Epworth HealthCare respects the confidential nature of the relationships between patients, employees, doctors and others. This extends to recognising your right to information privacy and access to information about you.
The Federal Privacy Amendment (Private Sector) Act 2000 and the Victorian Health Records Act (2001) cover Epworth HealthCare's management of personal, sensitive and health information. Epworth HealthCare will comply with the national and health information privacy principles established by these Acts.
Privacy principles:
- Require the responsible handling of personal and health information
- Respect people's right to be informed about the use of their personal and health information and have access to information collected and
held about them by organisations - Enable people to access or change information held about them by our organisation or other contracted organisations in service partnership
with Epworth HealthCare.
Epworth HealthCare recognises that these privacy principles apply to our relationship with employees, patients and partnering service providers. Epworth HealthCare expects that all private health professionals and organisations doing business with us, will similarly adhere to these privacy principles.
The standards set by the Victorian Health Records Act apply to:
- Personal information (including health information) collected in providing our health care service
- Health information held by other organisations.
These standards are binding. A contravention of these standards is "an interference with the privacy of an individual".
The Health Records Act establishes eleven Health Privacy Principles (HPPs). These principles provide the framework for Epworth HealthCare's management of all health information:
1. Collection
Epworth HealthCare will only collect health information necessary for the performance of its health services and with consent. Individuals who provide health information will be notified about what happens to their information and that they can gain access to it.
2. Use and Disclosure
Epworth HealthCare will only use or disclose health information for the primary purpose for which it was collected or a directly related secondary purpose which the person would reasonably expect. If there is any doubt about this expectation then Epworth will gain consent from the person for the use of their health information. Confidentiality agreements will be entered into between Epworth HealthCare and other parties where there is use of personal or health information.
3. Data Quality
Epworth HealthCare will take all reasonable steps to ensure health information it holds is accurate, complete, up to date and relevant to the functions and services it provides.
4. Data Security and retention
Epworth HealthCare will safeguard the health information it holds against misuse, loss, unauthorised access and modification. Health information will be destroyed or deleted in accordance with Health Privacy Principle 4.
5. Openness
Epworth HealthCare will maintain open/transparent operating procedures to manage its health information, and these policies will be available to any person who asks to see them.
6. Access and correction
Epworth HealthCare recognises that individuals have a right to seek access to health information about them, and that this right extends to correction of the information if it is inaccurate, incomplete, misleading or not up to date.
7. Identifiers
Epworth HealthCare will only assign a number or code number to identify a person if it is reasonably necessary to carry out the function or service efficiently.
8. Anonymity
Epworth HealthCare will give individuals the option of not identifying themselves when engaging with the organisation where this is lawful and practicable. Epworth will advise individuals of the importance of health information to the health care service provided to them by Epworth HealthCare.
9. Transborder Data Flows
Epworth HealthCare will only transfer health information outside Victoria if the receiving organisation is subject to laws substantially similar to the Health Privacy Principles, or confidentiality and disclosure agreements are in place between the individual and the external organisation (ie. in the case of overseas patients).
10. Transfer/Closure of the practice of a health service provider
Epworth HealthCare has relationships with numerous clinical service providers and businesses. In the event these businesses cease to operate or operate as partners in health services with Epworth, Epworth will expect to be notified of business organisation closures or transfers.
11. Making information available to another health service provider
Epworth HealthCare will make information relating to an individual available to another health service provider if requested by the individual and it is appropriate.
Complaints
Complaints about an interference with privacy will be handled by Epworth's complaint handling processes in the first instance. Epworth HealthCare acknowledges that individuals may ultimately choose to take complaints to the Health Services Commission.