Introduction

Yulu-Burri-Ba is bound by the National Privacy Principles in the Commonwealth Privacy Act 1988 (Cth). The National Privacy Principles shall apply to all Yulu-Burri-Ba clinics and business operations. All new clients and staff will be provided with a copy of Yulu-Burri-Ba’s Privacy Policy.

Procedures

1. Anonymity

Where it is lawful and practicable to do so, individuals may deal with Yulu-Burri-Ba anonymously or use a pseudonym (e.g. when enquiring about our services generally). However, Yulu-Burri-Ba needs to identify the individual to provide services, access Medicare or prescribe medication.

2. Collection and Use of your Information

Information, such as a client’s current and past medical conditions and family health history, is used to help Yulu-Burri-Ba provide clients with a quality health service. Clients’ information helps Yulu-Burri-Ba to run a quality service and review our work. Collection of personal and sensitive information includes, but is not limited to, an individual’s:

• names, addresses and contact details
• Medicare number for identification and claiming purposes
• healthcare identifiers
• medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors
• personal information which is needed for administration, e.g. bills and Medicare rebates
• Concession Card details; or
• Indigenous status.

Personally identified information will not be used for research purposes without the individual’s informed consent. Personal information may be held at Yulu-Burri-Ba in various forms, such as:

• Paper records
• Electronic records
• Visual – x-rays, CT scans, videos and photos; or
• Audio recordings

Yulu-Burri-Ba collects a client’s personal and demographic information via registration when a client presents to the clinic for the first time. Clients are encouraged to pay attention to the New Client Registration Form. During the course of providing medical services, Yulu-Burri-Ba’s healthcare practitioners will consequently collect further personal information. Personal information may also be collected from the individual’s guardian or responsible person (where practicable and necessary), or from any other involved healthcare specialist. Yulu-Burri-Ba holds all personal information securely, whether in electronic format, in protected information systems or in hard copy format in a secured environment.

3. Unsolicited Information

Where unsolicited information is received and is no longer needed, Yulu-Burri-Ba, within a reasonable period, will destroy or de-identify this information.

4. Notification of collection of Information

When Yulu-Burri-Ba receives any personal information, Yulu-Burri-Ba will notify the individual:

• of such matters or otherwise to ensure that the individual is aware of any such matters
• if any information is collected from someone other than the individual or if the individual may not be aware that Yulu-Burri-Ba has collected the information
• if the collection of the personal information is required or authorised by or under an Australian law or a court/tribunal order.

5. Disclosure of your Information

Yulu-Burri-Ba may disclose personal information for the purposes of:

• Continuity of care with other health service providers involved in the individual’s treatment or diagnostic services
• Providing an individual with further information about treatment options
• Conveying information to a responsible person (e.g. parent, guardian, spouse) when the individual is incapable or cannot communicate, unless the individual has requested otherwise
• Conveying information to close family members in accordance with the recognised customs of medical practice
• Management, funding, service-monitoring, planning, evaluation and complaint handling
• Legislative and regulatory compliance
• In response to orders of a Court or tribunal
• Quality assurance or clinical audit activities
• Accreditation activities
• Health insurance funding
• Billing and debt recovery
• Addressing liability indemnity arrangements including reporting to the hospital’ s insurers and legal representatives
• Preparing the defence for anticipated or existing legal proceeding
• Research or the compilation or analysis of statistics relevant to public health and safety; or
• Activities directly related to the provision of health services to an individual where the individual would reasonably expect disclosure

Yulu-Burri-Ba will inform the individual where there is a statutory requirement to disclose certain personal information (e.g. some diseases require mandatory notification). Yulu-Burri-Ba will not disclose personal information to any third party other than in the course of providing medical services, without full disclosure to the patient or the recipient, the reason for the information transfer and full consent from the patient. Exceptions to disclosure without patient consent are where the information is:

• Required by law
• Necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
• To assist in locating a missing person
• To establish, exercise or defend an equitable claim; or
• For the purpose of a confidential dispute resolution process

6. Direct Marketing

If Yulu-Burri-Ba holds personal information about an individual, Yulu-Burri-Ba will not use or disclose the information for the purpose of direct marketing.

7. Cross-border disclosure of personal Information

Yulu-Burri-Ba has business relationships with organisations throughout Australia and in some instance they operate overseas. Yulu-Burri-Ba may therefore disclose personal information outside the State or Territory in which the individual resides and also in some circumstances, to related entities that are located overseas. Yulu-Burri-Ba will take such steps, as are reasonable in the circumstances to ensure that all business relationships do not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.

8. Adoption, Use and Disclosure of Government Related Identifiers

Yulu-Burri-Ba will not adopt a government related identifier (e.g. Medicare number or Driver’s License) of an individual as its own identifier of the individual unless:

• the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order
• the use or disclosure of the identifier is reasonably necessary for Yulu-Burri-Ba to verify the identity of the individual for the purposes of Yulu-Burri-Ba‘s activities or functions
• the use or disclosure of the identifier is reasonably necessary for the organisation to fulfil its obligations to an agency or a State or Territory authority
• the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
• Yulu-Burri-Ba reasonably believes that the use or disclosure of the identifier is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

9. Integrity and Security of Information

Any personal information that is disclosed is to be as accurate, current and complete as possible. Yulu-Burri-Ba will take all reasonable steps to protect an individual’s information from loss and unauthorised access, change or disclosure. This includes the physical security of Yulu-Burri-Ba offices, paper based information, computer and network security and staff security. Yulu-Burri-Ba will take reasonable steps to protect information from misuse or loss and from unauthorised access, modification or disclosure. This includes:

• Requiring staff to maintain confidentiality
• Implementing document storage security
• Imposing security measures for access to Yulu-Burri-Ba computer systems
• Providing a secure environment and access control for confidential information
• Only allowing access to personal and health information where the individual seeking access has satisfied Yulu-Burri-Ba’s identification requirements.
• Personal and health information is retained for the period of time determined by law or required for administrative purposes.

When an individual’s information is no longer required, it will be destroyed in a secure and lawful manner. Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to ensure that the information is de-identified.

10. Access and Correction of your Information

Yulu-Burri-Ba will provide access to personal information on request by the individual. Individuals do not need to give a reason for asking and requests do not have to be in writing. Individuals can request to see any personal information, and request a copy of partial or complete records. There is no fee for lodging a request to access your records; however, a small charge may be made if Yulu-Burri-Ba has costs in providing you with access to your records. Yulu-Burri-Ba is not required to give the individual access to the personal information in the following circumstances:

• the entity reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety
• giving access would have an unreasonable impact on the privacy of other individuals
• the request for access is frivolous or vexatious
• the information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings
• giving access would reveal the intentions of Yulu-Burri-Ba in relation to negotiations with the individual in such a way as to prejudice those negotiations
• giving access would be unlawful; or
• denying access is required or authorised by or under an Australian law or a court/ tribunal order.

Yulu-Burri-Ba is not required to give the individual access to the personal information if Yulu-Burri-Ba has reason to suspect that unlawful activity or misconduct of a serious nature that relates to Yulu-Burri-Ba’s functions or activities has been, is being or may be engaged in, or giving access would:

• be likely to prejudice the taking of appropriate action in relation to the matter
• be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
• reveal evaluative information generated within the entity in connection with a commercially sensitive decision-making process.

If Yulu-Burri-Ba is unable to give an individual access to their personal information:

• Yulu-Burri-Ba will inform the individual in writing, giving the reasons for the refusal and the complaint mechanisms available to the individual.

If Yulu-Burri-Ba holds personal information about an individual; and either Yulu-Burri-Ba is satisfied that, having regard to a purpose for which the information is held, the information is inaccurate, out of date, incomplete, irrelevant or misleading; or the individual requests the entity to correct the information;

• Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up to date, complete, relevant and not misleading.

If Yulu-Burri-Ba corrects personal information about an individual that Yulu-Burri-Ba previously disclosed to another organisation; and if the individual requests Yulu-Burri-Ba to notify the other organisation of the correction;

• Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

If Yulu-Burri-Ba is unable to correct the personal information;

• Yulu-Burri-Ba will inform the individual in writing, giving the reasons for the refusal and the complaint mechanisms available to the individual.

If Yulu-Burri-Ba corrects personal information about an individual that the entity previously disclosed to third party; and the individual requests Yulu-Burri-Ba to notify a third party of the correction;

• Yulu-Burri-Ba will take such steps as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

Yulu-Burri-Ba will respond to the request for access or correction within 30 days of the request being made and give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.

11. Complaints and Feedback

Have a complaint?
Firstly speak to the Manager or Supervisor, which can often resolve most problems effectively and in a timely manner, as well as helping to identify ways that we can improve in the future. You may also ask for a ‘Complaints and Grievance’ form which can filled in and handed back in. After speaking with a Manager or Supervisor, you can also contact our Clinical Services Manager by email hr.@ybb.com.au or call us on 07 3409 9596 or write to us at PO 154 Dunwich QLD 4183. If you wish to take the matter further and feel you need to discuss the matter outside of the surgery there are several options available including the:

• The Complaints Unit at The Department of Child Safety, Youth and Women by email feedback@csyw.qld.gov.au, or by phone 1800 080 464, or by post at Locked Bag 3405, Brisbane Qld 4001
• Medical Registration Board of Australia (Australian Health Practitioner Regulation Agency), The State or Territory Manager, AHPRA, G.P.O. Box 9958, In your capital city 1300 419 495
• Australian Medical Association, PO Box 123, Red Hill, QLD 405, (07) 3872 2222, amaq@amaq.com.au
• Office of the Health Ombudsman

Tell us what you think
Yulu-Burri-Ba are committed to providing holistic health care to raise the health and wellbeing of Aboriginal and Torres Strait Islander people in the community. Do you have any suggestions on how we could improve our care or services that you’d like to give feedback on? We would love to hear your feedback or suggestions and there are several ways you can do this!

• Online – visit our Feedback page
• Online – contact us form to write to us
• Written form – fill in the ‘Tell Us What You Think’ form included in your Client Pack and either hand back in to a staff member, or ask for a pre-paid envelope to send back to us. A copy of this form is also available from any of our services.

If neither of these options are suitable you can also provide feedback verbally to any of our staff members who will then pass it on to the appropriate Manager. OR Contact us Yulu-Burri-Ba Aboriginal Corporation for Community Health PO Box 154 Dunwich QLD 4183 P (07) 3409 9596 E hr@ybb.com.au

Please address all emails & post to the relevant program you are contacting us about.

12. Policy Availability

Yulu-Burri-Ba’s Privacy Policy is:

• displayed in the Reception area of each Clinic
• displayed on the Yulu-Burri-Ba Aboriginal Corporation for Community Health website ybb.com.au or
• available by request at HR@ybb.com.au