Personal Information Management Policy
Aesthetic Day Surgery collects personal information in order to conduct its business and to meet its legislative obligations. It is bound by legislation in the management of matters relating to the privacy of personal information.
Aesthetic Day Surgery is committed to the protection of personal and health information we collect in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and the NSW Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW).
This policy statement explains in general terms, what sort of personal information Aesthetic Day Surgery holds and why we hold it, and how Aesthetic Day Surgery collects, uses and discloses that information.
WHAT IS PERSONAL INFORMATION?
Personal information: Means information or an opinion about an identified individual, or an individual who is reasonably identifiable (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in material form or not. Obvious examples include a person’s name and address, medical / health records, financial institution account details, photographs of individuals, videos containing individuals, biometric information (thumb / iris scans), information about likes and dislikes, place of employment.
Health information: Means information or an opinion about (a) the health or a disability of an individual; or (b) an individual’s expressed wishes about the future provision of health service to him or her; or (c) a health service that has been provided. It also includes other personal information collected to provide, or in providing a health services such as notes on symptoms, diagnosis and treatments given; results of tests and investigations; doctors notes; billing details; or other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or genetic information about an individual in a form that is, or could be predictive of the health of the individual or a genetic relative of the individual.
In order to provide you with the health services you have requested, Aesthetic Day Surgery will need to collect and use your personal information. If you provide incomplete or inaccurate information to us or withhold personal information from us we may not be able to provide you with the services you are seeking.
REQUIREMENTS OF THE LEGISLATION
The Commonwealth Government has enacted privacy legislation to protect information held by organisations about their customers’ personal information (Privacy Act 1988).
In December 2000 the Privacy Amendment Act (Private Sector) (Cth) further enacted the Privacy Act, (implementing the National Privacy Principles) to include provisions that regulate the way private sector organisations collect, use, disclose, keep secure and provide access to personal information.
Under the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth) (Reform Act) Aesthetic Day Surgery is required to comply with the Australian Privacy Principles. This legislation regulates how we may collect, use, disclose and store personal information including health information and how individuals (such as patients) may access and correct their personal information held by Aesthetic Day Surgery.
WHY WE COLLECT YOUR PERSONAL INFORMATION
Personal information is collected so that we can provide you with the services you require and to enable us to comply with our legal obligations.
WHAT PERSONAL INFORMATION DOES AESTHETIC DAY SURGERY COLLECT AND HOLD?
The information we collect may include the following:
- Name
- Date of birth
- Occupation
- Address (postal and email)
- Telephone numbers
- Health Fund details
- Medicare number
- Pension or other concession details
- Medical history, test results, diagnosis and treatments
- Names and telephone numbers of persons to contact in an emergency Banking details to enable the processing of your account
In the case of a medical practitioner applying for credentialing to our hospital or an individual applying for a position, information will be collected relative to the application.
HOW AESTHETIC DAY SURGERY COLLECTS YOUR PERSONAL INFORMATION
Wherever practicable, we will collect your personal and health information from you directly, unless for a particular reason you are unable to provide the information. We obtain the details when you fill out documents such as:
- A hospital admission form – either electronically or in hard copy
- An administrative form, or you
- Give personal and health information in person or over the telephone
- Complete a job application form
- Complete an application form for accreditation / credentialing (medical professional)
Additionally, we may obtain further information from a third party such as:
- An authorised representative (e.g. your Next of Kin or legal adviser) A health service provider
- A health professional who has treated your previously
- A family member
- Other sources where necessary to provide a health service
HOW WE HANDLE YOUR PERSONAL INFORMATION
Personal information is information or opinion that allows others to identify you. Aesthetic Day Surgery will act to protect your personal information in accordance with the Australian Privacy Principles. We collect personal information to provide you with the services you request. The law also requires us to collect personal information.
Personal information may be used within the Aesthetic Day Surgery Group to administer our services and for risk management purposes.
We disclose relevant personal information to external organisations to help us provide services. These organisations are bound by confidentiality arrangements and legislation.
You can seek access to the personal information we hold about you. If the information we hold is inaccurate, incomplete, or outdated, please inform us so we can update it.
If we deny access to your personal information, we will let you know why.
YOUR RIGHT FOR ANONYMITY / PSEUDONYMITY
Where it is lawful and practicable to do so, you may deal with Aesthetic Day Surgery anonymously or use a pseudonym (e.g. when enquiring about a service generally). However, in order for us to provide you with a health service, we will need to know your personal details to allow us to interact with other providers and apply concessions e.g. Health Insurance Funds etc.
CONSENT TO USE AND DISCLOSE YOUR PERSONAL INFORMATION
Aesthetic Day Surgery will only collect and use personal and health information that relates directly to the legitimate purpose for which it is being collected e.g. to provide a health service or an activity relating to the health service.
In most cases, before or at the time of providing you with a health service (if that is not practicable, as soon as practicable thereafter), the collecting staff member obtains your consent to the purposes for which we intend to use and disclose your personal information.
Having provided your consent, you are able to withdraw it at any time. To withdraw consent, contact the Aesthetic Day Surgery. However, by withdrawing your consent, we may not be able to provide you with the service you require.
USE OF YOUR PERSONAL INFORMATION
Aesthetic Day Surgery only uses your personal information for the purpose for which you have given it to us unless one of the following applies:
- The other purpose is directly related to the purpose for which you have given us and information and you would reasonably expect, or we have told you, that your information is usually disclosed for another purpose or to other individuals, organisations or agencies
- You have consented for us to use your information for another purpose
- Aesthetic Day Surgery is required or authorised by law to disclose your information for another purpose; or
- The disclosure of your information is reasonably necessary for the enforcement of the law. Examples of when your personal information may be used include:
- To enable other health services providers involved in your treatment to provide continuity of care, for example: referrals to other health professionals within and external of the hospital including your local doctor or if you are transferred to another hospital – either public or private
- Providing an individual with further information about treatment options
- Conveying information to a responsible person (e.g. a parent, guardian, spouse) when the individual is incapable or cannot communicate, unless the individual has requested otherwise
- Conveying information to close family members in accordance with the recognised customs of medical practice
- Management, funding, service monitoring, planning, evaluation and complaint handling
- Legislative and regulatory compliance reporting e.g. notification to the State Coroner
- Health insurance funding and confirming eligibility for a service
- Billing and debt recovery
- Addressing liability indemnity arrangements including reporting to an insurer or legal representative
- Preparing the defence for anticipated or existing legal proceedings
- Research or the compilation or analysis of statistics relevant to public health and safety e.g. reporting a notifiable disease
With your consent we may also provide your information to / use your information for:
Contractors: Where Aesthetic Day Surgery outsources any services or hires contractors to perform professional services within Aesthetic Day Surgery, the contractor is required to comply with the requirements of the Privacy Act 1988 (Cth), other relevant legislation and the Aesthetic Day Surgery Privacy Policy.
Job Applications: Aesthetic Day Surgery only collects personal information of individuals who apply for positions within Aesthetic Day Surgery for the primary purpose of assessing (and if successful) engaging the applicant. This information is then used to:
- Manage the individual’s employment
- Insurance purposes
- Ensuring relevant contact information is held Satisfying legal obligations.
Aesthetic Day Surgery may store information about an unsuccessful applicant for the purpose of future recruitment.
Employee Information: Personal information directly related to the employee relationship collected by Aesthetic Day Surgery as part of the employment process (including pre employment checks), becomes exempt under the Privacy Act 1988 immediately the employment relationship is established. Aesthetic Day Surgery will review employee requests to access to their personal record on a case-by-case basis.
Under the Act, Aesthetic Day Surgery cannot sell a list of employees to another organisation for the purposes of marketing.
Aesthetic Day Surgery acknowledges the recommendation by the Privacy Commissioner that the personal information of employees be handled in a manner that is consistent with that for other personal information.
Volunteer Records: Records of personal information collected and held by Aesthetic Day Surgery in relations to its volunteers will be managed in accordance with the APP’s.
Application for Accreditation by health professionals: Aesthetic Day Surgery collects personal information from health professionals seeking accreditation and credentialing under its Terms and Conditions of VMO Appointment. Personal information provided to meet these requirements is collected, used, stored and disclosed by Aesthetic Day Surgery for the purposes of fulfilling its obligations within the terms and conditions.
USE OF COMMONWEALTH GOVERNMENT IDENTIFIERS
In certain circumstances we are required to collect government identifiers such as Medicare, Pension or Veteran’s Affairs numbers. We will only use or disclose this information in accordance with the law.
SECURITY OF YOUR PERSONAL INFORMATION
Aesthetic Day Surgery will take all reasonable steps to keep the personal information you provide to us secure and to protect it from misuse, interference and loss as well as unauthorised access, modification or disclosure.
We have a range of procedures and policies in place to provide a secure environment for the personal (and other information) we hold. Our security measures include but are not limited to:
- Educating our staff about their obligations with regard to your personal information
- Requiring our staff to use passwords when accessing our systems
- Employing firewalls, intrusion detection systems and virus scanning tools to protect against unauthorised persons and viruses entering our systems
- Using dedicated secure networks or encryptions when we transmit electronic data
- Providing secure storage for physical records When information we hold is identified as no longer needed for any purpose we ensure it is effectively and securely destroyed e.g. by shredding and other means as in the case of electronic records and equipment.
ACCURACY OF YOUR PERSONAL INFORMATION
It is our aim to ensure that the personal information we hold is accurate, complete, up-to-date and relevant. If you believe that any of the information we hold is not accurate, complete or up-to-date, please contact us by applying in writing to Aesthetic Day Surgery to have it corrected. Where we are satisfied that that the information we hold is faulty, we will take all reasonable steps to correct the fault. If we are unable meet your request, we will advise you formally you of the reason we cannot change your information. No charge will be made with respect to a request to correct or for the correction of your personal information.
CROSS BORDER DISCLOSURE [TRANSFER OF INFORMATION OVERSEAS]
If Aesthetic Day Surgery transfers personal information to countries outside Australia, we will only do so in compliance with applicable Australian data protection and privacy laws. We will take all reasonable steps to protect personal information no matter what country it is stored in or transferred to.
ACCESSING YOUR PERSONAL INFORMATION
You can request to access your own personal (and health) information held by Aesthetic Day Surgery subject to some limited exceptions permitted or by law. Such requests must be made in writing to Aesthetic Day Surgery. Where the information requested relates to obtaining a copy of your health record, you will be required to complete a form detailing the specific information you require and submitting it to Dr. Perkins at Aesthetic Day Surgery. You may be charged a reasonable fee for providing this information. Provision of the copied documents will be conditional upon payment of the fee. You will be advised of this when you submit your request.
UNSOLICITED PERSONAL INFORMATION
Unsolicited personal information received by Aesthetic Day Surgery will as soon as practicable, be destroyed or de-identified if it is lawful and reasonable to do so giving consideration to the options available and the resources and costs of undertaking such actions.
VISITING AESTHETIC DAY SURGERY WEBSITE
This section of our Privacy Statement explains how we handle any personal information collected when you visit to the Aesthetic Day Surgery website.
When you visit the website of Aesthetic Day Surgery we do not attempt to identify you as an individual or collect personal information about you unless you specifically provide it to us; for example, you choose to provide your personal details via an online form or by email e.g. you make a general enquiry via the ‘contact us’ page.
Our website may automatically collect statistics about your visit. We may monitor statistics such as how many people visit our site, the user’s IP address, which pages people visit, the domains our visitors come from and which browsers they use. These statistics are used to assist us to improve the performance of our website.
We are, by law, obliged to allow law enforcement agencies and other government agencies with relevant authority to inspect our IP logs, if an investigation warrants such inspection.
Cookies: Our website may collect “cookies’ when you access it. While they do not identify individual users i.e. no personally identifiable information is collected, however they do identity your IP address and browser type. You can choose to either accept or reject cookies either individually or by disabling the function at browser level (which, while not affecting use of the website, may affect its functionality).
Links to Third Party Websites: Aesthetic Day Surgery websites may contain links to those of a third party. These sites are not subject to our privacy policy and we are not responsible for the content of the website or the privacy practices of that site. You will need to review these websites and read their privacy policy.
Security: Our website takes every precaution to protect user information it collects and measures are in place to protect the loss, misuse and alteration of this information.
MAKING A COMPLAINT OR CONTACTING US
We recognise that even in the best run organisations, things can go wrong. If you have a concern about the personal or health information we collect, use, hold or disclose or you believe we have breached your privacy rights in any way, you may complain.
Additionally, you may believe that the information we hold is inaccurate or incorrect and wish to have that information corrected. In these circumstances, you can contact Aesthetic Day Surgery in writing at the following address: Dr. Darrell Perkins, Aesthetic Day Surgery, 14 Kensington Street, Kogarah NSW 2217.
REFERENCES:
Privacy Act 1988 (Cwlth)
Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cwlth)
Health Records and Information Privacy Act 2002 (NSW)
Australian Privacy Principles guidelines – Privacy Act 1988
Office of the Australian Information Commissioner 2014
