In accordance with the Privacy Amendment (Private Sector) Act 2000 and the Health Records Act 2001 (Vic), Berkeley Medical Centre has developed this privacy policy to describe the processes under which personal information is collected, stored, used and disclosed by Berkeley Medical Centre. The policy is intended as a guide to the staff and/or stakeholders of Berkeley Medical Centre and for the advice of the broader community.

Any enquiries regarding this policy should, in the first instance, be directed to the Berkeley Medical Centre Practice Manager.

Berkeley Medical Centre has provided a copy of this policy to all members of staff (including new members upon commencement) and will train staff in the appropriate handling of personal information.

This policy is a public document and access to it will be granted on request.

Complaints Handling

Any complaints in relation to Berkeley Medical Centre’s handling of personal information should be directed to the Privacy Officer. In most cases the complainant will be asked to lodge their complaint in writing.

Unless a complaint can be dealt with immediately to the satisfaction of both parties, Berkeley Medical Centre will provide a written response to the complaint within 30 days of it being received.

If an individual believes their complaint has not been appropriately handled by Berkeley Medical Centre, they should contact the Office of the Federal Privacy Commissioner, Privacy Hotline 1300 363 992 (local call charge) or via www.privacy.gov.au or the Office of the Health Services Commissioner, Complaints and Information Line, phone (03) 8601 5200 or Toll Free 1800 136 066 or via https://www.oho.qld.gov.au/

1. Collection

Berkeley Medical Centre will only collect personal information necessary to undertake its programs, activities or functions.

1.1 Berkeley Medical Centre will only collect personal health information about an individual:

1.1.1 Where the individual or their authorised representative consents or when required by law.

1.1.2 Where the information is necessary for research or analysis of statistics and is collected in accordance with HPP 1.1(e)

1.1.3 Where the collection is in the interests of the individual’s or the public’s health and safety.

1.1.4 Where the collection is otherwise in accordance with HPP1.

1.2 Personal information about an individual will only be collected by lawful and fair means and directly from the individual wherever possible.

1.3 The name and contact details of Berkeley Medical Centre and an appropriate member of staff will be supplied to every individual who provides personal information.

1.4 Berkeley Medical Centre will take reasonable measures to ensure that each individual providing personal information is informed about and understands the purpose of collecting the information, to whom or under what circumstances their personal information may be disclosed to another party, and how they can access the information held about them by Berkeley Medical Centre.

1.5 Berkeley Medical Centre will take reasonable measures to ensure that individuals who are asked to provide personal information understand the consequences, if any, of not providing that information or of providing incomplete or inaccurate information.

2. Use & Disclosure

Berkeley Medical Centre will ensure that personal information will only be used for the purpose it was collected, or purposes that would reasonably be expected by the individual providing the information.

2.1 If the identified information is to be used for a secondary or unrelated purpose, such as data analysis or research, Berkeley Medical Centre will obtain informed consent from the individual.

2.2 Individuals will be given the opportunity to refuse such use or disclosure.

2.3 If an individual is physically or legally incapable of providing consent, a responsible person may do so.

2.4 Berkeley Medical Centre will only disclose personal information without consent where such disclosure is required by law, or for law enforcement, or in the interests of the individual’s or the public’s health and safety.

2.5 We will keep records of any such use and disclosure.

2.6 Information may be disclosed to a responsible person.

3. Data Quality

Berkeley Medical Centre will take reasonable steps to ensure that personal information kept, used or disclosed by us is accurate, complete, and as up to date as practicable.

4. Data Security

Berkeley Medical Centre will take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

4.1 Berkeley Medical Centre will destroy or permanently de-identify personal information that is no longer required.

4.2 Berkeley Medical Centre will ensure that all personal information transmitted electronically will be appropriately encrypted before transmission.

5. Openness

This policy will be made available to any person requesting access to it.

5.1 A general statement describing our approach to privacy will be on public display at all Berkeley Medical Centre’s offices.

6. Access & Correction

Under normal circumstances Berkeley Medical Centre will provide an individual with access to their personal information within 30 days of receiving a request for access.

6.1 There will be no fee associated with an individual lodging a request for access to their personal information.

6.2 A small administration fee may be charged for the provision of access and/or copies of personal information. This fee will be determined on a cost recovery basis.

6.3 Individuals will be provided access that is appropriate to their particular circumstances.

6.4 If an individual believes that information held by Berkeley Medical Centre is inaccurate or incomplete and notifies Berkeley Medical Centre of that belief in writing, Berkeley Medical Centre will take steps to amend or correct the information.

6.5 Berkeley Medical Centre may refuse access if it reasonably believes that:

6.5.1 Releasing the information may compromise any person’s health, safety or wellbeing.

6.5.2 Providing access would be unlawful or would prejudice a legal investigation.

6.5.3 Providing access would affect the privacy of others.

6.5.4 The request for access is frivolous and/or vexatious.

6.6 If information is withheld under 6.5, Berkeley Medical Centre will provide a written explanation of the reasons to the individual within 30 days of the decision to withhold.

7. Identifiers

Berkeley Medical Centre will not use Medicare or Veterans Affairs numbers, or other identifiers assigned by a Commonwealth or State/Territory agency to identify personal information or disclose such information unless required to do so by law.

8. Anonymity

Where it is lawful and practicable to do so, Berkeley Medical Centre will allow individuals to provide information anonymously.

8.1 An individual who chooses to access the services of Berkeley Medical Centre anonymously will be advised of any potential consequences resulting from their decision.

8.2 Berkeley Medical Centre will not preclude an individual from participating in the activities of the organisation because they request anonymity.

9. Trans border Data Flows

Berkeley Medical Centre will only transfer personal information about an individual to someone who is in another State or a foreign country if:

9.1 The individual consents to the transfer; or

9.2 The recipient is bound by legislation that is substantially similar to the NPPs and HPPs; or

9.3 Berkeley Medical Centre is reasonably sure that the information will not be held, used or disclosed inconsistently with the NPPs and HPPs.

10. Sensitive Information

Berkeley Medical Centre will only collect sensitive information about an individual if:

10.1 The individual consents; or

10.2 The collection is required by law; or

10.3 such collection is consistent with the provisions of NPP 10.

11. Transfers or Closure of Health Service Provider

In the event that a health service provider business owned or conducted by Berkeley Medical Centre is sold, Berkeley Medical Centre will:

11.1 publish a notice in a newspaper circulating in the locality of the practice or business stating—

11.1.1 that the practice or business has been, or is about to be, sold, transferred or closed down, as the case may be; and

11.1.2 The manner in which Berkeley Medical Centre proposes to deal with the health information held by the business about individuals who have received health services from Berkeley Medical Centre.

12. Making Information available to Another Health Service Provider

If an individual requests Berkeley Medical Centre to make health information relating to the individual held by Berkeley Medical Centre available to another health service provider or authorises another health service provider to request Berkeley Medical Centre to make health information relating to the individual held by Berkeley Medical Centre available to the requesting health service provider— Berkeley Medical Centre will provide a copy or written summary of that health information to that other health service provider within 30 days of the request.

Notes :

The Privacy Act defines a ‘person responsible’ as:

• a parent;
• a child or sibling at least 18 years of age;
• a spouse or de facto spouse;
• a relative at least 18 years of age and a member of the individuals household;
• a guardian or a person exercising enduring power of attorney that can be exercised in relation to the individuals health;
• a person who has an intimate personal relationship with the individual; or
• a person nominated by the individual to be contacted in an emergency.

## Sensitive information as defined under the Act is information or an opinion about an individual’s:

• racial or ethnic origin;
• political opinion;
• membership of a political association or religious beliefs, affiliations or philosophical beliefs;
• membership of a professional or trade association or membership of a trade union;
• sexual preference or practices
• criminal record.