Privacy Policy

Prahran Market Clinic complies with the Australian Privacy principles (APP's) under the commonwealth Privacy Act 1988 (the privacy Act) when handling personal information.

This policy sets out how Prahran Market Clinic uses and discloses a patient's health information, in the course of providing the patient with a health service. This includes when disclosing information to other members of an individual's treating team, as well as when providing care in a holistic manner.

What is "use" and what is "disclosure"?

In general terms, the use of health information refers to the handling of health information within Prahran Market clinic. Disclosure of health information involves the release of that information to someone outside the Clinic, other than the individual whom the information is about.

Generally, health information ,ay only be used or disclosed:

• For the main reason that we collected it (the primary purpose); or
• For another, directly related purpose (including other healthcare purposes) that the individual would reasonably expect; or
• With the patient's consent.

Providers should be confident about their use or disclosure of health information where there is a clear, shared understanding with their patient about such matters such as:

• The reasons that personal information is being collected;
• The circumstances when it may be used and disclosed; and
• To whom disclosures are likely to occur in the course of assessment, treatment or referral.

This criteria does not apply in circumstances where disclosing the information would lessen a serious and imminent threat to someone's life or health.

What is health information?

Brieflt, the Privacy Act applies to all"personal information" which is information about an individual whose identity is apparent, or can reasonably ascertained. "Sensitive information' is a sub-category of personal information, and it includes "health information". Any personal information held bt Prahran Market Clinic is generally health information under the Privacy Act.

 Primary purpose for collecting health information.

The Privacy Act distinguihes between the main reason that information is collected for, called the "Primary purpose"; and other purposes, called "secondary purposes". The primary purpose or main reason for collecting health information will usually be narrow, such as diagnose and treat of a particular condition or set of symptonms. Working out the primary purpose of collection should be possible from the given situation, when the information is collected, even though the provider may also have other, secondary reasons in mind.

APP permits health information to be used or disclosed for the primary purpose for which it was collected, without seeking the patient;s consent. Importantly though, the Privacy Act does require that individuals are told how their information will be handled.

Use and disclosure for directly related secondary purposes.

Secondary purposes for using and disclosing health information may either be"directly" related to the primary purpose that the information was collected, or not directly related.

For Prahran market clinic, directly related purposes generally include those, which involve providing treatment or care, including for health and wellbeing outside of the primary purpose. A provider can use or disclos a patient's health information for directly related secondary purposes, if the patient would reasonably expect the use or disclosure.

Other directly related purposes include the following activities or processes necessary to the functioning of the Clinic.

• Providing an individual with further information about treatment options;
• Billing or debt recovery (with care and discretion, consistent with confidentiality);
• Management, funding, complaint-handling, planning, evaluation and accreditation activities;
• Disclosure to a medical expert (only for medico-legal opinion), an insuer, a medical defence organisation, or a lawyer, solely for the purpose of addressing liability imdemnity arrangements (such as reporting as adverse incident), or for the defence of anticipated or exosting legal proceedings;
• Quality assurance or clinical audit activities, where they evaluate and seek to improve the delivery of a [articular treatment or service;
• Disclosure to a clinical supervisor by a pyschologist; and
• External IT support providers under a documented service agreement.

Giving notice to patients about the reason for collection

The Privacy Act requires that we give notice to patients about certain matters when we first collect health information. These matters include why the information is being collected, how it may be used and to whom it may be disclosed.

This collection notice lays the groundwork for a shared understanding between Prahran market Clinic and the patient as to how the patient's health information may be handled. This is important to determining the scope for later uses or disclosues of that information.

 A patient's consent is copied on the reverse of the patient registration form, and its signed by the patient upon registering with the clinic. This record is scanned to the patient's file.

 Disclosures in special circumstances

There are limited exemptions under APP, which permit Prahran Market Clinic to disclose a patient's information without consent, ven if the patient would not reasonably expect the disclosure.

This includes where using or disclosing the information would lessen or prevent a serious and imminent threat to a person's life, health and safety. For example, where a life-threatening condition is discovered while a patient is unconcious, and consent to use or share this information is not possible.

APP also permits disclosures to a person who is responsible for an individual with a decison-making disability such as a parent, for treatment reasons or compassionate reasons.

Use of information

If a patient's information is likely to be shared within a treating team, the provider should tell the patient that such disclosures may take place. The provider should also tell the patient who is in the treating team (such as a GP, physician, physiotherapist and others), and how much information may be disclosed to paarticular members of the team. A patient may be sensitive about certain information being shared without their consent even across a treatment team, or with particular members of it.

How much information should a provider disclose?

Providers should only disclose information that is necessary for the given circumstances, in line with usual obligations of confidentiality. If the information is particularly sensitive to the patient, they may be particularly interested in limiting who else may see it.

For instance, a patient who attends for sexual health issues may provide their information to be used for specific sexual health purposes, and may not expect their information to be disclosed outside the clinic at all. Generally, a provider would need that patient's consent for any disclosure or other uses, unless another APP exception applied. An exception could include statutory disease notification requirements that were or authorised by law.