This Practice is subject to the Privacy Act 1988 and relevant State Legislation operating in some States and territories of Australia. This document sets out the privacy policy for Ferngate Medical Centre

1. Introduction

Ferngate Medical Centre is committed to protecting the privacy and confidentiality of all personal information, particularly sensitive health information, in compliance with the Privacy Act 1988 and the Australian Privacy Principles (APPs). This policy outlines how we collect, store, use, share, and protect your personal and health information.

By visiting our clinic or using our services, you consent to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy.

A copy of this policy can be provided on request.

 

2. Purpose of Collecting Personal and Health Information

Ferngate Medical Centre collects personal and health information to:

• • Provide medical care, treatment, and advice.
  • Communicate with patients regarding appointments, tests, results, and other essential information.
  • Comply with legal, regulatory, and insurance requirements.
  • Manage administrative functions such as billing and payment.
  • Ensure that services are delivered in a safe, effective, and efficient manner.

We collect personal information only when necessary and in accordance with the law. This may include:

• • Personal Identification Information (e.g., name, contact details, date of birth).
  • Health Information (e.g., medical history, test results, treatment plans).
  • Sensitive Information (e.g., mental health, sexual health, genetic information), which is treated with heightened confidentiality.

You can deal with us anonymously or under a pseudonym, unless it is impracticable for us to do so or unless we are required or authorised by law to only deal with identified individuals. 

 

3. Compliance with the Privacy Act 1988

In accordance with the Privacy Act 1988, the clinic will:

• • Only collect personal information that is necessary for providing healthcare services.
  • Inform individuals about the purpose of data collection at the time of collection and seek their consent (where required).
  • Take reasonable steps to ensure that the information is accurate, complete, and up to date.
  • Ensure that personal health information is securely stored, and access is restricted to authorized personnel only.
  • Not disclose personal health information without consent, unless required by law or in emergency situations.
  • Ensure that should the need for remote access occur, similar conditions as in clinic consultations are met.

 

4. Definition of Electronic Health Record (EHR)

An Electronic Health Record (EHR) refers to a digital version of a patient’s health information that is securely stored and shared across healthcare providers. EHRs in Australia are governed by standards set by the Australian Digital Health Agency and comply with the My Health Record system.

An EHR typically includes key health information such as medical history, medication records, test results, diagnoses, and treatment plans. The My Health Record system allows individuals to manage and control their health information while giving healthcare professionals timely access to accurate patient data, improving the coordination of care.

The Australian standards ensure privacy and security of patient information, with strict guidelines under the Privacy Act 1988 and the Australian Privacy Principles (APPs) to protect sensitive health data. The integration of EHRs helps improve patient safety, reduce errors, and streamline the healthcare process across different providers, contributing to more efficient healthcare delivery.

 

5. Document Automation

Ferngate Medical Centre uses BP Premier Software. One of its key features is Document Automation, which streamlines the process of creating, managing, and sending medical documents. Below is an overview of how document automation works within this program.

5.1. Streamlining Document Creation:

• • BP Premier provides templates for common medical documents, such as referrals, prescriptions, patient notes, and medical certificates. These templates can be pre-filled with patient data (e.g. name, date of birth, medical history), which eliminates the need for manual data entry.
  • Document fields can be dynamically populated from the patient’s medical records within the software, ensuring that all the information is accurate and up-to-date

5.2. Patient Record Integration:

• • Automated Population of Patient Information: When creating a document, BP Premier can automatically pull data from the patient’s record, such as demographic details, medical history, and previous appointments, reducing errors and saving time.
  • This integration ensures that the generated documents are highly accurate and personalized.

5.3. Document Editing and Customization:

• • While templates are used, the system often allows users to edit or customize the documents as necessary, adding personalized notes or comments before they are finalized or sent to the patient or another medical professional.
  • Custom fields or additional text can be included based on the needs of the specific patient or clinical situation.

5.4. Clinical Correspondence:

• • BP Premier also allows the automated generation of clinical correspondence such as referral letters, discharge summaries, and medical reports.
  • These documents can be sent directly from within the software, reducing the time spent creating and transmitting documents, ensuring efficient communication between healthcare providers.

5.5. Sending Documents:

• • Once a document is generated, BP Premier can automate the process of sending the document. This can be done via email, fax, or through secure messaging systems integrated within the software.
  • This helps in ensuring that communication is swift and that documents reach their destination without delays.

5.6. Compliance and Security:

• • The software is designed to ensure that all documents adhere to healthcare industry regulations such as HIPAA (in the U.S.) or Australian Privacy Principles (APPs). Document automation tools within BP Premier are built with strong security features to protect patient data and maintain privacy.
  • Documents are stored securely, and access can be restricted to authorized users only, which is critical in a medical environment.

5.7. Audit and Record Keeping:

• • Automated document workflows typically include tracking features, which log all actions performed on a document, such as who created it, when it was sent, and if any modifications were made.
  • This audit trail is useful for maintaining accurate records and ensuring compliance with legal and regulatory requirements.

5.8. Integration with Third-Party Systems:

• • BP Premier can integrate with other healthcare tools and third-party systems for enhanced automation, such as systems used for appointment scheduling or patient management.
  • Integration with medical billing systems is also a common use case, where the automation of document creation and submission can ensure that all claims and patient invoices are sent promptly.

 

6. Data Security and Electronic Health Records (EHR)

The Clinic recognizes the importance of securing personal and health information, particularly electronic records. To protect patient data, we implement the following security measures:

6.1 Data Security Measures

• • Encryption: All electronic health records (EHR) are encrypted during storage and transmission to ensure unauthorized parties cannot access them.
  • Password Protection: EHR systems require strong password protection, and access to health records is restricted based on roles (e.g. only healthcare professionals involved in care will have access to specific patient information).
  • Regular Security Audits: We conduct regular audits of our information systems to ensure compliance with the Privacy Act and to identify any potential vulnerabilities.
  • Backup and Disaster Recovery: EHR data is regularly backed up, and secure disaster recovery plans are in place to protect against data loss.
  • Staff Training: All staff are trained on proper data security practices, including password management, encryption, and secure disposal of paper records.
  • Appointments: Patient identity is confirmed at the beginning of a telehealth appointment by the GP.

6.2 Electronic Health Records (EHR) Usage

EHRs are stored electronically and can be accessed only by authorized healthcare providers involved in the patient’s care.

Access to EHRs are logged and monitored to detect and prevent unauthorized access.

Patients are can review their EHRs upon request and are provided with access to their records in a secure manner.

7. How are Artificial Intelligence (AI) Scribes used?

This practice uses an AI scribe tool to support GP’s taking notes during their consultations with you. The AI scribe uses an audio recording of your consultation to generate aaccurate, personalized, and structured clinical notes for your health record. The practice AI scribe service we use is Lyrebird Health.

Lyrebird Health:

• Does not share information outside Australia
• Destroys the audio file once transcription is complete
• Removes sensitive, personal identifying data as part of the transcription

The practice will only use data from our digital scribe service to provide healthcare to you.

The practice will only use our digital scribe service with your consent. Consent to use our digital scribe service is obtained before every use.

Ferngate Medical Centre does not make or keep any audio-visual recordings.

8. Handling and Sharing of Personal Health Information

8.1 Collection of Personal and Health Information

The Clinic will collect health information directly from patients. This may include:

• • Direct information provided by patients during consultations, through forms, and online portals.
  • Information from third parties (e.g. referring doctors, specialists, or family members) where consent has been provided.

8.2 Sharing of Personal and Health Information

We may share personal and health information under the following conditions:

• • With Healthcare Providers: Personal and health information may be shared with other healthcare providers (e.g., specialists, laboratories, or hospitals) for the purpose of providing ongoing care and treatment.
  • With Third-Party Service Providers: Information may be shared with third-party contractors for administrative purposes (e.g. billing, IT support), subject to confidentiality agreements.
  • With Authorities: Personal information may be disclosed to government agencies, insurers, or regulators as required by law (e.g. for mandatory reporting of certain diseases or incidents).
  • Overseas: Personal and health information can be provided for patients who have relocated overseas (via encrypted email). The Clinic will require signed consent in this instance and can provide patients with appropriate forms upon request. (Consultations cannot be provided to patients who have either relocated or are on holidays overseas).

Exceptions to disclose without patient consent are where the information is:

• • Required by law
  • Necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
  • To assist in locating a missing person
  • To establish, exercise or defend an equitable claim
  • For the purpose of a confidential dispute resolution process.

In all cases, we ensure that:

• • Minimum necessary information is shared.
  • Patient consent is obtained (other than the exceptions outlined above)
  • Confidentiality agreements are in place with third parties to safeguard patient data.

8.3 Use of Personal Information

We use personal and health information only for the purposes outlined above, including:

• • Providing medical care and treatment.

• • Managing clinic operations (e.g. scheduling appointments, processing payments).
  • Complying with legal or regulatory obligations (e.g. mandatory reporting).

 

9. Breach of Privacy Protocol

9.1 Reporting a Privacy Breach

In the event of a suspected or actual breach of privacy, such as unauthorized access, disclosure, or loss of personal information, the Clinic will follow these procedures:

Immediate Action:

• • • The breach will be investigated immediately by the Clinic Manager.
    • Any affected parties (e.g. patients, staff) will be notified promptly if their personal information is involved in the breach.

Assessment of the Breach:

• • • The Clinic will assess the seriousness of the breach, considering factors such as:
      • Whether the breach could cause harm to the affected individual(s).
      • The type and amount of information involved.
      • The likelihood of the information being accessed or misused.

Notification to Affected Individuals:

• • • If the breach is serious and could result in harm (e.g. identity theft, reputational damage), affected individuals will be notified promptly and provided with advice on how to protect themselves.

Notification to the Office of the Australian Information Commissioner (OAIC):

3. • • If the breach is likely to result in serious harm, the Clinic will notify the OAIC within 30 days of becoming aware of the breach, as required under the Privacy Act 1988.

Preventive Measures:

• • • Following the breach, we will implement measures to prevent similar incidents, which may include:
      • Additional staff training on data security and privacy.
      • Review and updating of data security protocols.
      • Enhancement of physical and IT security measures.

Ongoing Monitoring:

6. • • After resolving the breach, the Clinic will continuously monitor the affected systems and processes to ensure that the privacy of patient information is fully protected moving forward.

 

10. Patient Rights

Under the Privacy Act 1988, patients have the following rights:

• • Access: You may request access to your personal and health information held by the Clinic at any time. We will provide this information within a reasonable period, unless there is a lawful reason for refusal (e.g., if providing the information would compromise patient safety).
  • Correction: If any information we hold about you is inaccurate, out of date, or incomplete, you can request that we correct it.

• • Complaints: If you have concerns about how your personal or health information is handled, you may contact the Clinic’s Manager. If you are not satisfied with the outcome, you can escalate the complaint to the Office of the Australian Information Commissioner (OAIC).

 

11. Changes to this Privacy Policy

The Clinic reserves the right to update this Privacy Policy as required. Any changes will be communicated to patients through our website, clinic signage, or other appropriate means. This policy will be reviewed regularly to ensure compliance with applicable laws and regulations.

 

12. Contact Information

If you have any questions about this Privacy Policy or require further information, please contact our Practice Manager:

Name:     Tanya Braine
Phone:     03 9758 2199
Email:      manager@ferngatemedical.com.au

 

13. Complaints

The Clinic takes complaints and concerns about the privacy of patient’s health information seriously. Patients should express any concerns about privacy concerns in writing. The Clinic will attempt to resolve it in accordance with its complaint resolution procedure.

Complaints should be addressed to:

Name:     Tanya Braine
Phone:     03 9758 2199
Email:      manager@ferngatemedical.com.au

Should a patient wish to submit a complaint anonymously, they can mail their complaint to:

Ferngate Medical Centre

691 Burwood Highway

Ferntree Gully VIC 3156

 

Should a patient be dissatisfied with the Clinic’s handling of a complaint regarding their privacy, they can contact the relevant health complaints commissioner using the below information.

Health Complaints Commissioner

Level 26, 570 Bourke Street

Melbourne, VIC 3000Ph: 1300 582 113 (freecall)