Privacy Statement
It is necessary for us to collect personal information from you and sometimes from other health care providers about you in order to attend to your healthcare needs and for administrative purposes. In the interests of providing the highest quality and continuity of your health care this may also include sharing information with other health care providers who comprise your medical team.
Research is regularly carried out by medical specialists to assist in developing better treatment/cures for diseases. Quality assurance and peer review activities are also vital in ensuring provision of safe and high quality care.
As part of best practice in cancer care and quality assurance, your care and medical information may be discussed at a multi-disciplinary team (MDT) meeting comprising of gynaecological, medical and radiation oncologists, radiologists, pathologists, and other allied members. In some circumstances, a fully rebatable charge will be made for discussion at this MDT meeting – Medicare will be billed directly with no out of pocket expense to you. The information generated at this meeting regarding your care will be discussed with you.
Dr Morton is a current member of the Queensland Centre for Gynaecological Cancer (QCGC) and its Quality Assurance Committee (QAC) and associated MDT meeting. With your consent, your data will be stored and processed relating to your condition/treatment for research, education and quality assurance purposes. This will include review of treatment outcomes, self audit and peer review by other specialists, to further improve patient outcomes and surgical safety and performance.
Your data will not be personally identifiable to persons or organisations outside of members of the QCGC or QAC. If your data is used in research and published it will be in a non-identifiable form according to best practice procedures in clinical research.
Dr Morton utilises AI transcription tools (e.g. Heidi, I-Scribe) to accurately and efficiently capture the details of discussions and the outcomes of appointments. This allows the doctor to focus entirely on you during your visit. Heidi and I-Scribe are compliant with Australian Privacy Principles and the Privacy Act. Conversations are transcribed simultaneously while they happen, meaning no recordings are ever stored.
Please find below the comprehensive practice Privacy Policy
Privacy Policy V3 04/07/24
Dr Rhett Morton Private Medical Practice Privacy Policy.
1. Introduction
Our practice is committed to best practice in relation to the management of information we collect. This practice has developed a policy to protect patient privacy in compliance with the Privacy Act 1988 (Cth) (‘the Privacy Act’). Our policy is to inform you of:
- the kinds of information that we collect and hold, which, as a medical practice, is likely to be ‘health information’ for the purposes of the Privacy Act;
- how we collect and hold personal information;
- the purposes for which we collect, hold, use and disclose personal information;
- how you may access your personal information and seek the correction of that information;
- how you may complain about a breach of the Australian Privacy Principles and how we will deal with such a complaint;
- whether we are likely to disclose personal information to overseas recipients;
2. What kinds of personal information do we collect?
The type of information we may collect and hold includes:
- Your name, address, date of birth, email and contact details
- Medicare number, DVA number and other government identifiers, although we will not use these for the purposes of identifying you in our practice
- Credit card or direct debit details
- Health fund details
- Other health information about you, including:
- notes of your symptoms or diagnosis and the treatment given to you o your general practitioner and specialist reports and test results
- your appointment and billing details
- your prescriptions and other pharmaceutical purchases
- your dental records
- your genetic information
- your healthcare identifier
- any other information about your race, sexuality or religion, when collected by a
- health service provider.
3. How do we collect and hold personal information?
We will generally collect personal information:
- from you directly when you provide your details to us. This might be via a face to face discussion, telephone conversation, email, registration form or online form
- from a person responsible for you
- from third parties where the Privacy Act or other law allows it – this may include, but is not limited to: other members of your treating team, diagnostic centres, specialists, hospitals, the My Health Record system, electronic prescription services, Medicare, your health insurer, the Pharmaceutical Benefits Scheme
In emergency situations we may also need to collect information from your relatives or friends.
We may be required by law to retain medical records for certain periods of time depending on your age at the time we provide services.
4. Why do we collect, hold, use and disclose personal information?
In general, we collect, hold, use and disclose your personal information for the following purposes:
- to provide health services to you
- to communicate with you in relation to the health service being provided to you
- to comply with our legal obligations, including, but not limited to, mandatory notification of communicable diseases or mandatory reporting under applicable child protection legislation
- to help us manage our accounts and administrative services, including billing, arrangements with health funds, pursuing unpaid accounts, management of our ITC systems
- for consultations with other doctors and allied health professional involved in your healthcare
- to obtain, analyse and discuss test results from diagnostic and pathology laboratories
- for identification and insurance claiming
- If you have a My Health Record, to upload your personal information to, and download your personal information from, the My Health Record system
- Information can also be disclosed through an electronic transfer of prescriptions service
- To liaise with your health fund, government and regulatory bodies such as Medicare, the Department of Veteran’s Affairs and the Office of the Australian Information Commissioner (OAIC) (if you make a privacy complaint to the OAIC), as necessary.
5. Who do we share your personal information with?
We sometimes share your personal information:
- with third parties who work with our practice for business purposes, such as accreditation agencies, debt collection agency or IT service providers – these third parties are required to comply with APPs and this policy.
- with other healthcare providers
- when it is required or authorised by law (e.g. court subpoenas)
- when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent (e.g. where a client or patient reveals information about self-harming, intent to suicide or intent to harm another person)
- to assist in locating a missing person
- to establish, exercise or defend an equitable claim
- for the purpose of confidential dispute resolution process
- when there is a statutory requirement to share certain personal information (e.g . some diseases require mandatory notification)
- during the course of providing medical services, through Electronic Transfer of Prescriptions (escripts) MyHealth Record (e.g. via Shared Health Summary, Event Summary). From time to time we may also provide statistical data to third parties for research purposes. Only people that need to access your information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without your consent.
6. How can you access and correct your personal information?
You have a right to seek access to, and correction of the personal information which we hold about you. On request, you may have access to your personal information held by our practice, except in circumstances where access may be denied under the Privacy Act or other law. Examples of these circumstances are:
- Where providing access will pose an unreasonable impact on the privacy of another individual; or
- Where your request for access is frivolous or vexatious; or
- Where the information relates to existing or anticipated legal proceedings between Dr Rhett Morton and you, and the information would not be accessible by the process of discovery in those legal proceedings; or Where providing access would be unlawful, would pose a threat to the life or health of an individual, may prejudice and investigation of possible unlawful activity, may prejudice enforcement of laws, or denying access is specifically authorised by law.
For details on how to access and correct your health record, please contact our practice as noted below under ‘Contact Details’.
We will endeavour to acknowledge a request for access to personal information within 14 days and provide the information requested within 30 days. If personal information is provided to you as a result of a request, you may be charged a fee for costs incurred in providing that information such as photocopying, the administration time involved in processing your request, and postage. If access is denied we will provide you with reasons for the decision.
7. How do we hold your personal information?
Our staff are trained and required to respect and protect your privacy. We take reasonable steps to protect information held from misuse and loss and from unauthorised access, modification or disclosure. This includes:
- We use secure end-to-end encrypted email servers
- We hold your personal and health information in a secure true cloud storage practice management database
- Any paper documents containing written information about you are stored securely at the practice
- Any electronic files containing written information about you are held in an encrypted end-to-end cloud storage
- We use strong passwords, password protection and management systems and leading cybersecurity systems
- Our staff sign confidentiality agreements
- Our practice has document retention and destruction policies
8. Privacy related questions and complaints
We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing to us (see ‘contact details’ below). If you have any questions about privacy-related issues or wish to complain about a breach of the Australian Privacy Principles or the handling of your personal information by us, you may lodge your complaint in writing to (see below for details). We will normally respond to your request within 30 days. If you are dissatisfied with our response, you may refer the matter to the OAIC:
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Fax: +61 2 9284 9666
Post: GPO Box 5218 Sydney NSW 2001
Website: oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint
9. Anonymity and pseudonyms
The Privacy Act provides that individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with our practice, except in certain circumstances, such as where it is impracticable for us to deal with you if you have not identified yourself. As a medical practice, it is largely impracticable to deal with patients anonymously or via a pseudonym, as it is likely to impact the provision of medical services and associated billing. This may be practicable if patients are prepared to forego notifying their insurer or seeking a Medicare benefit and pay the practice directly.
10. Overseas disclosure.
We may disclose your personal information to the following overseas recipients:
- any practice or individual who assists us in providing services (such as where you have come from overseas and had your health record transferred from overseas or have treatment continuing from an overseas provider)
- anyone else to whom you authorise us to disclose it Overseas cloud-based storage (Proton AG, Geneva, Switzerland) is used by this practice. This is a secured end-to-end encrypted service for email and electronic file storage, which means the cloud service provider cannot access or view any files, filenames or information stored by them. We therefore do not disclose any of your information to an anyone outside the practice.
11. Updates to this Policy
This Policy will be reviewed from time to time to take account of new laws and technology, changes to our operations and other necessary developments. Updates will be publicised on the practice’s website.
12. Privacy and websites
We may also collect your personal information when you visit our website, send us an email or SMS, telephone us, make an online appointment or communicate with us using social media. When browsing our website we may collect information from you through automatic tracking systems (such as information about your browsing preferences). In addition, we may collect information that you volunteer to us, such as information that you provide during a sign-up process, form submission or at other times while using our website.
We will not collect information that identifies you personally, except when you specifically volunteer that information to us when using features on our website. These features might include, but at not limited to:
- receiving notifications via text message or email
- receiving general emails from us
- commenting on our content such as blogs, articles, social media, videos or other similar features. Cookies enable us to tailor our website configuration to your needs and preferences, in order to improve your user experience. Most internet browsers accept cookies automatically, although you are able to change your browser settings to control cookies, including whether or not you accept them, and how to remove them.
13. Contact details for privacy related issues
Contact: Practice Manager
Ph: 07 3214 5300
Email: reception@drmorton.com.au
Postal address: Suite 93, Lvl 5, Sandford Jackson Building, Auchenflower QLD 4066