The purpose of this policy is to set out how Perth Cardiovascular Institute (PCI, we, us) collects and manages your personal information. This includes your patient health information but extends to other information we hold about you.

PCI complies with the Privacy Act 1988 (Cth) and the 13 Australian Privacy principles (APP) ensuring the privacy and confidentiality of all personal information that it collects.

This policy describes:

• who we collect information from,
• the types of personal information collected and held by us,
• how this information is collected and held,
• the purposes for which your personal information is collected, held, used and disclosed,
• how you can gain access to your personal information and seek its correction,
• how you may complain or inquire about our collection, handling, use or disclosure of your personal information and how that complaint or inquiry will be handled, and
• whether we are likely to disclose your personal information to any overseas recipients.

Collection of Personal Information

If you are a patient, the personal information we collect about you is information that is necessary for your medical care and treatment and for us to manage our medical practice.

This information may include but not be limited to information about your medical history, test results, family medical history, date of birth, gender, contact details, Medicare, health fund and insurance details, billing/account details.

If you are a healthcare professional, the information we collect about you may include and is not limited to your name, provider information, address, contact details (including personal email) and professional qualifications.

If you are a pharmaceutical company, business or supplier, the information we collect about you includes, but is not limited to names of representatives, contact details, ABN/ACN details and bank details.

The majority of this information we will collect from you directly, however, in respect to patient information, we may also need to collect information from other sources such as your general practitioner, previous or current specialists, radiology and pathology practices, hospitals, My Health Record and other health care providers.

Why we collect personal information and how do we use it?

Our primary uses of personal information include but are not limited to:

• Providing healthcare services
• Administration such as booking appointments, billing, notifications and communication
• Feedback and Improvements
• Education and Training
• Legal proceedings
• Adherence to statutory and public health requirements
• Other purposes with your consent

Storage and Security of Personal Information

We store personal information in a variety of formats including on databases and in hard copy files.

The security of your personal information is of importance to us, and we take all reasonable steps to protect the personal information we hold about you from misuse, loss, unauthorised access, modification or disclosure.

These steps include:

• Maintaining up-to-date IT and Communication systems, policies and procedures designed to protect personal information storage on our systems, including password management.
• Maintaining up-to-date Administration and HR systems, policies, procedures, training and education designed to support this policy.
• Maintaining quality Work Processes designed to ensure compliance with this policy.
• Restricting access to information on the Company databases on a need to know basis with different levels of security being allocated to staff based on their roles, responsibilities and security profile.
• Ensuring where sensitive information is stored in hard copy files that these files are stored in lockable filing cabinets in lockable rooms. Access to these records is restricted to staff on a need to know basis.
• Implementing physical security measures around Company facilities to prevent break-ins.
• Undertaking due diligence with respect to third party service providers who may have access to personal information, including cloud service providers, to ensure as far as practicable that they are compliant with the Australian Privacy Principles or a similar privacy regime.

Please note that any information that you send to us by electronic means may not be secure in transit unless it is encrypted. We are not responsible for the security of your information before it comes into our possession.

Personal information we hold that is no longer needed is destroyed in a secure manner, deleted or de-identified as appropriate.

Our website may contain links to other websites. We do not share your personal information with those websites and we are not responsible for their privacy practices. Please check their privacy policies.

Research

PCI may at times be asked to participate in trial studies or research projects. We only use de-identified information for these purposes and we will not share any identifiable information for research purposes without consent.

When performing diagnostic testing for patients undergoing trial studies, we adhere to the strict requirements of the trial study contracts including their privacy and confidentiality requirements.

Personal Information Disclosure

We only use personal information for the purposes for which it was given to us, or for purposes which are related (or directly related in the case of sensitive information) to our provision of healthcare and maintaining our medical practice.

We may disclose your personal information to:

• Referring clinicians, general practitioners, specialists, radiology and pathology practices, hospitals and other health care providers, in relation to the provision of healthcare services to you.
• Legal and Medical defence organisations
• Health Insurance Funds
• Medicare
• Government authorities where we are required to do so by law or in response to an order issued by a court or tribunal
• Your lawyers or insurance companies (eg. life insurance) who have been authorised by you to obtain this information.
• Family members, guardians or carers who are legally responsible for your healthcare decisions unless advised otherwise.
• Service providers required to run our business
• My Health Record system

 This information will be used only if one or more of the following apply:

• you have consented,
• you would reasonably expect us to use or disclose your personal information in this way,
• we are authorised or required to do so by law,
• disclosure will lessen or prevent a serious threat to the life, health or safety of an individual or to public safety,
• where another permitted general situation exception applies, and
• disclosure is reasonably necessary for a law enforcement related activity.

We may disclose personal information about an individual to overseas recipients in certain circumstances. We will however take all reasonable steps not to disclose an individual’s personal information to overseas recipients unless:

• We have the individual’s consent (which may be implied), or
• We have satisfied ourselves that the overseas recipient is compliant with the Australian Privacy Principles, or a similar privacy regime, or
• We form the opinion that the disclosure will lessen or prevent a serious threat to the life, health or safety of an individual or to public safety, or
• We are taking appropriate action in relation to suspected unlawful activity or serious misconduct.

How can you access or seek correction of your personal information?

We take all reasonable steps to ensure the personal information we hold, use and disclose is accurate, complete and up to date. On an ongoing basis we maintain and update personal information when we are advised by individuals or when we become aware through other means that their personal information has changed. 

Please contact us below if any of the details you have provided change. You should also contact us if you believe that the information, we have about you is not accurate, complete or up to date.

We will ask you to verify your identity when you make an access or correction request.

There may be circumstances where we will not be able to comply with your request, however we will let you know the reason why and will explain what other options may be available to you.

Privacy Complaints

If you wish to make a complaint about a breach of the APP by us, you may do so by providing your written complaint by email, letter or fax as noted below or by personal delivery to any of our locations. We may request to verify your identity and ask for further information, in order to investigate and respond to your concern or complaint appropriately. You should expect a response within five business days.

If we are unable to satisfactorily resolve your concern or complaint, you may wish to contact the Office of the Australian Information Commissioner (OAIC). Contact details for the OAIC can be found at the OAIC’s website: https://www.oaic.gov.au.

How to contact us

Please attention the Admin Manager

Email: admin@perthcardio.com.au

Phone: 08 6314 6833

Fax: 08 6314 6888

Changes to our privacy and information handling practices

This Privacy Policy is subject to change at any time.