Privacy Policy

Auburn Medical Centre is committed to protecting the privacy and confidentiality of our patients' personal and health information.

This policy explains what information we collect, how we collect, use, store and disclose it, and how patients can request access to their information, seek a correction or make a privacy complaint.

We handle information in accordance with applicable privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records and Information Privacy Act 2002 (NSW).

We collect information reasonably necessary to provide healthcare and manage the practice. Depending on your circumstances, this may include:

• Name, date of birth, address, telephone number, email address and emergency contact details.
• Medicare, Department of Veterans' Affairs, concession and healthcare identifier details, where relevant.
• Medical history, medications, allergies, immunisations, examination findings, diagnoses and treatment plans.
• Consultation notes, prescriptions, referrals, pathology and imaging results, and correspondence from other healthcare providers.
• Appointment, billing, payment, consent, recall, reminder and complaint records.

We may also collect relevant information about a parent, guardian, carer or authorised representative when necessary.

We usually collect information directly from you during registration, consultations, telephone calls, forms and other communications.

Where appropriate and lawful, we may receive relevant information from other treating healthcare providers, hospitals, pathology and imaging services, authorised representatives or government agencies.

You may make a general enquiry without identifying yourself where practical. We generally need to confirm your identity to provide clinical care, locate your record or process a claim.

If you do not provide information necessary for your care, we will explain any limitations this may create.

We use your information to:

• Assess, provide and coordinate healthcare.
• Maintain accurate medical records.
• Arrange referrals, prescriptions, tests and other services.
• Manage appointments, results, recalls and reminders.
• Communicate with you and healthcare providers involved in your care.
• Process Medicare claims, accounts and other relevant payments.
• Meet legal, regulatory and professional obligations.
• Support permitted practice administration, accreditation and quality improvement.

Where appropriate for your care, or where permitted or required by law, we may disclose relevant information to:

• GPs, specialists, hospitals, allied health professionals, pathology and imaging providers involved in your care.
• Medicare, Services Australia and other authorised government programs for relevant services or claims.
• Service providers supporting practice operations, subject to appropriate privacy and security arrangements.
• Courts, regulators or other bodies where disclosure is authorised or required by law.

The law may permit disclosure in limited circumstances without consent, including to address a serious threat to life, health or safety.

We do not provide information to family members or other third parties merely because they request it. We first consider your consent, their authority and applicable legal requirements.

Auburn Medical Centre participates in MyMedicare, a voluntary patient registration program. If you register, relevant information is handled through the program's authorised processes.

Reception can provide information about registration and changes to your registration.

My Health Record is a separate national digital health record system. Authorised healthcare professionals access or upload information through that system in accordance with applicable law and system requirements.

You may ask your GP or reception about the practice's participation in these programs.

Our website allows patients to book appointments and send enquiries through an integration with Healthengine.

When you use Healthengine, the information you submit may be collected and handled by Healthengine and provided to Auburn Medical Centre for the relevant booking or enquiry. This may include your name, contact details, appointment information and any health information you choose to provide.

Healthengine handles information under its own privacy policy. View Healthengine Privacy Policy

Auburn Medical Centre does not directly engage overseas staff or companies to access patient information as part of its practice operations.

Patients who use Healthengine integration should be aware that Healthengine may disclose, store or process personal information overseas through its service providers.

Healthengine's published privacy policy describes arrangements involving the United States, the European Union, Singapore, the Philippines and other countries where its providers operate.

These are Healthengine's arrangements, not a statement that Auburn Medical Centre directly engages overseas staff.

For further details, please read Healthengine's privacy policy .

We will review this section if the practice's services or information-handling arrangements change.

We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification and disclosure.

Our safeguards include:

• Individual staff access permissions.
• Confidentiality obligations.
• Appropriate handling of paper records.
• Security measures for electronic systems.
• Access restrictions based on staff duties.

We retain health records for the periods required by applicable law and professional obligations.

When information is no longer required and may lawfully be disposed of, we take reasonable steps to securely destroy or de-identify it.

We assess suspected privacy or security incidents and take appropriate action, including notification where required by law.

We may contact you by telephone, SMS, email or another practice-approved method about appointments and matters relating to your care.

Electronic communication carries privacy risks. Please tell reception if your contact details change or you have a preferred contact method.

We take reasonable steps to confirm identity and recipient details before sending sensitive information.

You may request access to the personal information and health records we hold about you by contacting the Practice Manager.

We may ask you to verify your identity and provide details that help us locate the relevant records.

We will respond within a reasonable period, generally within 30 calendar days.

A reasonable fee may apply for providing access or copies. We will explain any proposed fee beforehand; there is no charge simply for making an access request.

If a lawful exception prevents us from providing access, we will explain the decision and available complaint options as required by law.

If you believe information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, you may request a correction.

We will consider your request and take reasonable steps to correct information where appropriate.

A clinical record may require an explanatory amendment rather than deletion of the original entry.

If we decline a correction, we will explain why and advise you of relevant options.

If you have a question or concern about how your information has been handled, please contact the Practice Manager.

We will investigate privacy complaints and respond within a reasonable time.

If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

Visit the OAIC website

We review this policy at least annually and earlier if relevant laws, services, systems or information-handling practices change.

The current approved version will be available free of charge on our website and from reception.