Wyndham Health Care Privacy Policy

The objective of this privacy notice is to provide you, our patient, with clear information on how your personal information is collected and used within the practice. Occasionally, we also need to share your personal information to involve others in your healthcare and this policy outlines when, how, and why we share your information.

1. Who can I contact about this policy? For enquiries concerning this policy, you can contact manager@wyndhamhealthcare.com.au

2. When and why is your consent necessary? When you register as a patient of this practice, you provide consent for the GPs and practice staff to access and use your personal information to facilitate the delivery of healthcare. As a Victorian health service, Wyndham Health Care complies with the Health Records

Act 2001 (Vic) and the Health Privacy Principles (HPPs), as well as the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where applicable. Your personal information is generally collected, used and disclosed for the primary purpose of providing healthcare to you. In many circumstances, these activities are covered by implied consent because they are necessary to provide your healthcare. Where we wish to use or disclose your personal information for a purpose that is not directly related to your healthcare or is not otherwise permitted by law, we will seek your additional consent.

Access to your personal information is restricted to practice team members who require it to perform their duties and provide your care. It is important to us that, as our patient, you understand why we collect, use and disclose your personal information.

3. Why do we collect, use, store, and share your personal information? Wyndham Health Care collects, uses, stores and shares your personal information primarily to provide you with safe, high-quality healthcare and to manage your ongoing healthcare needs. This includes providing medical treatment, maintaining accurate medical records,
communicating with you and other healthcare providers involved in your care, and processing billing and payment claims.

We also use your personal information for purposes directly related to your healthcare that you would reasonably expect, including quality improvement activities, clinical audits, accreditation requirements, risk management, staff education and training, and the administration and operation of the practice.

Where required by law, or where your consent has been obtained, we may also use or disclose your personal information for other permitted purposes in accordance with the Health Records Act 2001 (Vic), the Health Privacy Principles (HPPs) and the Privacy Act 1988 (Cth).

4.What personal information is collected?

The personal information we collect about you may include:

• your name, date of birth, address and contact details
• emergency contact and next of kin details (where provided)
• medical information, including your medical history, current health conditions, medications, allergies, adverse reactions, immunisations, social history, family history and relevant risk factors
• Medicare number (where applicable) for identification and claiming purposes
• Individual Healthcare Identifier (IHI) and other healthcare identifier numbers
• health fund and Department of Veterans' Affairs (DVA) details (where applicable)
• information relating to referrals, pathology, diagnostic imaging and other healthcare providers involved in your care
• any other information necessary to provide you with safe and effective healthcare

5. Can you deal with us anonymously or using a pseudonym? Where lawful and practicable, you may choose to deal with Wyndham Health Care anonymously or by using a pseudonym. However, in most circumstances it is not practicable for us to provide healthcare services without collecting your identity. We may also be required or authorised by law to identify you, for example when processing Medicare claims, prescribing medications, making referrals, requesting pathology or diagnostic imaging services, or complying with legal obligations.

6.How is personal information collected? Wyndham Health Care collects personal information directly from you wherever possible. We may collect your personal information in several ways, including when you:

• register as a new patient
• make an appointment
• attend a consultation
• complete registration or other forms
• contact us by telephone, email, SMS or through our website
• use our online appointment booking services.

In some circumstances, we may also collect personal information from other sources, including:

• your parent, guardian or person responsible for your care
• other healthcare providers involved in your care, including specialists, allied health professionals, hospitals, community health services, pathology providers and diagnostic imaging providers
• Medicare, your health fund or the Department of Veterans' Affairs (where applicable)
• My Health Record (where you have not withdrawn or limited access) secure electronic prescribing and secure messaging systems
• other organisations or individuals where authorised or required by law.

While providing healthcare services, we may collect additional health information through:

• consultations and clinical examinations
• electronic prescribing
• My Health Record
• pathology and diagnostic imaging results
• online appointment systems and other digital health services.

We may also collect and use images, including:

• CCTV footage collected from our premises for security, safety and incident management purposes. CCTV cameras are located in public areas of the practice, including the entrance, reception, car park and internal hallways. Cameras are not installed in consultation rooms, treatment rooms or bathrooms.
• Clinical photographs and medical images taken where necessary to support your diagnosis, treatment or ongoing care. Where personal devices are used to capture clinical images, this is done in accordance with Wyndham Health Care's Personal Devices for Medical Images Policy. Images are securely transferred to your medical record and managed in accordance with our privacy and information security policies

7.When, why and with whom do we share your personal information?

We sometimes share your personal information:

• with third-party service providers that assist us in operating the practice, such as information technology providers, secure cloud hosting providers, medical software providers, accreditation agencies, billing services and other contractors who support our systems and services. These providers are required to comply with applicable privacy laws, maintain the nconfidentiality of your information and only use it for the services they provide to us.
• with other healthcare providers (for example, in referrals to specialists, hospitals, pathology providers, diagnostic imaging providers and allied health professionals)
• when required or authorised by law (for example, court subpoenas or mandatory reporting obligations)
• when it is necessary to lessen or prevent a serious threat to a patient's life, health or safety or to public health or safety, and it is impracticable to obtain the patient's consent 
• to assist in locating a missing person
• to establish, exercise or defend a legal or equitable claim
• for confidential dispute resolution processes
• where legislation requires notification to government authorities (for example, notification of certain communicable diseases)
• when providing medical services through electronic prescribing, My Health Record, Shared Health Summaries, Event Summaries and other secure digital health systems.

As a Victorian health service, Wyndham Health Care complies with the Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs), which regulate how health information is collected, used and disclosed. Under the Health Records Act 2001 (Vic), your health information may be disclosed without your explicit consent where the disclosure is:

• for the primary purpose of providing a health service to you; or
• for a directly related secondary purpose that you would reasonably expect.

These disclosures are therefore covered by implied consent.

Where third-party service providers assist us to deliver healthcare or operate the practice, only the minimum information necessary is shared. Depending on the service being provided, this may include your name, date of birth, contact details, Medicare number, healthcare identifier and other information reasonably required for that specific purpose. We do not disclose your complete medical record unless it is necessary for your care, required by law or you have authorised us to do so.

Only people who need access to your personal information to provide your care or support the operation of the practice are permitted to access it.

Other than providing healthcare or as otherwise described in this policy, Wyndham Health Care will not disclose your personal information to any third party without your consent unless the disclosure is authorised or required by law.

We do not disclose your personal information outside Australia unless you have provided consent or the disclosure is otherwise authorised or required by law. We do not share your personal information with anyone outside Australia (unless under exceptional circumstances that are permitted by law) without your consent.

8.Will your information be used for marketing purposes? Wyndham Health Care will not use your personal information to market goods or services directly to you without your express consent.

If you provide your express consent to receive direct marketing communications, you may withdraw your consent or opt out at any time by notifying the practice in writing or by using the unsubscribe option provided in the communication, where applicable.

Please note that appointment reminders, recall and reminder notices, health management communications and other information relating to your healthcare are not considered direct marketing and may be sent to you as part of the healthcare services we provide.

9.How is your information used to improve services? Wyndham Health Care may use your personal information to monitor, evaluate and improve the quality and safety of the healthcare services we provide. This may include quality improvement activities, clinical audits, accreditation requirements, staff education and training, practice management, and, where appropriate, research conducted in accordance with applicable privacy laws and ethical requirements.

Where possible, we may provide de-identified information to approved organisations for quality improvement, planning, research and population health purposes. De-identified information does not identify individual patients and is managed securely in accordance with applicable privacy legislation. Where applicable, this information is stored within Australia.

If you do not wish your de-identified information to be included in these activities, you may advise our reception staff or contact the practice, and we will discuss the available options with you.

10. How are document automation technologies used? Document automation refers to the use of secure software systems that use information already contained in your medical record to generate healthcare documents, such as referrals, care plans, medical certificates and other clinical correspondence.

Wyndham Health Care uses document automation technologies through Best Practice Software to prepare and securely send documents to other healthcare providers involved in your care. These documents contain only the information that is relevant and necessary for the purpose of your healthcare.

Access to our clinical software is restricted to authorised members of the practice team. Each user has their own unique user credentials and passwords, and access is role-based so that staff can only access the information necessary to perform their duties.

The practice complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs) to protect your personal and health information.

All patient information, whether held electronically or in paper form, is stored securely and managed in accordance with the Royal Australian College of General Practitioners (RACGP) Privacy and Managing Health Information guidance and our information security policies.

All data, both electronic and paper are stored and managed in accordance with the Royal Australian College of General Practitioners Privacy and managing health information guidance.

11. How is your personal information stored and protected? Your personal information may be stored in both electronic and paper records. Wyndham Health Care takes reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Electronic health records are stored securely using password-protected clinical software,secure networks and other appropriate security measures. Paper records and other confidential documents are stored in secure cabinets with access limited to authorised staff.

All staff and contractors are required to maintain the confidentiality of patient information and are bound by confidentiality agreements.

The practice also uses CCTV for the security and safety of our patients, staff and premises. CCTV cameras are located in public areas of the practice, including the entrance, reception, car park and internal hallways. CCTV cameras are not installed in consultation rooms, treatment rooms or bathrooms.

12. How can you access and correct your personal information at the practice? You have the right to request access to, and correction of, your personal information.

Wyndham Health Care acknowledges that patients may request access to their medical records. Requests can be made by completing a Request for Information form and providing valid photo identification.

We will respond to requests to access or correct your personal information within 14 days. We take reasonable steps to ensure that your personal information is accurate, complete and up to date. If you believe your information is incorrect or outdated, you may request that we correct or update it. In some cases, we may ask you to verify the information we hold.

To make a request, please contact the Practice Manager at manager@wyndhamhealthcare.com.au.

13. How can you lodge a privacy-related complaint, and how will the complaint be handled at the practice? We take complaints and concerns regarding privacy seriously. If you have a concern about the way your personal information has been handled, please contact the Practice Manager in person, by email at manager@wyndhamhealthcare.com.au or by telephone on (03) 9749 2766. We will acknowledge your complaint and endeavour to resolve it promptly in accordance with our complaints procedure.

If you are not satisfied with our response, you may lodge a complaint with:

• the Health Complaints Commissioner (Victoria) if your complaint relates to your health information or the health services we provide; or
• the Office of the Australian Information Commissioner (OAIC) if your complaint relates to the Privacy Act 1988 (Cth).

The OAIC generally expects you to have first attempted to resolve your complaint directly with the practice before it investigates the matter.

14. How is privacy on the website maintained? At Wyndham Health Care, any personal information you share with us through our website, email or social media channels is handled securely and in accordance with applicable privacy laws.

Our website may use cookies and analytics tools to help improve website performance, understand how users interact with our site, and enhance user experience. These tools do not directly identify you unless you choose to provide personal information.

We take reasonable steps to protect any personal information collected through digital platforms from unauthorised access, misuse, loss or disclosure.

15. Policy review statement Wyndham Health Care’s privacy policy is regularly reviewed and updated to ensure compliance with applicable legal and regulatory requirements.

If any changes are made:

• updates will be published on our website
• where appropriate, significant changes may also be communicated directly to patients via email, SMS or other reasonable communication methods.

We encourage you to review this policy periodically to stay informed about how we manage your personal information.

If you have any questions about this policy, please contact the Practice Manager at manager@wyndhamhealthcare.com.au.