Yulu-Burri-Ba Aboriginal Corporation for Community Health Privacy Policy

Yulu-Burri-Ba Aboriginal Corporation for Community Health (Yulu-Burri-Ba) is committed to the right to privacy and the protection of personal and health information in accordance with privacy laws.

Introduction

Yulu-Burri-Ba is bound by the National Privacy Principles in the Commonwealth Privacy Act 1988 (Cth). The National Privacy Principles shall apply to all Yulu-Burri-Ba clinics and business operations.

All new clients and staff will be provided with a copy of Yulu-Burri-Ba’s Privacy Policy.

Procedures

1. Anonymity

Where it is lawful and practicable to do so, individuals may deal with Yulu-Burri-Ba anonymously or use a pseudonym (e.g. when enquiring about our services generally). However, Yulu-Burri-Ba needs to identify the individual to provide services, access Medicare or prescribe medication.

2. Collection and Use of your Information

Information, such as a client’s current and past medical conditions and family health history, is used to help Yulu-Burri-Ba provide clients with a quality health service. Clients’ information helps Yulu-Burri-Ba to run a quality service and review our work.
Collection of personal and sensitive information includes, but is not limited to, an individual’s:

  • names, addresses and contact details
  • Medicare number for identification and claiming purposes
  • healthcare identifiers
  • medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors
  • personal information which is needed for administration, e.g. bills and Medicare rebates
  • Concession Card details; or
  • Indigenous status.

Personally identified information will not be used for research purposes without the individual’s informed consent. Personal information may be held at Yulu-BurriBa in various forms, such as:

  • Paper records
  • Electronic records
  • Visual – x-rays, CT scans, videos and photos; or
  • Audio recordings

Yulu-Burri-Ba collects a client’s personal and demographic information via registration when a client presents to the clinic for the first time. Clients are encouraged to pay attention to the New Client Registration Form.

During the course of providing medical services, Yulu-Burri-Ba’s healthcare practitioners will consequently collect further personal information.
Personal information may also be collected from the individual’s guardian or responsible person (where practicable and necessary), or from any other involved healthcare specialist.

Yulu-Burri-Ba holds all personal information securely, whether in electronic format, in protected information systems or in hard copy format in a secured environment.

3. Unsolicited Information

Where unsolicited information is received and is no longer needed, Yulu-Burri-Ba, within a reasonable period, will destroy or de-identify this information.

4. Notification of collection of Information

When Yulu-Burri-Ba receives any personal information, Yulu-Burri-Ba will notify the individual:

  • of such matters or otherwise to ensure that the individual is aware of any such matters
  • if any information is collected from someone other than the individual or if the individual may not be aware that Yulu-Burri-Ba has collected the information
  • if the collection of the personal information is required or authorised by or under an Australian law or a court/tribunal order.

5. Disclosure of your Information

Yulu-Burri-Ba may disclose personal information for the purposes of:

  • Continuity of care with other health service providers involved in the individual’s
  • treatment or diagnostic services
  • Providing an individual with further information about treatment options
  • Conveying information to a responsible person (e.g. parent, guardian, spouse) when the individual is incapable or cannot communicate, unless the individual has requested otherwise
  • Conveying information to close family members in accordance with the recognised
  • customs of medical practice
  • Management, funding, service-monitoring, planning, evaluation and complaint handling
  • Legislative and regulatory compliance
  • In response to orders of a Court or tribunal
  • Quality assurance or clinical audit activities
  • Accreditation activities
  • Health insurance funding
  • Billing and debt recovery
  • Addressing liability indemnity arrangements including reporting to the hospital’ s insurers and legal representatives
  • Preparing the defence for anticipated or existing legal proceeding
  • Research or the compilation or analysis of statistics relevant to public health and safety; or
  • Activities directly related to the provision of health services to an individual where the individual would reasonably expect disclosure

Yulu-Burri-Ba will inform the individual where there is a statutory requirement to disclose certain personal information (e.g. some diseases require mandatory notification).

Yulu-Burri-Ba will not disclose personal information to any third party other than in the course of providing medical services, without full disclosure to the patient or the recipient, the reason for the information transfer and full consent from the patient.

Exceptions to disclosure without patient consent are where the information is:

  • Required by law
  • Necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
  • To assist in locating a missing person
  • To establish, exercise or defend an equitable claim; or
  • For the purpose of a confidential dispute resolution process

6. Direct Marketing

If Yulu-Burri-Ba holds personal information about an individual, Yulu-Burri-Ba will not use or disclose the information for the purpose of direct marketing.

7. Cross-border disclosure of personal Information

Yulu-Burri-Ba has business relationships with organisations throughout Australia and in some instance they operate overseas. Yulu-Burri-Ba may therefore disclose personal information outside the State or Territory in which the individual resides and also in some circumstances, to related entities that are located overseas.

Yulu-Burri-Ba will take such steps, as are reasonable in the circumstances to ensure that all business relationships do not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.

8. Adoption, Use and Disclosure of Government Related Identifiers

Yulu-Burri-Ba will not adopt a government related identifier (e.g. Medicare number or Driver’s License) of an individual as its own identifier of the individual unless:

  • the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order
  • the use or disclosure of the identifier is reasonably necessary for Yulu-Burri-Ba to verify the identity of the individual for the purposes of Yulu-Burri-Ba‘s activities or functions
  • the use or disclosure of the identifier is reasonably necessary for the organisation to fulfil its obligations to an agency or a State or Territory authority
  • the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
  • Yulu-Burri-Ba reasonably believes that the use or disclosure of the identifier is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

9. Integrity and Security of Information

Any personal information that is disclosed is to be as accurate, current and complete as possible.

Yulu-Burri-Ba will take all reasonable steps to protect an individual’s information from loss and unauthorised access, change or disclosure. This includes the physical security of Yulu-Burri-Ba offices, paper based information, computer and network security and staff security.

Yulu-Burri-Ba will take reasonable steps to protect information from misuse or loss and from unauthorised access, modification or disclosure. This includes:

  • Requiring staff to maintain confidentiality
  • Implementing document storage security
  • Imposing security measures for access to Yulu-Burri-Ba computer systems
  • Providing a secure environment and access control for confidential information
  • Only allowing access to personal and health information where the individual seeking access has satisfied Yulu-Burri-Ba’s identification requirements.
  • Personal and health information is retained for the period of time determined by law or required for administrative purposes.

When an individual’s information is no longer required, it will be destroyed in a secure and lawful manner. Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to ensure that the information is de-identified.

10. Access and Correction of your Information

Yulu-Burri-Ba will provide access to personal information on request by the individual.

Individuals do not need to give a reason for asking and requests do not have to be in writing.

Individuals can request to see any personal information, and request a copy of partial or complete records.

There is no fee for lodging a request to access your records; however, a small charge may be made if Yulu-Burri-Ba has costs in providing you with access to your records.

Yulu-Burri-Ba is not required to give the individual access to the personal information in the following circumstances:

  • the entity reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety
  • giving access would have an unreasonable impact on the privacy of other individuals
  • the request for access is frivolous or vexatious
  • the information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings
  • giving access would reveal the intentions of Yulu-Burri-Ba in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
  • giving access would be unlawful; or
  • denying access is required or authorised by or under an Australian law or a court/ tribunal order.

Yulu-Burri-Ba is not required to give the individual access to the personal information if Yulu-Burri-Ba has reason to suspect that unlawful activity or misconduct of a serious nature that relates to Yulu-Burri-Ba’s functions or activities has been, is being or may be engaged in, or giving access would:

  • be likely to prejudice the taking of appropriate action in relation to the matter
  • be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
  • reveal evaluative information generated within the entity in connection with a commercially sensitive decision-making process.

If Yulu-Burri-Ba is unable to give an individual access to their personal information:

  • Yulu-Burri-Ba will inform the individual in writing, giving the reasons for the refusal and the complaint mechanisms available to the individual.

If Yulu-Burri-Ba holds personal information about an individual; and either YuluBurri-Ba is satisfied that, having regard to a purpose for which the information is held, the information is inaccurate, out of date, incomplete, irrelevant or misleading; or the individual requests the entity to correct the information;

  • Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up to date, complete, relevant and not misleading.

If Yulu-Burri-Ba corrects personal information about an individual that Yulu-Burri-Ba previously disclosed to another organisation; and if the individual requests YuluBurri-Ba to notify the other organisation of the correction;

  • Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

If Yulu-Burri-Ba is unable to correct the personal information;

  • Yulu-Burri-Ba will inform the individual in writing, giving the reasons for the refusal and the complaint mechanisms available to the individual.

If Yulu-Burri-Ba corrects personal information about an individual that the entity previously disclosed to third party; and the individual requests Yulu-Burri-Ba to notify a third party of the correction;

  • Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

Yulu-Burri-Ba will respond to the request for access or correction within 30 days of the request being made and give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.

11. Complaints and Feedback

If you have a problem we would like to hear it. We take complaints very seriously and endeavor to respond to your query or situation promptly, professionally and in a courteous manner. There are several options when making a complaint or providing feedback, such as:

1. Talk to one of our staff who will assist you with our complaints and feedback process

2. Put it in writing and address to:
Chief Executive Officer – Yulu-Burri-Ba Aboriginal Corporation for Community Health

PO Box 154
Dunwich
QLD 4183

OR Place your written complaint in the suggestion box located at Reception.

3. If you wish to take the matter further and feel you need to discuss the matter outside of the surgery there are several options available including the:

  • Medical Registration Board of Australia
  • Australian Medical Association
  • Office of the Health Ombudsman

Please note it is your decision whether you provide your personal details or remain anonymous, although feedback cannot be provided to you if you choose to remain anonymous.

12. Policy Availability

Yulu-Burri-Ba’s Privacy Policy is:

  • displayed in the Reception area of each Clinic
  • displayed on the Yulu-Burri-Ba Aboriginal Corporation for Community Health website www.ybb.com.au or
  • available by request at HR@ybb.com.au