing purposes. However, where you choose to become a member of a CPAP supply company club, take advantage of an extended warranty offer from a supply company, have equipment repaired under warranty or opt to have your CPAP usage information available on ‘Cloud’ services; then limited details become available to that particular service company (such as name, date of birth, phone numbers and address, medical record number, product information and gender). Peninsula Sleep Clinic is not responsible for and has no control over how the individual supply company use your information.

Overseas recipients:
Peninsula Sleep Clinic is unlikely to receive information from an overseas recipient/s and would not disclose information to an overseas recipient without your prior written approval.

Miscellaneous
In this Policy ‘personal information’ and ‘health information’ have the same meaning as under the Privacy Act. References to Peninsula Sleep Clinic are to Peninsula Health Care Pty Ltd, ACN No. 082 322 843, which has issued this policy.
This document represents Peninsula Sleep Clinic’s policy as at July 2019. It may be necessary to change this policy from time to time.