All Medicare-eligible consultations are bulk billed for patients with a valid Medicare card. Some items, including privately purchased vaccines and consumables, attract a fee.
This policy sets out what we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it.
Contents
Muswellbrook Doctors (“the practice”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal information we hold about our patients, their carers, visitors to the clinic and users of this website.
We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles made under it and, because we provide health services in New South Wales, by the Health Records and Information Privacy Act 2002 (NSW) and the fifteen Health Privacy Principles it contains. Where the two sets of rules differ, we apply whichever gives you the greater protection.
We also follow the privacy requirements in the RACGP Standards for general practices and the confidentiality obligations that apply to every registered health practitioner under the Health Practitioner Regulation National Law.
This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It applies to everyone who works at or for the practice — doctors, nurses, reception and administrative staff, practice management, contractors, students on placement and our IT providers.
When you register as a patient, you provide consent for our doctors and staff to access and use your personal health information so they can provide you with care. Only staff who need to see your record in order to do their job are able to access it.
That consent covers the routine business of running a general practice — making appointments, taking a history, ordering tests, writing referrals and prescriptions, billing Medicare, and recalling you when a result needs following up.
We will ask for your consent separately, and record it, when the use goes beyond your direct care. That includes:
You can withdraw your consent at any time by telling any member of our team, in person, by phone or in writing. Withdrawing consent does not affect anything already lawfully done, and it does not remove records we are required by law to keep. If a withdrawal would affect your care, a doctor will explain how before it takes effect.
Children and young people. A parent or guardian usually consents on behalf of a child. As young people mature, a doctor will assess whether they are able to consent for themselves. From that point their consultations and records are treated confidentially, in the same way as an adult’s, subject to the safety exceptions set out below.
Your patient health record is the complete file the practice holds about you. It is a clinical document and a legal document, and it is what allows any doctor at the practice to care for you safely when your usual doctor is away.
It typically contains:
The physical or electronic record is the property of the practice. The information within it is about you, and you have a right of access to it, which is explained in section 19.
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable — whether or not it is true, and whether or not it is written down.
At the practice this includes your name, date of birth, address, phone number, email address, Medicare number, DVA number, concession card details, private health fund details, emergency contact and next of kin, and your billing history.
It also covers information that identifies you indirectly. A combination of details that would let someone work out who you are — an unusual condition together with a suburb and an age, for example — is still personal information, and we treat it that way.
Sensitive information is a subset of personal information that carries a higher risk of harm if it is mishandled, so the law gives it extra protection. It includes information about your health, and also about your racial or ethnic origin, religious beliefs, sexual orientation, criminal record, and membership of a professional or trade association.
Nearly everything in a general practice record is sensitive information. We may only collect it with your consent and where it is reasonably necessary for our work, and we may only use or disclose it for the purpose it was collected for, or for a directly related purpose you would reasonably expect — unless the law requires or permits otherwise.
In practical terms this means your health information is not shared with family members, employers, insurers or anyone else without your consent, other than in the limited circumstances described in section 15.
We collect and hold the information we need to provide safe, continuous care and to run the practice. Depending on your circumstances, this may include:
We do not collect information we do not need, and we do not keep information for longer than the law and good clinical practice require.
A doctor may take a photograph as part of your care — most commonly a skin lesion, a wound being monitored over time, or a rash. Clinical images are part of your health record and are protected in the same way as your written notes.
Where a clinical image is taken:
We will not use a clinical photograph for teaching, publication, quality improvement or any promotional purpose without asking you separately and recording your consent. You can decline, and it will not affect your care.
Recording in the consultation room. Please ask before recording audio or video of a consultation. Doctors are usually happy to agree, or to write things down for you instead, but it should be a conversation rather than a surprise — and recordings that capture other patients or staff are not permitted anywhere in the practice.
Wherever it is reasonable and practical, we collect personal information directly from you.
That happens when you:
Sometimes we collect information about you from someone else, because it is necessary for your care and it is impractical to obtain it directly from you. Those sources include:
Where we receive information about you from a third party, we take reasonable steps to make sure you are aware of it and of this policy.
You are not obliged to give us any particular piece of information. It is worth knowing what the consequences may be.
If we cannot collect the information a doctor needs:
A doctor will tell you at the time if missing information is limiting what they can safely do, and you can then decide.
You have the option of dealing with us anonymously, or under a pseudonym, where it is lawful and practicable to do so. You can, for example, ask a general question about our services or our fees without giving us your name.
It is not practicable for a consultation. To provide clinical care we must be able to identify you, keep an accurate record, prescribe safely, and match results to the right person. Medicare and DVA claiming also require your correct identity, so an anonymous consultation cannot be bulk billed.
If you have a particular concern about being identified — and there are legitimate reasons why someone might — please raise it with our practice manager on (02) 6530 7404. There is often a way to accommodate it within the record.
We collect your personal information to provide you with health care, and to run the practice that provides it. Specifically, we use it to:
We do not sell your personal information. We do not use it for marketing by third parties, and we do not disclose it to advertisers or data brokers.
A telehealth consultation is a real consultation, and everything in this policy applies to it in the same way. The doctor makes the same clinical record, and it forms part of the same file.
When you have a telephone or video consultation with us:
We cannot control the privacy of the space you are in, or the security of the network and device you are using. If you are somewhere you can be overheard — a shared office, a car with passengers, a public place — tell the doctor and they can call back, or arrange for you to come in.
Telehealth is not suitable for every problem. If a doctor needs to examine you, they will ask you to attend the practice instead, and will say so.
The practice holds patient records electronically in clinical software hosted in Australia. Where paper records exist — older files, incoming correspondence, signed consent forms — they are held in a locked area of the practice that patients and visitors cannot access.
Email. Ordinary email is not a secure channel. We will not send your health information to you by unencrypted email unless you have asked us to and understand the risk, and we ask that you do not send us clinical details or images by email. Please call us on the practice number instead.
We are required to keep your health record for a minimum period, and we do not destroy records simply because you have stopped attending.
These periods come from the Health Records and Information Privacy Act 2002 (NSW). In some circumstances we keep records for longer — for example where a record is relevant to a legal claim, a coronial matter or a regulatory investigation, or where a doctor judges that the clinical history remains important for your ongoing care.
When a record reaches the end of its retention period it is destroyed securely, or de-identified so that it can no longer be linked to you.
If you move to another practice, we do not delete your record. We send a copy or a summary to your new doctor at your request, and retain the original for the period above.
My Health Record is a national online summary of your key health information, operated by the Australian Digital Health Agency under the My Health Record Act 2012 (Cth). Most Australians have one unless they opted out.
Where you have a My Health Record and have not restricted access, our doctors may view it to see information such as your medicines, allergies, discharge summaries and past results, and may upload a shared health summary or an event summary after a consultation.
You control your own My Health Record. Through myGov you can:
Tell us if you would prefer that we do not upload information from your consultations, and we will record that preference. Our doctors will still make and keep the practice’s own record, which is separate.
Under the Healthcare Identifiers Act 2010 (Cth) you have an Individual Healthcare Identifier (IHI), a sixteen-digit number that helps make sure information is matched to the right person. We use your IHI, together with the practice’s own identifier, when sending and receiving clinical information electronically. Identifiers are used for identification and communication only, and are protected in the same way as the rest of your record.
You can read every page of this website without telling us who you are. We do not require you to register, and we do not run advertising trackers or sell data about visitors.
The site uses a small number of cookies to keep it working properly and to measure aggregate usage. You can block or delete cookies in your browser settings; the site will still function. We do not use cookies to build advertising profiles.
Appointment booking is provided by a third-party booking platform. When you book online, the details you enter — your name, date of birth, contact details and the reason for the appointment where you provide one — are handled by that provider under their own privacy policy and terms, and are then transferred into our clinical system. We encourage you to read their policy before booking. You can always book by phoning us on (02) 6530 7404 instead.
Where we link to another organisation — healthdirect, Beyond Blue, NSW Health, a specialist or a pathology provider — we do so because the information is useful. We do not control those sites and we are not responsible for their privacy practices.
Social media. If you contact us through a social media platform, that platform holds the message under its own terms, and we cannot control it. Please do not send us clinical details, symptoms or images through social media. Call the practice on (02) 6530 7404.
Part of good general practice is following things up. With your consent, we may contact you to:
These messages are kept brief and do not include clinical detail, because we cannot be sure who else can see your phone or your letterbox. A reminder will say that something is due and ask you to call us; it will not say what the result was.
We contact you by SMS, phone, letter or email according to the preference recorded on your file. You can change that preference, or opt out of reminders altogether, by telling reception or calling (02) 6530 7404. Opting out will not affect the care you receive, but it does mean we will not prompt you when something is due — so the responsibility for follow-up moves to you.
We do not send you commercial marketing, and we do not give your contact details to anyone else for marketing purposes.
You have a right to access the personal information we hold about you, and to ask us to correct it if it is wrong.
Please put your request in writing and address it to the Privacy Officer at the practice, or ask reception for the request form. We will verify your identity before releasing anything.
We will respond within 30 days. In most cases we will provide a copy of your record, or a summary prepared by a doctor, whichever you prefer. A doctor will usually offer to go through it with you, because clinical records contain abbreviations and technical language that are easy to misread.
We do not charge for making a request. A reasonable administrative fee may apply for producing and copying a large record, and we will tell you the amount before we begin.
Access is a right, not an absolute one. We may refuse, in whole or in part, where:
If we refuse, we will tell you why in writing, and explain how to complain.
Tell us whenever your name, address, phone number, email, Medicare details or emergency contact change, so that we can reach you when it matters.
If you believe clinical information in your record is inaccurate, out of date, incomplete or misleading, ask us to correct it. Where we agree, we will correct it. Where a doctor does not agree — because a note records what was observed or concluded at the time, and the record must remain a true account — we will not delete it, but we will add a statement of your view to the file so that anyone reading it sees both. We will tell you in writing either way.
Requests can be posted to the Privacy Officer, Muswellbrook Doctors, Tenancy 16–17, Muswellbrook Fair, 19–29 Rutherford Road, Muswellbrook NSW 2333, or discussed first by calling (02) 6530 7404.
If you are concerned about how we have handled your personal information, we would like the chance to put it right.
Raise it with our practice manager, in person, by calling (02) 6530 7404, or in writing to the Privacy Officer, Muswellbrook Doctors, Tenancy 16–17, Muswellbrook Fair, 19–29 Rutherford Road, Muswellbrook NSW 2333.
We will acknowledge your complaint within seven days, investigate it, and give you a written response within 30 days. If it is going to take longer, we will tell you why and when to expect an answer. Complaining will not affect your care or your relationship with your doctor.
If you are not satisfied with our response, or you would prefer not to come to us first, you can contact:
A data breach happens when personal information is lost, or accessed or disclosed without authorisation — a stolen laptop, a misdirected letter, a compromised account, an intrusion into a system.
We work to prevent breaches through the measures in section 13, and we have a written response plan for the event that one occurs. If we become aware of a suspected breach we will:
Under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), where a breach is likely to result in serious harm and we cannot prevent that harm, we must notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable. Our notice will tell you what happened, what information was involved, and what you should do.
Our clinical records are held in Australia, and it is our strong preference that they stay there.
Some of the ordinary services a modern practice depends on — email filtering, secure backup, software support, appointment reminders — are provided by companies that may store or process limited data outside Australia, or may access it from overseas to provide technical support.
Where that is the case:
We do not otherwise disclose your health information to overseas recipients without your consent, except where the law requires it — for example if you are being referred to a practitioner overseas at your request.
We review this policy regularly, and update it when our practices change, when a service or provider changes, or when the law changes.
The current version is always published on this page, with the review date shown at the top. Where a change is significant, we will make it obvious — a notice at reception, and a note on the website. Continuing to use our services after a change means the updated policy applies to you.
A printed copy of this policy is available at reception on request, and we can provide it in large print or arrange for it to be explained through an interpreter.
If you have a question about this policy, or about how we handle your information, please contact our Privacy Officer.
We are inside Muswellbrook Fair. Our opening hours and a map are on the contact page, and our other patient-facing policies, including downloadable copies, are on the practice policies page.
In an emergency, call 000. Do not use email, this website or social media to tell us about an urgent medical problem. If you need urgent care and it is not an emergency, phone us on (02) 6530 7404 during opening hours, or call healthdirect on 1800 022 222 at any hour.
This policy is published under the Privacy Act 1988 (Cth) and the Health Records and Information Privacy Act 2002 (NSW). It explains how we handle your information; it is not medical advice, and it does not replace a conversation with your doctor. A printed copy is available at reception. Related: practice policies · terms of use.