Privacy Policy – Emerald Cardiac

1. OUR COMMITMENT TO YOUR PRIVACY

Emerald Cardiac — Bulk Billing Cardiac Centre is committed to protecting the privacy of patient information and to handling your personal information in a responsible manner in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”), the Australian Privacy Principles (APPs), and other applicable laws.

We request that you sign our Privacy Consent Form upon registration at the practice, in order to provide you with the best possible healthcare and to allow us to efficiently manage our practice.

This Privacy Policy explains how we collect, use, store and disclose your personal information, how you may access that information and how you may seek correction of any information. It also explains how you may make a complaint
about a breach of privacy.

2. DEFINITIONS

“Personal information” as defined in the Privacy Act means:

“information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.”

“Health information” as defined in the Privacy Act is a subset of “personal information” and means information or an
opinion about:

the health or a disability (at any time) of an individual; or
an individual’s expressed wishes about the future provision of health services to them; or
a health service provided, or to be provided, to an individual.

“Health information” is classified as “sensitive information” under the Privacy Act and is subject to additional
protections.

3. ABOUT EMERALD CARDIAC

Emerald Cardiac is a private bulk-billing cardiac centre located at:

Emerald Cardiac — Bulk Billing Cardiac Centre
Level 3, Suite 305, HQ Gregory Hills
39-47 Lasso Road, Gregory Hills NSW 2557

Phone: (02) 7229 2454
Fax: (02) 7229 2457

Mobile: 0411 179 997 / 0413 236 373
Email: info@emeraldcardiac.com.au

Our specialists provide a range of cardiac diagnostic and consultative services. Our cardiologists include Dr Amit
Michael, Dr Rajan Rehan, Dr Kaivan Vaidya, and Dr Victor D Joseph.

4. HOW WE USE YOUR PERSONAL INFORMATION

Emerald Cardiac uses your personal and health information to:

provide healthcare services to you;
appropriately manage billings, Medicare claiming and practice administration;
effectively communicate with third parties including your referring or treating doctors, private health insurers, Medicare Australia and other government departments;
train clinical and administrative staff;
conduct research, audit, quality assurance, teaching and education in order to improve methods of cardiac diagnosis and treatment. Where information is used for these purposes, only de-identified information is disclosed externally unless you provide explicit consent.

De-identified disclosure requires the removal of personal identifiers (name, address, date of birth, or other identifying information) and any other information that may allow you to be identified.

5. INFORMATION WE COLLECT

We collect information that is necessary and relevant to provide you with appropriate cardiac care and to manage our medical practice. This information includes:

Personal details — name, address, date of birth, Medicare number, contact numbers and email;
Health information — medical history, cardiac investigations, current medications, referral letters and specialist correspondence;
Financial details — health fund membership, billing and payment information;
Next-of-kin and emergency contact details.

Wherever practicable we will collect information directly from you. However, we may also need to collect information from other sources such as your general practitioner, treating specialists, radiologists, pathology providers, hospitals and government health databases where this is necessary to provide you with appropriate care.

We collect information via telephone, fax, email, in writing, in person at our rooms, or over the Internet where you transact with us online.

6. UNSOLICITED INFORMATION

If we receive personal information that our practice did not solicit, we will determine whether it could have been collected in the usual way. If the information could not have been legitimately collected, it will be destroyed or de-identified in accordance with the Privacy Act.

7. ANONYMITY AND PSEUDONYMITY

Where it is lawful and practicable, you have the option to request that we deal with you under a pseudonym or anonymously. However, it may be necessary for us to collect your personal or sensitive information in order to provide you with an appropriate standard of care. In such cases, we will advise you if anonymity or a pseudonym is not possible.

8. DISCLOSURE OF YOUR INFORMATION

We treat your personal information as strictly private and confidential. We will only use or disclose your information for purposes directly related to your care and treatment, or in ways that you would reasonably expect. We may transmit information by mail, fax, electronic delivery or email.

We will not use your information for another purpose unless you have given consent, or one of the exceptions under the Privacy Act applies (for example, where authorised by law or where necessary to lessen a serious threat to life, health or safety).

We may provide your personal information to third parties involved in your care, including:

your parents, children, relatives, close friends, guardians, or a person exercising power of attorney — please advise us if you do not wish us to share information with any third party;
government departments and agencies such as Department of Veterans Affairs, Department of Health, or other departments responsible for health, aged care and disability, where required;
private health insurers and Medicare Australia;
outside contractors performing services on our behalf, such as IT service providers, medical transcription services, medical software providers and accountants — all of whom are bound by confidentiality obligations;
anyone you have explicitly authorised to receive your personal information.

In the case of a medical emergency, we will provide your medical records to the relevant medical professional without waiting for your consent, where we believe this is in your best interests.

9. DATA QUALITY AND SECURITY

We take reasonable steps to ensure that your personal information is accurate, complete, up to date and relevant. Our staff may ask you to confirm your contact details are current at each visit.

We hold personal information in electronic records and systems. Information initially collected in paper-based form may be converted to electronic records. We take reasonable steps to protect your personal and sensitive information from misuse, interference, unauthorised access, modification, loss or disclosure. This includes:

Secure user identifiers, passwords and access-level controls on all databases and practice management systems;
Encrypted electronic communications and secure data storage servers;
Secure, locked premises for the storage of physical records;
Staff training on privacy and confidentiality obligations;
Regular review of our security practices.

10. RETENTION AND DESTRUCTION OF RECORDS

We are required by law to retain medical records for certain periods of time, depending on your age at the time we provided medical services and whether you participated in a clinical trial.

When we no longer require your personal information, we will take reasonable steps to destroy the information or ensure it is de-identified. Hard-copy medical records are disposed of by a certified secure destruction service. Electronic records are deleted or de-identified using an appropriate method.

11. ACCESS TO AND CORRECTION OF YOUR INFORMATION

You are entitled to request access to your medical records. We request that you put your request in writing and direct it to our Privacy Officer (contact details below). We will respond within a reasonable time, generally within 30 days.

There may be a fee for the administrative costs of retrieving and providing copies of your medical records.

We may deny access to your medical records in certain circumstances permitted by law — for example, if disclosure may cause a serious threat to your health or safety, or where it would interfere with the privacy of another individual.

If you believe that the information we hold about you is not accurate, complete or up to date, please contact us in writing so that we may correct it.

12. OVERSEAS DISCLOSURE

Emerald Cardiac may in limited circumstances engage with overseas entities — for example, sending imaging or reports to international specialists when deemed necessary in your treatment. We take reasonable steps to ensure that any overseas recipients handle your information in a manner consistent with the Australian Privacy Principles.

13. ELECTRONIC COMMUNICATIONS

The Spam Act 2003 prohibits sending unsolicited commercial emails and SMS messages. All electronic communications from Emerald Cardiac relate directly to services you have received or requested.

Emerald Cardiac sends appointment reminders and health information via SMS or email. If you do not wish to receive such communications, please advise our reception staff and we will update your preferences.

All bulk electronic communications will include an unsubscribe facility.

14. RESEARCH AND CLINICAL TRIALS

Emerald Cardiac may participate in medical research and quality improvement activities. Any clinical trial activity undergoes approval by a Human Research Ethics Committee (HREC).

We will always seek your explicit permission before using your identifiable information for research purposes. Where
de-identified health information is used for research or audit, no individual consent is required under the Privacy Act.

15. QUESTIONS AND COMPLAINTS

Emerald Cardiac is committed to the protection of your privacy. If you have any questions about how we handle personal information, or wish to make a complaint, please contact our Privacy Officer:

Privacy Officer — Emerald Cardiac
Level 3, Suite 305, HQ Gregory Hills
39-47 Lasso Road, Gregory Hills NSW 2557

Phone: (02) 7229 2454 Fax: (02) 7229 2457
Email: info@emeraldcardiac.com.au

Our Privacy Officer will acknowledge your complaint within five (5) business days and will aim to resolve the matter within 30 days. If you are not satisfied with the outcome, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

By attending Emerald Cardiac and signing our Privacy Consent Form at registration, you acknowledge that you have read, understood and agree to this Privacy Policy.