Privacy Statement

Introduction

Gippsland Primary Health Network (Gippsland PHN) manages personal information in accordance with, but not limited to the:

Privacy Act 1988 (Commonwealth)
Privacy Amendment (Notifiable Data Breaches Act 2017)
Notifiable Data Breach Scheme
Australian Privacy Principles (APPs)
Health Records Act 2001 (Vic)
Health Privacy Principles (HPPs) and
Health Records Regulations 2023 (Vic).

Gippsland PHN is committed to protecting the privacy of your personal information. This privacy statement explains how Gippsland PHN manages the personal information that we collect, use and disclose and how to contact us if you have any further queries about our management of your personal information.

Personal information

- is any information that identifies, or reasonably re-identifies from de-identified data, an individual. For example, name, date of birth, home address or postcode and telephone number.
- includes sensitive information such as an individual’s racial or ethnic origin, membership of political association or trade union, religious belief, sexual identity, gender identity, sexual orientation or intersex status, or criminal record.
- includes information about the health or disability of an individual, or individual’s wishes about the provision of health services.
- health and other information that does not identify a person.

Information type

Gippsland PHN manages de-identified information from stakeholders including consumers and carers and those with lived experience who access our commissioned services or general practices that have a de-identified data sharing agreement. Gippsland PHN also manages information from General Practitioners, specialists, allied health professionals, staff and potential staff, consultants, contractors, volunteers, students on placement, and members.

Gippsland PHN collects personal information at times for usual business purposes directly from individuals, in writing, by telephone, email or via the website and may also receive information from sources, including:

information provided by government or non-government agencies.
publicly available sources of information, such as public registers.
other health organisations.
or if required to do so, in accordance with legislation.

Personal information collected will be stored confidentially, unless disclosure is required by law.

Purpose

Gippsland PHN will only seek to collect information that is necessary for the operations of the organisation.

All information collected by Gippsland PHN will be used only for the primary purpose intended, i.e. for reporting to our funders, the employment of staff, commissioning and co-design activities, strategic and operational planning, to communicate with general practice, specialists and allied health to facilitate education sessions, services, and events, to undertake improvement activities, to respond to feedback such as compliments, complaints and suggestions or requests for information of a general nature about our services.

Gippsland PHN undertakes Privacy Threshold Assessments, and where applicable, Privacy Impact Assessments (PIA) to ensure that privacy risks are minimised while allowing the aims of projects to be met. Further, Gippsland PHN understands the successful outcomes of a PIA to include:

A clear understanding of the privacy risks associated with the project or initiative.
Agreed measures to reduce those risks that are built into, or introduced alongside, the project or initiative.
Confidence among the stakeholders that significant privacy issues have been addressed, and
Documentary evidence that the process has taken place.

Where an individual is participating in a specific program commissioned by Gippsland PHN, they will be provided with specific details regarding the collection of information and consent process, e.g. program flyer or details on Gippsland PHN website, verbal explanation by program staff or via a consent form.

Gippsland PHN may not be able to deliver some, or all services, unless some personal information is provided.

Organisational needs may require the disclosure of deidentified personal information, for example population health information such as condition prevalence or de-identified case studies, to related service providers (for example funding bodies and other health organisations).

Storing information

Gippsland PHN stores information electronically in secure databases and document management systems. At times some information may be stored in paper files.

Measures are taken to ensure information is accurate, up-to-date, complete and relevant, and is protected from unauthorised access, loss, misuse, disclosure or alteration.

Gippsland PHN adheres to the retention and disposal of personal information in line with our obligations under the Archives Act 1983 (Cth).

Disclosure

Gippsland PHN may need to share personal information. This information is disclosed with the understanding that all parties comply with the Privacy Act. Organisations that may receive personal information from Gippsland PHN in accordance with the Privacy Act, include:

The State and Commonwealth Department of Health (funder)
other health organisations.
auditors/external reviewers.
regulatory bodies.

Gippsland PHN may also disclose personal information if:

required or authorised by law or where there is a public duty to do so.
an individual has expressly consented, or consent can be reasonably inferred.
an individual’s health is at risk.
a job applicant referee, police, and/or recruitment agency pre-employment check is required.
where otherwise permitted to disclose the information under the Privacy Act

For example, when not otherwise permitted to disclose personal information, we may do so if required under a Ministerial declaration following a notifiable data breach, in accordance with the Privacy Act 1988.

Disclosure of information for marketing

Gippsland PHN only uses identifiable personal information for direct marketing of projects and programs where there is express consent to do so. Gippsland PHN does not sell information to other organisations.

Spam

We may contact you in a variety of ways, including by post, email, SMS or telephone call.

We will not send you any commercial electronic messages such as SMS or emails unless this is permitted by the Spam Act and only if we have your express consent to do so.

Any commercial electronic message that we send will identify Gippsland PHN as the sender and will include our contact details. If you do not wish to receive commercial electronic messages from us, please let us know (our contact details are provided at the end of this policy) or use the “Unsubscribe” option in the electronic communication.

Access to and correction of personal information

Individuals can request access to their personal information and can ask for corrections to be made if it is thought the information held is inaccurate, incomplete or out-of-date.

There are some circumstances in which Gippsland PHN is not required to give access to an individual’s personal information. For example, where this would have an unreasonable impact on the privacy of others, or access would pose a serious threat to the life, health or safety of any individual, or to public health or safety. If Gippsland PHN refuses to provide access, individuals will usually be provided with reasons as to why access is refused.

Proof of identity is required before Gippsland PHN provides access to personal information.

Lodging a complaint

Individuals who would like to lodge a complaint about a potential data or privacy breach can contact our Privacy Officer. The Privacy Officer will make good faith efforts to rectify the issue and respond within a reasonable period after the complaint is made.

Details regarding lodging a complaint at https://gphn.org.au/contact-us/ or call us on 03 5175 5444.

Further information

For further information or enquiries regarding our Privacy Statement, or to request access to personal information:

Phone: 03 5175 5444

Email: info@gphn.org.au